Security

autohandai Skill

Staff-engineer-level code review delivering 10 prioritized actionable findings across architecture, security, performance, and maintainability

gl0bal01 Bundle

Rapid static assessment, classification, and prioritization of malware samples. Use for the first look at any unknown file — hashes, file type, packing, imports, strings, initial IOCs, threat level, and the decision on which deep-analysis phase comes next. Claude runs the static tooling on the host itself; the sample is never executed.

gl0bal01 Skill

Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.

gl0bal01 Bundle

Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional delivery.

factory-ai-skills Skill

Scan code changes for security vulnerabilities using STRIDE threat modeling, validate findings for exploitability, and output structured results for downstream patch generation. Supports PR review, scheduled scans, and full repository audits.

extremeclarity Skill

Checks whether a set of options is well-constructed.

arize-ai-openinference Skill

Review Java OpenInference instrumentation code for correctness and completeness. Use this skill when reviewing a Java instrumentor package — whether it's a new instrumentor, a PR that modifies one, or when the user asks to audit/review/check an existing instrumentor's code quality. Trigger on phrases like "review the instrumentor", "check the Java code", "audit the package", "is this instrumentor correct", or any request to validate an OpenInference Java instrumentation package against project standards.

arize-ai-openinference Skill

Review Python OpenInference instrumentation code for correctness and completeness. Use this skill when reviewing a Python instrumentor package — whether it's a new instrumentor, a PR that modifies one, or when the user asks to audit/review/check an existing instrumentor's code quality. Trigger on phrases like "review the instrumentor", "check the code", "audit the package", "is this instrumentor correct", or any request to validate an OpenInference Python instrumentation package against project standards.

blackbearhq Skill

Scans staged or committed changes for leaked secrets (Stripe keys, .env files, API tokens, private keys). Auto-invoke before commit, before PR creation, or when user mentions secret, leak, credential, or API key.

blackbearhq Skill

Enforces Stripe integration best practices for webhook handling, idempotency, signature verification, and test vs live mode safety. Auto-invoke on any file touching Stripe webhooks, subscriptions, payments, checkout, or when user mentions Stripe, webhooks, webhook secret, idempotency, or subscription lifecycle.

rubencr14 Skill

Production-ready Python backend development with FastAPI. Use this skill whenever the user is building a backend API, structuring a Python service, designing domain layers, creating repositories, setting up dependency injection, writing Dockerfiles, configuring CI pipelines, implementing tests, or making any architectural decision about a Python backend. Covers light DDD, SOLID principles, FastAPI patterns, Pydantic validation, structured logging, container security, and testing strategy. Every feature must include its corresponding tests.

azat-io Bundle

Evaluate technical options with evidence and choose an approach. Use when requirements are fuzzy, multiple technical approaches exist, or change affects architecture, API, data, or security

noahjenkins Skill

Automate Dependabot PR merging safely, align branch protection to current CI jobs, and remediate stored-XSS output sinks. Use when asked to set up Dependabot auto-merge, harden branch protection for CI, or fix output-encoding vulnerabilities in URL composition, templated script output (e.g. JSON-LD), or RSS/XML interpolation. Works with any GitHub-hosted repository.

pluginagentmarketplace Bundle

Retrofit, OkHttp, REST APIs, JSON serialization, network security.

lirielgozi Bundle

Implement authentication for web applications with TypeScript frontends and Python backends. Use for: OAuth 2.1/OIDC with PKCE, social login (Google, Apple, Facebook, GitHub), passkeys/WebAuthn/FIDO2, MFA (TOTP, hardware keys, push notifications), magic links, password authentication with Argon2id, session management (JWT/cookies), CSRF/XSS protection. Includes crypto application requirements (CCSS, step-up auth, withdrawal protection). All implementations follow OWASP ASVS 5.0 and current security best practices.

marckohlbrugge Skill

Build and review Rails webhook systems with safe delivery, retries, observability, and tenant-aware security controls. Use when adding webhook endpoints, outbound deliveries, retry logic, or webhook admin tooling.

marckohlbrugge Skill

Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.

awrshift Skill

Audit MEMORY.md against the memory discipline — oversized sections, settled multi-session patterns that belong in knowledge/concepts/, stacked chronicle blocks, stale entries. Produces a move plan as a table for approval, then executes the approved moves atomically. Use when the SessionStart hook reports a tripped cap, when PreCompact blocks on an oversized cache, or when the user says "/memory-kit:memory-audit", "audit memory", "проверь память", "почисти память". Refuses only when no cap is tripped AND no settled-pattern candidate exists.

awrshift Skill

End-of-session ritual — audit today's patterns against accumulated memory, propose promotions, refresh MEMORY.md, and write the session handoff. Use when the user says "/memory-kit:close-session", "закрой сессию", "закрываем", "we're done for today", "wrap up".

superlines Skill

Audit pages against the GEO best practices checklist. Use when reviewing content for AI search readiness, ensuring pages follow Generative Engine Optimization principles, or preparing content for better visibility in ChatGPT, Perplexity, and Google AI Mode.

imehr Bundle

Railway.com deployment and management - deployment, logs, migrations, troubleshooting, monorepo strategies, security, and CLI reference. Use when deploying to Railway, configuring services, managing environment variables, or debugging deployment issues.

mahmutka Bundle

Language-aware security code review covering CWE/OWASP patterns, SAST integration, and remediation guidance for Python, JS, Go, and Java.

mahmutka Bundle

Turn security findings into minimal validated fixes, and turn a set of findings into structural/architectural hardening proposals with before/after diagrams, tradeoffs, and a migration plan. Goes beyond per-finding patches to systemic improvement.

mahmutka Bundle

Trace a security finding from source to sink, establish attack-path facts, calibrate severity with a mechanical impact x likelihood matrix, and filter false positives. Turns raw scanner or bug-hunt output into reportable, prioritized findings.

anshumanbh Bundle

Validate Cross-Site Scripting (XSS) vulnerabilities including Reflected, Stored, and DOM-based XSS. Test by injecting script payloads into user-controlled inputs and observing if they execute in browser context. Use when testing CWE-79 (XSS), CWE-80 (Basic XSS), CWE-81 (Error Message XSS), CWE-83 (Attribute XSS), CWE-84 (URI Scheme XSS), CWE-85 (Doubled Character XSS), CWE-86 (Invalid Character XSS), CWE-87 (Alternate XSS Syntax), or related XSS findings.

propstreet Bundle

Multi-angle parallel audit of a large PR or branch before merge. Dispatches one capable subagent per angle (matched to the changed surface), each anchored to the repo's own conventions and producing a uniform Blockers / Important / New-concepts-verdict / Verified-clean report; the orchestrator verifies every candidate against current code and synthesizes one merge-readiness verdict. Use when a PR spans multiple subsystems, when you worry it introduces new concepts where patterns already exist, or when asked to "audit before merge", "review from every angle", "is this safe to merge".

mesca Skill

Apply security best practices for Python applications. Use when handling secrets, validating user input, preventing injection attacks, managing dependencies, or reviewing code for vulnerabilities.

antoninolorenzo Skill

Discover and exploit directory traversal and local file inclusion vulnerabilities. Load when the target exposes file-serving, download, preview, or template endpoints, or when a parameter appears to reference a filename or path.

antoninolorenzo Skill

Perform initial HTTP/HTTPS reconnaissance on a target to identify the web stack, exposed endpoints, security headers, and surface-level misconfigurations. Load at the start of any web-facing task before running exploitation tools.

rudi-bruchez Bundle

Audits and hardens PostgreSQL security including role management, pg_hba.conf authentication, SSL/TLS configuration, row-level security policies, and audit logging. Use when performing security reviews, setting up new instances, responding to security incidents, or preparing for compliance audits.

ddnetters Skill

Slite knowledge base API — ask questions, search notes, retrieve content, manage users and groups, and audit knowledge health via the REST API

argythana Bundle

Use this skill when the user wants a production-grade review of Python code, a Python pull request, or a Python-focused diff. Check architecture, security, code quality, tests, documentation, deployment risk, and code-documentation consistency. Trigger on requests like "review this Python PR", "audit this diff", "check code quality", or "give me a fix plan". Do NOT use it for non-Python code review, writing new features, dependency-only changes, pytest-suite-specific audits where `pytest-suite-review` is a better fit, or iterative review-fix-rerun loops where `code-review-loop` is a better fit.

argythana Skill

Use this skill when the user wants an iterative `code-review` loop over Python changes: review a Python diff, PR, branch, or commit range with `code-review`, fix the actionable Critical, High, and Moderate findings, run the relevant checks and tests, and repeat until 5 consecutive clean PASS reviews, `insufficient evidence`, or max cycles. Trigger on "run code-review until clean", "keep reviewing and fixing this Python PR until it passes", or "fix the code-review findings and rerun review until acceptable". If the target repo, diff, branch, commit, or commit range is referenced but unavailable, ask after routing. Do NOT use for a single review-only pass; use `code-review`. Do NOT use for pytest-suite-specific audit loops; use `pytest-suite-review-loop`. Do NOT use for implementing a task against Acceptance Criteria; use `task-implementation-loop`. Do NOT use for non-Python code, dependency-only changes, or writing new features from scratch.

argythana Bundle

Use this skill when the user asks for a verifiable literature review or peer-reviewed citations for an ADR, design doc, paper, or technical decision, with prompts like "literature review on X", "find papers on X", "survey the literature on X", or "cite peer-reviewed sources for X". Enforce structural verification: every emitted citation needs metadata lookup, full-text retrieval, a supporting quote with locator, byte-for-byte author attribution, Negative Findings, and a self-audit table. Do NOT use it for single-URL summarization, drafting the surrounding ADR, casual citation pointers where verification is explicitly waived, fictional references, or unsourced factual questions.

manolakis Skill

Identify security weaknesses in code and dependencies using OWASP Top Ten as reference

hyhmrright Bundle

Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where should I focus testing", "onboarding review", "logic overview before we ship", "give me a health overview of this module". SCOPE RULE: prefer multi-file; also trigger for a single module when the user explicitly uses "health check", "health overview", or "logic health" — a concrete failure uses logic-locate; two versions uses logic-diff; explaining a path uses logic-explain; "fix everything" uses logic-fix-all. Do NOT trigger for: style/architecture-only audits, security-only scans, performance-only audits.