Security

majiayu000 Bundle

Guardrail policy for Aider CLI: refuse catastrophic actions, require scoped approvals, and reduce secret leakage.

majiayu000 Bundle

Guardrail policy for Codex CLI: refuse catastrophic actions, require scoped approvals, and reduce secret leakage.

majiayu000 Bundle

Guardrail policy for Llama CLI: refuse catastrophic actions, require scoped approvals, and reduce secret leakage.

majiayu000 Bundle

Angular 21+ functional HTTP interceptors for auth, error handling, loading states, retry logic, caching, and security best practices

majiayu000 Bundle

Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.

majiayu000 Bundle

NextAuth.js v5の設定とカスタマイズパターンを専門とするスキル。 OAuth 2.0プロバイダー統合、データベースアダプター、セッション戦略、コールバック実装、型安全なセッション管理を提供する。 Anchors: • Web Application Security (Andrew Hoffman) / 適用: OAuth脅威モデリングとセッションセキュリティ / 目的: 安全な認証フロー設計 • NextAuth.js v5 Official Docs / 適用: プロバイダー設定とコールバック / 目的: 標準準拠の実装 Trigger: Use when implementing NextAuth.js authentication, configuring OAuth providers (Google, GitHub), integrating database adapters (Drizzle), designing session strategies (JWT or database-backed), customizing authentication callbacks, or adding role-based data to sessions. Keywords: nextauth, oauth, authentication, session, jwt, drizzle adapter, google oauth, github oauth

majiayu000 Bundle

This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.

majiayu000 Bundle

Security patterns, CSP nonces, input validation, auth checks, Supabase SSR patterns. Use when implementing authentication, forms, security features, or when user mentions security/validation/auth.

majiayu000 Bundle

Cross-codebase security detective that fans out parallel sub-agents to rapidly audit ANY codebase's security posture. The noir investigator of the grove. Use when auditing an unfamiliar codebase, offering security review services, or needing a comprehensive security posture assessment fast.

majiayu000 Bundle

Use to assess regulatory applicability for products that may fall under AI regulation (EU AI Act, Article 50 transparency).

majiayu000 Bundle

Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.

majiayu000 Bundle

用于检测代码库中的敏感信息泄露风险。当用户需要检查敏感信息、安全扫描、代码安全审计、检测密钥泄露时触发此skill。 触发场景： - "检查敏感信息"、"安全检查"、"检测密钥泄露" - "扫描代码中的敏感数据"、"查找密码泄露" - 提交代码前的安全检查 - 代码审查前的安全扫描 - 检查.gitignore是否正确配置 检测范围：API密钥、密码、私钥、证书文件、数据库连接串、云服务凭证等敏感信息。

majiayu000 Bundle

Security best practices for deploying AI/ML models to production environments

majiayu000 Bundle

Implement security headers, input validation, and CSRF protection. Use when hardening security, reviewing for vulnerabilities, or before releases.

majiayu000 Bundle

Scaffold a Supabase project with database schema, Row Level Security policies, and auth integration. Use for: setting up RLS policies, debugging 'RLS not working', multi-tenant access control, auth.uid() patterns, team/org membership, profile triggers. Triggers: supabase, supabase rls, row level security, supabase auth, rls policy, supabase setup, supabase permissions, multi-tenant supabase, supabase project, rls not working.

majiayu000 Bundle

Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.

majiayu000 Bundle

Implement the UCP Buyer Consent extension — GDPR/CCPA consent collection, consent fields in checkout sessions, and privacy-compliant consent management. Use when adding consent flows, privacy compliance, or data processing agreements to UCP checkout.

majiayu000 Bundle

Harden Windows servers per security baselines and CIS benchmarks. Configure Group Policy, Windows Defender, and security features. Use when securing Windows Server environments.

majiayu000 Bundle

<!-- Copyright (c) 2026 defconxt. All rights reserved. -->

majiayu000 Bundle

Upstream version checking, agentskills.io spec compliance audit, Claude Code feature gap analysis. Activates on updates, version checks, or alignment work.

majiayu000 Bundle

This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.

majiayu000 Bundle

Upgrade dependencies safely using pnpm catalog, checking for breaking changes, and testing upgrades. Use when updating packages, applying security patches, or upgrading major versions.

majiayu000 Bundle

Expert incident responder specializing in security and operational incident management. Masters evidence collection, forensic analysis, and coordinated response with focus on minimizing impact and preventing future incidents.

majiayu000 Bundle

Run validation suite in parallel background workers. Auto-triggered after code changes when multiple validators apply. Use when tests, lint, and security checks should run simultaneously.

majiayu000 Bundle

Run a structured, repeatable audit for a live website and produce actionable artifacts.

majiayu000 Bundle

Use when reviewing n8n workflows or validating workflow JSON before deployment. Prevents production errors by catching anti-patterns in node configuration, connection wiring, and expression syntax. Covers workflow JSON structure, node configuration, connection wiring, expression syntax, credential setup, error handling patterns, deployment configuration, and known anti-patterns. Keywords: n8n, review, validation, workflow, audit, anti-pattern.

majiayu000 Bundle

Pflicht-Pre-Check vor jedem ausgehenden Versand — prueft Dokumentidentitaet (das richtige PDF? Stand vom richtigen Datum? Aktenzeichen passt?) Unterschrift (durch berechtigte Person? eigenhaendig oder qualifizierte elektronische Signatur?) Adressat (richtiges Gericht / Behoerde / Mandant? richtige Adresse beA-SAFE-ID EGVP-Adresse?) Anlagen (vollstaendig? im Inhaltsverzeichnis aufgefuehrt? Sigel richtig?) Versandweg (Post / beA / EGVP / E-Mail / De-Mail). Versandquittung sichern. Audit-Eintrag. Bei Mangel Versand sperren.

majiayu000 Bundle

Perform comprehensive software architecture audits to identify improvements for robustness, changeability, and testability. Use when asked to audit, review, or analyze a codebase's architecture, or when asked to suggest structural improvements. Triggers include "architecture audit", "audit the codebase", "review architecture", "architectural analysis", "code structure review", or explicit "/architecture-audit".

majiayu000 Bundle

Evaluate ENCODE experiment quality using standard metrics and audit flags. Use when the user asks about data quality, wants to filter for high-quality experiments, needs to interpret quality metrics (FRiP, NSC, RSC, NRF, IDR, TSS enrichment, fragment size), wants to understand ENCODE audit warnings, needs to compare quality across experiments, or is deciding whether data is usable for their analysis. Also use when the user mentions QC, quality control, or data filtering.

majiayu000 Bundle

Compares specification documents against implementation code to find divergences. Use when implementation of a spec or design doc is claimed complete.

majiayu000 Bundle

Diagnose a named or described business/engineering process for bottlenecks, risks, and optimization opportunities. Use when a user asks to review, map, or improve a workflow and wants concrete next steps with effort/impact tradeoffs.

majiayu000 Bundle

Archaeological analysis of WordPress sites. Detects all page builders, audits plugins (active vs dead weight), maps content structure, finds orphaned shortcodes, measures performance, and assesses security posture. Use when user says "analyze my wordpress site", "wordpress site audit", "site dna", or "check my wordpress health".

majiayu000 Bundle

認可エンドポイント（Authorization Endpoint）機能の開発・修正を行う際に使用。Authorization Request処理、同意フロー、Authorization Code生成実装時に役立つ。

majiayu000 Bundle

Backend expert guidance for API/DB/Security/Architecture

majiayu000 Bundle

This skill supports three modes: Create, Update, and Find.

majiayu000 Bundle

Use this skill for general PostgreSQL table design. **Trigger when user asks to:** - Design PostgreSQL tables, schemas, or data models when creating new tables and when modifying existing ones. - Choose data types, constraints, or indexes for PostgreSQL - Create user tables, order tables, reference tables, or JSONB schemas - Understand PostgreSQL best practices for normalization, constraints, or indexing - Design update-heavy, upsert-heavy, or OLTP-style tables **Keywords:** PostgreSQL schema, table design, data types, PRIMARY KEY, FOREIGN KEY, indexes, B-tree, GIN, JSONB, constraints, normalization, identity columns, partitioning, row-level security Comprehensive reference covering data types, indexing strategies, constraints, JSONB patterns, partitioning, and PostgreSQL-specific best practices.