Security

majiayu000 Bundle

The risk-profile skill assesses implementation risks before or during development using the Probability × Impact (P×I) scoring methodology. This skill identifies potential issues early, enables risk-based test prioritization, and informs quality gate decisions. By systematically evaluating risks across 6 categories (Technical, Security, Performance, Data, Business, Operational), the skill produces a risk matrix with mitigation strategies and test priorities.

majiayu000 Bundle

Row Level Security patterns for database operations. Use when writing Prisma/database code, creating API routes that access data, or implementing webhooks. Enforces withUserContext, withAdminContext, or withSystemContext helpers. NEVER use direct prisma calls.

majiayu000 Bundle

Audit claude-skills with systematic 9-phase review: standards compliance, official docs verification, code accuracy, cross-file consistency, and version drift detection. Use when investigating skill issues, major updates detected, skill not verified >90 days, or before marketplace submission.

majiayu000 Bundle

Security auditing for MOOLLM skills - static analysis and runtime surveillance

majiayu000 Bundle

Audit skill folders for guideline compliance and portability. Use when validating SKILL.md files against skill_development_guidelines.md or checking for non-portable examples, hard-coded paths, or missing references.

majiayu000 Bundle

Guide for integrating Stripe payments into an existing project. Covers one-time payments, subscriptions, and advanced patterns with security best practices.

majiayu000 Bundle

Review code for Treido project compliance, security issues, and best practices. Use when reviewing changes, checking for violations of project rules, or validating code before merge. Triggers include code review requests, security audits, pre-merge validation, or checking compliance with AGENTS.md rules.

majiayu000 Bundle

Run a VKC UX expert audit (Nielsen-style heuristic review + mobile-first flow check) and produce a prioritized issue list with severity and fixes.

majiayu000 Bundle

Enforce web security and avoid security vulnerabilities

majiayu000 Bundle

Assess non-functional requirements across 6 quality categories (Security, Performance, Reliability, Maintainability, Scalability, Usability) with measurable criteria, evidence-based evaluation, and automated checks. Scores each category, identifies gaps with severity ratings, and provides remediation guidance. Use during quality review to evaluate production readiness and NFR compliance.

majiayu000 Bundle

Laravel Blade template conventions covering components, output escaping, security, structure, and formatting.

majiayu000 Bundle

Sanctioned, logged bypass of a gate or hard rule — one audit line, then proceed.

majiayu000 Bundle

Deep, rarely-convened whole-codebase audit — eleven specialist lenses, a resumable on-disk audit log, findings filed as GitHub issues on approval. Expensive; estimates cost and STOPs before running. Never a required gate.

majiayu000 Bundle

· Run combined code-review, anti-slop, security-audit, and update-docs pass. Triggers: 'full review', 'review everything', 'audit this repo', 'full check', 'run all checks'. Not for single-dimension audits.

majiayu000 Bundle

Use when asked to audit comments in code files and propose structural replacements or deletions with per-candidate approval. Enumerates comments in C, JavaScript, TypeScript, HTML, CSS, and shell-style syntax, classifies each as earned or unearned, drafts structural alternatives, and returns a complete accounting ledger. Not for deterministic commented-out-code removal; use deslop.

majiayu000 Bundle

Quality review of individual decisions or decision registers. Checks schema compliance, body quality, connection completeness, and staleness. Not a content audit — a structural and reasoning audit. Triggers on "/pm-review", "/pm-review [decision]", "review this decision", "check quality", "audit decisions".

majiayu000 Bundle

Use when you need to PROVE a claim with evidence, run quality/security scans, or validate that work is actually complete. Evidence before claims -- no 'should work' allowed.

majiayu000 Bundle

Review changes made by AI editors (Codex, Claude, etc.). Run git diff, lint, security scan, tests, and provide a code review.

majiayu000 Bundle

Run a comprehensive audit against all applicable VCP standards. Supports full audit, compliance-specific audit, and quick release readiness check.

majiayu000 Bundle

Using the b2c CLI for SLAS (Shopper Login and API Access Service) client management

majiayu000 Bundle

Assemble the governance record for a range — commits, overrides, ADRs, sprint auto-decisions, open questions, checkpoint findings — into one dated audit packet. Read-only.

majiayu000 Bundle

Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs.

majiayu000 Bundle

Systematic false positive verification for security findings. Provides structured methodology to confirm or dismiss scanner results, manual audit findings, and automated alerts. Adapted from Trail of Bits. Use when triaging security scan results or verifying audit findings.

majiayu000 Bundle

Drafts GDPR Article 28-compliant Data Processing Addenda with schedules ready for execution. Use when drafting or updating a DPA, vendor GDPR addendum, controller-processor agreement, or data protection addendum involving sub-processors, breach notification, audits, international transfers, or SCCs.

majiayu000 Bundle

Scan repository for hardcoded secrets and credentials

majiayu000 Bundle

ACTIVATE THIS SKILL FOR ANY SHELL COMMAND. Check curl, wget, rm, sudo, apt, dpkg, chmod, dd, format, powershell, bash, sh. Check pipe patterns like | sh or | bash. Check when user says sysadmin told me, Stack Overflow says, is this safe, can I run. This skill blocks dangerous commands and warns on risky ones. ALWAYS apply the safety protocol from this document before responding about any command.

majiayu000 Bundle

Hunt for a specific APT/threat actor in your environment. Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs. Gathers intelligence from GTI, searches SIEM for IOCs and TTP-based indicators, and documents findings.

majiayu000 Bundle

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host header injection redirects token to attacker, predictable token, token leaked in referer, race condition on reset link), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session-fixation, (6) JWT manipulation, (7) password change without step-up (chain with password oracle), (8) social-recovery question abuse, (9) SSO subdomain takeover. Chain primitives: cookie theft + password oracle + missing step-up = persistent ATO; OAuth open redirect + redirect_uri = auth code theft = ATO; subdomain takeover at OAuth redirect_uri = ATO. Validate: actual account takeover demonstration on test account B from attacker A's session. Real paid examples for each path. Use when hunting ATO chains, when testing password reset / email change / MFA / OAuth / session, when chaining primitives toward Critical.

majiayu000 Bundle

Hunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation.

majiayu000 Bundle

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

majiayu000 Bundle

File Indian income tax returns (ITR) for FY 2025-26 / AY 2026-27. Use when the user wants to file their ITR, compute or verify Indian income tax, compare the old vs new tax regime, read a Form 16, AIS, TIS or Form 26AS, reconcile TDS, handle capital gains from Zerodha/Groww/Upstox statements, check their tax refund, or asks about ITR-1/ITR-2/ITR-3/ITR-4, sections 80C/80D/87A/111A/112A, crypto tax, advance tax, or the income-tax e-filing portal - even if they just say "help me with my taxes" in an Indian context.

majiayu000 Bundle

Keycloak identity and access management including realms, clients, authentication flows, themes, and user federation. Activate for OAuth2, OIDC, SAML, SSO, identity providers, and authentication configuration.

majiayu000 Bundle

LMS authentication system including SSO integration, useAuthReady hook patterns, four-layer security architecture, and permission checking. Use this skill when implementing auth flows, handling user sessions, fixing auth-related bugs, or understanding role-based access control.

majiayu000 Bundle

Security policy for MERN apps. Enforces OWASP Top 10 and CWE Top 25 mitigations.

majiayu000 Bundle

Security policy for NEAN apps. Enforces OWASP Top 10 and CWE Top 25 mitigations.

majiayu000 Bundle

Before main skill execution, perform guardrail checks.