Security

florianbuetow Bundle

This skill should be used when the user asks to "check API security", "audit REST API", "find BOLA vulnerabilities", "check for mass assignment", "analyze API rate limiting", "detect excessive data exposure", or mentions "API security", "BOLA", "IDOR", "mass assignment", "rate limiting", "broken function-level authorization", "excessive data exposure", or "OWASP API Top 10" in a security context.

florianbuetow Skill

This skill should be used when the user asks to "check for denial of service", "analyze availability risks", "find DoS vulnerabilities", or mentions "denial of service" or "DoS" in a security context. Maps to STRIDE category D.

florianbuetow Skill

This skill should be used when the user asks to "fix security finding", "fix vulnerability", "generate security fix", "appsec fix", "patch vulnerability", "remediate finding", or "apply security patch". Also triggers when the user references a finding ID (e.g., INJ-001) and asks for a fix, or points to a file:line and asks to fix the security issue there.

florianbuetow Skill

This skill should be used when the user asks to "run security scan", "scan for vulnerabilities", "security check", "check security", or invokes /appsec:run. Smart orchestrator that detects the tech stack, selects relevant security tools, and runs them in parallel.

florianbuetow Bundle

This skill should be used when the user asks to "check for authentication issues", "analyze auth", "find credential vulnerabilities", "review login security", "check session management", or mentions "authentication", "passwords", "MFA", "sessions", or "brute force" in a security context. Maps to OWASP Top 10 2021 A07: Identification and Authentication Failures.

florianbuetow Skill

This skill should be used when the user asks to "generate fuzz inputs", "create fuzz tests", "fuzz test generation", "generate test payloads", "create security test cases", or "generate edge case inputs". Also triggers when the user wants intelligent test inputs for input parsers, API endpoints, file format handlers, or needs context-aware injection payloads for security testing.

florianbuetow Skill

This skill should be used when the user asks to "learn about security", "teach me OWASP", "security tutorial", "learn threat modeling", or invokes /appsec:learn. Interactive guided walkthrough using your codebase as teaching material.

florianbuetow Skill

This skill should be used when the user asks to "map to ATT&CK", "show attack techniques", "MITRE mapping", or wants to understand how findings relate to real-world attacker behavior. Maps security findings to MITRE ATT&CK tactics, techniques, and procedures.

florianbuetow Skill

This skill should be used when the user asks to "run OWASP analysis", "check OWASP Top 10", "OWASP scan", or invokes /appsec:owasp. Dispatches 10 category subagents (A01-A10) in parallel for comprehensive OWASP Top 10 coverage.

florianbuetow Skill

This skill should be used when the user asks to "start security analysis", "assess security", "which security tools should I use", "appsec start", "what should I scan", "security assessment", or invokes /appsec:start. Assesses the project's tech stack, data sensitivity, architecture, and installed scanners, then recommends which /appsec:* tools to run in priority order with rationale.

florianbuetow Skill

This skill should be used when the user asks to "configure security", "appsec settings", "security preferences", or invokes /appsec:config. Manages security tool preferences and thresholds.

florianbuetow Bundle

This skill should be used when the user asks to "check for cryptographic issues", "analyze encryption", "find weak hashing", "audit password storage", "check for hardcoded keys", or mentions "cryptography", "encryption", "hashing", "TLS", "certificates", or "random number generation" in a security context. Maps to OWASP Top 10 2021 A02: Cryptographic Failures.

florianbuetow Skill

This skill should be used when the user asks to "harden code", "security hardening", "improve security posture", "add security headers", "tighten security", "defensive coding suggestions", or "proactive security improvements". Also triggers when the user asks about CSP, CORS hardening, rate limiting, input validation improvements, security logging, or defense-in-depth measures.

florianbuetow Skill

This skill should be used when the user asks to "generate security report", "create appsec report", "export findings", "security summary", "findings report", "executive security summary", or "export to SARIF". Also triggers when the user wants a formatted overview of all security findings, remediation progress, scanner coverage, or needs to share security status with stakeholders.

florianbuetow Skill

This skill should be used when the user asks to "check CWE Top 25", "run SANS analysis", "check for common weaknesses", or mentions "CWE" or "SANS Top 25" in a security context. Checks code against the SANS/CWE Top 25 Most Dangerous Software Weaknesses.

florianbuetow Skill

This skill should be used when the user asks for "security status", "show findings", "security dashboard", "security posture", or invokes /appsec:status. Shows current security posture overview.

florianbuetow Skill

This skill should be used when the user asks to "verify fix", "confirm fix", "check if vulnerability is fixed", "validate remediation", "recheck finding", or "test if patch works". Also triggers when the user has applied a security fix and wants confirmation that the vulnerability is actually resolved, or when referencing a finding ID and asking if it is still present.

florianbuetow Skill

This skill should be used when the user asks to "explain security concept", "what is OWASP", "explain this finding", "what does this vulnerability mean", "explain stride", "explain injection", "what is CSRF", "explain spoofing", "what does INJ-003 mean", "compare stride vs pasta", or asks any question about security terminology, frameworks, vulnerability categories, or specific findings. Works at framework, category, finding, and comparison levels.

florianbuetow Bundle

This skill should be used when the user asks to "check GraphQL security", "analyze GraphQL endpoint", "find GraphQL vulnerabilities", "audit GraphQL schema", "check for introspection", "analyze query depth", or mentions "GraphQL", "introspection", "query depth limit", "query complexity", "GraphQL batching", "alias abuse", or "per-field authorization" in a security context.

florianbuetow Bundle

This skill should be used when the user asks to "check for logging issues", "analyze security logging", "find missing audit logs", "check for log injection", "audit monitoring configuration", or mentions "logging", "audit trail", "log injection", "monitoring", or "alerting" in a security context. Maps to OWASP Top 10 2021 A09: Security Logging and Monitoring Failures.

florianbuetow Bundle

This skill should be used when the user asks to "check for secrets", "find hardcoded credentials", "scan for API keys", "detect leaked tokens", "find passwords in code", "check for committed .env files", "scan for private keys", or mentions "secrets", "credentials", "API keys", or "leaked tokens" in a security context. Also triggers for git history secret scanning and high-entropy string detection.

florianbuetow Skill

This skill should be used when the user asks "what is IDOR", "define CSRF", "security glossary", or wants quick security term definitions. Quick reference for security terms, acronyms, and categories.

florianbuetow Skill

This skill should be used when the user asks to "check for spoofing", "analyze identity spoofing risks", "find authentication vulnerabilities", or mentions "spoofing" in a security context. Maps to STRIDE category S.

florianbuetow Bundle

This skill should be used when the user asks to "check for misconfigurations", "analyze security headers", "find misconfigured settings", "check CORS policy", "find debug mode", "audit server configuration", or mentions "misconfiguration" in a security context. Maps to OWASP Top 10 2021 A05: Security Misconfiguration.

florianbuetow Skill

This skill should be used when the user asks to "check for tampering", "analyze data integrity risks", "find injection vulnerabilities", or mentions "tampering" in a security context. Maps to STRIDE category T.

florianbuetow Bundle

This skill should be used when the user asks to "check WebSocket security", "analyze WebSocket authentication", "find WebSocket vulnerabilities", "audit WebSocket handlers", "check for CSWSH", or mentions "WebSocket", "ws://", "wss://", "socket.io", "CSWSH", "WebSocket origin check", "WebSocket rate limit", or "WebSocket authentication" in a security context.

florianbuetow Skill

This skill should be used when the user asks to "check for regressions", "verify fixes still hold", "regression test security", "check for reintroduced vulnerabilities", "security regression check", or "verify no old bugs returned". Also triggers when the user wants to confirm that previously fixed vulnerabilities have not been reintroduced by recent code changes.

florianbuetow Bundle

Analyze an existing CLAUDE.md against all 7 Claude Code source leak findings and produce a detailed gap report showing which limitations are mitigated, partially addressed, or completely unaddressed. Use when the user says "fixclaude analyze", "analyze claude md", "check claude md coverage", "audit claude directives", or "what's missing from my claude md".

florianbuetow Bundle

This skill should be used when the user asks to "check file upload security", "analyze upload validation", "find upload vulnerabilities", "check for zip slip", "audit file upload handling", or mentions "file upload", "upload validation", "content-type check", "magic bytes", "zip slip", or "path traversal in upload" in a security context.

florianbuetow Skill

This skill should be used when the user asks to "define technical scope", "map attack surface", "identify entry points", "build a data flow diagram", or is running PASTA stage 2. Also triggers when the user asks about DFDs, network boundaries, external dependencies, or deployment topology in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 2 of 7).

florianbuetow Skill

This skill should be used when the user asks to "analyze vulnerabilities", "find security weaknesses", "map CWEs", "run vulnerability analysis", or is running PASTA stage 5. Also triggers when the user asks about SAST, DAST, dependency scanning, or CWE mapping in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 5 of 7).

florianbuetow Skill

This skill should be used when the user asks to "check for repudiation", "analyze audit logging", "find logging gaps", or mentions "repudiation" or "non-repudiation" in a security context. Maps to STRIDE category R.

florianbuetow Skill

This skill should be used when the user asks to "review plan for security", "check plan for security issues", "security review of implementation plan", "audit the plan for vulnerabilities", or "check my plan before coding". Also triggers when the user mentions security in the context of an implementation plan, architecture proposal, or design document before code has been written. This is the FLAGSHIP pre-code security skill -- no other tool reviews plans at design time.

florianbuetow Skill

This skill should be used when the user asks to "check for unawareness", "analyze consent mechanisms", "find privacy issues related to transparency", "check for hidden data collection", "audit user consent flows", or mentions "unawareness" in a privacy context. Maps to LINDDUN category U. No STRIDE equivalent exists.

florianbuetow Bundle

This skill should be used when the user asks to "check for vulnerable dependencies", "audit dependencies", "find outdated packages", "scan for CVEs", "check for typosquatting", or mentions "vulnerable components", "outdated dependencies", or "supply chain" in a security context. Maps to OWASP Top 10 2021 A06: Vulnerable and Outdated Components.

florianbuetow Skill

This skill should be used when the user asks to "analyze threats", "identify threat actors", "map attack vectors", "cross-reference MITRE ATT&CK", or is running PASTA stage 4. Also triggers when the user asks about adversary tactics, supply chain threats, or threat intelligence in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 4 of 7).