Security

majiayu000 Bundle

Conduct a dependency audit for a project — checking for security vulnerabilities, license compliance issues, outdated packages, and transitive dependency risk. Use when asked to audit dependencies, review package security, check license compliance, assess dependency health, or produce a vulnerability report. Produces a vulnerability findings table, license compliance matrix, update priority matrix, dependency health score, and 30-day remediation plan.

majiayu000 Bundle

Generates production-ready multi-stage Dockerfiles and .dockerignore files with BuildKit features, pnpm monorepo support, OCI labels, and security hardening. Use when creating or writing Dockerfiles for Node.js, Python, Go, Java, or Rust. Does not validate (use dockerfile-validator).

majiayu000 Bundle

Analyzes volatile memory dumps to detect malware, rootkits, and security breaches in digital forensics.

majiayu000 Bundle

Perform code reviews using GitHub Copilot CLI to identify bugs, security vulnerabilities, performance issues, and code quality problems. Use when the user asks to review code, check for issues, security audit, or before committing. Requires Copilot CLI installed.

majiayu000 Bundle

Review a PR diff for quality, security, and correctness

majiayu000 Bundle

Manage Cloudflare R2 buckets, lifecycle, and signed URLs. Use for low-egress object storage and media delivery.

majiayu000 Bundle

Code review specialist for quality, security, and best practices

majiayu000 Bundle

This skill should be used when implementing "multi-layer validation", "comprehensive error handling", "input sanitization", "security testing", "data validation layers", "fault tolerance", or when building robust systems with multiple validation checkpoints.

majiayu000 Bundle

Perform systematic code review following project standards. Use when reviewing pull requests, analyzing code quality, checking for patterns compliance, or auditing code changes. Invoked by: "code review", "review PR", "review changes", "audit code".

majiayu000 Bundle

Implement centralized audit logging and SIEM integration. Configure log retention and security monitoring. Use when implementing audit trail requirements.

majiayu000 Bundle

Implement iOS authentication patterns including Sign in with Apple (ASAuthorizationAppleIDProvider, ASAuthorizationController, ASAuthorizationAppleIDCredential), credential state checking, identity token validation, ASWebAuthenticationSession for OAuth and third-party auth flows, ASAuthorizationPasswordProvider for AutoFill credential suggestions, and biometric authentication with LAContext. Use when implementing Sign in with Apple, handling Apple ID credentials, building OAuth login flows, integrating Password AutoFill, checking credential revocation state, or validating identity tokens server-side.

majiayu000 Bundle

Guide for mobile game security on Android and iOS platforms. Use this skill when working with Android/iOS reverse engineering, mobile game hacking, APK analysis, root/jailbreak detection bypass, or mobile anti-cheat systems.

majiayu000 Bundle

Process for conducting system security reviews and remediating vulnerabilities. Follow the phases sequentially.

majiayu000 Bundle

Manage skills through three operations: Create, Update, and Validate.

majiayu000 Bundle

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.

majiayu000 Bundle

Perform a maximally picky and professional code review of recent changes. Reviews all code added since the last review, checking for thread safety, async safety, security vulnerabilities, data integrity, test quality, and code smells. Use before committing significant changes.

majiayu000 Bundle

Data validation strategies for stock_picker_bot using Pydantic models and SQLAlchemy constraints. Covers API input validation, stock data validation, and database integrity.

majiayu000 Bundle

Expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (current) and v4.0. Use this skill whenever a user asks about PCI DSS, payment card security, cardholder data protection, CDE scoping, SAQ types (A, A-EP, B, B-IP, C, C-VT, P2PE, D), ROC, AOC, QSA assessments, ASV scans, merchant levels, service provider levels, network segmentation, penetration testing, tokenisation, encryption of PAN data, or any of the 12 PCI DSS requirements. Also trigger for questions like "are we PCI compliant?", "how do I scope my CDE?", "which SAQ applies to us?", "what changed in PCI DSS v4.0?", "how do I prepare for a QSA audit?", or any request involving payment data security, cardholder data environment, or PCI certification readiness.

majiayu000 Bundle

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

majiayu000 Bundle

Proactive threat hunting, IOC extraction, MITRE ATT&CK mapping, behavioral anomaly detection, log analysis correlation

majiayu000 Bundle

Audit project dependencies for risk when the user asks to check dependencies, audit packages, review dependency health, check for vulnerabilities, or assess supply chain risk

majiayu000 Bundle

Create, validate, and audit event-driven hooks for intercepting events, enforcing security patterns, and automating interventions. Use when building or reviewing hooks, implementing event handlers, or adding safety guardrails. Includes matcher patterns, action types, timeout configuration, and security enforcement. Not for manual actions, passive knowledge, or non-event-driven automation.

majiayu000 Bundle

Fetch real, current API docs and verify package versions before installing packages, calling external APIs, using SDKs, or integrating any third-party library. Triggers on npm install, pip install, package.json changes, import statements for external packages, API calls (fetch, axios, SDK methods), "integrate with", "connect to", "use X library", or debugging silent API failures where code returns 200 but produces no effect.

majiayu000 Bundle

Implement change management processes. Configure CAB reviews, change windows, and rollback procedures. Use when managing production changes.

majiayu000 Bundle

Implement disaster recovery strategies and runbooks. Configure RPO/RTO targets and failover procedures. Use when planning for business continuity.

majiayu000 Bundle

Audit performance against Core Web Vitals and performance budgets when the user asks to check performance, audit speed, or analyze web vitals

majiayu000 Bundle

Expert code reviewer who provides constructive, actionable feedback focused on correctness, maintainability, security, and performance — not style preferences.

majiayu000 Bundle

Coordinates 9 specialized audit workers (security, build, architecture, code quality, dependencies, dead code, observability, concurrency, lifecycle). Researches best practices, delegates parallel audits, aggregates results into docs/project/codebase_audit.md.

majiayu000 Bundle

認証機能（Authentication Policy, MFA）の開発・修正を行う際に使用。認証ポリシー、パスワード、OTP、FIDO2、条件付き認証実装時に役立つ。

majiayu000 Bundle

Implement GDPR data protection requirements. Configure consent management, data subject rights, and privacy by design. Use when processing EU personal data.

majiayu000 Bundle

Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.

majiayu000 Bundle

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.

majiayu000 Bundle

Audit code for multi-tenant security vulnerabilities and data isolation issues

majiayu000 Bundle

Conduct threat modeling using STRIDE methodology. Identify threats, assess risks, and design security controls. Use when designing secure systems or assessing application security.

majiayu000 Bundle

Guide for implementing Spring Security with JWT authentication and role-based access control. Use this when adding security to endpoints or implementing authentication features.

majiayu000 Bundle

Creates, updates, validates, and displays the architectural DNA of a project through two shared documents: docs/specs/architecture.md (technology stack, architectural rules, security constraints, AI guardrails) and docs/specs/ontology.md (domain glossary / Ubiquitous Language). Use BEFORE brainstorm as a project setup step, or at any point in the SDD lifecycle to validate specs/tasks against architecture principles. Triggers on 'create constitution', 'update constitution', 'constitution check', 'validate against constitution', 'project principles', 'architectural guardrails', 'setup project architecture', 'define ontology'.