Security

majiayu000 Bundle

Phase 3: Generate and present audit report for user review

majiayu000 Bundle

Audit project alignment with VISION.md, identify SDLC gaps, and generate feature proposals. Use when reviewing strategic direction or planning new features.

majiayu000 Bundle

Aggregate and deduplicate findings from multiple audit reports

majiayu000 Bundle

Audit onboarding: first-run, time to aha, friction points, empty states. Outputs structured findings. Use log-onboarding-issues to create issues. Invoke for: onboarding review, new user experience, activation audit.

majiayu000 Bundle

Analyze competitor's ad strategy by researching their Facebook Ad Library presence, TikTok Top Ads, identifying longest-running ads (likely winners), and extracting angles, hooks, and frameworks. Use when entering a new market, researching what's working, or building competitive intelligence.

majiayu000 Bundle

Comprehensive dependency health auditing for JavaScript/TypeScript projects. Run npm audit, detect outdated packages, check for security advisories, and verify license compliance. Prioritises vulnerabilities by severity and provides actionable fix recommendations. Use when: auditing project dependencies, checking for vulnerabilities, updating packages, preparing for release, or investigating "npm audit" warnings. Keywords: audit, vulnerabilities, outdated, security, npm audit, pnpm audit, CVE, GHSA, license.

majiayu000 Bundle

This skill should be used when implementing features from Linear issues with full TDD workflow, automated planning, parallel code reviews (security and Rails best practices), systematic feedback implementation, and automated PR creation with Linear integration. Use when the user provides a Linear issue ID (e.g., "TRA-9", "DEV-123") and wants a complete implementation workflow from issue to PR.

majiayu000 Bundle

Configuring Claude Code settings.json & Security. Set up permissions (allow/deny), permission modes, environment variables, tool restrictions. Use when securing Claude Code, restricting tool access, or optimizing session settings.

majiayu000 Bundle

Administer PostgreSQL - security, roles, permissions, maintenance

majiayu000 Bundle

Audit protected files, generate protection reports, and verify protection consistency. Use for protection system maintenance and compliance.

majiayu000 Bundle

AI generation provenance and audit trail tracking. Records decision factors, data lineage, reasoning chains, confidence scoring, and cost tracking for AI-generated content.

majiayu000 Bundle

Docs as QA: audit doc coverage and freshness, validate runbooks, and maintain documentation quality gates for APIs, services, events, and operational workflows. Includes AI-assisted audits, observability patterns, and automated coverage tracking.

majiayu000 Bundle

Senior QMS Audit Expert for internal and external quality management system auditing. Provides ISO 13485 audit expertise, audit program management, nonconformity identification, and corrective action verification. Use for internal audit planning, external audit preparation, audit execution, and audit follow-up activities.

majiayu000 Bundle

Perform a repo-wide, evidence-based audit of documentation against the current codebase and recent changes. Produces a proposed, fully rewritten documentation set in TempDoc-ForUserReview and asks for approval before any changes are applied to the existing docs.

majiayu000 Bundle

Comprehensive Ruby and Rails code review using Sandi Metz rules and SOLID principles. Automatically runs rubycritic and simplecov, analyzes changed files in current branch vs base branch, identifies OOP violations, Rails anti-patterns, security issues, and test coverage gaps. Outputs REVIEW.md with VSCode-compatible file links. Use when reviewing Ruby/Rails code, conducting code reviews, checking for design issues, or when user mentions code review, pull request review, or code quality analysis.

majiayu000 Bundle

Automatically rollback changes from failed workflow phases using changes log files. Use when workflows fail and need to restore previous state, including file restoration, artifact cleanup, and command reversal. Use for error recovery after failed bug fixes, security patches, or refactoring operations.

majiayu000 Bundle

Эксперт по S3 политикам. Используй для IAM policies, bucket permissions, cross-account access и security best practices.

majiayu000 Bundle

Protect repositories from accidental secret commits. Essential when working with AI agents. Use when: setting up new project, adding pre-commit hooks, scanning for secrets, fixing leaked credentials. Triggers: "настрой защиту секретов", "setup secrets", "check secrets", "scan secrets", "проверь секреты", "pre-commit", "gitleaks". PROACTIVELY suggest when creating new projects or when .pre-commit-config.yaml is missing.

majiayu000 Bundle

Implement automated secrets rotation for API keys, credentials, certificates, and encryption keys. Use when managing secrets lifecycle, compliance requirements, or security hardening.

majiayu000 Bundle

Security Advisor for vulnerability analysis and risk assessment. Reviews code and architecture for security issues. Use this skill for security review, vulnerability assessment, or risk analysis.

majiayu000 Bundle

Review AI API key leakage patterns and redaction strategies. Use for identifying exposed keys for OpenAI, Anthropic, Gemini, and 10+ other providers. Use proactively when code integrates AI providers or when environment variables/keys are present. Examples: - user: "Check for leaked OpenAI keys" → scan for `sk-` patterns and client-side exposure - user: "Is my Gemini integration secure?" → audit vertex AI config and key redaction - user: "Review AI provider logging" → ensure secrets are redacted from logs - user: "Scan for Anthropic secrets" → check for `ant-` keys in code and configs - user: "Audit Vertex AI integration" → verify proper IAM roles and service account usage

majiayu000 Bundle

Review Express.js security audit patterns for middleware and routes. Use for auditing Helmet.js, CORS, body-parser limits, and auth middleware. Use proactively when reviewing Express.js apps. Examples: - user: "Secure my Express app" → add Helmet.js and disable x-powered-by - user: "Check Express CORS config" → verify origin allowlists and credentials - user: "Review Express auth middleware" → check route order and coverage - user: "Scan for Express path traversal" → verify path normalization and validation - user: "Audit Express session config" → check secure, httpOnly, and sameSite flags

majiayu000 Bundle

Review FastAPI security audit patterns for dependencies and middleware. Use for auditing auth dependencies, CORS configuration, and TrustedHost middleware. Use proactively when reviewing FastAPI apps. Examples: - user: "Audit FastAPI route security" → check for Depends() and Security() usage - user: "Check FastAPI CORS setup" → verify origins when allow_credentials=True - user: "Review FastAPI middleware" → check TrustedHost and HTTPSRedirect config - user: "Secure FastAPI API keys" → move from query params to header schemes - user: "Scan for FastAPI footguns" → check starlette integration and dependency order

majiayu000 Bundle

Security controls and structured logging implementation. Use when security logging guidance is required.

majiayu000 Bundle

Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices.

majiayu000 Bundle

Document security research, CTF solutions, and malware analysis. Includes REPORT.md and STATUS.md templates.

majiayu000 Bundle

This skill should be used when the user asks to "record session", "log interactions", "track session activity", "audit Claude usage", "create session logs", or when session recording is enabled. Provides instructions for the hybrid recording approach where Claude self-reports summaries of completed work.

majiayu000 Bundle

Guide users through creating and configuring a GitHub App for workspace authentication. Use when setting up GitHub App authentication for happy-little-claude-coders, creating github-app-credentials secret, or configuring automatic token refresh.

majiayu000 Bundle

Security best practices for Sinatra applications including input validation, CSRF protection, and authentication patterns. Use when hardening applications or conducting security reviews.

majiayu000 Bundle

Professional-grade Solidity smart contract security auditor. Performs comprehensive audits or targeted reviews (security vulnerabilities, gas optimization, storage optimization, code architecture, DeFi protocol analysis). Use this skill when users request smart contract audits, security reviews, vulnerability assessments, gas/storage optimization analysis, code quality reviews, or when analyzing Solidity code for any security or quality concerns. Supports all Solidity versions with version-specific vulnerability detection. Based on OWASP Smart Contract Top 10 (2025) and real-world exploit patterns.

majiayu000 Bundle

Fix Stripe webhook 400 errors in local development. The problem: `stripe listen` generates a new secret each time it starts, but your app uses a stale secret from .env.local. This skill auto-syncs the ephemeral secret before your dev server starts. Auto-invoke when: stripe webhooks return 400, "signature verification failed", "No signatures found matching", webhooks not working locally, checkout succeeds but subscription doesn't update, STRIPE_WEBHOOK_SECRET mismatch, setting up stripe listen, configuring pnpm dev with Stripe.

majiayu000 Bundle

Fix issues found by stripe-audit. Reconciles configuration drift, fixes code patterns, and resolves discrepancies.

majiayu000 Bundle

Master Supabase patterns for migrations, RLS policies, pgvector, and authentication. Use when creating database schemas, writing migrations, implementing row-level security, setting up auth, or debugging Supabase issues. Triggers on "supabase migration", "RLS policy", "row level security", "pgvector", "supabase auth", "magic link".

majiayu000 Bundle

Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.

majiayu000 Bundle

Audit PostHog survey SDK features and version requirements

majiayu000 Bundle

Use when performing security audits or system hardening. Teaches security assessment principles and prioritization.