Security

joogy06 Skill

Use when administering Red Hat Enterprise Linux 9 systems — dnf/rpm package management, subscription-manager, user/group management, SSH hardening, systemd services, firewalld, NetworkManager/nmcli networking, LVM/Stratis storage, kernel tuning, security hardening (CIS, SELinux, fail2ban), Cockpit web console, backup/restore, and on-prem VM guest tools (Proxmox, VMware, Hyper-V). Parent skill for the rhel-* skill family.

joogy06 Bundle

Use when designing or building SaaS applications — multi-tenancy models (silo/pool/bridge), tenant isolation, subscription and billing integration (Stripe/Paddle), onboarding flows, feature flags and entitlements, usage metering, API rate limiting, tenant-aware data partitioning, SaaS operational patterns (noisy neighbor, tenant health), and SaaS security (data isolation, compliance, SOC2).

joogy06 Bundle

Use when checking dependency currency and known CVEs in any project with manifests — pyproject.toml / package.json / Cargo.toml / go.mod / Gemfile / pom.xml. Surfaces stale library versions and known vulnerabilities BEFORE AI design agents propose using them. Callable from forge Step 1 (advisory), alf Step 2a (data extraction), pre-commit hooks (POSIX `.sh` + Windows hardened `.ps1`), standalone CLI, the `G_DEP_CURRENCY` gate in `_meta/gates.py`, and as a scope_delta source for critical CVEs in direct deps. Trigger on - "check deps", "what versions are stale", "CVE check", "dependency audit", "is this lib current", "freshness check", forge Step 1 auto-invoke when manifests detected.

joogy06 Skill

Use when configuring web servers on Ubuntu 24.04 LTS — Nginx, Apache, Caddy setup and tuning, virtual hosts, SSL/TLS certificates, Let's Encrypt/certbot, reverse proxy patterns, load balancing, HTTP/2/3, security headers, and performance optimization. Part of the ubuntu-* skill family.

joogy06 Skill

Use when administering Ubuntu Server 24.04 LTS systems — package management, user/group management, SSH hardening, systemd services, UFW/nftables firewall, netplan networking, LVM/disk management, kernel tuning, security hardening (CIS, AppArmor, fail2ban), backup/restore, and on-prem VM guest tools (Proxmox, VMware, Hyper-V). Parent skill for the ubuntu-* skill family.

joogy06 Bundle

Use when hardening Windows systems via PowerShell — Windows Firewall (NetSecurity), Windows Defender/Microsoft Defender, BitLocker drive encryption, audit policy and event log analysis, local security policy, credential management (SecureString, Windows Credential Manager), AppLocker, Windows Update management, and security compliance scanning. Part of the windows-ps-* skill family.

joogy06 Skill

Use when implementing authentication (OAuth, OIDC, SAML, JWT, sessions), authorization (RBAC, ABAC), user management, multi-tenant isolation, API security, or applying OWASP security patterns in Python web applications. Covers Flask and FastAPI security patterns.

joogy06 Bundle

Use at the start of any development task — feature, bugfix, refactor, or infrastructure change. Defines mandatory SDLC phases that must be completed with evidence before work is considered done. Enforces testing, security review, and documentation gates.

joogy06 Bundle

Use when building or modifying WooCommerce themes, customizing checkout or product pages, working with WooCommerce hooks and templates, integrating payment gateways, using the WooCommerce REST API, or writing any PHP code that touches WooCommerce. Includes mandatory security patterns.

joogy06 Bundle

Use when a ledger will not agree — a trial balance that does not balance, a bank or control account that will not reconcile, a VAT return that does not tie to the VAT control account, a balance sheet where net assets do not equal shareholders' funds, or suspected duplicate, missing, mis-signed or mis-period transactions. Covers the arithmetic signatures that identify an error class from the difference alone, the detection query for each class, and the correction protocol that fixes the books without destroying the audit trail.

joogy06 Bundle

Use when hardening Python code that touches Microsoft Office files or Microsoft 365 APIs — covers the consolidated security checklist for the ms-office-python-* family, the YAML rule manifest (17 Office-specific rules), and the runnable Python validator (python3 -m ms_office_security_check). All output is advisory-only; defers generic SAST to bandit/semgrep, dependency CVEs to dep-currency-check/pip-audit, secrets to gitleaks/trufflehog, and SBOM to cyclonedx/syft. Part of the ms-office-python-* skill family.

planifest Bundle

Explain code, security tool output, or configuration text — outputs clear EXPLANATION, SECURITY IMPLICATIONS, CONFIGURATION EXPLANATION, or ANSWER sections depending on input type. Use when you need a plain-language breakdown of what code or config does.

planifest Bundle

Perform a comprehensive code review of a snippet or diff — assessing correctness, security, performance, readability, and edge cases, with prioritised recommendations and suggested improvements. Use when reviewing PRs or auditing code quality.

rweisssieker-xp Skill

Create audit-ready evidence packs for Power BI reports and datasets. Use for KPI approval, RLS testing, source reconciliation, data privacy, assumptions, deployment approvals, and compliance reviews.

rweisssieker-xp Skill

Run structured Power BI requirements interviews for business users. Use to collect outcome, KPI, grain, dimensions, source systems, security, refresh, acceptance, and delivery constraints before experts build anything.

rweisssieker-xp Skill

Use when Power BI security exposure must be analyzed across RLS, OLS, sharing, export, sensitivity labels, external guests, PII, groups, workspaces, and tenant settings.

rweisssieker-xp Skill

Use when AI-generated Power BI recommendations, insights, DAX, Power Query, KPI definitions, or process actions need auditable sources, assumptions, tests, approvals, confidence, and change history.

rweisssieker-xp Skill

Use when Power BI sources or governance depend on identity, security, access, Entra ID, Okta, Ping Identity, SailPoint, CyberArk, BeyondTrust, IAM, PAM, RBAC, access reviews, or privileged access.

rweisssieker-xp Skill

Use when regulated BI artifacts need audit evidence for KPI changes, source lineage, tests, approvals, AI recommendations, human confirmation, SOX, GxP, ISO, GDPR, or similar controls.

rweisssieker-xp Skill

Use when Power BI needs automated scanning for RLS, sharing, export, external guests, PII, sensitivity labels, groups, workspaces, and tenant security exposure.

rweisssieker-xp Skill

Use when Power BI sources include tax, compliance, audit, GRC, controls, risk, SOX, VAT, indirect tax, audit management, Workiva, Diligent, SAP GRC, AuditBoard, Vertex, Avalara, or ONESOURCE.

kienbui1995 Skill

Use when conducting quality audits — reviewing process compliance, identifying gaps between defined process and actual practice, conducting structured inspections (code review audits, test quality reviews), and producing audit reports with remediation plans.

kienbui1995 Skill

Use when conducting a heuristic evaluation of an existing interface, identifying usability problems, or prioritizing UX improvements

kienbui1995 Skill

Use when reviewing code for security vulnerabilities, auth issues, data exposure, or before deploying to production

kienbui1995 Skill

Use when reviewing smart contracts for security vulnerabilities, auditing web3 patterns, or preparing for a formal audit

kienbui1995 Skill

Create, validate, audit, and govern Amplitude event taxonomy across a product. Uses mcp__Amplitude__get_event_properties, mcp__Amplitude__get_project_context, mcp__Amplitude__query_amplitude_data.

kienbui1995 Skill

Use when testing security from a QC perspective — OWASP Top 10 test cases, authentication and authorization testing, input validation testing, security regression testing, and integrating security checks into the QC process.

williamcorrea23 Skill

SAP API Management policy design and governance — security, traffic, mediation, lifecycle

williamcorrea23 Bundle

Keep a SAP NetWeaver / S/4HANA system's logs, traces, spool, job logs, ABAP dumps, audit logs and work directory from filling the filesystem — via the SAP standard reorganization jobs (RSBTCDEL2, RSPO1041, RSSNAPDL, RSBDCREO …) and safe OS-level cleanup, on Linux/Windows/AIX. Use for "clean up logs/traces", "/usr/sap is full", "reorg spool/jobs/dumps", "housekeeping jobs", "delete old work-dir files", "audit log cleanup". Hands DB log/trace cleanup to sap-db-command-reference. Cited to SAP Note 16083 + help.sap.com.

williamcorrea23 Skill

SAP BTP Audit Log Service — audit trail capture, configuration, compliance (SOC 2, GDPR), audit log viewer, retention policies, OAuth audit integration. Use when implementing audit logging on BTP, configuring compliance audit trails, or capturing security-relevant events.

williamcorrea23 Bundle

Develop and review SAP ABAP, CDS, HANA SQLScript/AMDP, RAP, OData/Fiori, integrations, enhancements, testing, and security with Clean Core guidance. Use when a request needs a broad SAP development workflow or its local Vaibe reference patterns.

williamcorrea23 Bundle

PR triage: audit open PRs, deep review selected ones, draft and post review comments. Args: "all" to review all, PR numbers to focus (e.g. "42 57"), "en"/"fr" for language, no arg = audit only in French.

kienbui1995 Skill

Use when implementing auth - OAuth 2.0, JWT, session management, API keys, RBAC, or reviewing auth security

kienbui1995 Skill

Synthesize multiple session replays into a UX friction map identifying systemic usability issues. Uses mcp__Amplitude__list_session_replays, mcp__Amplitude__get_session_replay_events, mcp__Amplitude__get_session_replays.

kienbui1995 Skill

Secure browser extensions — CSP configuration, minimal permissions, content script XSS prevention, and handling sensitive data safely.

garyld1962 Skill

Interrogate to discover the single-sentence product or architectural thesis, then audit all planned features and decisions against it.