Security

pyfagorass Bundle

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

onfire7777 Bundle

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.

onfire7777 Bundle

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.

onfire7777 Bundle

Harden LDAP directory services against common attacks including credential harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers LDAPS enforcement, channel binding, LDAP si

onfire7777 Bundle

SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate message integrity, and define policies for handling unauthenticated mail. Proper im

onfire7777 Bundle

Ed25519 is a high-performance digital signature algorithm using the Edwards curve Curve25519. It provides 128-bit security with 64-byte signatures and 32-byte keys, offering significant advantages ove

pyfagorass Skill

Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".

pyfagorass Skill

Administer IT — monitor security and configure Workspace.

prism-shadow Bundle

Solve Cedar Ridge Intake Coordination Portal tasks — patient access verification, referral readiness audits, transfer packet reviews, chronic-care enrollment panels, and referral-to-chart activation. Use when a task points at the Cedar Ridge portal and asks for a single JSON object following an answer_template.json. Read BEFORE querying the portal.

prism-shadow Bundle

Solving Cedar Ridge Intake Coordination Portal audit/intake tasks — reconcile patient, referral, transfer, chart, and program data into a strictly-templated JSON answer. Use whenever a task points at the Cedar Ridge portal (batches like NPI-JUN-01, ORTHO-JUN-01, DIAL-WINTER-01, DMHTN-2026A, PULM-JUN-02) and asks for a JSON activation/audit/enrollment file.

prism-shadow Bundle

Asteria Fleet Data Quality Hub — Audit & Certification Skill

prism-shadow Bundle

Public Health Observatory Algorithmic Audit Skill

prism-shadow Skill

PHO Audit Task Group -- Shared Skill Reference

prism-shadow Skill

Resolve PeopleOps Console HR lifecycle/leave/payroll/policy-case/recruitment/document/audit tasks by applying source-precedence, folder-readiness, notice-defect, and audit-scope rules and emitting the template's normalized business labels.

prism-shadow Bundle

Produce a clerk-ready court-operations closeout packet as a single structured JSON object matching a provided answer template, by reconciling local case materials (hearing/bench notes, clerk audit or supervisor memos, finance queue or worksheet extracts, financial petitions, and local form excerpts) against the authoritative court operations portal (system of record). Use for criminal sentencing/disposition closeouts, disposition registers, fee reconciliation, traffic-citation closeouts, installment/extended payment plans, probation referrals, and license-suspension orders. Triggers when a task gives target cases/citations/petitions plus mixed local documents and a portal, and asks for audit findings, corrected dispositions, fee/register totals, payment schedules, form/placeholder handling, or excluded-charge lists in a schema-constrained JSON.

prism-shadow Skill

Asteria Fleet Data Quality Hub — Audit & Certification Skill

prism-shadow Skill

Asteria Fleet Data Quality Hub — Audit & Certification Skill

prism-shadow Skill

Public Health Observatory — Algorithmic Transport Audit Skill

prism-shadow Skill

Public Health Observatory Algorithmic Audit Skill

prism-shadow Skill

PHO Algorithmic Audit Skill

charlieviettq Skill

Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.

caishengold Skill

当需要对SuperPowers运营进行内部审计时使用。触发场景：月度运营审计、财务审计、流程合规审计、质量趋势审计。当用户提到"审计"、"内审"、"audit"、"检查运营"、"流程规范吗"、"有没有漏洞"时应触发此技能。独立于被审计角色，提供客观评估。

caishengold Skill

当需要撰写审计报告相关专业文案、行业指南、科普文章时使用。触发场景：审计报告/内审。当用户提到"审计报告"、"审计报告"、"内审"、"audit"、"report"时应触发此技能。

caishengold Skill

当需要编写能源审计报告、节能诊断、能效评估时使用

caishengold Skill

当需要撰写安全评估报告、渗透测试报告、漏洞报告时使用。触发场景：安全评估报告、渗透测试报告、漏洞披露、风险评级。当用户提到"安全报告"、"渗透测试报告"、"漏洞报告"、"security report"、"pentest report"时应触发此技能。

paulasilvatech Skill

Apply Spring Boot best practices for project structure, dependency injection, configuration, REST controllers, DTO validation, services, transactions, Spring Data JPA, logging, testing, and security. Use when asked for Spring Boot guidance or to implement Java backend code.

paulasilvatech Skill

Use this skill when the user asks to modernize legacy code with a disciplined GitHub Copilot workflow: brief, assess, map, extract business rules, reimagine architecture, transform modules, and harden with tests and security review. Trigger for COBOL, JCL, legacy Java, .NET, C++, classic ASP, monolith modernization, behavior-preserving rewrite, business-rule extraction, modernization assessment, or legacy-to-modern transformation.

paulasilvatech Bundle

Review, audit, author, and harden GitHub Actions workflows against Actions-specific threats: untrusted-input script injection, privileged trigger escalation, mutable action references, over-scoped GITHUB_TOKEN permissions, unsafe GITHUB_ENV/GITHUB_OUTPUT writes, secret exposure, OIDC misuse, and self-hosted runner risk. Use for .github/workflows/*.yml, secure my CI, pull_request_target danger, SHA pinning, or permissions lockdown.

paulasilvatech Bundle

Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references/SOURCES.md for verification. Use when asked: "assess breach impact", "what data could be exposed", "calculate blast radius", "data exposure analysis", "how bad would a breach be", "quantify data risk", "sensitive data inventory", "data flow security audit", "pre-breach assessment", "worst-case breach scenario", "breach readiness", "data risk report", "/data-breach-blast-radius". For any stack handling user data, health records, or financial information. Output labels law-sourced figures (exact) vs heuristic estimates (planning only). Does not replace legal counsel.

paulasilvatech Skill

Use this skill when the user asks to modernize legacy code with a disciplined GitHub Copilot workflow: brief, assess, map, extract business rules, reimagine architecture, transform modules, and harden with tests and security review. Trigger for COBOL, JCL, legacy Java, .NET, C++, classic ASP, monolith modernization, behavior-preserving rewrite, business-rule extraction, modernization assessment, or legacy-to-modern transformation.

paulasilvatech Skill

Review or generate Salesforce Apex classes, triggers, handlers, batch jobs, and test classes with quality guardrails for bulk safety, explicit sharing, CRUD/FLS enforcement, SOQL injection prevention, PNB tests, trigger architecture, and modern Apex idioms. Use when asked to catch governor limit risks, security gaps, and Apex deployment quality issues.

paulasilvatech Skill

Review or improve .NET and C# code against solution/project best practices for documentation, architecture, dependency injection, resources, async, tests, configuration, Semantic Kernel, logging, performance, security, SOLID, and code quality. Use when asked for .net/c# or .NET/C# best practices or cleanup.

paulasilvatech Skill

Apply Spring Boot best practices for project structure, dependency injection, configuration, REST controllers, DTO validation, services, transactions, Spring Data JPA, logging, testing, and security. Use when asked for Spring Boot guidance or to implement Java backend code.

paulasilvatech Bundle

Review, audit, author, and harden GitHub Actions workflows against Actions-specific threats: untrusted-input script injection, privileged trigger escalation, mutable action references, over-scoped GITHUB_TOKEN permissions, unsafe GITHUB_ENV/GITHUB_OUTPUT writes, secret exposure, OIDC misuse, and self-hosted runner risk. Use for .github/workflows/*.yml, secure my CI, pull_request_target danger, SHA pinning, or permissions lockdown.

sheshiyer Skill

Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies. USE WHEN handling user input, building Perl web apps, running system commands, writing DBI queries, or reviewing Perl for vulnerabilities.

sheshiyer Bundle

Comprehensive security checklist and patterns to catch vulnerabilities in application code. USE WHEN adding authentication or authorization, handling user input or file uploads, creating API endpoints, working with secrets or credentials, implementing payment features, or storing and transmitting sensitive data.