Security

kubernetes-sigs-kueue Skill

Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).

kubernetes-sigs-kueue Skill

Flag information-disclosure patterns — full-object logging, request echoing, credentials in status/annotations, kubeconfig logging, secret-bearing status (CWE-200, CWE-522, CWE-532, CWE-552).

sendaifun Bundle

Security vulnerability detection and variant analysis skill. Use when hunting for dangerous APIs, footgun patterns, error-prone configurations, and vulnerability variants across codebases. Combines sharp edges detection with variant hunting methodology.

apecloud Bundle

Access-security capability entry for TLS and mTLS on existing KubeBlocks clusters. Use when the user wants to enable, verify, or rotate encrypted database connections. Do not use this as a create-time primary entry; create-time routing still starts at preflight plus the dedicated engine skill.

agile-v Skill

Authoring, approval, immutability, and supersession of Architecture Decision Records (ADRs) in the Agile V lifecycle. Load when recording a significant, long-lived architectural, platform, tooling, or security decision.

nodejsmith Skill

Use when the user says: "audit this CLI", "CLI quality check", "full CLI review", "CLI UX audit". Comprehensive CLI tool quality audit across all dimensions — hardening, output, clarity, affordances, and complexity.

apecloud Skill

Access-security capability entry for account, password, and credential handling on existing KubeBlocks clusters. Use when the user wants to retrieve, rotate, reset, or preconfigure database credentials. Do not use this as a create-time primary entry; create-time routing still starts at preflight plus the dedicated engine skill.

agile-v Skill

STRIDE threat modeling and privacy impact assessment to generate security/privacy requirements. Use before requirement-architect to shift security left.

willyu1007 Bundle

Review code changes for architectural consistency, correctness risks, security/performance concerns, and verification gaps; produce a prioritized, actionable review report.

natea Skill

Credential exposure detection, OAuth flow validation, API key management testing, and data sanitization verification for n8n workflows. Use when validating n8n workflow security.

telum-ai Bundle

Exercises real user or operator jobs. Use after audit before story, epic, or project validation.

telum-ai Bundle

Audits implemented work adversarially. Use after implementation and before any story or epic validation.

telum-ai Bundle

Validates an epic across completed stories and audit evidence. Use at the epic prove gate before retrospective.

telum-ai Bundle

Validates a story after audit and declares readiness. Use at the story prove gate before retrospective.

brite-nites Skill

Foundation sub-skill for the flow-architecture plugin (implements CDR-023). Runs at the start of every FDA orchestrator (`/flow:start-project`, `/flow:retrofit-project`, `/flow:add-domain`, `/flow:add-sub-flow`, `/flow:audit`) to verify the environment, discover existing FDA artifacts on the filesystem, classify the run mode, confirm Linear scope (writing `.flow/config.json` on first run via the embedded Q36 7-step bootstrap), and emit the Q12.5 structured preamble that downstream sub-skills consume. Read-only EXCEPT the atomic-rename `.flow/config.json` write on first successful confirmation or stale-config replacement.

brite-nites Skill

Apply 7 quality checks to a single Linear issue object. Returns pass/fail per check. Phase 1 audit and Phase 2 scope both consume this skill.

hack23 Skill

ISMS policy alignment and compliance verification for Hack23 AB security standards (ISO 27001, NIST CSF 2.0, CIS Controls v8.1)

hack23 Skill

Security incident detection, analysis, containment, and recovery per NIST SP 800-61r2 and ISO 27035

telum-ai Bundle

Implements analyzed story work. Use after required spec, plan, tasks, and story analysis before speck-audit.

djankies Skill

Automated tooling and detection patterns for JavaScript/TypeScript security vulnerabilities. Provides scan commands, vulnerability patterns, and severity mapping—not output formatting or workflow.

djankies Skill

Sanitizing and validating user input to prevent XSS, injection attacks, and security vulnerabilities in TypeScript applications

hack23 Skill

Security code review using OWASP Top 10, input validation, and Hack23 ISMS secure development policy for TypeScript/MCP

hack23 Skill

API security, MCP tool security, input validation, rate limiting, audit logging, secure authentication, and defense-in-depth principles

hack23 Skill

Open source governance, security badges, license compliance, SBOM, supply chain security, and vulnerability management per Hack23 Open Source Policy

florinsenoner Skill

Audit Convex bandwidth and function call consumption, identify optimizations, and plan fixes

b-open-io-prompts Bundle

Audit which bOpen plugins, CLIs, env keys, third-party skills, agents, and hooks are installed across the harness, then emit a runtime-tailored instruction plan with optional user-triggered installation of selected dependencies. Use for "bopen setup", "setup ui", "harness install", "audit my setup", "install everything", or "unified installer". For a single hook, use hook-manager.

hack23 Skill

GitHub Agentic Workflows (gh-aw) — markdown-defined AI automation with Copilot/Claude/Codex, safe outputs, 5-layer security, and Continuous AI patterns

hack23 Skill

Systematic vulnerability lifecycle management with SLAs aligned with OWASP, NIST, and CIS Controls for Node.js/TypeScript

hack23 Skill

Comprehensive SDLC security practices with DevSecOps automation, OWASP Top 10, supply chain security (OSSF/SLSA)

joaquimscosta Bundle

Audit, classify, validate, and scaffold documentation using the Diataxis framework (Tutorials, How-to guides, Reference, Explanation). Use when user mentions "diataxis", "documentation framework", "quadrant", "doc audit", "doc coverage", "collapsed document", "tutorial vs how-to", "quadrant purity", "documentation types", or wants to classify docs by type.

joaquimscosta Bundle

Reviews open Dependabot PRs, classifies by risk (patch/minor/major, security, lockfile-only), and merges safe ones or advises on what to do. Use when user mentions "dependabot", "dependabot PRs", "dependency updates", "merge dependabot", "review dependabot", "dependency PRs", "bump PRs", "update dependencies", or runs /dependabot-review command.

florinsenoner Skill

Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations

florinsenoner Skill

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

packmindhub Skill

Audit and improve the CLAUDE.md files listed in the run worklist: apply only high/medium priority fixes, create the ones that are missing, and delete instructions already fully covered by a repository skill. Driven non-interactively by a GitHub workflow (.github/workflows/weekly-claude-md-improver.yml owns the schedule and resolves the worklist, which differs per repository); not intended for interactive use.

packmindhub Skill

Audit and inventory all feature flags declared in the Packmind codebase. Use when the user asks to list, audit, review, or inventory feature flags, asks which flags are active, wants to know what a flag gates, or asks which flags are opened to a given domain/user. Produces a synthetic markdown table with each flag key, its audience, an inferred functional description, its active/orphan status, and its usage locations.

b-open-io-prompts Bundle

Proactive self-audit covering incomplete changes, untested assumptions, pattern violations, buried concerns, and cleanup debt. Invoke before ending a session, marking a task done, or saying "complete", and when the user asks "are you sure?", "did you miss anything?", "anything else?", or "audit your work". Do not wait to be asked.