Security

majiayu000 Bundle

Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.

majiayu000 Bundle

Compare two security audit reports to track remediation progress and identify new vulnerabilities.

majiayu000 Bundle

Identify and prioritize technical debt in Python codebases. Use when the user asks to find tech debt, analyze code quality, identify what needs refactoring, find security issues, check test coverage gaps, review dependencies, find TODOs/FIXMEs, or assess maintainability. Triggers on phrases like "find technical debt", "what's wrong with this codebase", "where should I focus refactoring", "audit this code", "find TODOs", "check for security issues", "analyze dependencies", or "what needs tests". Complements python-simplifier skill (use that for complexity and code smell analysis).

majiayu000 Bundle

Expert guide to detecting, categorizing, and prioritizing technical debt in Rails applications. Use when: (1) Auditing codebase health, (2) Planning refactoring sprints, (3) Estimating feature impact, (4) Identifying code smells, (5) Tracking deprecations. Trigger keywords: technical debt, code smell, complexity, cyclomatic, deprecation, legacy, refactor, audit, health check, god class

majiayu000 Bundle

Activate when the user needs help integrating threat intelligence feeds, configuring API-based lookups, creating custom threat feeds, or enriching detections with threat intelligence data in LimaCharlie.

majiayu000 Bundle

Read-only TypeScript auditor for Treido (strictness, unsafe casts, any/unknown discipline). Returns structured payload for ORCH merge. Trigger: TS-AUDIT

majiayu000 Bundle

Security best practices and patterns for Vigil Guard v2.0.0 development. Use when implementing authentication, handling secrets, validating input, preventing injection attacks, managing CORS, ensuring secure coding practices, 3-branch detection security, or implementing security audit fixes.

majiayu000 Bundle

This skill provides expert-level guidance for VS Code extension development. Use when implementing new extension features, debugging extension code, designing WebView UIs, implementing Language Server Protocol features, or optimizing extension performance. Covers activation events, contribution points, VS Code API patterns, security best practices, testing strategies, and publishing workflows.

majiayu000 Bundle

Comprehensive security assessment and remediation. Use for security reviews, compliance checks, vulnerability assessments.

majiayu000 Bundle

Audit AI-powered interfaces against the uxuiprinciples Part V taxonomy — 44 principles covering transparency, trust calibration, human override, consent, agentic workflows, and conversational design. Returns structured findings with severity and remediation. API key optional — enriched output requires uxuiprinciples.com API Access.

majiayu000 Bundle

Master compliance management with GDPR, SOC 2, ISO 27001, audit preparation, and regulatory requirements.

majiayu000 Bundle

Electronデスクトップアプリケーションのアーキテクチャ設計を専門とするスキル。 Main/Renderer/Preloadプロセスの責務分離、型安全なIPC通信設計、セキュリティ設定を支援する。 Anchors: • Clean Architecture (Robert C. Martin) / 適用: 依存関係ルール / 目的: プロセス間の責務分離 • Electron公式ドキュメント / 適用: プロセスモデル / 目的: セキュアな設計パターン • TypeScript / 適用: 型安全なIPC設計 / 目的: エンドツーエンドの型安全性 Trigger: Use when designing Electron architecture, implementing IPC communication, configuring security settings, or separating Main/Renderer responsibilities. electron, ipc, main process, renderer, preload, contextIsolation, contextBridge

majiayu000 Bundle

Electronプロセス間通信（IPC）パターンの設計と実装専門知識。 安全で効率的なMain-Rendererプロセス通信、contextBridge、型安全なAPI設計を提供。 Anchors: • Electron Security / 適用: contextBridge/preload設計 / 目的: セキュアなIPC実装 • Clean Architecture / 適用: Main/Renderer境界設計 / 目的: 責務分離と保守性 • Type Safety / 適用: TypeScript型契約 / 目的: IPC通信の型安全性確保 Trigger: Use when implementing IPC communication patterns, setting up contextBridge, designing typed IPC handlers, securing renderer-main communication, or structuring bidirectional messaging flows. ipcMain, ipcRenderer, contextBridge, invoke, handle, preload, typed IPC

majiayu000 Bundle

ファイル監視システムのセキュリティ対策を実装するスキル。パストラバーサル・シンボリックリンク攻撃の防止、最小権限の原則に基づく権限管理、多層防御アーキテクチャを設計・実装。 Anchors: • Threat Modeling（Adam Shostack） / 適用: STRIDEモデル / 目的: 脅威の体系的分類 • Web Application Security（Andrew Hoffman） / 適用: 入力検証 / 目的: パストラバーサル対策 • OWASP Cheat Sheet / 適用: 防御パターン / 目的: 実装レベルのセキュリティ Trigger: Use when implementing file watcher security, preventing path traversal attacks, detecting symbolic link attacks, designing access control, or conducting security audits.

majiayu000 Bundle

Cross-cutting ACP development patterns — idempotency, error handling, 3D Secure flows, request signing, rate limiting, monitoring, and security best practices. Use when designing architecture or solving production concerns.

majiayu000 Bundle

Use PROACTIVELY when auditing code quality, running security scans, assessing technical debt, reviewing code for production readiness, setting up CI quality gates, or tracking DORA metrics. Analyzes codebases against OWASP Top 10, SOLID principles, Testing Trophy, and 2024-25 SDLC standards. Supports incremental audits for large codebases. Not for runtime profiling or real-time monitoring.

majiayu000 Bundle

Git ignore configuration patterns for MetaSaver monorepos. Includes 10 required pattern categories (dependencies, build outputs, environment files with security-critical .env and .npmrc exclusions, logs, testing, IDE, OS, database, cache, temporary files). Use when creating or auditing .gitignore files to prevent secret leakage and repository pollution.

majiayu000 Bundle

Use when designing features - loads plugin methodology refs and delegates to dev-guides-navigator for online Drupal domain knowledge. Trigger: 'load guides', 'get reference docs', 'methodology references'. Use proactively during Phase 2 design — loads SOLID, Library-First, DRY, TDD, Security guides.

majiayu000 Bundle

Expert guidance for implementing FHIR servers using HAPI FHIR Plain Server framework. Use this skill when creating RESTful FHIR server implementations, implementing resource providers, adding FHIR operations (read, create, update, delete, search, $operations), implementing server interceptors for logging, security, and validation, setting up authentication and authorisation, or configuring FHIR server behaviour. Trigger keywords include "HAPI", "FHIR server", "RestfulServer", "resource provider", "IResourceProvider", "FHIR interceptor", "AuthorizationInterceptor", "FhirContext", "FHIR validation", "FHIR search", "FHIR operation".

majiayu000 Bundle

Use when verifying code is production-ready. Runs build, lint, and test commands to check compilation, code quality, and test suite. Essential validation step for /build and /audit commands.

majiayu000 Bundle

Spring Boot (Java) framework guardrails, patterns, and best practices. Use when working with Spring Boot Java projects, or when the user mentions Spring Boot. Provides JPA, Security, REST, WebFlux, and enterprise Java guidelines.

majiayu000 Bundle

Tracks package.json dependencies and identifies undocumented, outdated, or misaligned tools. Compares installed packages against documented versions in docs/infrastructure/, detects unused dependencies, and flags version mismatches. Use when user requests "check dependencies", "audit package.json", "find undocumented packages", or mentions dependency alignment.

majiayu000 Bundle

Create Horizon Realms (Umbral pocket dimensions) for Mage: The Ascension 20th Anniversary Edition. Handles Rank, build points, Structure, Inhabitants, Magick, Security, merits/flaws, and maintenance costs. Requires mage-rules-reference for Practice/Resonance lookups. Cross-references sanctum-creator, library-creator, node-creator for sub-components. Triggers: create a horizon realm, design an umbral realm, M20 pocket dimension, chantry realm, umbral sanctuary.

majiayu000 Bundle

Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project

majiayu000 Bundle

Detect known malicious npm package versions and install-time supply-chain indicators in repositories, lockfiles, and node_modules. Use when a user mentions an npm compromise, Shai-Hulud, the Keyv/cacheable incident, suspicious preinstall scripts, credential-stealing packages, or asks whether a JavaScript project was exposed to a package supply-chain attack. Do not use as a general CVE or license audit.

majiayu000 Bundle

Audit and safely remediate a cross-runtime Skill ecosystem spanning Codex, Claude Code, Loom, VibeGuard, Spellbook, and independent Git sources. Use when the user asks to inspect all local skills, resolve duplicate or divergent Skill copies, establish canonical sources and managed projections, retire obsolete skills without reinstall resurrection, scan Skill files for embedded credentials, quarantine unsafe automation, or prove Codex/Claude visibility with fresh checks. Do not use for invocation statistics alone; use skill-usage-stats for usage and zombie-skill evidence.

majiayu000 Bundle

Audit every Critical section for necessity, scope, and duration — find stale or overly broad holds that block the main thread

majiayu000 Bundle

Create or audit SLOs, SLIs, alert rules, incident response steps, escalation paths, postmortems, operational runbooks, and customer-impact communication. Use when defining production reliability, preparing launch readiness, responding to an outage, writing a runbook, tuning alerts, or closing the loop after an incident.

majiayu000 Bundle

Identify newsletters and mailing lists in email, show volume per sender, and help clean up subscriptions. Use when user wants to see what newsletters they're subscribed to, audit mailing lists, or identify email noise. Arguments: optional time range or "unsubscribe" to surface opt-out links.

majiayu000 Bundle

Check local branch changes against all best practices documentation. Systematically audits the diff between current branch and base branch against every applicable best practice. Triggers on: check best practices, best practices check, audit best practices, bp check, check bp.

majiayu000 Bundle

Verify milestone achievement against its definition of done, checking requirements coverage, cross-phase integration, and end-to-end flows. Triggers include "audit milestone", "verify milestone", "check milestone", and "milestone audit". This skill reads existing phase verification files, aggregates technical debt and gaps, and spawns an integration checker for cross-phase wiring.

majiayu000 Bundle

Complete project health audit (7 checks)

majiayu000 Bundle

Audit NVCA recipe quality: check file inventory, metadata schema, field-to-replacement coverage, ambiguous keys, smart quotes, test fixtures, and fill quality. Produces a structured scorecard per recipe with maturity tier classification. Use when user says "audit recipe quality," "check recipe coverage," "recipe scorecard," or "NVCA recipe quality."

majiayu000 Bundle

Audit query tools for accuracy, gaps, and retirement candidates

majiayu000 Bundle

Patterns, checklists, and templates for systematic code review with a focus on correctness, security, readability, performance, and maintainability.

majiayu000 Bundle

Identifies technical debt in WordPress sites - orphaned shortcodes from deleted plugins, unused plugins, database bloat, unused media, builder data from inactive builders. Use when user says "analyze technical debt", "scan for orphaned shortcodes", "check for unused plugins", or "find database bloat".