Security

Security audits, vulnerabilities, compliance, auth, secrets, and safe automation

skills in category: 29,246
pages available: 1,219

Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.

Open in full browser

Browse security skills

Showing 3,337–3,360 of 29,246 skills

OauthAHow to use @owlmeans/oauth — the shared layer of OwlMeans OAuth sign-in: the two grants (device authorization RFC 8628, authorization code + PKCE S256), the consent protocols (makeOAuthProtocols), the `_oauth` flow, fetch-only client helpers (discovery, device authorization, polling, revoke), user/device-code and redirect-URI matching, and the error family incl. SignInRequired. Auto-invoked when a project needs an authorization server, a browser consent screen or a CLI/MCP browser sign-in, wh...securitygotestingVotes: 0GitHub stars: 3
Mailer SmtpAHow to use @owlmeans/mailer-smtp — SMTP transport (nodemailer) for the MailerService contract. Use when configuring real outbound email, an SMTP relay such as Mailgun, or the email-OTP mailer. Applies to files matching **/context.ts, **/config.ts, **/setup.ts.securitynodeapiVotes: 0GitHub stars: 3
Basic KeysAHow to use @owlmeans/basic-keys — Ed25519 keypair generation, signing/verification, key model, and auth plugins (built on @noble/curves and @noble/hashes). Auto-invoked when importing keypair utilities or implementing crypto-based auth.securitytypescriptgoVotes: 0GitHub stars: 3
AuthAHow to use @owlmeans/auth — the core authentication and authorization vocabulary shared by server and client, covering the Auth / AuthPayload / AuthCredentials types, the AuthRole and AuthenticationType enums, the error hierarchy (AuthUnknown, AuthenFailed, AuthForbidden …), the request JSON schemas, the entrypoint aliases, and authHelper.entitySlugOf for reading the organization entity off a token. Auto-invoked when importing auth types, errors, schemas or constants, or when working with req...securitytypescriptgoVotes: 0GitHub stars: 3
Auth TokenAHow to use @owlmeans/auth-token — the contracts behind long-lived access tokens (API keys) — the token format and its deployment prefix, the three management routes, the Authorization parsing that Bearer needs, and the client-side carrier guard a CLI or an MCP server authenticates with. Auto-invoked when importing the token entrypoints, the carrier guard, parseAuthorizationHeader, or an access-token type.securitytypescriptapiVotes: 0GitHub stars: 3
Auth ProtocolAComprehensive reference for the OwlMeans authentication and authorization protocol — the Ed25519, OIDC, provider-backed local identity, email-OTP, hosted-app (integrated provider) and PK-supervisor paths, the identity model (one account per e-mail, credentials on the account, profile rows per app and organization, organizations with groups), pairwise subjects, the acting organization as session state and its switch, the four permission kinds, the core types and error hierarchy, guards and gat...securityrustgoVotes: 0GitHub stars: 3
Skills DirectorySkills Directory 3 slots · $399/mo · one ad per page · sponsors can never buy grades.See placements
Api Config ServerAHow to use @owlmeans/api-config-server — the backend half of the runtime config flow, which answers the api-config endpoint from package-owned allowlist plugins. Auto-invoked when serving API config from a server app or deciding what a backend advertises to its clients.securitytypescriptrustVotes: 0GitHub stars: 3
SecurityAUse when the user asks for a security review, vulnerability scan, security audit, or to check code for security issues, front end or back end.securityrustgoVotes: 0GitHub stars: 3
HardenASecurity audit: threat model, OWASP Top 10 (and LLM Top 10), abuse cases, dependency and secret scan, with ranked findings and concrete fixes. Read-only.securityrustgoVotes: 0GitHub stars: 10
Security And HardeningAHardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.securitytypescriptrustVotes: 0GitHub stars: 3
Xss AnalysisAAnalyze and validate cross-site scripting in web/UI code — use when reviewing HTML sinks, DOM APIs, template escaping, dangerouslySetInnerHTML, or reflected/stored XSS paths (CWE-79 / A03:2021).securityjavascriptrustVotes: 0GitHub stars: 15
Websocket SecurityAAnalyze WebSocket security posture — use when reviewing WS/WSS upgrade auth, origin checks, message authorization, or cross-site WebSocket hijacking risks (CWE-346 / CWE-352 / A01:2021).securitygospringVotes: 0GitHub stars: 15
Threat ModelingALightweight threat modeling for an application before deep scanning — map assets, trust boundaries, and abuse cases; feeds /axguard-audit.securityrustgoVotes: 0GitHub stars: 15
Supply Chain SecurityDAssess install hooks, curl|sh, untrusted indexes, and integrity gaps in dependency/build pipelines before ship (CWE-494 / CWE-506 / A06:2021 / A08:2021).securityrustgoVotes: 0GitHub stars: 15
Ssti AnalysisAAnalyze server-side template injection risks — use when user input reaches template engines (Jinja, Twig, Freemarker, Pug, Liquid) or dynamic template compile/render APIs (CWE-1336 / A03:2021).securityrustgoVotes: 0GitHub stars: 15
Ssrf AnalysisAAnalyze and validate server-side request forgery in application code — use when reviewing outbound HTTP/fetch sinks, user-controlled URLs, webhook callbacks, previewers, or cloud metadata exposure (CWE-918 / A10:2021).securityrustgoVotes: 0GitHub stars: 15
Sql InjectionAAnalyze SQL and ORM injection risks in application code — use for string-built queries, raw SQL helpers, and database sinks (CWE-89 / A03:2021).securityrustgoVotes: 0GitHub stars: 15
Session SecurityAAnalyze session management security — use when reviewing cookie flags, session fixation, timeout, logout, concurrent sessions, or server-side session stores (A07:2021 / CWE-287 / CWE-352 adjacency).securitygoapiVotes: 0GitHub stars: 15
Security TriageADomain reasoning for triaging AXguard findings — keep/drop gates, confidence, and severity promotion before remediation.securitygosqlVotes: 0GitHub stars: 15
Security RemediationBApply minimal defensive patches for confirmed findings and verify with re-audit — post-triage only.securitygoshellVotes: 0GitHub stars: 15
Security Architecture ReviewAReview security architecture and trust boundaries — use for design-level control gaps across authZ, secrets, egress, multi-tenant isolation, and insecure-by-design features (A04:2021) before or with /axguard-audit.securityrustgoVotes: 0GitHub stars: 15
Secrets DetectionAFind and triage hard-coded secrets, tokens, and credentials in source and build artifacts before ship (CWE-798 / A07:2021 adjacent).securitygogitVotes: 0GitHub stars: 15
Prototype PollutionAAnalyze JavaScript prototype pollution risks — use when reviewing deep merges, recursive object assigns, query-to-object parsers, or untrusted JSON key merges (CWE-1321 / A03:2021).securityjavascripttypescriptVotes: 0GitHub stars: 15
Prompt InjectionAAssess direct and indirect prompt-injection risks in LLM/AI features — use for chatbots, RAG, agents, and tool-calling apps.securityrustgoVotes: 0GitHub stars: 15