All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,770
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 10,897–10,920 of 29,770 skills
- Dependency ManagementManaging third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.Votes: 0GitHub stars: 10
- Dag Scope EnforcerRuntime enforcement of file system boundaries and tool access restrictions. Blocks unauthorized operations and logs violations. Activate on 'enforce scope', 'access control', 'boundary enforcement', 'tool restrictions', 'runtime security'. NOT for validation (use dag-permission-validator) or isolation management (use dag-isolation-manager).Votes: 0GitHub stars: 10
- Dag Permission ValidatorValidates permission inheritance between parent and child agents. Ensures child permissions are equal to or more restrictive than parent. Activate on 'validate permissions', 'permission check', 'inheritance validation', 'permission matrix', 'security validation'. NOT for runtime enforcement (use dag-scope-enforcer) or isolation management (use dag-isolation-manager).Votes: 0GitHub stars: 10
- Dag Isolation ManagerManages agent isolation levels and resource boundaries. Configures strict, moderate, and permissive isolation profiles. Activate on 'isolation level', 'agent isolation', 'resource boundaries', 'sandboxing', 'agent containment'. NOT for permission validation (use dag-permission-validator) or runtime enforcement (use dag-scope-enforcer).Votes: 0GitHub stars: 10
- Crisis Response ProtocolHandle mental health crisis situations in AI coaching safely. Use when implementing crisis detection, safety protocols, emergency escalation, or suicide prevention features. Activates for crisis keywords, safety planning, hotline integration, and risk assessment.Votes: 0GitHub stars: 10
- Code Review ChecklistGenerates comprehensive, context-aware code review checklists tailored to the specific codebase, programming language, and team standards. Analyzes PR diffs and suggests what reviewers should focus on.Votes: 0GitHub stars: 10
- Code NecromancerSystematic framework for resurrecting and modernizing legacy codebases through archaeology, resurrection, and rejuvenation phases. Activate on "legacy code", "inherited codebase", "no documentation", "technical debt", "resurrect", "modernize". NOT for greenfield projects or well-documented active codebases.Votes: 0GitHub stars: 10
- Cdn Cache Control HeadersDesigning HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.Votes: 0GitHub stars: 10
- Agentic Zero Trust SecurityCryptographic security architecture for autonomous AI agent systems. This skill covers the intersection of traditional security engineering and the unique challenges of agents that plan, persist, delegate, and execute across trust boundaries. **Core principle**: Never trust, always verify — applied to every agent-to-agent message, every skill loaded, every tool invoked, and every result returned.Votes: 0GitHub stars: 10
- Secure PhaseRetroactively verify threat mitigations for a completed phaseVotes: 0GitHub stars: 90
- SecurityComplete security suite — expert mindset + active code scanner. Covers OWASP 2025, supply chain, L1-L4 data flow analysis, 21 vulnerability rules with a cost-tiered default pass, TINY/SMALL/LARGE scan modes, bilingual output (vi/en). Use when scanning code for security vulnerabilities, doing security audits, or applying security mindset. Triggers on "scan security", "kiểm tra bảo mật", "security audit", "review security".Votes: 0GitHub stars: 3
- Threat ModelerBuild a threat model for a feature or system BEFORE it is implemented — assets, actors, trust boundaries, data flows, STRIDE-style threat enumeration per boundary, abuse cases written from attacker behavior, risks ranked by consequence and confidence, mitigations mapped to each threat, and a validation plan for every control with negative tests where denial is claimed. Use when designing a security-sensitive feature (auth, uploads, payments, integrations, admin/support tooling), when asked to...Votes: 0GitHub stars: 4
- Tenant Isolation ReviewerReview an existing multi-tenant system or design for cross-tenant leakage across EVERY surface — identity, data, API, storage, logs, analytics, support tooling, exports, imports, background jobs, search, AI retrieval, billing, feature flags, and audit — not just the database. Produces severity-ranked isolation findings with file:line evidence, an isolation test matrix per surface, a negative-test plan for tenant A versus tenant B, and an explicit not-inspected list. Use when asked whether ten...Votes: 0GitHub stars: 4
- Supply Chain Security ReviewerReview software supply-chain risk with SLSA-style provenance thinking — dependencies (CVEs triaged by reachability, not presence), lockfile integrity/pinning, transitive/typosquat/confusion risk, install and build scripts, CI/CD workflows (untrusted PR triggers, secret exposure, token scopes, unpinned Actions), artifact provenance, and postinstall/hook execution. Extends to the AI/ML (LLM04: models, datasets, adapters, registry promotion) and agentic (ASI04: MCP servers/manifests, tool/skill ...Votes: 0GitHub stars: 4
- Static Analysis ReviewerTriage SAST / CodeQL / SARIF / linter-security output on first-party code into what actually matters — sort each finding into true-positive, false-positive, duplicate, or accepted-risk, and rank the true positives by reachability, exploitability, asset sensitivity, tenant impact, and business impact. Confirms each true positive against the real code (a scanner hit is a lead, not a verdict), requires an exploit path for high-severity, and outputs a triaged, deduplicated, prioritized remediatio...Votes: 0GitHub stars: 4
- Share Link Access ArchitectDesign guest/public share-link access for a multi-tenant SaaS — a CAPABILITY model where possession of an opaque, high-entropy, expiring, revocable token grants a fixed narrow scope, distinct from member RBAC: token design, ephemeral guest sessions (not memberships), optional password/OTP gating, per-link scope (which resource, which permission), enumeration/abuse defense, and audit. The link must expose exactly the shared resource and never become a hole into the rest of the tenant. Use when...Votes: 0GitHub stars: 4
- Sensitive Disclosure GuardPrevent an LLM feature from disclosing sensitive information (OWASP LLM02) — audit and design the data-minimization and redaction pipeline so secrets, credentials, PII, and other-tenant data are stripped BEFORE they enter model context, prompts, or logs; assemble context with least-data (only the fields the task needs, not whole records); check the output path for leaks (the model echoing sensitive input, cross-conversation/cache bleed); and confirm provider data-handling posture (retention, ...Votes: 0GitHub stars: 4
- Security Scan OrchestratorOrchestrate a whole-repo security scan and aggregate it into ONE prioritized report — coordinate the static suite (SAST + dependency/SCA + secret + IaC/config scanning), normalize every scanner''s output into one finding schema, and route it. It RUNS and AGGREGATES; it does NOT triage findings (finding TRIAGE is static-analysis-reviewer''s — yield) and NEVER fixes, opens PRs, or changes settings — every action is handed to a human. Tool-agnostic (scanner CATEGORIES, not one vendor''s CLI). Fa...Votes: 0GitHub stars: 4
- Security Pr ReviewerSecurity-focused review of an ACTUAL diff (PR, branch delta, or staged/working changes) — hunts authn/authz gaps, missing object-level and tenant-scope checks, injection, unsafe deserialization, secrets in code/config/logs, SSRF, mass assignment, and unsafe security-relevant changes introduced by the change. Reports severity-ranked findings, each with file:line evidence, an exploit path or abuse scenario for high-severity claims, and remediation; requires tenant-isolation and object-level aut...Votes: 0GitHub stars: 4
- Security Logging Alerting ArchitectDesign the security-event detection and alerting layer — DETECTION coverage (what must be logged: authn failures/anomalies, access-control denials, privilege/config changes, injection/abuse signals, sensitive-data access), ALERTING rules (alert vs ticket, thresholds justified against baselines, correlation, noise control), and response WIRING (every alert has an owner, severity, escalation, runbook link). Addresses the detection and alerting portion of OWASP Top 10:2025 A09 (Security Logging ...Votes: 0GitHub stars: 4
- Secure Migration ReviewerReview a database migration for security and deploy safety before it ships — privilege/GRANT changes, effective RLS scope for the intended app role, unsafe defaults, destructive or irreversible operations, tenant-scoped backfills, lock/downtime risk, and forward/rollback safety with deploy-order coupling. A new tenant table with RLS enabled but no applicable policy is default-denied, an availability finding rather than exposure. Produces evidenced findings, rollback assessment, and negative t...Votes: 0GitHub stars: 4
- Secrets Identity HardenerMANUAL-ONLY; never auto-invoke. Harden how an application handles secrets and identity — move hardcoded credentials/tokens/keys into a secret manager or server-only env, classify each variable as public vs server-only (and catch client-bundle exposure like VITE_/NEXT_PUBLIC_ leaks), enforce least-privilege service accounts, add rotation and revocation, and tighten session/token handling (expiry, refresh, storage flags) — with tests proving a secret is unreachable from the client and a rotated...Votes: 0GitHub stars: 4
- Rls Policy AuditorAudit and (where asked) author row-level-security policies for a tenant-scoped database — inspect SELECT/INSERT/UPDATE/DELETE policies per table for missing tenant scope, deny-by-default gaps, policy recursion, unsafe SECURITY DEFINER helpers, over-broad GRANTs, service-role/superuser leakage, and frontend-derived (client-supplied) tenant scope, and ALWAYS deliver a negative-test plan proving wrong-tenant/wrong-role/missing-auth access is denied per command. Use when asked to review, write, o...Votes: 0GitHub stars: 4
- Prompt Injection DefenderMANUAL-ONLY; never auto-invoke. Design the layered defense against prompt injection (OWASP LLM01) for an LLM feature or agent — establish trust zones (trusted rules vs untrusted user input, retrieved docs, emails, tool/model outputs, images, audio, file metadata), enforce that untrusted content can never change instructions/tool permissions/identity/access policy/execution plan, spec content/instruction separation, gate every side-effecting action behind deterministic authorization outside th...Votes: 0GitHub stars: 4