Security

legioncodeinc Bundle

Support stack specialist for SaaS products — selects the right tool from Plain, Pylon, Front, Help Scout, and Intercom; configures shared inboxes; designs AI-deflection flows (Fin 2.0, Ari, Crisp Bot); sets SLA tiers; wires integrations to Slack, Linear, and Notion; and provides a founder-as-support playbook for teams of 1-3. Invoke when choosing a support tool, auditing an existing stack, configuring AI deflection, designing SLA policy, or setting up escalation to Linear. Do NOT invoke for chat widget installation code (live-chat-support-worker-bee), auth SSO (auth-worker-bee), or GDPR/retention audits (security-worker-bee).

legioncodeinc Bundle

Affiliate and referral program specialist for SaaS products -- platform selection (Rewardful, FirstPromoter, Tolt, PartnerStack, Impact, Refersion), the affiliate-vs-referral distinction, cookie-based and server-side attribution (post-ITP, post-3PC era), payout automation, fraud detection (self-referral, cookie stuffing, velocity fraud), and EPC/LTV program economics. Invoke when the user says "set up an affiliate program", "which affiliate platform should I use", "Rewardful vs FirstPromoter", "my attribution is broken in Safari", "referral program fraud", "EPC or LTV for our program", "20% recurring commission", "postback tracking setup", or "PartnerStack vs FirstPromoter". Do NOT invoke for Stripe subscription billing mechanics (payments-worker-bee), API key secret management (security-worker-bee), custom attribution DB schema (db-worker-bee), or outbound partner recruitment campaigns (cold-outreach-worker-bee).

legioncodeinc Bundle

Dissect and reverse engineer Electron desktop apps: locate resources/app.asar, read archive metadata, unpack with @electron/asar, decode bundled/minified JavaScript with webcrack, and attach live inspectors over the Chrome DevTools Protocol. Use when asked to unpack app.asar, reverse engineer / dissect / audit an Electron app, find what code a desktop app runs, recover app logic from a bundle, attach devtools via remote debugging, or harden your own Electron app against exactly this.

coldbox Skill

Use this skill when working with BCrypt password hashing in ColdBox/BoxLang applications. Covers installation, work-factor configuration, hashing passwords, verifying credentials, generating salts, mixin helpers in handlers/interceptors, user registration, authentication, password change/reset, and security best practices for credential handling.

coldbox Skill

Use this skill when implementing user authentication with the cbauth module in ColdBox/BoxLang applications. Covers installation, IUserService and IAuthUser interfaces, session-based login/logout, manual login, authentication checks, CBStorages integration, Flash RAM messaging, and security patterns for credential handling.

coldbox Skill

Use this skill when generating OpenAPI 3.x (Swagger) documentation for ColdBox/BoxLang REST APIs using cbswagger. Covers installation, module configuration, handler/action JSDoc annotations, request/response schemas, security definitions, parameter documentation, and accessing the generated spec.

coldbox Skill

Use this skill when securing ColdBox/BoxLang applications with cbsecurity. Covers firewall rule configuration, annotation-based security on handlers/actions, JWT authentication, role and permission checks, security context helpers, custom validators, interceptor events, and production hardening patterns.

coldbox Skill

Use this skill when implementing authorization in ColdBox with CBSecurity, defining security rules for events and URLs, checking user roles with cbsecurity.has(), checking permissions with cbsecurity.can(), implementing role-based route protection, using @secured annotations on handler actions, or blocking unauthorized access.

coldbox Skill

Use this skill when implementing Role-Based Access Control (RBAC) in ColdBox, creating role and permission management services, building hierarchical role structures, assigning roles and permissions to users, checking permissions in handlers with cbsecurity, or when designing a group-based access control system.

coldbox Skill

Use this skill when implementing user authentication in ColdBox with CBAuth, creating user services with retrieveUserById/retrieveUserByUsername, hashing passwords with BCrypt, managing login/logout sessions, implementing remember me functionality, or setting up the CBAuth module configuration.

coldbox Skill

Use this skill when reviewing ColdBox application code for correctness, security, performance, testability, and adherence to ColdBox conventions. Covers handlers, services, models, interceptors, modules, routing, ORM/OBM usage, REST APIs, dependency injection patterns, and common anti-patterns to flag during pull request reviews.

coldbox Skill

Use this skill when understanding ContentBox architecture, core modules, service layer, multi-site behavior, security foundations, and the recommended extension points for building or maintaining ContentBox solutions.

coldbox Skill

Use this skill when implementing JWT (JSON Web Token) authentication in ColdBox REST APIs with CBSecurity, generating access/refresh tokens, validating bearer tokens, configuring JWT settings and secret keys, implementing token refresh endpoints, or securing API routes with JWT authentication middleware.

takazudo Bundle

Organize and maintain package.json and npm config (.npmrc) for readability and security. Use when: (1) Reorganizing scripts section or adding separators, (2) Extracting multi-process commands into shell scripts, (3) Setting up multi-environment dev commands (local/preview/prod), (4) Handling pnpm "Ignored build scripts" warnings, (5) Configuring .npmrc security (strictDepBuilds, allowBuilds, ignoredBuilds), (6) Managing pnpm via corepack and packageManager field, (7) Adding predev port cleanup. Keywords: package.json, npm scripts, .npmrc, pnpm, build scripts, supply chain, corepack, packageManager, predev, kill port, port in use.

latestaiagents Skill

Comprehensive API security for REST and GraphQL APIs. Use this skill when building or reviewing API endpoints, implementing authentication, or securing data transfer. Activate when: API security, REST security, GraphQL security, API authentication, API rate limiting, API versioning, secure endpoint, API design.

latestaiagents Skill

JSON Web Token security best practices. Use this skill when implementing JWT authentication, validating tokens, or reviewing JWT usage. Activate when: JWT, JSON Web Token, token authentication, bearer token, refresh token, token validation, JWT secret, token expiry.

latestaiagents Skill

OWASP A04 - XML External Entity (XXE) Prevention. Use this skill when parsing XML, processing SOAP requests, handling SVG uploads, or working with XML-based formats. Activate when: XML parsing, SOAP, SVG upload, XML input, DOCTYPE, DTD, external entity, XML bomb, billion laughs, XSLT.

latestaiagents Skill

HTTP security headers configuration guide. Use this skill when hardening web applications, configuring CSP, or setting up security headers. Activate when: security headers, CSP, Content-Security-Policy, HSTS, X-Frame-Options, CORS headers, clickjacking prevention, helmet.

latestaiagents Skill

Cross-Site Request Forgery prevention techniques. Use this skill when implementing forms, state-changing operations, or reviewing CSRF protections. Activate when: CSRF, cross-site request forgery, form security, token validation, same-site cookie, state changing request, POST request security.

latestaiagents Skill

Find and prevent leaked secrets, API keys, and credentials in code. Use this skill when reviewing code for exposed secrets, setting up pre-commit hooks, or auditing repositories. Activate when: leaked secret, API key exposed, credentials in code, hardcoded password, secret scanning, git secrets, pre-commit hook.

latestaiagents Skill

OWASP A10 - Insufficient Logging and Monitoring. Use this skill when implementing audit logs, security monitoring, or incident detection. Activate when: logging, audit trail, security events, monitoring, alerting, SIEM, incident detection, log analysis, security logging, breach detection.

latestaiagents Skill

OWASP A02 - Broken Authentication Detection. Use this skill when reviewing login systems, session management, password handling, or authentication flows. Activate when: login, authentication, password, session, token, JWT, OAuth, credentials, sign in, logout, remember me, forgot password, password reset, MFA, 2FA.

latestaiagents Skill

Systematic security code review methodology. Use this skill when reviewing pull requests for security issues, auditing critical code paths, or performing security assessments. Activate when: security review, code audit, secure code, review PR for security, find vulnerabilities, security assessment.

latestaiagents Skill

OWASP A05 - Broken Access Control Detection. Use this skill when implementing authorization, checking permissions, or auditing who can access what resources. Activate when: authorization, permissions, access control, RBAC, ABAC, admin access, privilege escalation, IDOR, direct object reference, role check, can user access.

latestaiagents Skill

OWASP A09 - Using Components with Known Vulnerabilities. Use this skill when auditing dependencies, updating packages, or reviewing security advisories. Activate when: npm audit, dependency check, vulnerable package, CVE, security advisory, outdated packages, supply chain, package vulnerability, Dependabot, Snyk.

latestaiagents Skill

OWASP A08 - Insecure Deserialization Prevention. Use this skill when parsing serialized data, handling JSON with type information, or processing pickled/marshalled objects. Activate when: deserialization, JSON parse, pickle, marshal, serialize, unserialize, ObjectInputStream, yaml.load, eval JSON, prototype pollution.

latestaiagents Skill

OWASP A03 - Sensitive Data Exposure Prevention. Use this skill when handling PII, passwords, credit cards, API keys, or any sensitive information. Activate when: encryption, PII, personal data, credit card, SSN, password storage, HTTPS, TLS, data at rest, data in transit, GDPR, compliance, data masking.

mrciphersmith Skill

Use when a code-level security review is requested, checking for injection vulnerabilities, auth gaps, insecure cryptography, secrets, and OWASP Top 10 patterns in changed code. NOT for infrastructure, deployment, or dependency audits.

dragoon0x Skill

Audit and fix ARIA attributes. Ensures proper aria-label, aria-hidden, aria-live, and role usage throughout the interface.

dragoon0x Skill

Comprehensive design quality audit with severity ratings, specific line references, and actionable fix instructions. Deeper than /score — examines every declaration.

dragoon0x Skill

Audit visual density and whitespace balance. Checks that sections alternate between sparse and dense, avoiding uniform monotony.

dragoon0x Skill

Audit all font-family, font-size, font-weight, line-height, and letter-spacing declarations across the codebase. Find inconsistencies, banned fonts, and missing hierarchy.

dragoon0x Skill

Map all colors in the codebase. Find duplicates, near-duplicates, one-off values, and colors not in the token system.

dragoon0x Skill

Map all layout patterns. Identify grid/flexbox usage, spacing patterns, nesting depth, and responsive breakpoints across the codebase.

40rty-ai Skill

Score how findable, readable, and recommendable the store's catalog is to AI shopping agents — then route each gap to the agentic skill that fixes it.

40rty-ai Skill

Read-only: flags products and variants with missing images or fewer than a minimum number of images.