All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,770
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 10,873–10,896 of 29,770 skills
- Analyzing Authenticode Signatures'Analyzes Windows Authenticode signatures on PE files: checking for a signature,Votes: 0GitHub stars: 22
- Analyzing Api Call Traces'Analyzes API call traces from a sandbox or API monitor (JSON) to group calls byVotes: 0GitHub stars: 22
- Analyzing Android Dex Malware'Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readableVotes: 0GitHub stars: 22
- Ssh Essentials 1.0.0Essential SSH commands for secure remote access, key management, tunneling,Votes: 0GitHub stars: 170
- Ssh Essentials 1 0 0Essential SSH commands for secure remote access, key management, tunneling,Votes: 0GitHub stars: 170
- Failure EscalationTerminate on unrecoverable external blockers and report precise errorVotes: 0GitHub stars: 170
- Failure EscalationTerminate on unrecoverable external blockers and report precise errorVotes: 0GitHub stars: 170
- Failure EscalationTerminate on unrecoverable external blockers and report precise error details.Votes: 0GitHub stars: 170
- Typespec Create Api PluginGenerate a TypeSpec API plugin with REST operations, authentication, and Adaptive Cards for Microsoft 365 CopilotVotes: 0GitHub stars: 2
- Sql Code ReviewUniversal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across all SQL databases (MySQL, PostgreSQL, SQL Server, Oracle). Focuses on SQL injection prevention, access control, code standards, and anti-pattern detection. Complements SQL optimization prompt for complete development coverage.Votes: 0GitHub stars: 2
- DevcontainersProvides expert guidance on Development Containers (devcontainers) — creating, configuring, and optimising containerised development environments using the Dev Container Specification. This skill should be used when users ask about devcontainer.json, .devcontainer setup, Dev Container Features or Templates, pre-building images, multi-container workflows, Docker-in-Docker, cloud development environments (Codespaces, DevPod), or troubleshooting container performance and permission issues.Votes: 0GitHub stars: 2
- Ansible SecretsSecure secrets handling in Ansible with Infisical vault integration, no_log directive enforcement, and a reusable Infisical lookup task for safe credential retrieval.Votes: 0GitHub stars: 2
- Wp SecurityWordPress security hardening — nonce verification, wp_nonce_field, check_admin_referer, sanitize_text_field, sanitize_email, esc_html, esc_attr, esc_url, wp_kses, SQL injection prevention, $wpdb->prepare(), capability checks, current_user_can, authentication hardening, wp-config.php secrets, security headers, file permissions, Bedrock .env secrets, disable XML-RPC, brute force wp-login.php, CSRF protection. Invoke for: security audit, input sanitization, output escaping, nonce verification, S...Votes: 0GitHub stars: 13
- SentinelAutomated security gatekeeper. Blocks unsafe code before commit — secret scanning, OWASP top 10, dependency audit, permission checks. A GATE, not a suggestion.Votes: 0GitHub stars: 86
- AdversaryPre-implementation red-team analysis. Use when a plan is high-risk, critical path, or expensive to reverse. Challenges plans before code is written — finds edge cases, security holes, scalability bottlenecks, error propagation risks, and integration conflicts. Catches flaws at plan time (10x cheaper than post-implementation).Votes: 0GitHub stars: 86
- Webauthn Passkey ImplementationImplementing the relying-party (server) side of WebAuthn / passkeys to replace passwords — the registration ceremony, the authentication ceremony, the verification steps the server MUST perform on each (challenge match, origin match, RP ID hash, signature, counter monotonicity), conditional UI for autofill, and the synced-vs-device-bound distinction. Grounded in W3C WebAuthn-3, FIDO Alliance, passkeys.dev, and SimpleWebAuthn.Votes: 0GitHub stars: 10
- Proverif Tamarin Protocol ModelingFormal protocol verification with ProVerif and Tamarin Prover for multi-agent coordination systems. Use when modeling secrecy properties (escrow opacity, session note confidentiality), replay resistance (token dismissal finality, backup-restore attacks), delegation chain correctness, or append-only log integrity in applied pi calculus. Use when deciding between ProVerif and Tamarin for a given property. Use when extending existing .pv models (e.g., harbor_card_v3_delegation.pv) with new secur...Votes: 0GitHub stars: 10
- Output Contract EnforcerValidates that a DAG node's output matches its declared JSON schema before passing to downstream nodes. The glue that makes multi-agent DAGs reliable. Use when checking output contract compliance, generating validation schemas from descriptions, or debugging contract mismatches between nodes. Activate on "validate output", "output contract", "schema validation", "contract mismatch", "output doesn't match". NOT for content quality assessment (use dag-quality), skill grading (use skill-grader),...Votes: 0GitHub stars: 10
- Oauth2 And Oidc From ScratchUse when implementing or reviewing OAuth 2.0 / OAuth 2.1 / OpenID Connect from scratch in a real codebase, choosing a flow (authorization code + PKCE, client credentials, BFF), validating ID tokens, storing tokens safely in browsers, sizing refresh-token rotation, or migrating off implicit / ROPC. Triggers: "should I use a JWT or session cookie", PKCE code_challenge/code_verifier, exact redirect_uri match, state vs nonce confusion, ID-token replay, refresh-token rotation, BFF (backend-for-fro...Votes: 0GitHub stars: 10
- Oauth Oidc ImplementerExpert in implementing OAuth 2.0 and OpenID Connect (OIDC) authentication flows. Specializes in secure token handling, social login integration, API authorization, and identity provider configuration.Votes: 0GitHub stars: 10
- Modern Auth 2026Modern authentication implementation for 2026 - passkeys (WebAuthn), OAuth (Google, Apple), magic links, and cross-device sync. Use for passwordless-first authentication, social login setup, Supabase Auth, Next.js auth flows, and multi-factor authentication. Activate on "passkeys", "WebAuthn", "Google Sign-In", "Apple Sign-In", "magic link", "passwordless", "authentication", "login", "OAuth", "social login". NOT for session management without auth (use standard JWT docs), authorization/RBAC (...Votes: 0GitHub stars: 10
- Mobile Biometric Auth ExpertMobile biometric authentication expert for Face ID, Touch ID, BiometricPrompt, Keychain/Keystore, and WebAuthn. Activate on: biometric authentication, Face ID, Touch ID, BiometricPrompt, Keychain, Keystore, WebAuthn, passkeys, FIDO2, device authentication. NOT for: OAuth/OIDC flows (use oauth-oidc-implementer), secret management (use secret-management-expert), general security (use security-auditor).Votes: 0GitHub stars: 10
- Mcp CreatorExpert MCP (Model Context Protocol) server developer creating safe, performant, production-ready servers with proper security, error handling, and developer experience. Activate on 'create MCP', 'MCP server', 'build MCP', 'custom tool server', 'MCP development', 'Model Context Protocol'. NOT for using existing MCPs (just invoke them), general API development (use backend-architect), or skills/agents without external state (use skill-coach/agent-creator).Votes: 0GitHub stars: 10
- Hipaa ComplianceEnsure HIPAA compliance when handling PHI (Protected Health Information). Use when writing code that accesses user health data, check-ins, journal entries, or any sensitive information. Activates for audit logging, data access, security events, and compliance questions.Votes: 0GitHub stars: 10