Security

pluginagentmarketplace Bundle

Master MongoDB security, authentication, authorization, encryption, and backup. Learn role-based access control, TLS/SSL, encryption, and disaster recovery. Use when securing deployments, managing users, or implementing compliance.

microsoft Skill

Reviews new or changed CODE on aspire.dev for correctness, safety, and adequate test coverage — not documentation prose. USE FOR: reviewing a PR supplied as a number or URL (or the current branch's diff), checking C#/TypeScript/Astro/HTML/CSS changes for bugs, catching correctness/security/data-loss/accessibility regressions, verifying that important scenarios have unit tests, e2e tests (desktop/tablet/mobile), and axe-core accessibility tests. DO NOT USE FOR: validating documentation content or examples (use doc-tester), reviewing a documentation PR for factual accuracy (use doc-pr-reviewer), writing or fixing docs pages (use doc-writer), two-slash TypeScript blocks (use twoslash-validator), or nitpicking style/formatting (ESLint and Prettier own that). INVOKES: git (read-only diff inspection), gh (to resolve and fetch a PR by number or URL), and optionally the repo's existing test commands for verification. FOR SINGLE OPERATIONS: read the diff with git or gh pr diff and apply the relevant language checklist

womendefiningai Bundle

Research-backed code review skill with OWASP Top 10 security checks, SAST tool integration (SonarQube, CodeQL, Snyk), performance pattern detection, and automated quality standards enforcement. Auto-invoked for code review, security audit, PR analysis, and bug checking. Implements 2025 best practices with 92% faster vulnerability remediation.

mksteady Bundle

审计问题修复技能。读取模块的 AUDIT.md，逐个修复安全/质量问题，修复后归档到 AUDIT_HISTORY.md。严格约束只修改 AUDIT.md 列出的文件。

gullitmiranda Skill

Code quality, commit standards, quality gates, PR standards, documentation, performance, security, and output character hygiene (gremlin characters). Use when writing code, committing, creating PRs, generating any text, or when the user runs /gremlin-clean.

zgagnon Skill

Use when reviewing a test harness for adequacy — post-implementation (adversarial review), as an audit-loop reviewer node, or pre-spec to verify that planned coverage reaches every acceptance criterion. Classifies tests as outside-in vs unit, and flags structural blind spots that let green tests miss real regressions.

tradingstrategy-ai Skill

Audit curator feeder YAML files for stale Twitter, LinkedIn, RSS and website error markers, decide whether each error is real, then clear false positives, repoint renamed handles/links, or tombstone dead entities — leaving a dated audit comment on every entry touched.

aakash-dhar Skill

Reviews code for bugs, security issues, performance problems, and adherence to best practices. Use when the user asks to "review this code", "check my code", "is this code good?", or before submitting a PR.

aakash-dhar Skill

Scans code for security vulnerabilities including injection attacks, authentication flaws, exposed secrets, insecure dependencies, and data exposure. Use when the user says "security review", "is this secure?", "check for vulnerabilities", "audit this", or before deploying to production.

aakash-dhar Skill

Generates a structured penetration testing report based on OWASP standards including OWASP Top 10, ASVS, and WSTG methodology. Scans code for vulnerabilities, maps findings to OWASP categories, assigns CVSS scores, and produces a professional pentest report. Use when the user says "pentest report", "penetration testing", "OWASP audit", "OWASP report", "security assessment", "vulnerability assessment", "application security test", or "OWASP compliance check".

aakash-dhar Skill

Quantifies technical debt across the codebase by scanning for code smells, outdated dependencies, complexity hotspots, missing tests, TODOs, dead code, and architectural issues. Produces a prioritized report with effort estimates and business impact. Saves output to project-decisions/ folder. Use when the user says "tech debt report", "how much tech debt", "technical debt", "code health", "codebase health check", "what needs cleanup", "debt audit", "code quality report", "health check", or "what's the state of our codebase?".

aakash-dhar Skill

Scans project dependencies for known vulnerabilities (CVEs), categorizes them into three severity-based reports (Critical/High, Medium, Low), and generates detailed markdown documents with remediation guidance. Saves output to project-decisions/ folder. Use when the user says "vulnerability report", "dependency vulnerabilities", "CVE report", "package vulnerabilities", "npm audit report", "dependency scan", "vulnerable packages", "security vulnerabilities in dependencies", or "generate vulnerability reports".

openai Bundle

Audit or fix sensitive-data exposure in JS SDK diagnostics, exceptions, logging, and telemetry.

guifav Bundle

Configures and manages Cloudflare DNS, caching, security rules, rate limiting, and Workers

ottawacloudconsulting Bundle

Produce or audit `docs/ARCHITECTURE_AND_DESIGN.md` for any codebase, standalone from the `/project` flow. Create mode reverse-engineers an architecture document from source for repos that lack one; Audit mode updates an existing document in place against the current code. Use when there is no architecture document and one is needed, when an existing architecture doc has drifted from the code, or when the user asks to "document this architecture", "reverse engineer the architecture", "create an architecture doc", or "audit the architecture doc against the current code". Operates on the current working directory by default; accepts an optional positional `target_path` argument.

sergebulaev Skill

Audit and rewrite a Facebook Page for 2026: Page name, username and vanity URL, profile picture and cover photo, Intro/About and category, the CTA button (Shop, Book, Sign Up, Contact matched to your goal), pinned post, tabs order, and contact/link fields. Triggers on "review my Facebook Page", "fix my Page about", "optimize my cover", "set my CTA button", "Page audit". Converts a default Page into one that turns a visitor into a follower or a lead. Not for writing Page posts (use fb-post-writer).

sddevelopment-be Skill

Architect Alphonso conducts rigorous code review and architecture-fit analysis: ADR compliance, test coverage, architectural patterns, security. Outputs review document with APPROVED/REDIRECT/BLOCKED status.

onmax Bundle

Review and bootstrap open-source repo health (OSS) by auditing or scaffolding README, CONTRIBUTING, CODE_OF_CONDUCT, LICENSE, SECURITY, GitHub templates, CI workflows, Renovate, publishing (pkg-pr-new + npm Trusted Publishing), linting/formatting, Changesets, and automation. Use when asked to review OSS setup, check OSS health, or set up/add OSS files and workflows.

buldee Bundle

Legacy code rescue - audit hotspots, cover with characterization tests, break dependencies, and plan strangler-fig migrations. Use when inheriting, taming, testing, or refactoring an untested/undocumented codebase.

yldgio Skill

ASP.NET Core patterns, dependency injection, middleware, async/await, and security

yldgio Skill

GitHub Actions workflow security, performance optimization, and best practices

bcanfield Bundle

Audit the tech-debt registry, rank survivors by churn × Fowler quadrant, surface a top-N list, then walk paydown on user follow-up. Use when the user asks to review debt, see what to pay down, work through entries, or check the debt registry. Stale entries drop with "drop A,B,C".

bcanfield Bundle

Audit the debt registry, rank survivors by churn × Fowler quadrant, surface a top-N list, then walk paydown on user follow-up. Use when the user asks to review debt, see what to pay down, work through entries, or invokes /debt-ops:review. Stale entries drop with `drop A,B,C`.

derhaken Skill

Use when reviewing code for vulnerabilities, implementing authentication or authorization, handling user input, storing sensitive data, or before any feature that touches security boundaries goes to production

derhaken Skill

Use when adding new dependencies, deciding whether to update packages, running security audits on dependencies, evaluating library alternatives, or encountering outdated or vulnerable packages

jwilger Bundle

Three-stage code review protocol covering spec compliance, code quality, and domain integrity. Use this skill whenever the user asks to review code, prepare or check a PR, assess implementation quality, verify code against a spec or acceptance criteria, or audit for security and domain modeling issues. Triggers on: "review this code", "review my PR", "check implementation against spec", "code quality audit", "does this match the requirements", "review for security issues", "check for primitive obsession", "monetary precision review", "review test coverage gaps". Also activates when the user wants structured PASS/FAIL verdicts per requirement, severity-rated findings, or a gated review that blocks on critical issues. NOT for: style/formatting linting, debugging runtime errors, writing new code, or automated CI checks.

ai-dynamo-dynamo Skill

Validates and normalizes raw AIPerf outputs, then evaluates valid results against target SLOs and comparable prior candidates. Use after an AIPerf Job completes to produce benchmark audit, summary, and performance analysis artifacts.

diagrid-labs Bundle

This skill reviews Dapr Workflow activity implementations for idempotency, retries, error boundaries, and convention violations. Use this skill when the user asks to "review workflow activities", "check activity idempotency", "audit Dapr activities", or similar.

diagrid-labs Bundle

This skill reviews the HTTP management endpoints (start, status, terminate, pause, resume, raise-event, purge) that an app exposes for Dapr Workflows. Use this skill when the user asks to "review workflow management", "audit workflow management API", "check workflow HTTP endpoints", or similar.

diagrid-labs Bundle

This skill reviews Dapr Workflow code for non-determinism hazards that would cause stuck workflows on replay. Use this skill when the user asks to "review workflow for determinism", "check non-determinism in workflow", "audit Dapr workflow replay safety", or similar.

ai-dynamo-dynamo Bundle

Audit Dynamo Rust hot-path `.clone()` calls, explain which clones are removable and why, and only apply clone-removal patches when explicitly requested.

boom5426 Bundle

Submission-grade Nature/high-impact journal figure workflow for Python or R, plus optional OpenRouter GPT Image 2 manuscript schematic generation when the user explicitly asks for AI-generated graphical abstracts, concept schematics, mechanism diagrams, or paper schematic illustrations. Use whenever the user asks to create, revise, audit, or polish manuscript figures, multi-panel scientific plots, figures4papers-style matplotlib plots, journal-ready SVG/PDF/TIFF outputs, or OpenRouter/API-generated schematic drafts, especially for Nature-family or other high-impact journals. Before plotting or image generation, define the figure's conclusion, evidence logic, export needs, and review risks. For plotting tasks, honor an explicit Python/R choice, otherwise reuse the saved nature-figure backend preference; if no preference exists, ask once whether the user prefers Python or R and save that answer for future calls. For explicit OpenRouter/GPT Image 2 schematic generation, do not ask Python or R; use the AI-schemat

boom5426 Bundle

Use when a manuscript is close to submission or resubmission and you need a preflight audit for claim support, figure-panel coverage, legend sync, methods references, terminology stability, and venue-facing risks.

askaret Skill

Use to improve GitHub Actions workflows for speed, reliability, and security. Do NOT change product code unless required by CI. Keep checks deterministic and aligned with branch protection.

askaret Skill

Use when creating or modifying GitHub Actions workflows. Focus on security hardening and least privilege. Do NOT change application code unless required for workflow correctness.

wcygan Skill

Audit or update a repository .gitignore from tracked, untracked, generated, and sensitive files. Use for gitignore cleanup, ignore pattern design, and accidental-tracking checks.