Claude Skills by Rootx202

Focused API security auditor for REST, GraphQL, and webhook endpoints in any stack. Use when the user is building or reviewing an API layer, mentions rate limiting, API keys, webhooks, CORS, or specifically wants "API security" checked — as opposed to a full-project audit.

Deep-dive auditor for authentication and session management — login, signup, password handling, JWT, OAuth, MFA, password reset, and session lifecycle. Use whenever the user is building or reviewing a login system, password logic, token/session handling, an OTP flow, or an OAuth/SSO integration, for any application in any stack.

Backend/server-side security auditor for Node.js, Express, NestJS, FastAPI, Django, Flask, Spring, Ruby on Rails, and similar frameworks. Use when reviewing server-side application logic, error handling, logging, file upload handling, or general middleware configuration specifically — separate from database or API-contract concerns.

Cloud and infrastructure configuration security auditor for Vercel, Netlify, AWS, Azure, Google Cloud, and Supabase/Firebase project settings. Use when reviewing deployment configuration, environment variable management, IAM permissions, storage bucket access, or general cloud misconfiguration — rather than the application code itself.

Elite full-codebase security auditor for any language or stack (JavaScript, TypeScript, Python, Java, Kotlin, PHP, Go, Rust, C/C++, Ruby, C#). Trigger this whenever the user asks to review, audit, scan, harden, or "check the security" of any project, before deploying/shipping/launching a site or app, after adding authentication or payment logic, after merging a large feature, or whenever the words "security review", "audit my code", "is this safe to deploy", "vulnerability check" appear. This...

Database security auditor covering PostgreSQL, MySQL, SQL Server, MongoDB, and Supabase/Firebase-style backends. Use when the user asks about database security, Row Level Security (RLS) policies, exposed database access, ORM-related SQL injection, or backend-as-a-service data access rules for any project.

Dependency and supply-chain vulnerability scanner for npm, pip, composer, gradle, cargo, and other package ecosystems. Use whenever the user wants to check for known CVEs, outdated packages, or supply-chain risk in package.json, requirements.txt, composer.json, build.gradle, Cargo.toml, or similar manifest/lockfiles, for any project.

Frontend/client-side security auditor covering React, Next.js, Vue, and general SPA/SSR concerns — server components, server actions, middleware, cookies, CSP headers, hydration, and client-side XSS. Use when reviewing a frontend application's client-side and edge-runtime security specifically, for any project.

Defensive triage for suspicious files, scripts, or dependencies the user has already encountered (e.g. a suspicious npm package, an unexpected script in a repo, a file behaving oddly). Use only to identify and explain suspicious behavior in code the user already has, to help them decide whether to remove/report it — never to create, improve, or "test" malicious payloads.

Structured self-assessment checklist that simulates how a professional security review would probe an application (recon, auth/authorization testing, input testing) for planning and reporting purposes. Use when the user wants a pentest-style checklist or assessment plan for a system they own/operate, or wants to understand what a professional assessment would look for before hiring one or running automated tools.

Secure code fixer — takes findings from other security skills (code-audit, vulnerability-scanner, etc.) and implements the actual code fixes safely, preserving functionality, for any language or stack. Use whenever the user asks to fix, patch, or remediate previously identified vulnerabilities directly in their codebase, not just describe the fix.

Scans any codebase or repository for hardcoded secrets — API keys, tokens, passwords, private keys, database URLs, cloud credentials. Use whenever the user wants to check for exposed secrets before making a repo public, before a major commit/push, before deployment, or as part of any broader security audit.

Lightweight secure-code-review checklist for a single pull request, diff, function, or file — as opposed to a full-project audit. Use when the user shares a diff/PR and asks for a review before merge, wants a quick pre-merge security pass, or asks for a secure coding checklist to follow while actively developing a feature.

Generates a professional, consolidated security report (Markdown or HTML) from findings produced by other security skills, including an executive summary and an overall security score out of 100. Use at the end of any security audit/scan/pentest-style session, or whenever the user asks for a formal write-up of security findings for any project.

OWASP Top 10 aligned security scanner for any web application or API, in any language or framework. Use whenever the user wants a standardized OWASP-based scan, mentions "OWASP", "Top 10", "security scan", "pentest checklist", or wants findings organized against the official ten categories with consistent severity ratings — a strong complement to code-audit for producing a compliance-style, auditable result.