Security

tomevault-io Bundle

Enterprise Spring Boot development with JPA, security, testing, and microservices patterns Use when this capability is needed.

tomevault-io Bundle

Manage Swift Package Manager dependencies with security checks and update verification. Use when this capability is needed.

tomevault-io Bundle

Startup runbook for MERN projects. Establishes stack decisions, scaffolds the project, configures GitHub security, and confirms governing constraints. Use when this capability is needed.

tomevault-io Bundle

Security policy for MERN apps. Enforces OWASP Top 10 and CWE Top 25 mitigations. Use when this capability is needed.

tomevault-io Bundle

Startup runbook for NEAN projects. Establishes stack decisions, scaffolds the project, configures GitHub security, and confirms governing constraints. Use when this capability is needed.

tomevault-io Bundle

Security policy for NEAN apps. Enforces OWASP Top 10 and CWE Top 25 mitigations. Use when this capability is needed.

tomevault-io Bundle

Audit or install maximum-depth 1Password integration in the current project — fetches fresh 1Password developer docs first, detects existing integration, and either reviews/improves it or greenfield-installs (Service Account secret resolution + site-compat autocomplete/well-known). Stack-aware (Laravel, Node/Next, Python, Ruby/Rails, Go). Use when the user says "integrate 1Password", "make this site 1Password-friendly", "audit our 1P integration", or invokes /onepassword-integrate. Use when this capability is needed.

tomevault-io Bundle

Scans a codebase structure, audits AI convention files, and creates or updates AGENTS.md with project-specific build commands, test patterns, and coding standards. Use when onboarding a project for AI agents, setting up AI instructions, after significant codebase changes, or to audit AI convention files like AGENTS.md or .cursorrules. Use when this capability is needed.

tomevault-io Bundle

OWASP Top 10 Dispatcher

tomevault-io Bundle

Lightweight end-of-session tech debt sweep. Finds duplicated code, dead exports, unused deps, stale TODOs, and bloated files. Use when user asks for "tech debt", "cleanup", "dead code", "unused exports", "code sweep", or end-of-session hygiene. Do NOT use for full codebase audits (use /audit instead). Use when this capability is needed.

tomevault-io Bundle

MoltAudit Security Scanner

tomevault-io Bundle

Generate a personalized threat advisory based on your tech stack — what CVEs, breaches, and supply chain attacks matter to YOU. Use when this capability is needed.

tomevault-io Bundle

Expert guidance for implementing FHIR servers using HAPI FHIR Plain Server framework. Use this skill when creating RESTful FHIR server implementations, implementing resource providers, adding FHIR operations (read, create, update, delete, search, $operations), implementing server interceptors for logging, security, and validation, setting up authentication and authorisation, or configuring FHIR server behaviour. Trigger keywords include "HAPI", "FHIR server", "RestfulServer", "resource provider", "IResourceProvider", "FHIR interceptor", "AuthorizationInterceptor", "FhirContext", "FHIR validation", "FHIR search", "FHIR operation". Use when this capability is needed.

tomevault-io Bundle

Set up pre-commit hooks and GitHub Actions workflows for testing, linting, security scanning, releases, and deployments. Supports Python, Node.js, Go, Rust, and multi-language projects. Use when this capability is needed.

tomevault-io Bundle

Golang OpenAPI/Swagger documentation with swaggo/swag — annotation comments (@Summary, @Param, @Success, @Router, @Security), swag init code generation, framework integrations (gin, echo, fiber, chi, net/http), security definitions (Bearer/JWT, OAuth2, API key), and struct tags (swaggertype, enums, example, swaggerignore). Apply when adding or maintaining Swagger/OpenAPI docs in a Go project, or when the codebase imports github.com/swaggo/swag, github.com/swaggo/gin-swagger, github.com/swaggo/echo-swagger, github.com/swaggo/http-swagger, or github.com/swaggo/files. Use when this capability is needed.

tomevault-io Bundle

Query and manage Google NotebookLM notebooks with persistent profile auth, source sync, batch/multi queries, and structured exports. Use when user asks to query NotebookLM, 'ask my notebook', shares NotebookLM notebook URLs, wants to list/create notebooks, manage sources, do bulk folder sync, dedupe, or audit exports. Use when this capability is needed.

tomevault-io Bundle

Adding a new agenix secret

tomevault-io Bundle

Documentation freshness audit. Invoke with /tzurot-doc-audit to review docs for staleness, missing tools, and inconsistencies. Use when this capability is needed.

tomevault-io Bundle

Scan for RustSec advisories and guide remediation Use when this capability is needed.

tomevault-io Bundle

Perform comprehensive security review targeting OWASP Top 10 2025 vulnerabilities for PRs, commits, or entire codebases. This skill should be used when a user wants to audit code security, scan for vulnerabilities, review security posture, or check for OWASP compliance. Analysis only - identifies vulnerabilities without modifying code. Use when this capability is needed.

tomevault-io Bundle

Patch engineer persona focused on security fix quality, code correctness, testing strategies, and regression prevention Use when this capability is needed.

tomevault-io Bundle

Use when performing a structured AIDE repository-state review for documentation coherence, inventory or matrix drift, host-lane freshness, maintenance hygiene, or explicit blocked and deferred status checks.

tomevault-io Bundle

Expert in code quality auditing — dead code, complexity, duplication, and architecture smells. Use when this capability is needed.

tomevault-io Bundle

IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT devices. Use when this capability is needed.

tomevault-io Bundle

Comprehensive content quality and maintenance assessment. Evaluates documentation quality, relevance, maintenance needs, and provides actionable recommendations. Use when this capability is needed.

tomevault-io Bundle

This skill should be used when the user asks to "share a secret", "send secret", "share credentials", "share password", "share securely", "encrypted sharing", "one-time secret link", "self-destructing message", "secure file transfer", or mentions "send-secret" without specifying file/clipboard/receive. Routes to the appropriate specialized skill based on context. Use when this capability is needed.

tomevault-io Bundle

Designs and implements backend systems including REST APIs, microservices, database architectures, authentication flows, and security hardening. Use when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Covers Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns. Use when this capability is needed.

tomevault-io Bundle

Performs a complete technical audit of Django applications, covering security, architecture patterns, performance, database, and code quality. Use this skill whenever you need to review a Django app for bugs, security risks, or technical debt. Supports both English and Portuguese. Use when this capability is needed.

tomevault-io Bundle

Comprehensive macOS development environment health check. Detects brew drift, orphaned packages, security issues, version mismatches, and deferred cleanup readiness. Use when this capability is needed.

tomevault-io Bundle

Check and update dependencies safely with security audits and test verification. Use when this capability is needed.

tomevault-io Bundle

Check and update dependencies safely with security audits and test verification. Use when this capability is needed.

tomevault-io Bundle

Audit the dev experience and maintainability — local setup, documentation, test quality, CI feedback time, debuggability. Run as part of /audit Phase E. Use when this capability is needed.

tomevault-io Bundle

安全审查技能

tomevault-io Bundle

Web application security scanner with proxy and active/passive scanning Use when this capability is needed.

tomevault-io Bundle

Manage a source-code repo's local patches against its installed package-manager dependencies — when a dep has a bug, security fix, or behavior tweak that upstream will not ship in time. Covers tracking each patch's relationship to upstream (is an issue filed? is a PR open? has it merged or been rejected?), detecting drift when upstream changes, forward-porting across version bumps, and upstream etiquette. Use when working with patch-package, yarn patch, pnpm patch, .yarn/patches/, the cweagans/composer-patches plugin in PHP, or Bazel's http_archive patches and Bzlmod single_version_override patches (which handle diff patching for polyglot deps regardless of language). Not for distribution-side patching (Homebrew/nixpkgs/Debian/Gentoo/BSD ports) nor for fork-and-redirect approaches (Cargo [patch], go mod replace, Bundler :git, requirements.txt git URLs, Elixir Mix :git). Use when this capability is needed.

tomevault-io Bundle

Sync AI coding sessions from 14 tools (Claude Code, Codex, Cursor, Aider, Cline, Gemini CLI, Continue, Copilot, Roo Code, Windsurf, Zed AI, Amp, OpenCode, OpenRouter) to Obsidian vault as markdown notes. Use when user wants to backup, export, or sync their AI chat sessions to Obsidian, set up automatic syncing, check sync status, or troubleshoot sync issues. Handles secret redaction automatically. Cross-platform (macOS, Linux, Windows). Use when this capability is needed.