Security

jqaisystems Bundle

Refresh and verify a GitHub profile or public proof layer. Use when the user wants to update GitHub profile visuals, replace README assets while preserving paths, audit profile image references, validate live GitHub rendering, prepare LinkedIn/X proof copy, or document a profile-refresh proof trail.

natuleadan Bundle

Testing practices (vitest, TDD, coverage), security rules (secrets, XSS, injection, CORS), and seed data patterns (anonymization, multi-language).

natuleadan Bundle

Multi-layer web security patterns — rate limiting, Content Security Policy, security headers, CORS, IP deny lists, and graceful degradation.

natuleadan Bundle

Secures npm, pnpm, and bun against supply chain attacks — lockfile enforcement, provenance, version pinning, dependency audit, and script blocking.

natuleadan Bundle

Supabase platform — Row Level Security, Edge Functions, Realtime patterns, Storage signed URLs, PostgreSQL schema design, and anti-patterns.

natuleadan Bundle

Day-to-day package management for npm, pnpm, and bun — install, update, audit, publish, dependency inspection, and version conflict resolution.

nimbusxr Bundle

Create and monitor geofences for perimeter security and proximity alerts

dragoon0x Skill

Audit visual density and whitespace balance. Checks that spacing from your system creates appropriate rhythm between sections.

dragoon0x Skill

Audit elevation consistency. Checks that shadow usage follows a logical hierarchy — cards < dropdowns < modals.

dragoon0x Skill

Find every font-size in the codebase that doesn't match your type scale. Lists violations with suggested scale values.

dragoon0x Skill

Find every color in the codebase that isn't in your palette or token system. Lists orphan colors with suggested replacements.

dragoon0x Skill

Find every spacing value in the codebase that doesn't match your scale. Lists violations by file and line.

dragoon0x Skill

Check background color hierarchy. Verifies that surfaces, cards, and modals use the correct token from your system.

dojogenesis Skill

Systematically audit all skills in a directory to assess completeness, grade each skill, identify ecosystem-wide patterns, and prioritize upgrades. Use for quarterly maintenance, after creating 5+ new skills, when skills are reported as confusing, before major releases, after major refactors, or when onboarding new contributors to assess current ecosystem health.

navanithans Bundle

Start code reviews, PR checks, or bug analysis. Triggers: "review my code", "check this PR", "analyze for bugs", "code review". Do NOT use for: - Automating fixes (use `ask-python-refactor`). - Generating new features. Capabilities: - Static analysis: Correctness, Security, Performance, Style. - Feedback priority: Critical > Performance > Style.

navanithans Bundle

Pre-flight security checker. Scan for secrets and vulnerabilities.

navanithans Bundle

Orchestrator skill that splits a target repository into chunks and runs multiple audit subagents in parallel to bypass context limits.

navanithans Bundle

Static security analysis auditing for OWASP Top 10 risks.

navanithans Bundle

Audit repos for architectural drift, dead code, and abstraction bloat.

alti3 Bundle

Build secure Litestar APIs using authentication middleware, built-in security backends, guards, endpoint inclusion and exclusion controls, JWT validation, request-boundary discipline, and secret-safe data handling. Use when implementing or auditing end-to-end API security controls in Litestar. Do not use for generic request parsing, unrelated business logic, or non-security transport concerns.

alti3 Bundle

Implement Litestar authentication with custom authentication middleware, built-in security backends, JWT and session flows, route inclusion and exclusion rules, and typed auth context on `Request` / `ASGIConnection`. Use when establishing identity, issuing or validating credentials, or attaching authenticated user context in Litestar. Do not use for generic request parsing, broad security audits, or unrelated transport concerns.

alti3 Bundle

Implement Litestar exception handling with HTTPException, built-in exception subclasses, custom exception handlers, layered overrides, status-code mappings, and stable API error contracts. Use when translating domain failures, validation errors, middleware/dependency failures, or router-generated HTTP errors into deterministic Litestar responses. Do not use for authentication or authorization policy design that belongs in security layers.

alti3 Bundle

Design Advanced Alchemy SQLAlchemy models using its base classes, mixins, unique-record helpers, relationship patterns, and declarative base customization. Use when building or refactoring database models, choosing UUID or bigint key strategies, adding slugs or audit columns, or simplifying deduplicated many-to-many workflows. Do not use for repository or HTTP endpoint logic.

popup-studio-ai Skill

View audit logs, decision traces, and session history for AI transparency. ACTION_TYPES (19 entries) include PDCA events (phase_transition, gate_passed/failed, agent_spawned/completed/failed, rollback_executed, destructive_blocked) and Sprint events (sprint_paused, sprint_resumed, master_plan_created — v2.1.13). Triggers: audit, log, decision trace, history

popup-studio-ai Skill

Manage PDCA checkpoints and rollback — create, list, restore for safe recovery. Rollback events are recorded via lib/audit/audit-logger ACTION_TYPES.rollback_executed. For sprint-level recovery, individual feature rollbacks may be triggered from within sprint phases (sprint itself is forward-only — terminal state is `archived`, not rolled back; v2.1.13). Triggers: rollback, checkpoint, restore, undo

roodlicht Skill

SOC 2 Type II prep — AICPA Trust Services Criteria (Security required plus Availability/Confidentiality/Processing Integrity/Privacy), Common Criteria CC1–CC9, Type I vs Type II choice, evidence-collection rhythm, auditor-friendly packaging, Complementary User Entity Controls.

roodlicht Skill

ISO/IEC 27001:2022 ISMS implementation and certification prep — clauses 4-10 (context, leadership, planning, support, operation, evaluation, improvement), Annex A 93 controls across four themes, Statement of Applicability, Stage 1/Stage 2 audit prep, and the certification cycle.

roodlicht Skill

SIEM query-builder workflow — Splunk SPL, Microsoft Sentinel/Defender KQL, Elastic EQL/KQL, with cross-translation patterns, performance tuning (data models, summary indexes, CCS), and query-by-detection-need. Source layer for detection-engineer, log-triage, and threat-hunt.

roodlicht Skill

API security review against OWASP API Top 10 2023. Covers auth (OAuth2/JWT/API-keys), object-level authorization (BOLA/IDOR), schema validation, rate-limiting, CORS, SSRF, and GraphQL-specific concerns (introspection, query depth, batching).

roodlicht Skill

Dynamic Application Security Testing workflow — OWASP ZAP automation (baseline/full/API scans), Burp Suite Professional playbooks, Burp Collaborator for out-of-band detection, auth-state orchestration, and CI integration with scope-safe active scanning.

roodlicht Skill

Evidence collection and packaging for security audits — evidence types (inspection/observation/inquiry/re-performance/automated), cadence per control, chain of custody, period tagging, WORM storage and retention, auditor delivery. Usable for SOC 2, ISO 27001, NIS2, DORA, and internal audits.

roodlicht Skill

Policy-drafting workflow for security policies — AUP, Incident Response Plan, Access Control, Data Classification, BCP, Change Management, Vendor Management, Crypto, and Remote Work. Structure with Purpose/Scope/Statement/Roles/Enforcement/Review, ISO 27001 Annex A.5 alignment, NL/EN drafting.

roodlicht Skill

Security review workflow for a PR, feature or codebase — scope, automated scans, manual OWASP/CWE pattern-check, prioritize and report. Uses secure-coding as pattern library.

roodlicht Skill

Digital-forensics assistant for IR context — memory analysis via Volatility 3, disk-imaging hygiene (write-blocker, hash validation), timeline reconstruction via plaso/log2timeline, file-system artifacts per OS. Audit-grade evidence; courtroom-grade chain of custody requires additional specialized forensics work.

roodlicht Skill

SAST orchestration for Semgrep, CodeQL and SonarQube. Covers tool selection, ruleset curation, PR-comment integration, noise reduction with baselines, and language-specific linters (bandit, gosec, brakeman, eslint-security) when they add coverage.

roodlicht Skill

Structured red-team pass over your own output — surface assumptions, gaps, failure modes and security red flags before shipping.