Security

tomevault-io Bundle

Security anti-pattern for unrestricted file upload vulnerabilities (CWE-434). Use when generating or reviewing code that handles file uploads, processes user-submitted files, or stores uploaded content. Detects missing extension, MIME type, and size validation. Use when this capability is needed.

tomevault-io Bundle

<!-- SVK Version Check — runs once per session on first skill invocation -->

tomevault-io Bundle

Interact with Dependabot and Snyk pull requests for dependency upgrades and security fixes. Documents Dependabot commands, javax/jakarta compatibility checks, safe merge workflows, and troubleshooting. Use when managing dependency upgrade PRs or security fix PRs. Use when this capability is needed.

tomevault-io Bundle

FastAPI changes since training cutoff (0.112-0.135.3) -- native SSE, yield streaming, strict_content_type, dependency scopes, Pydantic v1 dropped, Starlette 1.0, Pydantic 2.12 MISSING sentinel/exclude_if, security 401 fix. Load before working with FastAPI. Use when this capability is needed.

tomevault-io Bundle

---

tomevault-io Bundle

Skills for exploiting vulnerable and outdated components including insecure deserialization per OWASP A06:2021. Use when this capability is needed.

tomevault-io Bundle

Spring Boot Security Patterns

tomevault-io Bundle

Security Baseline Controls

tomevault-io Bundle

Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection. Use when building systems requiring regulatory compliance, implementing security controls across multiple frameworks, or automating audit preparation. Use when this capability is needed.

tomevault-io Bundle

Authentication, authorization, and API security implementation. Use when building user systems, protecting APIs, or implementing access control. Covers OAuth 2.1/OIDC, JWT patterns, sessions, Passkeys/WebAuthn, RBAC/ABAC/ReBAC, policy engines (OPA, Casbin, SpiceDB), managed auth (Clerk, Auth0), self-hosted (Keycloak, Ory), and API security best practices. Use when this capability is needed.

tomevault-io Bundle

Audits Flutter mobile apps against OWASP Mobile Top 10 (2024) vulnerabilities. Trigger this skill before any production release, when the user mentions "security audit", "OWASP", "penetration test", "App Store rejection security", "hardcoded API key", "secrets in code", or any concern about leaked credentials, insecure storage, or weak crypto. Combines automated scanning (grep for hardcoded secrets, dependency CVE check, network security analysis) with manual checklist (storage, crypto, IPC, runtime protections). NOT a replacement for professional pentesting on apps handling financial/health data, but catches 90% of common issues. Use when this capability is needed.

tomevault-io Bundle

Audit and reconcile the latest Ralph run in Codex-driven repositories. Use when Ralph finishes and you want a post-run diagnostic or remediation pass to catch unmerged story branches, failures, state/spec drift, and merge issues, then execute a bounded recovery plan. Use when this capability is needed.

tomevault-io Bundle

Understand business logic vulnerabilities in AI code including race conditions, integer overflow, and calculation errors that pass functional tests but create security holes. Use this skill when you need to learn about race conditions in AI code, understand integer overflow vulnerabilities, recognize business logic security flaws, or identify calculation errors. Triggers include "race conditions", "business logic vulnerabilities", "integer overflow", "race condition AI", "flash sale security", "concurrent access", "negative totals", "calculation errors". Use when this capability is needed.

tomevault-io Bundle

Vercel Security Basics

tomevault-io Bundle

Windsurf Audit Logging

tomevault-io Bundle

Activate security engineer mode for code audits. Expert in vulnerability identification, OWASP guidelines, and threat modeling. Use when reviewing code for security issues, implementing authentication, or conducting security assessments. Use when this capability is needed.

tomevault-io Bundle

Trail of Bits security skills analysis for Solidity contracts. Use for deep smart contract security review with invariant suggestions. Use when this capability is needed.

tomevault-io Bundle

Helps users understand and modify their Guardian security configuration through natural language Use when this capability is needed.

tomevault-io Bundle

Security pattern for systems that manage cryptographic keys themselves rather than delegating to an external service. Use when the application must store, retrieve, and manage cryptographic keys directly. Implementation of Cryptographic Key Management pattern. Covers key storage security, key derivation from passwords, limiting key exposure, and protecting key confidentiality and integrity throughout the lifecycle. Use when this capability is needed.

tomevault-io Bundle

Trigger point for architecture, design, or system structure reviews. Use when user asks to review architecture, design, or understand system structure. Guides you to check for existing threat models first. Use when this capability is needed.

tomevault-io Bundle

Comprehensive Automation Audit

tomevault-io Bundle

OWASP Top 10 for Web Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in web application environments. Use when this capability is needed.

tomevault-io Bundle

Audit an existing FastAPI project for Clean Architecture compliance — verifies unidirectional layer dependencies, correct abstraction boundaries, repository pattern correctness, DI wiring, naming conventions, DB constraint rules, and documentation standards. Reports every violation with file and line number. Use when this capability is needed.

tomevault-io Bundle

Run a single-session performance audit on the codebase Use when this capability is needed.

tomevault-io Bundle

Run a single-session refactoring audit on the codebase Use when this capability is needed.

tomevault-io Bundle

Smart code scanner that detects Spring Boot patterns and routes to appropriate skills. Use when editing Java or Kotlin files in Spring Boot projects, working with pom.xml/build.gradle containing spring-boot-starter, or when context suggests Spring Boot development. Detects annotations (@RestController, @Entity, @EnableWebSecurity, @SpringBootTest) to determine relevant skills and provides contextual guidance. Uses progressive automation - auto-invokes for low-risk patterns (web-api, data, DDD), confirms before loading high-risk skills (security, testing, verify). Use when this capability is needed.

tomevault-io Bundle

Audit Claude Code status lines for quality and cross-platform compatibility. Use when creating or validating custom status line scripts, or troubleshooting terminal output issues. Use when this capability is needed.

tomevault-io Bundle

Audit hook event schema for drift. Compares implementation against official docs. Use when this capability is needed.

tomevault-io Bundle

Guidelines for building Python cybersecurity tools with secure coding practices, async scanning, and structured security testing. Use when this capability is needed.

tomevault-io Bundle

Provides comprehensive KeyCloak administration guidance including realm management, user/group administration, client configuration, authentication flows, identity brokering, authorization policies, security hardening, and troubleshooting. Covers SSO configuration, SAML/OIDC setup, role-based access control (RBAC), user federation (LDAP/AD), social login integration, multi-factor authentication (MFA), and high availability deployments. Use when configuring KeyCloak, setting up SSO, managing realms and clients, troubleshooting authentication issues, implementing RBAC, or when users mention "KeyCloak", "SSO", "OIDC", "SAML", "identity provider", "IAM", "authentication flow", "user federation", "realm configuration", or "access management".

tomevault-io Skill

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.

tomevault-io Bundle

Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities. Use when this capability is needed.

tomevault-io Skill

Autonomously deep-scan entire codebase line-by-line, understand architecture and patterns, then systematically transform it to production-grade, corporate-level professional quality with optimizations

tomevault-io Bundle

Audit and update GitHub Actions workflow files on a dmzoneill repo. Checks for outdated action versions, deprecated references, and missing best practices. Use when this capability is needed.

tomevault-io Bundle

Implement n8n credential types including API key, OAuth2, and header-based authentication patterns. Use this skill when creating *.credentials.ts files, implementing ICredentialType interfaces, configuring OAuth2 flows, setting up credential testing, injecting authentication headers, or following credential security best practices. Apply when building any n8n node that requires API authentication, token management, or secure credential handling. Use when this capability is needed.

tomevault-io Bundle

Generate compliance reports from OSCAL assessment results, SSPs, and POA&Ms in various formats. Use this skill to create audit-ready documentation, executive summaries, and detailed compliance status reports. Use when this capability is needed.