Security

majiayu000 Bundle

Audits dependency supply chains for bad versions, lockfile drift, and artifact integrity. Use when adding deps, handling incidents, or releasing a plugin.

majiayu000 Bundle

Data encryption and key management patterns for tenant isolation. Covers encryption at rest, tenant-specific keys, and secure key management.

majiayu000 Bundle

Structured approaches for AI security testing including threat modeling, penetration testing, and red team operations

majiayu000 Bundle

Orchestrate end-to-end ADR-030 test-quality remediation by routing work across specialist skills (ce-test-pruning-expert, ce-test-creator, ce-test-audit, ce-code-quality-auditor, ce-deadcode-hunter, ce-devils-advocate) using the Test Quality Method with Option A/B/C focus selection.

majiayu000 Bundle

Detects anti-patterns and code smells in .NET test suites. Use when the user asks to review test quality, find test smells, identify flaky test indicators, or audit tests for common mistakes. Covers assertion quality, test isolation, naming, flakiness indicators, over-mocking, and structural problems. Works with MSTest, xUnit, NUnit, and TUnit.

majiayu000 Bundle

Use when you need to design, review, or improve REST APIs with Quarkus REST (Jakarta REST) — including resource classes, HTTP methods, status codes, request/response DTOs, Bean Validation, exception mappers, optional runtime OpenAPI exposure (SmallRye), contract-first generation from OpenAPI, content negotiation, pagination, sorting and filtering, API versioning, idempotency (Idempotency-Key), optimistic concurrency (ETag / If-Match), HTTP caching (Cache-Control), API deprecation (Sunset / Deprecation headers), RFC 7807 Problem Details, ISO-8601 for time in contracts, and security-aware boundaries. This should trigger for requests such as Review or improve JAX-RS resources in a Quarkus project; Design HTTP APIs with validation and error handling on Quarkus; Add API versioning, idempotency, ETag concurrency, or deprecation headers; Implement pagination, sorting, or RFC 7807 Problem Details error responses. Part of cursor-rules-java project

majiayu000 Bundle

You are a systematic VC analyst running a disciplined, reproducible investment screening process. Every decision is scored, weighted, and logged to JSON for audit.

majiayu000 Bundle

Audit memory directory for structural issues (orphans, dangling refs, duplicates, missing sections, oversized entries) and staleness against session-history transcripts; report-first, fix-on-confirmation. Use when the user says "audit memory", "memory hygiene", or "find stale/duplicate memories".

majiayu000 Bundle

Configure this skill configures service meshes like istio and linkerd for microservices. it generates production-ready configurations, implements best practices, and ensures a security-first approach. use this skill when the user asks to "configure service ... Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.

majiayu000 Bundle

Design PostgreSQL 17 schemas for laneweaverTMS using Supabase conventions - UUIDs, ENUMs, audit trails, soft deletes, triggers, functions, views, and atomic migration patterns.

majiayu000 Bundle

Comprehensive LinkedIn personal branding analysis, profile optimization, and visibility improvement skill using Claude for Chrome browser tools. Use when users request LinkedIn profile analysis, personal branding audit, profile optimization recommendations, LinkedIn visibility improvement, headline optimization, About section review, content strategy guidance, engagement analysis, or Social Selling Index improvement. Works with Claude for Chrome to analyze profile photos, banners, headlines, About sections, experience, skills, recommendations, featured content, activity/posts, and network engagement directly from the user's browser.

majiayu000 Bundle

Concurrency audit worker (L3). Checks race conditions, missing async/await, resource contention, thread safety, deadlock potential. Returns findings with severity, location, effort, recommendations.

majiayu000 Bundle

Implement n8n credential types including API key, OAuth2, and header-based authentication patterns. Use this skill when creating *.credentials.ts files, implementing ICredentialType interfaces, configuring OAuth2 flows, setting up credential testing, injecting authentication headers, or following credential security best practices. Apply when building any n8n node that requires API authentication, token management, or secure credential handling.

majiayu000 Bundle

Analyze code, infrastructure, and configurations by conducting comprehensive security audits. It leverages tools within the security-pro-pack plugin, including vulnerability scanning, compliance checking, and cryptography review. Use when assessing security or running audits. Trigger with phrases like 'security scan', 'audit', or 'vulnerability'.

majiayu000 Bundle

Dynamic security testing of web forms using Playwright browser automation. Sends actual payloads to test for vulnerabilities. REQUIRES USER CONFIRMATION before execution. Use when user wants to "test payloads", "dynamic security test", "exploit testing", "penetration test forms".

majiayu000 Bundle

When implementing backend APIs, database queries, authentication, or handling user input.

majiayu000 Bundle

มาตรฐาน security ขั้นต่ำที่ทุก service ต้องมี: authentication, authorization, input validation, secrets handling, และ security headers ที่ทำให้ระบบปลอดภัยตั้งแต่ day one

majiayu000 Bundle

Detect OWASP Top 10 vulnerabilities via static analysis. Calculate security score (0.00-1.00) for code quality. Auto-generate remediation suggestions with implementation examples. Integrate with Serena for vulnerability tracking and SLA compliance. Use when: securing code, detecting vulnerabilities, improving security posture, validating fixes, enforcing security standards.

majiayu000 Bundle

Security protocols and vendor management expertise from Marcus covering emergency response codes, vendor relations, and operational safety

majiayu000 Bundle

Security and privacy guardrails for Sketch Magic. Use when handling API keys, logs, uploads, telemetry, or when debugging errors to avoid leaking secrets or user images.

majiayu000 Bundle

Analyze Supabase authentication configuration for security weaknesses and misconfigurations.

majiayu000 Bundle

Test if user signup is open and identify potential abuse vectors in the registration process.

majiayu000 Bundle

List all tables exposed via the Supabase PostgREST API to identify the attack surface.

majiayu000 Bundle

Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.

majiayu000 Bundle

Threat modeling methodologies using STRIDE, attack trees, and risk assessment for proactive security analysis. Use when designing secure systems, conducting security reviews, or identifying potential attack vectors in applications.

majiayu000 Bundle

Validate TypeScript/JavaScript code quality with ESLint, Prettier, type checking, and security analysis. Use for TypeScript/JS codebases to ensure code quality and standards.

majiayu000 Bundle

Provides patterns and guidance for implementing user-scoped data filtering and multi-tenancy in web applications. Use this skill when you need to: (1) Restrict data access based on user identity, (2) Implement ownership checks for database operations, (3) Build multi-tenant applications with organization-level data scoping, (4) Implement admin bypass for viewing all data, (5) Create audit trails for data access. This skill focuses on Python, FastAPI, and SQLAlchemy.

majiayu000 Bundle

Validate CSRF protection implementations for security gaps. Use when reviewing form security or state-changing operations. Trigger with 'validate CSRF', 'check CSRF protection', or 'review token security'.

majiayu000 Bundle

Mobile layout diagnostics - identifies responsive breakpoint problems, text sizing issues, column stacking failures, element visibility issues, navigation menu behavior. Device-by-device breakdown. Use when user says "check my mobile experience", "audit mobile responsiveness", "scan for mobile layout issues", or "mobile experience report".

majiayu000 Bundle

Ensures complete traceability of financial calculations from raw data to final output. Use when implementing calculations, scoring systems, or any data transformations that need audit trails for regulatory compliance and debugging.

majiayu000 Bundle

Complete codebase audit combining code review, Prisma query optimization, and TypeScript analysis with intelligent routing. Use when asked for a full project review, complete codebase audit, or comprehensive quality check of a full-stack application.

majiayu000 Bundle

Follow an opinionated Go feedback loop with targeted tests, linting, local CI, security scans, dependency audits, coverage, benchmarking, generation, and migrations. Use when Codex is modifying Go code, setting up repeatable repo scripts, or tightening validation after a Go change.

majiayu000 Bundle

Deliver a 360° evaluation of a codebase or feature, blending architecture, correctness, performance, security, and UX signals.

majiayu000 Bundle

HTTPプロトコルの仕様に基づき、RESTful APIおよびWebサービス実装における通信設計を提供。ステータスコード、ヘッダー、キャッシュ、冪等性設計を網羅。 Anchors: • HTTP/2 in Action (Barry Pollard) / 適用: プロトコル仕様・パフォーマンス / 目的: 効率的なHTTP通信 • RESTful Web Services (Richardson, Ruby) / 適用: REST設計原則 / 目的: 一貫したAPI設計 • Web API Design (Brian Mulloy) / 適用: 実践的なAPI設計パターン / 目的: 使いやすいAPI Trigger: Use when designing REST APIs, implementing HTTP clients, configuring cache strategies, setting security headers, or ensuring idempotency. http, rest api, status codes, cache-control, cors, idempotency, headers, http/2, keep-alive

majiayu000 Bundle

Consult external AIs (Gemini 2.5 Pro, OpenAI Codex, fresh Claude) for second opinions when stuck on bugs or making architectural decisions. Use when: debugging attempts have failed, making significant architectural choices, security concerns, or need fresh perspective. Automatically suggests consultation after one failed attempt. Provides synthesis comparing multiple AI perspectives with web research, thinking mode, and repo-aware analysis.

majiayu000 Bundle

pre-commit hookセキュリティスキル。機密情報検出パターン、git-secrets/gitleaks統合、チーム展開戦略、Git履歴スキャンを実装し、コミット前の機密情報漏洩を防ぐ。 Anchors: • Web Application Security (Andrew Hoffman) / 適用: 脅威モデリング・セキュア設計 / 目的: セキュリティリスクの体系的評価 • OWASP Top 10 / 適用: 機密情報検出パターン設計 / 目的: 業界標準の脆弱性分類に基づくパターン定義 • git-secrets / gitleaks公式ドキュメント / 適用: ツール統合・設定 / 目的: 公式ベストプラクティスに準拠した導入 Trigger: Use when implementing pre-commit hooks for secret detection, designing detection patterns, integrating git-secrets/gitleaks, scanning Git history for leaked secrets, or deploying security hooks across teams. pre-commit security, secret detection, git-secrets, gitleaks, credential scanning, Git history scan