Security

advisely Skill

OWASP Top 10 security checklist, vulnerability scanning, and security hardening procedures for web applications

profsynapse Bundle

Testing strategies, test pyramid guidance, and quality assurance patterns for PACT Test phase. Use when: designing test suites, implementing unit tests, integration tests, E2E tests, performance testing, security testing, or determining test coverage priorities. Triggers on: test design, unit testing, integration testing, E2E testing, test coverage, test pyramid, mocking, fixtures, performance testing, test phase.

christianearle01 Skill

Automated security validation for OWASP Top 10, CVE detection, and secrets scanning with confidence-scored vulnerability reports.

deepseek-ai Bundle

Create, restructure, review, audit, or migrate DeepSeek Harness Markdown documentation, package READMEs, and the documentation website using audience-first hierarchy, kind-mapped YAML metadata, bilingual line alignment, summary/contents navigation, progressive user-to-developer detail, executed-operation fact-checking, and repository validation. Use for new or revised DSH docs, docs-tree organization, documentation-quality audits and budgets, website page publishing, and bilingual documentation structure changes.

potpie-ai Skill

Use before writing, modifying, reviewing, refactoring, or testing code so repo/project preferences surface: error handling, file structure, frameworks, logging, dependency choices, testing, security, API style, and naming. Also use after code work when a reusable project preference should be recorded.

sergebulaev Skill

Repurpose content into a native TikTok script and caption. Take a LinkedIn post, blog, newsletter, or X thread that worked elsewhere and rebuild it as a spoken script: hook in the first second, every line sayable in one breath, open on the payoff, a trend angle where it fits, plus a caption, published via Publora on approval. Adapts content across platforms. Not for a fresh hook (use tt-hook-scripter), not the caption only (use tt-caption-writer), not auditing a script (use tt-humanizer --mode audit).

getsentry Bundle

Sentry-specific security review based on real vulnerability history. Use when reviewing Sentry endpoints, serializers, or views for security issues. Trigger keywords: "sentry security review", "check for IDOR", "access control review", "org scoping", "cross-org", "security audit endpoint".

advisely Skill

Detect silent failures in status, health, detection, and initialization code. Catches hardcoded status values, swallowed errors, stale data, no-op handlers, and single-path detection that corrupt real system state.

highnoonoffice Bundle

Headless Ghost publishing. Write, audit, and automate your entire Ghost operation from your AI workflow — 17 workflows covering article publishing, batch imports, site health audits, email performance, bulk excerpt push, and GSC indexing repair. Admin API only. No browser, no dashboard, no context switching.

bejranonda Skill

Comprehensive OWASP security guidelines, secure coding patterns, vulnerability prevention strategies, and remediation best practices for building secure applications

navikt Bundle

OWASP Top 10:2025 kodenivå-mønstre for Kotlin, Go, Java og Node.js — tilgangskontroll, forsyningskjede, injeksjon og feilhåndtering

navikt Bundle

Bruk før commit, push eller pull request for å sjekke at koden er trygg å merge

captaincrouton89 Skill

Identify and remediate vulnerabilities through systematic code analysis. Use when performing security assessments, pre-deployment reviews, compliance validation (OWASP, PCI-DSS, GDPR), investigating known vulnerabilities, or post-incident analysis.

navikt Bundle

Sikkerhetssjekk for macOS-utviklermaskiner — brannmur, SSH, Git, hemmeligheter, nettverk og Nav-plattformverktøy

anysiteio Bundle

Read-only static security audit of Claude Code skills, commands, and plugins. Analyzes SKILL.md frontmatter, body content, supporting scripts, and hooks for security risks. Use this skill when the user asks to "audit a skill", "review skill security", "check SKILL.md for risks", "scan a plugin for dangerous patterns", "verify skill safety", "check skill permissions", "analyze skill hooks", "audit a skill from GitHub", "review a remote skill", "check a skill by URL", or needs a security assessment of any Claude Code skill, command, or plugin before enabling it.

anysiteio Skill

Read-only data quality audit of the connected CRM - field completeness per mapped property, duplicate candidates, stale records, enrichability estimate. Produces a report and a concrete fix plan, never writes anything - run it first when you don't yet know what's broken; the actual fixing happens in anysite-crm-enrich. Use when the user asks "what's the state of my CRM", wants a data quality report, duplicate check, or a safe first run after connecting a CRM. Requires an active CRM connection.

anysiteio Skill

Deep competitive intelligence combining web scraping, LinkedIn data, social media monitoring, leadership analysis, GitHub activity, Glassdoor sentiment, and community insights. Analyzes founders/C-level profiles, tracks real-time signals vs quarterly reports, and creates comprehensive competitor profiles. Use for a DEEP DOSSIER ON ONE named competitor - leadership/founder profiling, product/pricing teardown, strategic threat assessment of a single company. For tracking a landscape of several competitors over time use anysite-competitor-intelligence; for CRM-tied displacement lists use anysite-crm-competitor-intel.

damusix Bundle

Comprehensive PostgreSQL reference for developers and DBAs covering versions 14–18. Use whenever the user asks about PostgreSQL syntax, DDL/DML/DQL, joins, LATERAL, CTEs, window functions, GROUPING SETS, DISTINCT ON, RETURNING, ON CONFLICT, PL/pgSQL, functions, procedures, triggers, views, materialized views, indexes (B-tree/GIN/GiST/BRIN/Hash/Bloom), MVCC, VACUUM, autovacuum, WAL, TOAST, partitioning, replication (streaming/logical), backup, PITR, HA (Patroni/repmgr), pgBouncer, EXPLAIN ANALYZE, RLS, roles, extensions (pgvector, PostGIS, TimescaleDB, Citus, pg_trgm, pg_cron), JSON/JSONB, full-text search, UUID, timestamptz, COPY, system catalogs, collations, large objects, cursors, GUC, or any Postgres administration, performance, security, replication, backup, or recovery topic.

damusix Bundle

Use when writing or reviewing PostgreSQL/PL-pgSQL, designing table schemas, writing functions and procedures, building migrations, defining domains, or architecting a Postgres application database. Also use when writing RAISE EXCEPTION patterns, BEFORE/AFTER triggers for cross-table constraints, base/subtype hierarchies, composite key designs, row-level security policies, or idempotent DDL scripts. If you are touching Postgres for an application database, use this skill. PostgreSQL-specific — examples will not run on other engines.

danieldekay Bundle

Diagnose a machine and set up a developer environment with VS Code, GitHub Copilot, Node.js, and Python. Supports use-case-specific tracks: data science (Python/R), AI-assisted development, web development, and general programming. Installs packages per use case with reporting from Markdown to Quarto. Use when: setting up a new machine, onboarding a developer, bootstrapping a dev environment, data science environment, R setup, Python data science, Quarto, Jupyter, AI dev environment, checking what is installed, detecting package managers, checking user permissions, OS detection, Windows/Mac/Linux setup, environment audit.

damusix Bundle

Review and improve your SKILL.md with actionable recommendations. Reads skill bundle, validates syntax and references, explains rubric, shows before/after scores. Use when reviewing skill quality, improving a SKILL.md file, checking scoring dimensions and quick wins, auditing progressive disclosure and orphaned bundle files, generating improvement recommendations, running a post-edit quality audit, creating approval-gated change proposals, or automating the skill review workflow. For the full optimization cycle (review + evals + improve), use `optimize-skill-performance-and-instructions`.

unix2dos Bundle

Only invoke when explicitly requested via "UI审查"、"设计审计"、"@ui-ux-auditor" or "design audit". Do NOT auto-trigger.

unix2dos Bundle

Use when reviewing Go code for performance, concurrency safety, security vulnerabilities, or readability issues

micaelmalta Bundle

Review code and design for security vulnerabilities and insecure patterns. Use when the user asks for a security review, security audit, find vulnerabilities, or when assessing auth, crypto, input handling, or exposure of sensitive data.

superamped Skill

Use this skill to run a scored 53-point conversion audit covering customer focus, narrative, copy, design, calls to action, and proof. Trigger it when a landing, sales, product, or ad destination page needs diagnosis, pre-launch review, or prioritized conversion fixes.

el-feo Bundle

Comprehensive Ruby and Rails code review using Sandi Metz rules and SOLID principles. Analyzes changed files in current branch vs base branch, runs rubycritic and simplecov, identifies OOP violations, Rails anti-patterns, security issues, code smells, and test coverage gaps. Outputs REVIEW.md with VSCode-compatible file links. Use when reviewing Ruby/Rails code, conducting code reviews, checking for design issues, pull request review, code quality analysis, or when user mentions Sandi Metz, POODR, 99 Bottles, SOLID, Law of Demeter, or "Tell Don't Ask".

ericosiu Bundle

Design, analyze, and optimize cold outbound email campaigns for Instantly. Handles end-to-end ICP definition, expert panel scoring (recursive to 90+), sequence copywriting, infrastructure audit, capacity planning, and implementation docs. Use when asked to build cold outbound sequences, optimize cold email, analyze outbound campaigns, build sales sequences, build Instantly sequences, create cold outbound strategies, or design email campaigns. Supports both "start from scratch" and "optimize existing" modes.

b-open-io-bsv-skills Bundle

This skill should be used when the user asks to "review a script template", "audit a template", "check template implementation", "validate ts-templates code", or mentions reviewing BitCom templates like AIP, MAP, SIGMA, BAP. Validates ScriptTemplate implementations against best practices.

endorlabs Skill

Main Endor Labs security router. Use when the user says "endor", "endor labs", or asks a general security question without specifying a particular endor command. Routes ambiguous requests like "check my security", "help with this dependency", or "what security tools are available" to the right specialized skill. Do NOT use when the user names a specific command like /endor-scan, /endor-check, /endor-fix, etc. — those skills handle themselves directly.

endorlabs Skill

Remediate security vulnerabilities by finding safe upgrade paths. Use when the user says "fix this vulnerability", "how do I fix CVE-XXXX", "remediate this finding", "patch this vuln", "endor fix", or wants step-by-step fix instructions for a specific CVE, finding, or vulnerable package. Can apply fixes automatically. Do NOT use for general scanning (/endor-scan) or just viewing vulnerability info (/endor-explain).

endorlabs Skill

Quick reference for all available Endor Labs commands. Use when the user says "endor help", "what commands are available", "endor usage", "what can endor do", or wants to discover available security scanning capabilities. Do NOT use when the user already knows which specific command they want — route to that skill directly.

endorlabs Skill

Fast security scan of the current repository using Endor Labs. Use when the user says "scan my code", "quick scan", "endor scan", "scan this repo", "run a security scan", or wants a rapid overview of vulnerabilities, secrets, and SAST issues. Also handles incremental PR scans when user mentions "just my changes" or "PR scan". Do NOT use for deep reachability analysis (/endor-scan-full) or checking a single package (/endor-check).

endorlabs Skill

Evaluate open source package health before adoption. Use when the user says "should I use this package", "is lodash well-maintained", "endor score express", "package health", "compare lodash vs underscore", "evaluate this dependency", or wants activity, popularity, security, and quality scores. Do NOT use for checking known CVEs in a package (/endor-check) or scanning the whole repo (/endor-scan).

endorlabs Skill

Create and manage Endor Labs security policies for automated enforcement. Use when the user says "create a policy", "block critical vulns", "endor policy", "security gate", "enforcement rules", "exception policy", or wants to define rules for blocking PRs, requiring reviews, or enforcing security standards. Do NOT use for one-time PR review (/endor-review) or viewing findings (/endor-findings).

endorlabs Skill

Pre-PR security review of your current branch or git diff. Use when the user says "review my changes", "ready to merge", "pre-PR check", "security review before PR", "endor review", or is about to create a pull request. Runs dependency checks, SAST, secrets detection, and license compliance as a security gate. Do NOT use for scanning repos outside the current branch (/endor-scan) or checking individual packages (/endor-check).

endorlabs Skill

Get detailed information about a specific CVE or security finding. Use when the user says "what is CVE-2024-XXXXX", "explain this vulnerability", "tell me about GHSA-...", "endor explain", "finding details", or wants to understand severity, impact, attack vectors, and affected versions for a specific issue. Do NOT use for fixing a vuln (/endor-fix) or listing all findings (/endor-findings).