Security

smirnovalex-qa Skill

Independent QA/tech-lead audit of a bugfix — verifies against the facts of the code and tests whether the bug is actually fixed, whether a regression was introduced, whether adjacent functionality got broken, and whether the implementation meets enterprise/prod-ready standards. Use when asked to check/audit a bugfix, review a fix, confirm a bug is really fixed before merge/release, or check whether fixing the bug caused a regression.

smirnovalex-qa Skill

Независимый QA/tech-lead аудит багфикса — проверяет по фактам кода и тестов, действительно ли баг исправлен, нет ли регрессии, не сломан ли смежный функционал, и соответствует ли реализация enterprise/prod-ready стандартам. Используй когда просят проверить/заодитить фикс бага, ревьюнуть исправление, убедиться что баг реально пофикшен перед мержем/релизом, или проверить нет ли регрессии от исправления бага.

smirnovalex-qa Skill

Focused performance and resource-cost audit of ONE specific feature/change in the-platform (not the whole codebase) — scope taken from a directory/branch/diff, a requirements document, or a YouTrack issue; the same measurement discipline as the full audit (EXPLAIN ANALYZE, py-spy, bundle size, k6), a "before/after" comparison if the feature replaces existing functionality, an explicit production-readiness verdict. Use when asked to check the performance/resource consumption of a specific feature, branch, PR, or YouTrack task before merge/release, to assess whether a new implementation degraded existing functionality in speed/resources, or to give the resource-cost green light for that specific change — even without the word "audit", e.g. "will this feature take down the database", "how much will this eat at real volumes", "is this branch ready performance-wise".

smirnovalex-qa Skill

Точечный аудит производительности и ресурсоёмкости ОДНОЙ конкретной фичи/изменения в the-platform (не всей кодовой базы) — периметр из директории/ветки/diff, документа требований или YouTrack issue; та же дисциплина измерений, что и у полного аудита (EXPLAIN ANALYZE, py-spy, размер бандла, k6), сравнение "до/после" если фича заменяет существующий функционал, явный вердикт готовности к продакшену. Используй когда просят проверить производительность/расход ресурсов конкретной фичи, ветки, PR или YouTrack-задачи перед мержем/релизом, оценить не деградировала ли новая реализация существующий функционал по скорости/ресурсам, или дать зелёный свет по ресурсоёмкости именно для этого изменения — даже без явного слова "аудит", например "не положит ли эта фича базу", "сколько это будет жрать на реальных объёмах", "готова ли эта ветка по производительности".

ghosteken Skill

Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems.

ghosteken Bundle

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

ghosteken Skill

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

ghosteken Skill

Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.

ghosteken Bundle

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

ghosteken Bundle

Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

ghosteken Skill

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

ghosteken Bundle

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across multiple ecosystems to identify vulnerabilities, assess risks, and provide automated remediation strategies.

theneoai Bundle

Metasploit Expert

theneoai Bundle

HashiCorp Vault Expert

theneoai Bundle

Container Security Expert

theneoai Bundle

Gerrit Permission Manager

wesleyegberto Skill

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

wesleyegberto Skill

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.

kok-o Bundle

Minimalist coding mindset. Write only what is strictly necessary for the task. 7-rung decision ladder before writing any code. Eliminates premature abstraction while keeping all safety, validation, error handling, and security guards intact.

gongyijie85 Skill

HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

gongyijie85 Skill

Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations. Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration.

gongyijie85 Skill

Local-evidence production readiness audit for shipped apps, pre-launch reviews, post-merge checks, and "what breaks in prod?" questions without sending repo data to an external audit service. Use when auditing production readiness before launch, after a merge, or when asked what breaks in prod.

gongyijie85 Skill

Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security. Use when reviewing Quarkus authn/authz, JWT or OIDC, RBAC, validation, or secrets.

gongyijie85 Skill

Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math. Use when auditing or writing Solidity AMM, liquidity pool, or swap code.

gongyijie85 Skill

PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices. Use when designing PostgreSQL schemas, indexes, or RLS policies, or when a query is too slow.

gongyijie85 Skill

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services. Use when reviewing Spring Security authn/authz, validation, CSRF, secrets, headers, or rate limiting.

pa4uslf Skill

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

pa4uslf Skill

Kimlik doğrulama eklerken, kullanıcı girdisi işlerken, secret'larla çalışırken, API endpoint'leri oluştururken veya ödeme/hassas özellikler uygularken bu skill'i kullanın. Kapsamlı güvenlik kontrol listesi ve kalıplar sağlar.

pa4uslf Bundle

認証の追加、ユーザー入力の処理、シークレットの操作、APIエンドポイントの作成、支払い/機密機能の実装時にこのスキルを使用します。包括的なセキュリティチェックリストとパターンを提供します。

pa4uslf Bundle

인증 추가, 사용자 입력 처리, 시크릿 관리, API 엔드포인트 생성, 결제/민감한 기능 구현 시 이 스킬을 사용하세요. 포괄적인 보안 체크리스트와 패턴을 제공합니다.

yknothing Bundle

Use when a concrete code change is ready for review and the reviewer must evaluate correctness, security, maintainability, test adequacy, contract alignment, and brownfield safety before merge, especially when unsupported flows, backward compatibility, or release-boundary constraints must be enforced.

yknothing Bundle

Use when a reviewed change, release candidate, or high-risk slice must be challenged for abuse paths, trust-boundary failures, secret handling, dependency risk, or data exposure before release.

is-bo Skill

Audit local persistence, queued actions, synchronization, conflicts, revocation, privacy, and recovery under intermittent connectivity.

is-bo Skill

Build an evidence-backed application profile and architecture map before any specialized audit begins.

is-bo Skill

Audit money movement, pricing, entitlements, provider events, reconciliation, idempotency, and sensitive data boundaries.

is-bo Skill

Perform a threat-informed audit of trust boundaries, injection, secrets, browser controls, dependencies, and abuse cases.