Security

fujigo-software Skill

Authentication and authorization patterns for secure access control. Use when: (1) Implementing JWT authentication, (2) OAuth2/OIDC integration, (3) Building RBAC/ABAC systems, (4) Session management, (5) MFA implementation. Auto-detects: auth, jwt, oauth, oidc, rbac, abac, permission, session, token, refresh, login, password, mfa, 2fa

benjaming Skill

This skill should be used when the user wants a ranked list of the highest-leverage technical or architectural improvements to make to their project, presented as a ranking matrix. The technical counterpart to `innovate`. Triggers on requests like "elevate", "biggest tech wins", "best architectural moves", "what should I upgrade", "improvement opportunities", or "tech audit". Accepts an optional focus argument (e.g., "feedback-loop", "dx", "build speed", "testing", "observability") to constrain the search.

beshkenadze Skill

Review code for quality, security, and best practices. Use when asked to review code, find bugs, or suggest improvements.

benjaming Skill

Specialist for TypeScript backend development including Node.js servers, NestJS applications, APIs, databases (PostgreSQL, MongoDB, Redis), authentication, testing, deployment, server-side code, microservices, database queries, migrations, controllers, services, repositories, and middleware. Use for ANY work involving .ts backend files, server-side architecture, performance optimization, and backend security.

openai Bundle

Internal prototype QA helper. Use only after a Product Design prototype, URL-to-code build, or image-to-code build has a source visual target and a rendered implementation to compare before handoff. Do not use for broad UX critique, design critique, product audits, or flow reviews; route those user-facing requests to audit.

cognyai Skill

Google Ads Demand Gen audit — audience strategy, creative format diversity, creative freshness, placements, CPA vs goal

mhylle Skill

Recommend which workflow mode fits the task at hand — solo (implement-plan), small team (team-implement-plan with Implementer + Reviewer), full team (team-implement-plan-full with parallel per-phase implementers + shared Reviewer), or a dynamic workflow (the Workflow tool — deterministic parallel fan-out across tens-to-hundreds of background agents for large read/analyze/audit/research jobs, e.g. /tt-workflow-audit). Factors in task complexity, risk, parallelism, work shape (analyze vs implement), and token budget. Use when the user asks which workflow to pick, is unsure whether to go solo or team-based, mentions "which mode should I use", asks "solo or team for this", "should I use a workflow", "parallel audit", or is about to kick off execution without having chosen a mode. Triggers on "/workflow-guide", "which workflow mode", "solo or team", "pick a workflow", "dynamic workflow or team".

mhylle Bundle

Comprehensive 6-check verification framework for validating implementation quality across build, types, lint, tests, security, and diff review. This skill ensures code meets all quality gates before phase completion. Triggers on "verify implementation", "run verification", "/verification-loop", or automatically as part of implement-phase Step 2.

mhylle Bundle

Run code quality audits covering test coverage, cyclomatic complexity, module sizes, dependency structure (cycles, fan-in/out), and mutation testing. Produces a prioritized report and acts as a quality gate. Use whenever the user wants to audit code quality, check coverage, find complex or oversized modules, detect dependency cycles, run mutation tests, assess technical debt, or gate a phase on quality thresholds. Triggers on "audit code quality", "check coverage", "run mutation testing", "find complex modules", "check for cycles", "/code-quality-audit", or automatically before marking an implementation phase complete.

cognyai Skill

Audit a sending domain's deliverability — SPF, DKIM, DMARC, MX, BIMI, blocklists — with a prioritized fix order

mhylle Bundle

Adversarial code review that breaks the self-review monoculture by spawning three independent subagent personas (Saboteur, New Hire, Security Auditor) in parallel isolated contexts. Each subagent has no knowledge of the author's intent or Claude's prior conclusions — Claude cannot replicate that isolation on its own. Default mode reviews a diff (staged/unstaged, or explicit ref/file); `--codebase` mode reviews an entire repo or subtree for tech debt, attack surface, and knowledge silos. Use before merging a PR, when the user asks for a hostile/harsh/adversarial/critical/brutal/skeptical review, when the user admits fatigue after a long session, when an earlier /code-review came back too easily clean, when the user trusts a gut feeling that something is off, or when the user wants a whole-codebase audit of an inherited / unfamiliar repo. Triggers on "/adversarial-reviewer", "/adversarial-review", "adversarial review", "hostile review", "critical review", "harsh review", "review this PR harshly", "second-opinio

filipemotta Bundle

DevSecOps, security scanning, and vulnerability management. Activates when reviewing security configurations, analyzing vulnerabilities, implementing secrets management, hardening infrastructure, or discussing compliance (SOC2, PCI-DSS, HIPAA).

cygnusfear Skill

ONLY USE WHEN REPO IS USING AXIOM LOGGING. Audit Axiom logs to identify and prioritize errors and warnings, research probable causes, and flag log smells. Use when user asks to check Axiom logs, analyze production errors, investigate log issues, or audit logging patterns.

artsmc-claude-dev-agents Bundle

Deep analysis of codebase vs documentation alignment (cline-docs/). Detects drift, identifies undocumented code, extracts missing glossary terms, and provides actionable recommendations without making changes. Use this skill when the user asks "are the docs up to date", "check documentation quality", "what's missing from the docs", or wants a read-only audit before deciding what to update. For actually making changes, use document-hub-update instead.

phananhtuan09 Skill

Use when implementing login/auth flow, designing token strategy, adding permission/role checks, building auth middleware, reviewing auth security, or choosing between auth approaches. Skip when auth system is already fully defined and task is routine implementation with no design choices. Skip when running a post-implementation security audit — use be-security-check instead.

navraj007in Skill

Generate comprehensive security audit checklist from architecture blueprint. Covers OWASP Top 10, data security, authentication, authorization, secrets management, compliance, and testing procedures.

navraj007in Skill

Six-pillar well-architected framework for evaluating architecture quality — operational excellence, security, reliability, performance, cost optimization, and developer experience

helderberto Bundle

Harden code proactively against vulnerabilities at the boundary where untrusted input enters the system. Use when implementing auth, handling user input, storing or transmitting sensitive data, integrating external APIs, adding file uploads, or any code that crosses a trust boundary. Don't use for reactive secret scanning (use `safe-repo`) or dependency CVE checks (use `deps-audit`).

maroffo Skill

Restrict edits to one directory of the current repo for the rest of the session, so focused debugging cannot spill into unrelated files. Use when user says /freeze, freeze the boundary, freeze this dir, keep edits inside <dir>, unfreeze, or /freeze off. Writes a repo-local boundary file that the freeze-guard PreToolUse hook reads. Not a security boundary and not a scope mechanism for parallel subagents.

amattas Skill

File descriptor abuse, race conditions, and TOCTOU vulnerabilities

helderberto Skill

Check dependencies for known vulnerabilities and staleness. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for reviewing code quality.

helderberto Bundle

Review a GitHub Pull Request for bugs, security, performance, and code quality. Use when user asks to review a PR or wants pull request feedback. Don't use for reviewing local uncommitted changes, creating new PRs, or merging branches.

maroffo Skill

Create new skills or review and improve existing ones. Use when user says create skill, new skill, improve skill, review skill, audit skills, or skill quality.

helderberto Bundle

Explore a codebase to surface architectural friction and propose refactors toward deep modules (simple interface, large implementation) as GitHub issue RFCs. Use when the user asks to audit architecture, find structural friction, or identify refactor opportunities across a codebase. Don't use for single-module interface design (use /codebase-design) or code-level review of a diff (use /code-review).

kurokeita Skill

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

kurokeita Bundle

This skill should be used when the user asks to "clean the repository", "remove stale branches", "clear old stashes", "manage git hygiene", or "scan for redundant worktrees". Uses the @kurokeita/git-clean-up tool to audit and safely remove unused Git resources.

neuromechanist Bundle

This skill should be used when the user says "security audit", "check for vulnerabilities", "security review", "harden project", "dependency audit", "credential scan", "check for secrets", "scan for secrets", "OWASP review", "security checklist", "audit dependencies", "find vulnerabilities", or wants to review their project for security issues, exposed credentials, or vulnerable dependencies.

neuromechanist Bundle

Use this skill when the user asks to "explore this codebase", "understand this repo", "map the architecture", "review our stack", "get up to speed", "break ground" on an unfamiliar project or research field, "what is the state of this project", "audit the architecture", or before planning changes in a codebase you have not worked in. Produces a verified reconnaissance report before any design or edit.

developerscoffee Bundle

53 AI-ready security remediation guides for Java vulnerabilities

developerscoffee Skill

Use this skill when you need to remediate CWE-1333 (ReDoS (Regular Expression Denial of Service)) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing redos (regular expression denial of service) issues.

developerscoffee Skill

Use this skill when you need to remediate CWE-833 (Deadlock) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing deadlock issues.

developerscoffee Skill

Use this skill when you need to remediate CWE-330 (Use of Insufficiently Random Values) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing use of insufficiently random values issues.

developerscoffee Skill

Use this skill when you need to remediate CWE-91 (XML Injection) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing xml injection issues.

developerscoffee Skill

Use this skill when you need to remediate CWE-22 (Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing improper limitation of a pathname to a restricted directory (path traversal) issues.

developerscoffee Skill

Use this skill when you need to remediate CWE-601 (URL Redirection to Untrusted Site (Open Redirect)) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing url redirection to untrusted site (open redirect) issues.

developerscoffee Skill

Use this skill when you need to remediate CWE-90 (LDAP Injection) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing ldap injection issues.