All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,246
- 1,219
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,145–3,168 of 29,246 skills
- Browser ExploitationUse when attacking browsers. Proxy plus Debugger.Votes: 0GitHub stars: 86
- Soc2 ComplianceUse when preparing a SaaS company for a SOC 2 Type I or Type II audit: Trust Service Criteria mapping, control matrices, gap analysis and evidence collection. Also covers readiness checklists, vendor management and continuous compliance. Framework playbook; for the auditor org role across SOC 2, ISO 27001 and HIPAA see compliance-auditor.Votes: 0GitHub stars: 21
- Security ReviewerUse when conducting a security audit or pentest: SAST, dependency and secrets scans, manual auth and crypto review, and a severity-rated report. Tools include Semgrep, Bandit, Gitleaks, npm audit and Trivy, plus infrastructure and cloud checks; requires scoped authorization. For an in-flight coding checklist use security-review.Votes: 0GitHub stars: 21
- Security ReviewUse when adding auth, user input, file uploads, secrets, API endpoints or payment features: a pass/fail security checklist with TypeScript patterns. Covers secrets in env vars, Zod validation, SQL injection, XSS, CSRF, rate limiting and data exposure. A developer checklist; for full audits and pentest reports use security-reviewer.Votes: 0GitHub stars: 21
- Security AuditorUse when an org role acts as security auditor and must assess existing code and systems for exploitable vulnerabilities, rate severity, and re-test fixes. Covers OWASP and CWE checklists, auth and IDOR testing, SAST/SCA/secrets scanning and scoped audits. For smart contracts, use blockchain-auditor.Votes: 0GitHub stars: 21
- Security ArchitectUse when an org role acts as security architect and must design security in before build: threat models, trust boundaries, zero-trust and authn/authz patterns. Covers STRIDE, least privilege, defense in depth, secrets architecture, OIDC and mTLS, and ADRs for security controls.Votes: 0GitHub stars: 21
- Secure Code GuardianUse when implementing security controls in code: auth and authorization, password hashing, parameterized SQL, input validation, CORS and CSP headers, JWTs. Workflow of threat model, implement, validate against OWASP Top 10 with checkpoints, plus TypeScript examples (bcrypt, Zod, Helmet). Implementation-focused, not an audit.Votes: 0GitHub stars: 21
- Production AuditUse when asking whether an app is production-ready or what breaks in prod, as a pre-launch or post-merge audit built only from local evidence. Checks release surface, recent changes, auth, data, payments, CI, migrations and rollback, then gives a ship/block call. Not a formal compliance audit.Votes: 0GitHub stars: 21
- Intent Driven DevelopmentUse when a feature or high-risk change (auth, data, migration, external API) needs scoped, verifiable acceptance criteria before or alongside implementation. Produces Quick Capture or Full Acceptance Briefs with AC-NNN criteria and handles revisions; lighter-weight and risk-scaled compared with spec-driven-workflow.Votes: 0GitHub stars: 21
- Adversarial ReviewerUse when you want a deliberately hostile code review in which three personas must each find issues. Saboteur, New Hire and Security Auditor findings end in a BLOCK, CONCERNS or CLEAN verdict; built to break agreeable self-review.Votes: 0GitHub stars: 21
- X ApiX/Twitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.Votes: 0GitHub stars: 17
- Security Bounty HunterHunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.Votes: 0GitHub stars: 17
- Quarkus SecurityQuarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.Votes: 0GitHub stars: 17
- Prediction Market Risk ReviewReview prediction-market, basket, oracle, and trading-agent workflows for compliance, safety, data-quality, privacy, and execution risk. Use before any workflow handles venue auth, user portfolio data, API keys, or trade planning.Votes: 0GitHub stars: 17
- Opensource PipelineOpen-source pipeline: fork, sanitize, and package private projects for safe public release. Chains 3 agents (forker, sanitizer, packager). Triggers: '/opensource', 'open source this', 'make this public', 'prepare for open source'.Votes: 0GitHub stars: 17
- X ApiX/Twitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.Votes: 0GitHub stars: 17
- Eval HarnessFormal evaluation framework for Claude Code sessions implementing eval-driven development (EDD) principlesVotes: 0GitHub stars: 17
- Document ReviewStructural review of documents for gaps, clarity, completeness, and organization. Use when a brainstorm, plan, spec, ADR, or any doc needs polish before the next workflow step. For exploring new ideas from scratch, use brainstorming instead.Votes: 0GitHub stars: 12
- Azure Health BotExpert knowledge for Azure Health Bot development including best practices, decision making, architecture & design patterns, security, configuration, and integrations & coding patterns. Use when configuring Health Bot channels, web chat/voice embeds, management APIs, orchestrator flows, or cost estimation, and other Azure Health Bot related development tasks. Not for Azure AI Bot Service (use azure-bot-service), Azure Communication Services (use azure-communication-services), Azure Health Dat...Votes: 0GitHub stars: 12
- HunchDiscover, bet on, track, and settle Hunch prediction markets in natural language. Trigger when a user wants to bet, take a position, or get odds on a crypto outcome — token market-cap milestones and flips, launchpad races (Bankr vs pump.fun volume / #1-days / launches over a cap), token head-to-head outperformance, mcap strike-ladders, and up/down price rounds. Also trigger on "what can I bet on about $TOKEN", "odds on …", "take YES/NO on …", "show my Hunch bets", "did my market resolve". Set...Votes: 0GitHub stars: 9
- EulerEuler EVK vaults, borrowing, liquidation, risk, EVC authorization, oracle pricing and periphery integration.Votes: 0GitHub stars: 9
- Sdd TraceInspect, rebuild, or verify the append-only SDD Composy semantic trace (events.jsonl) and its derived projection (trace.json). Use for 'o que aconteceu nessa task', 'histórico do fluxo', 'verificar o trace', 'rebuild the trace projection'. Do NOT use for a status overview (sdd-status), evidence manifests (sdd-evidence), or to edit trace history.Votes: 0GitHub stars: 3
- Qa TestExecute explicitly authorized tests and record traceable expected, observed, evidence-bound results.Votes: 0GitHub stars: 3
- Qa Specialist SecurityDesign authorized, bounded, reproducible security checks without turning scanner findings into penetration-test permission.Votes: 0GitHub stars: 3