Security

majiayu000 Bundle

Encrypt and decrypt files or streams using age — a simple, modern, and secure encryption tool with small explicit keys, passphrase support, SSH key support, post-quantum hybrid keys, and UNIX-style composability. No config options, no footguns.

majiayu000 Bundle

Use when Claude Code permissions have accumulated in settings.local.json and you want to audit, consolidate, or clean up tool permission patterns.

majiayu000 Bundle

REST and GraphQL API design patterns, OpenAPI/Swagger specifications, versioning strategies, and authentication patterns. Use when designing APIs, reviewing API contracts, evaluating API technologies, or implementing API endpoints. Covers contract-first design, resource modeling, error handling, pagination, and security.

majiayu000 Bundle

Activate arifOS Full Autonomy Governance mode. Use when the user types /fag, asks to enter full autonomy governance, or wants the pre-flight checklist and authority boundaries before making changes.

majiayu000 Bundle

API認証ドキュメント（OAuth 2.0/PKCE、API Key、JWT、トークン管理）の作成と図解を支援するスキル。 認証フローの説明、トークン取得手順、セキュリティ注意点をわかりやすく整理します。 Anchors: • OAuth 2.0 Simplified / 適用: フロー図解 / 目的: 正確な説明と用語整理 • Web Application Security / 適用: セキュリティ注意点 / 目的: 安全な認証ドキュメント • API Documentation Best Practices / 適用: ドキュメント構成 / 目的: 読みやすさの担保 Trigger: Use when writing authentication docs, creating OAuth flow diagrams, documenting token management, or preparing quickstart guides for API auth.

majiayu000 Bundle

Binance Web3 official skill — security audit for token contracts, detecting honeypots, rug pulls, and malicious functions across BSC, Base, Solana, and Ethereum. Sourced from github.com/binance/binance-skills-hub.

majiayu000 Bundle

Comprehensive database security scanning and data integrity validation. Identify security vulnerabilities, enforce OWASP compliance, validate data types/formats/ranges, ensure referential integrity, and implement business rules. Use when assessing database security, checking compliance, validating data integrity, or enforcing constraints.

majiayu000 Bundle

Dependency security scanning. Use when auditing npm packages for vulnerabilities.

majiayu000 Bundle

Patterns for implementing role-based authorization in erify_api with JSONB roles/permissions, AdminGuard, and multi-scope access control

majiayu000 Bundle

Receive and verify FusionAuth webhooks. Use when setting up FusionAuth webhook handlers, debugging JWT signature verification, or handling authentication events like user.create, user.login.success, user.registration.create, or user.delete.

majiayu000 Bundle

Managed-custody authentication — shared API key login, session keypair generation, encrypted computedData payloads, AES-256-CBC encryption, and secp256k1 trade signing

majiayu000 Bundle

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.

majiayu000 Bundle

Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.

majiayu000 Bundle

Best practices for handling data with Lindy AI. Use when managing sensitive data, implementing data privacy, or ensuring data compliance. Trigger with phrases like "lindy data", "lindy privacy", "lindy PII", "lindy data handling", "lindy GDPR".

majiayu000 Bundle

Add secure storage to .NET MAUI apps using SecureStorage.Default. Covers SetAsync, GetAsync, Remove, RemoveAll, platform setup (Android backup rules, iOS Keychain entitlements, Windows limits), common pitfalls, and a DI wrapper service for testability. USE FOR: "secure storage", "SecureStorage", "store token securely", "Keychain", "Android Keystore", "save secret", "encrypted storage", "store credentials", "sensitive data storage". DO NOT USE FOR: general file storage (use maui-file-handling), SQLite databases (use maui-sqlite-database), or authentication flows (use maui-authentication).

majiayu000 Bundle

Test authentication and session management controls for bypass and account takeover scenarios.

majiayu000 Bundle

Set up authorized C2 simulation workflows and measure defensive detection outcomes.

majiayu000 Bundle

Perform passive reconnaissance and leak intelligence collection with no direct contact to target systems.

majiayu000 Bundle

Coordinate autonomous pentest skills with dependency enforcement, deconfliction, and emergency stop controls.

majiayu000 Bundle

Tools and frameworks for AI red teaming including PyRIT, garak, Counterfit, and custom attack automation

majiayu000 Bundle

Überwacht die interne KI-Richtlinie auf Abweichungen von der gelebten Praxis — wöchentlicher Abgleich gespeicherter Folgenabschätzungen, Triage-Ergebnisse und Anbieterprüfungen, oder direkte Prüfung einer geplanten neuen KI-Praxis. Lädt, wenn der Nutzer „Richtlinien-Sweep", „KI-Richtlinie prüfen", „deckt unsere Richtlinie das ab", „wir wollen X einführen — brauchen wir eine Richtlinienänderung" oder „Policy-Monitor starten" sagt.

majiayu000 Bundle

Vulnerability review, OWASP patterns, secure coding practices, and threat modeling approaches. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations.

majiayu000 Bundle

Automate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR capabilities. Use when scaling security operations or implementing DevSecOps.

majiayu000 Bundle

Implement comprehensive security for shared library. Use when working with security audits, dependency vulnerabilities, API security, token encryption, or secure coding practices for library consumers. Library security impacts all consuming plugins.

majiayu000 Bundle

Explain MotherDuck security, governance, and access-control patterns. Use when a security_compliance_owner, technical_owner, or application_builder is asking about residency, access boundaries, service accounts, isolation, sharing, or governance posture.

majiayu000 Bundle

Privilege system reference for the HMIS project. Use when adding new privileges, implementing access control, working with user roles, checking privilege-based rendering in XHTML, or auditing security controls.

majiayu000 Bundle

Security output format, core refusal policy, and purpose statement shared across all platforms.

majiayu000 Bundle

Manejo seguro de autenticación, RLS y conexión a base de datos y storage con Supabase.

majiayu000 Bundle

Navigate UK data protection and privacy compliance (UK GDPR, DPA 2018, PECR), review DPAs, handle data subject requests, and assess cross-border transfer requirements under ICO guidance. Use when reviewing data processing agreements, responding to DSARs, assessing international transfers, or evaluating privacy compliance for a UK-based organisation.

majiayu000 Bundle

Screen incoming NDAs under English law (England & Wales), classify as GREEN (standard), YELLOW (needs review), or RED (significant issues). Applies English law tests for enforceability, restrictive covenants, penalty doctrine, and injunctive relief. Use when triaging NDAs for a UK-based organisation.

majiayu000 Bundle

Integrate authentication and authorization flows with provider-specific setup and RBAC safeguards.

majiayu000 Bundle

- Planning exploit mitigation bypass strategies

majiayu000 Bundle

Audit a repo's test, lint, type-check, static analysis, build, and debug infrastructure for AI coding agents. Generate scored reports and optimized configs for the lint-on-write hook. Triggers on audit tests, test harness, lint setup, check test infrastructure, entering a new repo.

majiayu000 Bundle

Dual-mode workflow issue logger. Use with mode=log to append mistakes during waves. Use with mode=summary at workflow end to review accumulated issues. Use when completing /build, /audit, or /ms workflows.

majiayu000 Bundle

Configures 1Password CLI with direnv for fast secret loading using op-run pattern. Activates for: 1Password + direnv setup, slow secrets (>2 sec), environment variables from 1Password, .env.op files,

majiayu000 Bundle

Validation wrapper that tests TDMS and Documentation Standards integration during comprehensive audit