Security

majiayu000 Bundle

Autonomously deep-scan entire codebase line-by-line, understand architecture and patterns, then systematically transform it to production-grade, corporate-level professional quality with optimizations

majiayu000 Bundle

Audit project dependencies for vulnerabilities, outdated versions, license compatibility, and supply-chain risk. Use before releases or periodically.

majiayu000 Bundle

Theater Detection Audit

majiayu000 Bundle

API security testing guide covering OWASP API Security Top 10, JWT attacks, OAuth vulnerabilities, GraphQL security, and API fuzzing techniques.

majiayu000 Bundle

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.

majiayu000 Bundle

コード・プラン・スコープを多角的にレビュー。品質の番人、参上。Use when user mentions reviews, code review, plan review, scope analysis, security, performance, quality checks, PRs, diffs, or change review. Do NOT load for: implementation work, new feature development, bug fixes, or setup.

majiayu000 Bundle

Reverse engineers network protocols through packet analysis, dissection, and documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging communication. Triggers include "pcap", "packet capture", "protocol analysis", "Wireshark", or "tcpdump".

majiayu000 Bundle

Use when reviewing Compact contracts for security vulnerabilities, privacy leaks, disclosure violations, access control issues, or ZK-specific attack vectors.

majiayu000 Bundle

Expert for building user stories using Test-Driven Development (TDD) with NestJS and @lenne.tech/nest-server. Implements new features by creating story tests first in tests/stories/, then uses generating-nest-servers skill to develop code until all tests pass. Ensures high code quality and security compliance. Use in projects with @lenne.tech/nest-server in package.json dependencies (supports monorepos with projects/*, packages/*, apps/* structure).

majiayu000 Bundle

Comprehensive code quality and security audit for financial systems. Use when asked to "review code", "code review", "security audit", "check for issues", "審核程式碼", "檢查安全性", or before merging changes. Focuses on DDD compliance, financial precision (no floats for money), security vulnerabilities, and test coverage.

majiayu000 Bundle

Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstrated cases.

majiayu000 Bundle

Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.

majiayu000 Bundle

Enterprise Skill for advanced development

majiayu000 Bundle

Web security assessment. USE WHEN web assessment, pentest, security testing, vulnerability scan. SkillSearch('webassessment') for docs.

majiayu000 Bundle

skillname: when-setting-network-security-use-network-security-setup

majiayu000 Bundle

VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-exploited), default credentials, SSO configuration disclosure, vmdir LDAP enumeration, ESXi Open SLP RCE history. ONLY for vCenter / Workspace ONE / Aria instances exposed to the internet — internal-network vCenter is out of scope per the external-only boundary. Use when recon shows port 443 with vCenter banner, `/ui` redirect, `/websso/SAML2/Metadata`, or VMware product fingerprints.

majiayu000 Bundle

skillname: when-configuring-sandbox-security-use-sandbox-configurator

majiayu000 Bundle

Authenticatie en beveiliging bij Nederlandse overheid: DigiD, eHerkenning, OAuth, OIDC, PKIoverheid, BIO, NIS2, security.txt, kwetsbaarheid melden.

majiayu000 Bundle

Validates PopKit security posture using concrete vulnerability patterns, automated secret scanning, and OWASP-aligned checklists

majiayu000 Bundle

Meta-skill that analyzes the Trail of Bits Testing Handbook (appsec.guide) and generates Claude Code skills for security testing tools and techniques. Use when creating new skills based on handbook content.

majiayu000 Bundle

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

majiayu000 Bundle

Use when conducting comprehensive code review for pull requests across multiple quality dimensions. Orchestrates 12-15 specialized reviewer agents across 4 phases using star topology coordination. Covers automated checks, parallel specialized reviews (quality, security, performance, architecture, documentation), integration analysis, and final merge recommendation in a 4-hour workflow.

majiayu000 Bundle

Coverage Gaps audit worker (L3). Identifies missing tests for critical paths (Money 20+, Security 20+, Data Integrity 15+, Core Flows 15+). Returns list of untested critical business logic with priority justification.

majiayu000 Bundle

認証・認可機構のセキュリティ評価とベストプラクティスを提供します。 ブルース・シュナイアーの『Secrets and Lies』とOAuth 2.0仕様に基づき、 認証メカニズム、セッション管理、アクセス制御、JWT/トークンセキュリティの 包括的な評価基準と実装ガイダンスを提供します。 使用タイミング: - 認証システムのセキュリティレビュー時 - OAuth/OpenID Connect実装の評価時 - セッション管理とトークンセキュリティの設計時 - アクセス制御（RBAC/ABAC）の実装評価時 - JWT署名アルゴリズムとトークン管理の検証時 Use this skill when reviewing authentication code, designing authorization systems, or validating token security implementations. 📚 リソース参照: このスキルには以下のリソースが含まれています。 必要に応じて該当するリソースを参照してください: - `.claude/skills/authentication-authorization-security/resources/access-control-models.md`: RBAC/ABAC/ACLアクセス制御モデルの詳細比較と選択基準 - `.claude/skills/authentication-authorization-security/resources/jwt-security-checklist.md`: JWT署名アルゴリズム選択とトークンセキュリティ検証項目 - `.claude/skills/authentication-authorization-security/resources/oauth2-flow-comparison.md`: OAuth 2.0フロー（Authorization Code、PKCE等）の選択決定ツリー - `.claude/skills/authentication-authorization-security/resources/password-hashing-guide.md`: bcrypt/argon2/scryptハッシュアルゴリズムの設定と実装ガイド - `.claude/skills/authenticati

majiayu000 Bundle

Framework for assessing IT service providers, technology vendors, and third-party partners. Creates structured risk assessments across financial, operational, compliance, security, and reputational dimensions with regulatory checklists (GDPR, DORA, NIS2, SOX). Use when: (1) Evaluating new vendors or technology providers, (2) Conducting third-party risk assessments for procurement, (3) Performing critical vendor due diligence for regulatory compliance, (4) Creating vendor onboarding documentation, (5) Establishing ongoing vendor monitoring processes, (6) Assessing vendor concentration risk, or (7) Generating executive-level vendor risk reports.

majiayu000 Bundle

When Auditing Security Use Security Analyzer

majiayu000 Bundle

Monitor cross-chain bridge security, liquidity, and transaction status across networks. Use when monitoring cross-chain asset transfers. Trigger with phrases like "monitor bridges", "check cross-chain", or "track bridge transfers".

majiayu000 Bundle

Run npm audit to scan for security vulnerabilities and check for outdated packages. Returns structured output with vulnerability counts by severity (critical/high/moderate/low), affected packages, and recommended updates. Used for security audits and maintenance.

majiayu000 Bundle

git workflows for agents: ship (stage → commit → push), worktree (parallel branches), hunks (selective staging). never force push, never git add -A, conventional commits. triggers on: commit, push, stage, ship, git add, worktree, hunks, selective staging.

majiayu000 Bundle

Personal AI Infrastructure core. AUTO-LOADS at session start. USE WHEN any session begins OR user asks about identity, response format, contacts, stack preferences, security protocols, or asset management.

majiayu000 Bundle

Split one artifact across independent lenses and return where they clash, plus the single question that resolves the clash. Use when one reviewer angle is not enough, such as a spec read for security, cost, and operability at once, or when the user says "prism this" or "review this from different angles". It reports the disagreement and never the average. To repeat one identical read to measure divergence, use fan-out-fresh-reads.

majiayu000 Bundle

Git workflow expert for user projects. Auto-commit features, semantic messages, GitHub integration. Auto-activates on keywords "commit", "push", "git", "github", "version control" or when feature/bugfix completed.

majiayu000 Bundle

· Handle git branches, commits, remotes, conflicts, hooks, signing, releases, PR/MR workflows. Triggers: 'git', 'commit', 'branch', 'merge', 'rebase', 'tag', 'push', 'PR', 'MR', 'gh', 'glab'.

majiayu000 Bundle

Reload behavioral guidelines and audit recent actions for compliance

majiayu000 Bundle

Financial ledger - transactions, audit trails. Use when tracking money.

majiayu000 Bundle

Read-only audit of `.tex`, `.qmd`, or `.md` text for AI-voice tells — boilerplate transitions ("Moreover", "Furthermore", "It is important to note that"), AI-cliché lexicon ("delve", "navigate the complexities", "tapestry", "robust framework"), em-dash overuse, symmetric paragraph shapes, tricolon abuse, hedging stacking, "not only X but also Y" frames, and formulaic openers. Produces a report; does NOT rewrite. Use when user says "humanize", "does this sound like AI?", "check for AI tells", "de-AI this draft", "remove AI voice", "audit my prose for sycophancy", or before journal submission / posting a working paper.