Plugins

12 plugins

Security from nivkazdan/skills-agents-catalog.

16 skills · plugin

Security audits, vulnerability scanning and secure coding.

30 skills · plugin

Code Security Review Pipeline

Audit code changes for bugs, security flaws, and quality issues before merging.

15 skills · plugin

@alirezarezvani

Engineering Team

32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security,

16 skills · plugin

Static Analysis

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

3 skills · plugin

Testing Handbook Skills

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills · plugin

MCP Security Audit Pipeline

Audit MCP servers for secrets exposure, shell injection, and supply chain risks.

12 skills · plugin

Secure Laravel Deployment

Installs a pipeline to harden, audit, verify, and enforce security for Laravel apps.

4 skills · plugin

Secure Firebase Backend

Installs a pipeline to validate, plan, execute, and enforce Firebase security best practices.

7 skills · plugin

PR Review Pipeline

Install this pack to review a PR with structured analysis, security scanning, and quality enforcement.

11 skills · plugin

Bug Finding Pipeline

Install this pack to detect bugs, security issues, and logical errors in your branch changes.

9 skills · plugin

Secure Spring Boot Service

Installs a pipeline to harden, audit, verify, and enforce security for Spring Boot services.

4 skills · plugin

Results for “security”

185 skills

AI Prompt Engineering Safety Review

Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness, providing detailed improvement recommendations with frameworks, testing methodologies, and educational content.

Builds and queries multi-language source code graphs for security analysis, including blast radius, taint propagation, privilege boundaries, and entry point enumeration.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Scans Python and JavaScript codebases for bugs, security vulnerabilities, code smells, and anti-patterns, producing a prioritized fix list with line numbers, severity ratings, and suggested corrections.

Manage AWS EC2 virtual machines — instances, security groups, key pairs, AMIs, EBS volumes, Auto Scaling Groups, Spot Instances, Session Manager, placement groups, and instance lifecycle automation.

Audit Integrity

Enforces output quality, intellectual honesty, and continuous improvement across security analysis agents with anti-rationalization guards, self-critique loops, retry protocols, and quality gates.

36.2k · bundle

Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.

Mermaid To Proverif

Translates Mermaid sequence diagrams of cryptographic protocols into ProVerif formal verification models (.pv files) for proving security properties like secrecy, authentication, and forward secrecy.

Implementing API Schema Validation Security

Enforce API input/output contracts using OpenAPI specifications and JSON Schema to prevent injection, mass assignment, and data leakage attacks.

24.6k · bundle

Wp Security Secrets

Audits WordPress plugin and theme code for secret-handling issues: hardcoded credentials, weak randomness, insecure password storage, cookie flags, and secret leakage in logs.

178 Use 01fe0ef7

Provides a pre-deployment security checklist for OAuth-connected apps and external client apps, covering configuration, token policies, access control, and compliance.

Pr Review Expert

Review GitHub PRs and GitLab MRs with structured analysis including blast radius, security scanning, test coverage delta, breaking change detection, and performance impact.

Differential Review

Performs security-focused differential review of code changes (PRs, commits, diffs), adapting analysis depth to codebase size and generating comprehensive markdown reports.

Hardening Docker Containers For Production

Apply CIS Docker Benchmark v1.8.0 security best practices to harden Docker containers for production, covering daemon configuration, image building, runtime controls, and auditing.

24.6k · bundle

Implementing Supply Chain Security With In Toto

Verify container image integrity across CI/CD pipelines using the in-toto framework to generate and check cryptographically signed attestations.

24.6k · bundle

Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.

12.8k · bundle

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with support for multiple languages, scan modes, and data extension models.

Designs and implements backend systems including REST APIs, microservices, database architectures, authentication flows, and security hardening. Covers Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns.

20.4k · bundle

Runs a structured security audit across six phases: attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team analysis, and a final verdict, with optional Python automation scripts.

Performing Container Image Hardening

Harden container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations.

24.6k · bundle

Performing Hardware Security Module Integration

Integrate Hardware Security Modules (HSMs) using the PKCS#11 interface for cryptographic key management, signing operations, and secure key storage with python-pkcs11, AWS CloudHSM, and YubiHSM2.

24.6k · bundle

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.

Agentic Actions Auditor

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations, detecting attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

Securing Container Registry Images

Scan container images for vulnerabilities with Trivy and Grype, generate SBOMs, sign images with Cosign and Sigstore, configure registry access controls, and enforce security gates in CI/CD pipelines.

24.6k · bundle

Detecting Supply Chain Attacks In CI CD

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

24.6k · bundle

sakamoto-family-smile

Defi Amm Security

Provides a security checklist and hardened Solidity patterns for auditing AMM contracts, liquidity pools, and swap flows, covering reentrancy, CEI ordering, donation attacks, oracle manipulation, slippage, admin controls, and integer math.

Implementing API Gateway Security Controls

Configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) as a centralized security enforcement point with authentication, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection.

24.6k · bundle

Launches four parallel read-only sub-agents to review a git diff or file scope for regressions, security risks, performance issues, and contract gaps, then aggregates findings into a prioritized fix path.

Configuring Oauth2 Authorization Flow

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.

24.6k · bundle

Auditing Foundry Smart Contract Security

Runs a pre-deployment security audit of Solidity smart contracts in a Foundry project, combining static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing to catch reentrancy, access-control, and arithmetic bugs before deploying to an EVM chain.

24.6k · bundle

Implementing Passwordless Authentication With Fido2

Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3.

24.6k · bundle

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

Quarkus Security

Secure Quarkus applications with authentication, authorization, input validation, and secrets management.

Android Intent Security

Audit Android component configurations and Intent handling to prevent Intent Redirection and unauthorized access.

Oauth2 Flow Helper

Provides step-by-step guidance and generates configurations for OAuth2 flows, following industry best practices and security patterns.