Security

lirielgozi Bundle

Implement authentication for web applications with TypeScript frontends and Python backends. Use for: OAuth 2.1/OIDC with PKCE, social login (Google, Apple, Facebook, GitHub), passkeys/WebAuthn/FIDO2, MFA (TOTP, hardware keys, push notifications), magic links, password authentication with Argon2id, session management (JWT/cookies), CSRF/XSS protection. Includes crypto application requirements (CCSS, step-up auth, withdrawal protection). All implementations follow OWASP ASVS 5.0 and current security best practices.

marckohlbrugge Skill

Build and review Rails webhook systems with safe delivery, retries, observability, and tenant-aware security controls. Use when adding webhook endpoints, outbound deliveries, retry logic, or webhook admin tooling.

marckohlbrugge Skill

Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.

awrshift Skill

Audit MEMORY.md against the memory discipline — oversized sections, settled multi-session patterns that belong in knowledge/concepts/, stacked chronicle blocks, stale entries. Produces a move plan as a table for approval, then executes the approved moves atomically. Use when the SessionStart hook reports a tripped cap, when PreCompact blocks on an oversized cache, or when the user says "/memory-kit:memory-audit", "audit memory", "проверь память", "почисти память". Refuses only when no cap is tripped AND no settled-pattern candidate exists.

awrshift Skill

End-of-session ritual — audit today's patterns against accumulated memory, propose promotions, refresh MEMORY.md, and write the session handoff. Use when the user says "/memory-kit:close-session", "закрой сессию", "закрываем", "we're done for today", "wrap up".

superlines Skill

Audit pages against the GEO best practices checklist. Use when reviewing content for AI search readiness, ensuring pages follow Generative Engine Optimization principles, or preparing content for better visibility in ChatGPT, Perplexity, and Google AI Mode.

imehr Bundle

Railway.com deployment and management - deployment, logs, migrations, troubleshooting, monorepo strategies, security, and CLI reference. Use when deploying to Railway, configuring services, managing environment variables, or debugging deployment issues.

mahmutka Bundle

Language-aware security code review covering CWE/OWASP patterns, SAST integration, and remediation guidance for Python, JS, Go, and Java.

mahmutka Bundle

Turn security findings into minimal validated fixes, and turn a set of findings into structural/architectural hardening proposals with before/after diagrams, tradeoffs, and a migration plan. Goes beyond per-finding patches to systemic improvement.

mahmutka Bundle

Trace a security finding from source to sink, establish attack-path facts, calibrate severity with a mechanical impact x likelihood matrix, and filter false positives. Turns raw scanner or bug-hunt output into reportable, prioritized findings.

anshumanbh Bundle

Validate Cross-Site Scripting (XSS) vulnerabilities including Reflected, Stored, and DOM-based XSS. Test by injecting script payloads into user-controlled inputs and observing if they execute in browser context. Use when testing CWE-79 (XSS), CWE-80 (Basic XSS), CWE-81 (Error Message XSS), CWE-83 (Attribute XSS), CWE-84 (URI Scheme XSS), CWE-85 (Doubled Character XSS), CWE-86 (Invalid Character XSS), CWE-87 (Alternate XSS Syntax), or related XSS findings.

propstreet Bundle

Multi-angle parallel audit of a large PR or branch before merge. Dispatches one capable subagent per angle (matched to the changed surface), each anchored to the repo's own conventions and producing a uniform Blockers / Important / New-concepts-verdict / Verified-clean report; the orchestrator verifies every candidate against current code and synthesizes one merge-readiness verdict. Use when a PR spans multiple subsystems, when you worry it introduces new concepts where patterns already exist, or when asked to "audit before merge", "review from every angle", "is this safe to merge".

mesca Skill

Apply security best practices for Python applications. Use when handling secrets, validating user input, preventing injection attacks, managing dependencies, or reviewing code for vulnerabilities.

antoninolorenzo Skill

Discover and exploit directory traversal and local file inclusion vulnerabilities. Load when the target exposes file-serving, download, preview, or template endpoints, or when a parameter appears to reference a filename or path.

antoninolorenzo Skill

Perform initial HTTP/HTTPS reconnaissance on a target to identify the web stack, exposed endpoints, security headers, and surface-level misconfigurations. Load at the start of any web-facing task before running exploitation tools.

rudi-bruchez Bundle

Audits and hardens PostgreSQL security including role management, pg_hba.conf authentication, SSL/TLS configuration, row-level security policies, and audit logging. Use when performing security reviews, setting up new instances, responding to security incidents, or preparing for compliance audits.

ddnetters Skill

Slite knowledge base API — ask questions, search notes, retrieve content, manage users and groups, and audit knowledge health via the REST API

argythana Bundle

Use this skill when the user wants a production-grade review of Python code, a Python pull request, or a Python-focused diff. Check architecture, security, code quality, tests, documentation, deployment risk, and code-documentation consistency. Trigger on requests like "review this Python PR", "audit this diff", "check code quality", or "give me a fix plan". Do NOT use it for non-Python code review, writing new features, dependency-only changes, pytest-suite-specific audits where `pytest-suite-review` is a better fit, or iterative review-fix-rerun loops where `code-review-loop` is a better fit.

argythana Skill

Use this skill when the user wants an iterative `code-review` loop over Python changes: review a Python diff, PR, branch, or commit range with `code-review`, fix the actionable Critical, High, and Moderate findings, run the relevant checks and tests, and repeat until 5 consecutive clean PASS reviews, `insufficient evidence`, or max cycles. Trigger on "run code-review until clean", "keep reviewing and fixing this Python PR until it passes", or "fix the code-review findings and rerun review until acceptable". If the target repo, diff, branch, commit, or commit range is referenced but unavailable, ask after routing. Do NOT use for a single review-only pass; use `code-review`. Do NOT use for pytest-suite-specific audit loops; use `pytest-suite-review-loop`. Do NOT use for implementing a task against Acceptance Criteria; use `task-implementation-loop`. Do NOT use for non-Python code, dependency-only changes, or writing new features from scratch.

argythana Bundle

Use this skill when the user asks for a verifiable literature review or peer-reviewed citations for an ADR, design doc, paper, or technical decision, with prompts like "literature review on X", "find papers on X", "survey the literature on X", or "cite peer-reviewed sources for X". Enforce structural verification: every emitted citation needs metadata lookup, full-text retrieval, a supporting quote with locator, byte-for-byte author attribution, Negative Findings, and a self-audit table. Do NOT use it for single-URL summarization, drafting the surrounding ADR, casual citation pointers where verification is explicitly waived, fictional references, or unsourced factual questions.

manolakis Skill

Identify security weaknesses in code and dependencies using OWASP Top Ten as reference

hyhmrright Bundle

Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where should I focus testing", "onboarding review", "logic overview before we ship", "give me a health overview of this module". SCOPE RULE: prefer multi-file; also trigger for a single module when the user explicitly uses "health check", "health overview", or "logic health" — a concrete failure uses logic-locate; two versions uses logic-diff; explaining a path uses logic-explain; "fix everything" uses logic-fix-all. Do NOT trigger for: style/architecture-only audits, security-only scans, performance-only audits.

saturate Bundle

Performs comprehensive codebase audit checking architecture, tech debt, security vulnerabilities, test coverage, documentation, dependencies, and maintainability. Use when auditing a project, assessing codebase health, running security scans, checking for vulnerabilities, reviewing code quality, analyzing tech debt, or asked to audit/analyze the entire codebase.

hughyau Bundle

批评与自我批评：在工作完成、阶段验收、收到批评或同类错误反复出现时，对成果和过程做诚实、具体、基于事实的审视，输出可执行的改进项，并处理外来批评而不辩解。触发信号包括 review、复盘、审查、"帮我看看有没有问题"、"你确定吗"；任务刚开始或只是单步查询时不触发。 English: Criticism and self-criticism. After delivery, at a review checkpoint, on receiving criticism, or when the same mistake recurs, examine the result and the process honestly and concretely, produce actionable fixes, and accept valid criticism without defensiveness. Triggers include review, retrospective, audit, "check this for problems", "are you sure"; skip at the start of a task or for one-step lookups.

u1pns Skill

Acts as a Senior Security Engineer and Code Auditor. Use this skill when the user asks to review code, audit security, or check for best practices. Triggers: 'review code', 'check for bugs', 'security audit', 'code smells', 'refactor suggestion'.

zbruhnke Skill

Review code changes for quality, security, and best practices. Use when reviewing staged changes, pull requests, or specific files before merging.

epochdevs Skill

Audit an Exhibit A study definition by comparing it against the original reference image and transcript. Use when the user wants to review, audit, or fix a definition to match the Exhibit A source material. Checks for: visual match, data-driven approach (no hardcoded values), correct data source/range, chart type accuracy, and proper labeling.

bmad-code-org Bundle

Audit NFR evidence for performance, security, reliability, and maintainability. Use when implementation evidence exists and the user says "audit NFR evidence", "audit NFRs", or "evaluate non-functional requirements"

photoszzt Skill

This skill runs a comprehensive review of a TLA+ specification including parsing, symbol extraction, smoke testing, and best practices checklist. It should be used when the user asks to "review my spec", "audit my spec", "is my spec good", "spec quality check", "comprehensive review", "best practices check", "check spec quality", "spec review", "analyze my spec", "what's wrong with my spec", "review my TLA+ spec", "spec health check", "validate my specification", or wants a full quality assessment.

pluginagentmarketplace Bundle

JavaScript security best practices and vulnerability prevention.

bkircher Skill

Scan and triage Snyk security findings in local repositories and container images. Use for Snyk vulnerability reviews, scan summaries, severity filtering, and remediation planning.

martin-janci Bundle

Review a pull request diff for bugs, security issues, and code quality. Use when reviewing PRs or diffs.

rejectall Bundle

基于《中华人民共和国个人信息保护法》（PIPL）及GB/T 35273-2020对隐私政策/隐私协议进行全面合规审查。当用户需要审查隐私政策合规性、检查隐私协议是否符合个人信息保护法、或对隐私协议进行整改优化时使用此技能。触发词：隐私政策审查、隐私协议合规、个人信息保护法审查、PIPL合规、隐私协议整改。

hardw00t Bundle

iOS mobile application penetration testing with Frida and Objection on jailbroken or non-jailbroken devices. Use for static + dynamic analysis of IPAs, SSL pinning / jailbreak / biometric bypass, keychain & local-storage extraction, network interception, and OWASP MASTG iOS assessments. Triggers on requests to pentest iOS apps, analyze IPAs, bypass iOS security controls, or produce MASTG-aligned findings.

hardw00t Bundle

Router skill for API penetration testing across REST, GraphQL, gRPC, and WebSocket. Covers OWASP API Top 10 (2023) including BOLA/BFLA/BOPLA, JWT attack chains, GraphQL introspection abuse, and mass assignment. Invoke when the user asks to pentest an API, analyze OpenAPI/Swagger, test auth/authorization, fuzz endpoints, or find API vulnerabilities.

hardw00t Bundle

Software Composition Analysis: find vulnerable dependencies, correlate CVE/GHSA/OSV across ecosystems, generate CycloneDX/SPDX SBOMs, assess license compliance, and run reachability-aware triage to suppress unexploitable findings. Use when scanning package dependencies (npm, PyPI, Maven, Cargo, Go, RubyGems, Composer), reviewing PR lockfile diffs, generating SBOMs, auditing licenses, hunting malicious packages, or auditing the software supply chain. Triggers on requests to scan dependencies, check vulnerable packages, generate SBOM, license compliance, typosquat/dependency-confusion review, or reachability-based vuln triage.