Security

unitoneai Skill

Virtual CISO role bundle for organizations without a full-time CISO. Orchestrates security program assessment, compliance readiness, risk management, and board-level reporting. Auto-invoked when the user asks for security program guidance, compliance assessment, risk posture evaluation, or board reporting preparation. Sequences the appropriate security skills based on engagement type.

unitoneai Skill

SOC Analyst role bundle covering Tier 1 through Tier 3 operations. Orchestrates alert triage, threat hunting, incident investigation, and detection engineering workflows. Auto-invoked when the user needs help with security monitoring, alert analysis, threat hunting hypotheses, incident timelines, or detection rule development. Sequences the appropriate security skills based on the operational engagement type.

unitoneai Bundle

Reviews REST and GraphQL APIs against the OWASP API Security Top 10:2023. Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication, rate limiting, and SSRF. Produces findings mapped to API1-API10 with remediation guidance.

unitoneai Skill

Reviews identity and access management configurations against NIST SP 800-63B, NIST SP 800-207 zero trust principles, and CIS Controls v8. Auto-invoked when reviewing IAM policies, role definitions, user provisioning workflows, or when asked to assess identity security posture. Produces findings on least privilege violations, MFA gaps, stale accounts, and service account hygiene with prioritized remediation.

unitoneai Skill

Guides structured triage of security alerts using a four-phase methodology (collect, correlate, classify, escalate) mapped to MITRE ATT&CK v16 and aligned with NIST SP 800-61 Rev 2 incident handling guidelines. Auto-invoked when the user discusses alert investigation, asks "is this a true positive?", or shares alert data requiring disposition. Produces a triage decision with priority assignment, disposition category, and escalation recommendation.

unitoneai Skill

Performs a structured DNS security review against NIST SP 800-81 Rev 2 (Secure Domain Name System Deployment Guide) and CIS Controls v8 (Control 9.2 -- Use DNS Filtering Services). Auto-invoked when reviewing DNS configurations, DNSSEC deployment, or investigating DNS-based exfiltration and tunneling indicators. Produces a DNS security assessment covering DNSSEC validation, protective DNS, and exfiltration detection patterns.

unitoneai Skill

Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI integration patterns.

unitoneai Bundle

Reviews web applications against the OWASP Top 10:2021 vulnerability categories. Auto-invoked when reviewing web application code, server configurations, or when a user asks for a general security review of a web application. Produces structured findings mapped to A01-A10 with CWE references, severity ratings, and specific remediation guidance.

unitoneai Skill

Performs a structured firewall rule base audit against CIS Controls v8 (Controls 4.4 and 4.5) and NIST SP 800-41 Rev 1 (Guidelines on Firewalls and Firewall Policy). Auto-invoked when reviewing firewall configurations, ACLs, or network security policies. Produces a prioritized findings report covering overly permissive rules, shadowed rules, logging gaps, and egress filtering deficiencies.

unitoneai Bundle

Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity ratings and specific remediation guidance.

unitoneai Skill

Performs a PCI DSS v4.0 compliance review across all 12 requirements and their sub-requirements. Auto-invoked when discussing payment card security, cardholder data protection, PCI compliance validation, or merchant/service provider assessment. Covers scope reduction strategies, SAQ vs ROC determination, compensating controls, customized approach, and the new targeted risk analysis requirements introduced in v4.0.

unitoneai Bundle

Analyzes project dependencies for known vulnerabilities, license risks, and supply chain integrity. Auto-invoked when package manifests (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml) are shared or when discussing dependency security. Produces an SBOM assessment with CVE findings triaged by EPSS and CISA KEV, license compliance check, and supply chain risk rating.

sidetoolco Skill

Review code for vulnerabilities, implement secure authentication, and ensure OWASP compliance. Handles JWT, OAuth2, CORS, CSP, and encryption. Use PROACTIVELY for security reviews, auth flows, or vulnerability fixes.

snowflake-labs Bundle

Use when a contributor has built a Cortex Code skill locally and wants a pre-PR readiness check before opening a pull request against Snowflake-Labs/cortex-code-skills. Verdict: promote, adapt, or skip — with concrete fixes. Triggers: "review a skill", "is this skill ready for labs", "check this skill before PR", "audit skill for promotion", "does this skill belong in labs".

wardawgmalvicious Skill

Execute the handoff briefs a /drift-handoff run wrote to docs/audits/<audit-date>/<source-id>/ — apply each brief's edits, run its own verification steps, and stamp it done. Use when the user says to execute, apply, action, or work through the drift handoffs or briefs, or points at a docs/audits directory. Reads briefs from disk and never from the conversation, so it runs cold in a fresh session (preferred) or warm straight after /drift-audit and /drift-handoff. Walks briefs in numbered order with a checkpoint each — confirm the brief's quoted evidence still exists, apply, verify, stamp, continue — and stops on the first failure rather than pressing on. Briefs whose Kind is a decision rather than an edit are put back to the user, never executed. Skips briefs already carrying an execution log, so an interrupted run resumes where it stopped. Hands off to /commit at the end.

wardawgmalvicious Bundle

Turn a completed drift-audit report into handoff briefs on disk. Use immediately after a /drift-audit run, or when the user asks to prepare handoffs, write up the findings, or capture the recommended actions from an audit. Writes one directory per run — docs/audits/<audit-date>/<source-id>/ — holding the audit report verbatim as 00-audit-report.md plus one numbered brief per recommended action, grouped so each brief covers a single kind of work with its own verification steps. Only recommended actions become briefs; every other finding stays a conversational read-through. Runs inline and reads the report from the current session, so it cannot reconstruct an audit it did not see.

cwijayasundara Bundle

Run the adaptive pre-merge quality gate: deterministic checks, evaluator, diff review, and security review only when the diff crosses a security/data/API boundary. (Renamed from /review to avoid colliding with Claude Code's native /review PR-review command.)

cwijayasundara Skill

[Internal pipeline stage — run by the planning stages; invoke directly only as a power user.] Bounded clarification gate for resolving product, domain, API, security, or architecture uncertainty without exhausting the user.

cwijayasundara Skill

Implement an approved /retro recommendation and open a PR against this harness repo. Use after a human has approved a recommendation via /retro --apply-decisions. Merge always stays human — this skill only opens the PR, never merges. Refuses gate-loosen/security-class recommendations outright; those are permanently human-gated and must go through /vibe or /change manually.

theyoungastronauts Skill

Django/DRF verification checklist — models, serializers, views, security, API contract.

traygerbig Skill

macOS security hardening for Claude Code — pre-execution validation, malicious config detection, credential hygiene, endpoint protection

davesnx Bundle

Review, execute, reconcile, or publish an existing codebase audit plan. Use when the user points to an existing plan and asks to review, implement, reconcile, or publish it. Source edits happen only in an isolated worktree; never merge or push without authorization, and never touch the main worktree. Use improve-codebase-architecture instead to discover improvements or create a new audit.

davesnx Bundle

Review local changes, branch diffs, commits, or pull requests for correctness, security, regressions, maintainability, standards, spec compliance, and blast radius. Use for "review", "code review", "review PR", "deep review", "adversarial review", "thermonuclear", "blast radius", or "review and ship". Accepts an optional fixed point, PR number, or PR URL.

zauberzeug Bundle

Hunt for one previously-undocumented defect, doc drift, missing test, or inconsistency; file it via Skill(create-card). AUTO-INVOKE on "find me a bug", "audit X", "check for inconsistencies", or /audit-deck. Inconsistencies are the primary lead.

zauberzeug Skill

Query or change how often this repo's autonomous GitHub Actions run (pull-card, audit-deck, refine-deck). AUTO-INVOKE when the user asks what the current cadence is, how often pull-card/audit/refine run, to speed up or slow down the deck, to run pull-card every N hours, to change the autonomous cadence, or to retune the workflows. Repo-local dev skill that wraps scripts/set_cadence.py; not a packaged goc skill.

cboone Bundle

Set up GitHub Actions CI with test, lint, format, and vulnerability check jobs, plus matching Makefile targets. Use when the user says "set up CI", "add GitHub Actions", "create a CI workflow", "add CI", "set up GitHub Actions CI", "configure CI", or wants test, lint, and format jobs wired up for a project. Detects the project language (Go, JavaScript/TypeScript, Python, Rust, Ruby, Shell, Zig, Zsh, or multi-language) and selects the matching template. Pairs with set-up-linters (linter configuration), set-up-secret-scanning (gitleaks/TruffleHog), and add-scrut-cli-tests (CLI snapshot tests).

cboone Bundle

Best practices for handling user-provided secrets in CLI tools. Use when: (1) building CLI tools that accept API keys, tokens, or passwords from users, (2) reviewing secret-handling code for security issues, (3) choosing between input methods (env vars, stdin, keychains, config files), (4) implementing credential storage or retrieval. Covers the security hierarchy of input methods, credential storage patterns, secret masking, and language-specific libraries.

cboone Bundle

Pin every version surface in a repository to commit hashes, integrity digests, or specific versions as a one-shot supply-chain hardening pass. Use when the user says "pin everything", "pin all versions", "harden version pinning", "SHA-pin actions", "SHA-pin all the actions", "pin to commit hashes", "audit version pins", "pin all uses to commit hashes", or wants to harden a repository against supply-chain attacks. SHA-pins GitHub Actions, integrity- pins Yarn via Corepack, exact-pins application package-manager dependencies, migrates scaffolded CI to language version files, pins install commands, and optionally generates a weekly drift-audit script. For ongoing template-drift detection use refresh-project-scaffolding; for credential-leak hardening use set-up-secret-scanning.

cboone Bundle

Detect project languages, recommend linters and formatters, install them, and generate config files, including Pandoc-academic Markdown presets. Use when the user says "set up linters", "add linters", "configure linters", "set up formatters", "add a formatter", "add prettier", "add eslint", "add golangci-lint", "add ruff", "add clippy", "add markdownlint", "generate linter configs", "lint configuration", or wants linting and formatting wired up for a project. Detects Go, JavaScript/TypeScript, Python, Ruby, Rust, Shell, Swift, Zsh, Lean, and Markdown. Pairs with set-up-ci (CI workflows), set-up-secret-scanning (gitleaks and TruffleHog), and lint-and-fix (running the linters once they are configured).

cboone Bundle

Assess every version reference in a repository, check current upstream versions, evaluate repo-specific risk and reward, and present selectable upgrade options. Use when the user says "upgrade everything", "upgrade all versions", "check dependency upgrades", "assess upgrades", "update dependencies", "what can be upgraded", or asks for a full upgrade audit. Always includes every discovered upgrade candidate in the plan and applies upgrades only after explicit user selection.

cboone Bundle

Add standard community files to a project: CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, and a pull request template. Use when the user says "add community files", "add contributing guide", "prepare for open source", "add code of conduct", "add security policy", or any variant involving adding community or open-source readiness files to a project.

cboone Bundle

Bootstrap, audit, and maintain REUSE-style mixed-license coverage in a repository: populate `LICENSES/`, write a root `NOTICE`, wire a root `REUSE.toml`, apply SPDX headers or sidecars to files, and keep `reuse lint` clean. Use when the user says "license this repo", "bootstrap licensing", "add SPDX headers", "normalize LICENSES", "audit license coverage", "REUSE lint", "fix REUSE", "add a NOTICE", "set up multi-license", "this new file needs a license header", or any variant involving SPDX, REUSE, `.license` sidecars, CC-BY, or dual licensing in a repo-maintenance context. Do not fire for legal interpretation of license text or for third-party dependency licensing questions.

agentflocks Skill

指导 Flocks 新建、添加和接入安全设备。Use when the user asks to create, add, onboard, or connect a new security device.

1398281322-a11y Skill

接口安全

anthonyalcaraz Bundle

Bi-temporal edge primitive for agentic graph memory. Tracks two independent time dimensions per relationship: when the relationship was VALID in the domain (valid_from / valid_until) and when the system LEARNED about it (ingested_at). Enables point-in-time queries like "What was the EC2 instance type for service-checkout-api at 2026-03-15T08:00Z when the outage occurred?" — answerable even after the config has changed. Graphiti / Zep production pattern (Ch4). Use when memory must answer "what did we know and when did we know it" questions: incident reconstruction, audit, root-cause forensics, regulated environments. NOT for ephemeral cache state (use TTL), NOT for append-only event logs (use kafka-style log, no validity window needed), NOT for single-point- in-time configs (use a plain dict).

ardurai Bundle

God-level codebase review, indexing, and audit skill. Use when reviewing, auditing, or analyzing any codebase — existing or newly written. Covers deep code indexing, multi-pass review (bugs, vulnerabilities, architecture, quality, performance, maintainability), zero-shortcut audit methodology, tool-driven analysis, and continuous self-checking. Never skips files, never assumes correctness, never takes shortcuts. Reviews for security vulnerabilities (OWASP Top 10, CWE, CVE patterns), code quality, design principle adherence, test coverage adequacy, dependency risk, and technical debt.