Security

majiayu000 Bundle

This skill should be used when the user asks to "automate maintenance", "update dependencies", "security scanning", "automated backups", "system health monitoring", or needs comprehensive automated maintenance to reduce operational overhead and prevent technical debt.

majiayu000 Bundle

Toggle GitHub repo between private and public with security hardening, contribution lockdown, and pre-flight safety checks.

majiayu000 Bundle

Orchestrate multiple review skills in parallel against a codebase. Spawns specialized subagents, waits for all to complete, and synthesizes findings into a unified report. Supports pre-merge, deep audit, project health, and post-incident modes.

majiayu000 Bundle

Design architecture foundations before implementation. Use when asked to design or refactor architecture, choose Rust/Go crate, package, module, runtime, workflow, or service boundaries, compare mature project architecture, prevent stacked one-off PRs, audit migration debt in existing repos, or produce a spec before coding.

majiayu000 Bundle

Use when the user asks to "check if our surfaces have drifted from the canon", "watch for competitor repositioning", or "define when we should reposition"; produces a drift report — self-drift per flagship surface vs the narrative-registry canon over time (via wayback.py, change history Measured with as-of dates), competitor-repositioning alerts, an explicit repositioning-trigger condition set, and a D1/W1/M1 message-shift retro (intended vs actual pull-through, evidence-labeled) — feeding the TALE L drift-audit sub-items and the narrative-whiplash guardrail fact base. Not for the first-time consistency check before a surface ships — use narrative-cascade-planner; not for computing the NQS or running the vetoes — use narrative-quality-auditor; not for echo-rate / AI-answer resonance measurement — use narrative-resonance-monitor. 自漂移监测/竞品重定位告警/重定位触发/叙事漂移复盘

majiayu000 Bundle

Speculative parallel implementation methodology — dispatch N candidate implementations, audit all, score, pick best. Auditability mandate: ALL candidates logged (not just winner).

majiayu000 Bundle

Logging system design guide covering centralized architecture, field standards, and distributed tracing. Use when designing log systems, establishing standards, or debugging production issues.

majiayu000 Bundle

Reproducibility Audit

majiayu000 Bundle

Audit for memory leaks, handle leaks, GDI leaks, and CPU churn

majiayu000 Bundle

Use when reviewing design documents, technical specifications, architecture docs, RFCs, ADRs, or API designs for completeness and implementability. Triggers: 'review this design', 'is this spec complete', 'can someone implement from this', 'what's missing from this design', 'review this RFC', 'is this ready for implementation', 'audit this spec'. Core question: could an implementer code against this without guessing?

majiayu000 Bundle

This skill should be used when the user asks to "validate the code", "check code quality", "run /buff:validate", "review for issues", "find bugs", "check for security issues", "lint the code", "check complexity", "validate the project", "run project-wide validation", "quick validate", "validate session changes", "check cross-file coherence", "show quality trend", or any request for high-sensitivity code quality analysis. Supports project-wide scanning, --quick (graph-guided), --session (session-modified files only), and cross-file coherence analysis with quality trending. Also auto-invoked by /buff:execute as part of the dev loop.

majiayu000 Bundle

Evaluate HackerOne / Bugcrowd / Intigriti programs before committing time. Decide signal-to-noise, payout history, response time, scope size, and competition level. Use when the user is considering a new bug bounty target or asking "should I hunt this".

majiayu000 Bundle

Use when reviewing, designing, or modifying Java enterprise systems that may support financial entities, critical ICT services, third-party ICT provider integrations, or operational resilience obligations under DORA. This should trigger for requests such as Review a Java platform for DORA ICT risk controls; Design operational resilience evidence for a financial service; Add incident, continuity, backup, recovery, or third-party ICT controls; Assess resilience testing and monitoring before production release. Part of cursor-rules-java project

majiayu000 Bundle

Set up Cognito User Pools with custom attributes, auth triggers, and CDK escape hatches for GainInsight Standard projects. Use when configuring authentication, adding custom user attributes, or debugging auth flow issues.

majiayu000 Bundle

Implement AP2 challenge and step-up flows — 3DS2, OTP verification, redirect challenges, and trusted surface interactions. Use when building additional authentication steps during agentic payment processing.

majiayu000 Bundle

外部APIとの統合設計パターンに関する専門知識。RESTful API、GraphQL、WebSocket等の統合設計と実装指針を提供します。 Anchors: • 『RESTful Web APIs』（Leonard Richardson）/ 適用: RESTful API設計、HTTPセマンティクス / 目的: リソース中心の設計パターン理解 • 『Building Microservices』（Sam Newman）/ 適用: APIコントラクト設計、マイクロサービス間通信 / 目的: サービス境界の明確化 Trigger: Use when designing authentication flows (OAuth 2.0, API Key, JWT), implementing rate limiting and retry strategies, or reviewing API integration architecture.

majiayu000 Bundle

Authentication and authorization patterns for Kagenti services

majiayu000 Bundle

API Key、JWT、OAuth 2.0、mTLS などの認証方式を比較し、適切なフロー設計と実装方針を整理するスキル。 方式選定、トークン管理、署名戦略、セキュリティ対策を一貫して設計します。 Anchors: • Web Application Security / 適用: 脅威整理 / 目的: 認証フローのリスク把握 • OWASP Authentication Cheat Sheet / 適用: 実装ベストプラクティス / 目的: 安全な実装指針 • RFC 6749 & RFC 7519 / 適用: OAuth/JWT仕様 / 目的: 標準準拠の設計 Trigger: Use when selecting authentication flows (API Key/JWT/OAuth/mTLS), designing token strategy, or validating auth configuration.

majiayu000 Bundle

Run Bandit security analysis to find common security issues and vulnerabilities in Python code. Use when the user mentions Bandit, security analysis, vulnerability scanning, security audit, software composition analysis (SCA), or wants to check for security issues in Python code.

majiayu000 Bundle

Generate a prioritised compliance checklist for GDPR, SOC 2, ISO 27001, FCA, HIPAA, or other frameworks with a gap analysis. Use when asked for a compliance checklist, gap analysis, readiness assessment, or audit preparation for any regulatory framework. Produces a structured checklist with prioritised gaps, quick wins, and evidence requirements. Optimised for Opus 4.7 and newer models. Not a substitute for legal or compliance professional advice.

majiayu000 Bundle

<!-- Copyright (c) 2026 defconxt. All rights reserved. -->

majiayu000 Bundle

This skill should be used when the user asks to "implement device auth", "add device authorization", "authenticate desktop app", "authenticate CLI tool", "device code flow", "RFC 8628", "poll for token", "get user info after device auth", or mentions authenticating apps that can't handle browser redirects. Provides step-by-step guidance for device authorization with Sigma Identity.

majiayu000 Bundle

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.

majiayu000 Bundle

Use the Anaconda `ctf` environment and installed exploit tooling for binary exploitation and runtime-debugging tasks. Use when Codex needs `pwntools`, `pwndbg`, `gdb`, `checksec`, `patchelf`, `qemu-user`, `pwninit`, or other pwn-focused helpers.

majiayu000 Bundle

Skill for configuring security and authorization in Orchard Core. Covers permission definitions, authorization services, CORS, security headers, content security policies, and OpenID Connect.

majiayu000 Bundle

Assess the overall organization security posture

majiayu000 Bundle

Configure plugin sandboxing with vm2 or isolated-vm for secure plugin execution.

majiayu000 Bundle

Techniques to test and bypass AI safety filters, content moderation systems, and guardrails for security assessment

majiayu000 Bundle

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities. Invoke for authentication, authorization, input validation, encryption, OWASP Top 1

majiayu000 Bundle

Verify project dependencies against VCP dependency management standards. Checks lockfile hygiene, version ranges, package existence, and suspicious packages.

majiayu000 Bundle

Use when auditing whether tests genuinely catch failures, or when user expresses doubt about test quality. Triggers: 'are these tests real', 'do tests catch bugs', 'tests pass but I don't trust them', 'test quality audit', 'green mirage', 'shallow tests', 'tests always pass suspiciously', 'would this test fail if code was broken'. Forensic analysis of assertions, mock usage, and code path coverage.

majiayu000 Bundle

Assess NFRs like performance security and reliability. Use when the user says "lets assess NFRs" or "I want to evaluate non-functional requirements"

majiayu000 Bundle

Local development and testing workflows for Kagenti. Full test suites for Kind and HyperShift.

majiayu000 Bundle

Implement granular authorization with Symfony Voters; decouple permission logic from controllers; test authorization separately from business logic

majiayu000 Bundle

Audit your Obsidian vault in Claude Code — finds stale drafts, empty folders, duplicate filenames, and incomplete files. Saves a dated report.

majiayu000 Bundle

Autonomously audit business and financial performance weekly. Analyzes revenue, expenses, completed tasks, bottlenecks, and generates executive briefing with proactive suggestions. Use when generating weekly report, business audit, or when user mentions "briefing", "ceo report", "performance summary", "weekly audit", "business review".