All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,246
- 1,219
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,385–3,408 of 29,246 skills
- 21 Threat IntelligenceCyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reportingVotes: 0GitHub stars: 430
- Xss Html InjectionThis skill should be used when the user asks to \"test for XSS vulnerabilities\", \"perform cross-site scripting attacks\", \"identify HTML injection flaws\", \"exploit client-side injection...Votes: 0GitHub stars: 277
- Athena ReviewPACE 实现后一次独立多维 review。进入 review stage 时触发；优先本端原生入口，fallback 为一个只读 reviewer。Votes: 0GitHub stars: 188
- Setup SnowflakeFirst-time Snowflake setup wizard for the NATIVE ConnectionManager path (the connection the analyst actually queries through, with auto-logged provenance). Prompts for every connection field, stores the approved credential in .env, registers the dataset, and VERIFIES the session is live on the warehouse before declaring success. Use when the user says "set up snowflake", "connect to snowflake", "configure the warehouse", or is routed here from /connect-data. For day-to-day remote querying aft...Votes: 0GitHub stars: 304
- Setup NotionConnect Claude Code to Notion's official hosted MCP, complete OAuth, verify the intended workspace with a read, and stop before any write. Use when the user asks to connect Notion, set up Notion, export to Notion, or diagnose an unavailable Notion connection.Votes: 0GitHub stars: 304
- TprmExpert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mention...Votes: 0GitHub stars: 935
- Sox ItgcExpert SOX IT General Controls (ITGC) advisor for finance, internal audit and IT compliance teams. Covers the four ITGC domains external auditors test for SOX 404 — access to programs and data, program changes, computer operations, and program development — plus scoping in-scope systems from the financial statements, designing risk-and-control matrices (RCMs), writing control narratives and test scripts, evaluating deficiencies (control deficiency vs significant deficiency vs material weaknes...Votes: 0GitHub stars: 935
- Cyber EssentialsExpert UK Cyber Essentials and Cyber Essentials Plus advisor — the NCSC-owned, IASME-delivered baseline certification. Covers the current Danzell question set (Requirements for IT Infrastructure v3.3, mandatory for assessment accounts from April 27, 2026) and the Willow transition, the five control themes (firewalls, secure configuration, security update management, user access control, malware protection), scoping rules for cloud services, BYOD and home working, the 14-day critical-update ru...Votes: 0GitHub stars: 935
- Firebase Security Rules AuditorAudits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.Votes: 0GitHub stars: 16
- LienfiResearch and buy tokenized US tax lien certificates on LienFi (Base, USDC) — screen the live book by NET yield with no credential, then, once your operator has authorized your wallet in a browser, register and run the prepare → sign → confirm → submit → report purchase loop from the wallet you control. LienFi signs only the price; every transaction leaves your wallet.Votes: 0GitHub stars: 1,203
- Secrets VaultUse whenever an API key, token, password, connection string, or any other secret needs to be stored, rotated, retrieved, or used — so the value never enters the chat transcript. Triggers on "vault this", "save this key/token/password", "rotate the <x> key", "where's the <x> secret", "put this in the vault", or any time a credential is about to be handled.Votes: 0GitHub stars: 2
- Cw HandoffUse when writing a Codewhale takeover prompt, continuation note, or end-of-session summary for another agent or a later session: a paste-ready handoff grounded in live state, with done/suspected/blocked kept separate.Votes: 0GitHub stars: 17
- MoneyBank accounts, balances, and transactions via Plaid. Use when: bank, balance, transactions, spending, accounts, or plaid.Votes: 0GitHub stars: 17
- GmailSearch, read, draft, and send Gmail when the user asks to work with their inbox or email.Votes: 0GitHub stars: 17
- High Security Corporate Meeting PlanningDevelops comprehensive security plans for high-risk corporate meetings or board events, focusing on venue hardening, access control, surveillance of blind spots, ballistic protection, and mitigation of advanced threats like 3D-printed weapons.Votes: 0GitHub stars: 17
- Tanstack StartTanStack Start best practices for full-stack React applications. Server functions, middleware, SSR, authentication, and deployment patterns. Activate when building full-stack apps with TanStack Start.Votes: 0GitHub stars: 17
- Technical DebtTechnical debt inventory, prioritization, and audit for PHP/Laravel (MySQL) and Node/TypeScript/React projects. Use when assessing code health, identifying refactoring candidates, planning debt paydown, or auditing a codebase for accumulated debt. Triggers on "audit technical debt", "find tech debt", "debt inventory", "what should we refactor first", or tasks involving code health, security debt, performance debt, data debt, observability debt, debt prioritization, or remediation planning.Votes: 0GitHub stars: 17
- Laravel Owasp SecurityOWASP Top 10 security audit and secure coding guidelines for Laravel + React/Inertia.js applications. Use when auditing for vulnerabilities ("run OWASP audit", "security review", "check my app security") or writing secure Laravel code involving auth, payments, file uploads, or API design. Triggers on security-related tasks, payment handling, authentication, or any request to audit a Laravel codebase.Votes: 0GitHub stars: 17
- Using Model EndpointCall a configured Feynman model endpoint and interpret its response. Use when a task needs inference from a registered endpoint, remote model API, local model service, or custom connector-backed predictor.Votes: 0GitHub stars: 211
- Compute Env SetupSet up a reproducible Feynman compute environment for research jobs. Use when a task needs Python/R packages, GPU libraries, containers, Modal, SSH, caches, or managed model runtime setup.Votes: 0GitHub stars: 211
- Security PassRuns a context-aware security review of a software project — first understands what the system does and who could attack it, then adapts the analysis instead of running a static checklist. Produces a ranked, evidence-backed findings report and triages each finding by what kind of action it needs (code fix, spec change, design/ADR change, product decision, or accepted risk). Never edits the project — analysis only. Use when the user asks for a security review, security pass, security audit, or...Votes: 0GitHub stars: 211
- Appstore ReviewApp Store review readiness audit for iOS apps. Scans the codebase, entitlements, Info.plist, privacy manifests, paywall/subscription UI, and metadata for anything that could trigger a warning or rejection during App Store review. Invoke explicitly when preparing a submission. Do NOT trigger automatically.Votes: 0GitHub stars: 211
- Using AxiomQueries Axiom logs and metrics, investigates anomalies, and manages monitors and notifiers. Use for observability, incident investigation, service health, APL or MPL analysis, and Axiom monitor work.Votes: 0GitHub stars: 64
- Code ReviewReview Proto Fleet pull requests for concrete security, correctness, and reliability defects. Use for every GitHub Copilot code review.Votes: 0GitHub stars: 56