Security

Security audits, vulnerabilities, compliance, auth, secrets, and safe automation

skills in category: 29,770
pages available: 1,241

Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.

Open in full browser

Browse security skills

Showing 10,921–10,944 of 29,770 skills

Model Context DesignerADesign what enters and leaves a model context window: assemble vetted inputs server-side under caps and closed schemas, minimize sensitive data, separate controlled-store persistence from transient segments, verify provider retention before claiming end-to-end non-persistence, make reconstruction limits explicit, and document exclusions. Also design the prompt contract for each call: a versioned, owned instruction, its declared inputs, a pointer to the output contract, when the model must dec...securityrustgoVotes: 0GitHub stars: 4
Inter Agent Comms ReviewerAReview the security of agent-to-agent and agent-to-MCP-server communication (OWASP Agentic ASI07) — mutual authentication, message integrity, replay protection, confidentiality, topology allowlists and spoofed tool results. Enforces authenticated ≠ trusted: ordinary peer content is untrusted input and cannot assert approvals or permissions; task mutation requires a separate verified authorized channel. Use when agents exchange messages (A2A, MCP transports, shared queues/buses), when wiring a...securityrustgoVotes: 0GitHub stars: 4
Iac ReviewerAReview infrastructure-as-code changes (Terraform, Bicep, CloudFormation, CDK, Pulumi) for deploy safety and security — destructive replace/delete of stateful resources hidden in innocent diffs, state/backend safety, public exposure, over-broad IAM/RBAC widening, missing encryption, secrets in code or captured in state, tenant-isolation impact, drift from documented architecture, module pinning, and tagging/cost impact. Review-only: severity-ranked findings with file:line evidence and proposed...securityrustgoVotes: 0GitHub stars: 4
Human Approval BoundaryACheck current task instructions, prior conversation grants and the owner approval register before a risky action. Proceed within an active scoped grant; obtain a new explicit human approval only when the action is not covered or its security impact is unclear. Covers schema changes or destructive migrations, RLS or security policy, production data, secrets, deployments or releases, billing, git history rewrites and broad multi-file refactors. Use when a task approaches one of these boundaries...securityrustgoVotes: 0GitHub stars: 4
Gated Deployment Prompt TemplateAAuthor the reusable operator prompt template gating a RECURRING class of risky operations (migrations, production grants, backfills): operator-filled placeholders (<owner>/<repo>, <tenant-id> — never live identifiers; credentials as env-var names), hard rules with required inputs, stop conditions with safe halt states, backup-then-verify gating (verified backup BEFORE; expected deltas AFTER), per-phase smoke expectations, a required per-run report path, and ETA ranges calibrated from a deploy...securitygoreactVotes: 0GitHub stars: 4
Full Codebase AuditorAAudit an ENTIRE repository with inventory-first discipline — enumerate every directory, language, entry point, dependency manifest, CI/CD pipeline, and doc before forming any finding, so nothing is judged by its most interesting-looking files. Covers architecture, security, code quality, tests, dependencies, CI/CD, deployment, documentation, and operational readiness, and separates every result into confirmed findings, likely findings, hypotheses, and missing information. Use for whole-repo h...securityrustgoVotes: 0GitHub stars: 4
Skills DirectorySkills Directory 3 slots · $399/mo · one ad per page · sponsors can never buy grades.See placements
Error Handling Security ReviewerAReview error/exception handling through a security lens — fail-closed defaults (a failed check, timeout, or down dependency DENIES, never allows), error-path AUTHORIZATION (authz still enforced on every error/retry/fallback branch), exception-driven logic BYPASS (does an exception skip a check, validation, rollback, or audit write?), and leak-free error responses (no stack traces/secrets/internal detail to callers — generic outside, rich inside). Closes OWASP Top 10:2025 A10 (Mishandling of E...securitygosqlVotes: 0GitHub stars: 4
Dast Safety Harness DesignerADesign a SAFE dynamic-testing (DAST) harness against a RUNNING application — the safety harness is the deliverable, not an attack method. Mandates EXPLICIT WRITTEN AUTHORIZATION before any run (scope, target, window, blast radius recorded — composes human-approval-boundary); staging/non-production targets only unless prod is explicitly authorized; rate/impact limits so it never DoS-es the target; no destructive probes without separate sign-off; data-handling; and the run/result contract. Fail...securitygotestingVotes: 0GitHub stars: 4
Compliance Control FoundationAAuthor the framework-agnostic common control set that ISO 27001, ISO 42001, and SOC 2 work all consumes — one catalog across access control, cryptography, change management, logging/monitoring, incident response, vendor management, and risk assessment, each control written ONCE with objective, owner, verified operating mechanism or gap, and evidence hook, then projected per framework instead of rebuilt per framework. Shipped skills identify design and review routes; they do not prove that an ...securityrustgoVotes: 0GitHub stars: 4
Authorization Matrix DesignerADesign authorization for multi-tenant software as a service (SaaS) as an explicit roles × permissions × resources matrix. Include object-level rules, enforcement points, deny-by-default behavior, brokered support access, negative tests, and a safe migration and rollback plan. Use when roles or permissions need design or repair. Do NOT use for plan entitlements (plan-entitlement-architect), audit records (audit-log-architect), or row-level security (RLS) policy review (rls-policy-auditor).securitygosqlVotes: 0GitHub stars: 4
Audit Log ArchitectADesign a durable, tenant-scoped audit log system with an event taxonomy, record schema, append-only integrity, write-failure policy, retention, redaction, scoped reads, and negative tests. Include rollout and safe rollback for a live system. Use for audit logging and compliance trails such as System and Organization Controls 2 (SOC 2), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001, or customer contracts. Do NOT use for external event ...securitygorailsVotes: 0GitHub stars: 4
Appsec ImplementerAMANUAL-ONLY; never auto-invoke. Implement a named, already-decided application security (AppSec) control in code, such as input validation, output encoding, parameterized queries, authorization, safe sessions/files, or server-side request forgery (SSRF) and redirect allowlists. Prove it test-first with a failing-then-passing negative test and no scope creep. Use when the user or an approved review has named the exact control to build. Side-effecting and manual-only. Do NOT use to choose contr...securitygotestingVotes: 0GitHub stars: 4
Api Event ArchitectADesign external application programming interface (API) and event contracts for multi-tenant software as a service (SaaS). Tenant context comes from credentials by default; an explicitly authorized partner or aggregator may select only tenants allowed by its credential. Define routes, versioning, idempotency, rate limits, and signed tenant-scoped webhook delivery. Produce contract conventions, event schemas, delivery policy, and migration plan. Use for public API or webhook design and partner...securityrustgoVotes: 0GitHub stars: 4
Ai Threat ModelerABuild an artificial-intelligence-specific threat model for a large language model (LLM) feature, retrieval-augmented generation (RAG) pipeline, or agent before release. Inventory prompts, models, stores, tools, credentials and trust boundaries; enumerate Open Worldwide Application Security Project (OWASP) LLM Top 10 threats; write attacker abuse cases; rank concrete exploit paths; and map mitigations to owning skills and evaluation cases. Compose threat-modeler for conventional application th...securityrustgoVotes: 0GitHub stars: 4
Ai Sdlc Operating ModelADefine the end-to-end software development lifecycle (SDLC) operating model for artificial-intelligence-assisted work: context, classify, plan, implement, validate, review, merge, close, and learn. Name the human or agent authority holder, entry and exit gates, and owning skill at each stage. Compose agent-authorization-matrix, agent-memory-governance, and agent-governance-audit. Use when designing how humans and agents build together, adopting agents on a team, correcting skipped review or s...securitygoapiVotes: 0GitHub stars: 4
Ai Lifecycle Risk ManagerAOperationalize the National Institute of Standards and Technology (NIST) Artificial Intelligence (AI) Risk Management Framework (RMF) as an organization risk program across design, development, deployment, operation, and decommissioning. Its GOVERN, MAP, MEASURE, and MANAGE functions form a voluntary risk method, not a certification. Compose ai-governance-risk-reviewer for feature tiering, ai-threat-modeler, ai-evaluation-harness, and incident-response-runbook for procedure authoring. Use whe...securitygosecurityVotes: 0GitHub stars: 4
Agent Identity Privilege ReviewerAReview agent identities and privilege paths under the Open Worldwide Application Security Project (OWASP) agentic identity identifier ASI03. Check distinct least-privilege identities, scoped credentials, delegation that only reduces authority, confused-deputy paths, and attribution to both human and agent. Complements secrets-identity-hardener for custody and rotation. Use for agent identity and delegation design or privilege-escalation review. Do NOT use for secret storage, per-tool enforcem...securitygoapiVotes: 0GitHub stars: 4
Agent Containment ReviewerAReview whether a multi-agent system contains failure and drift. Covers the Open Worldwide Application Security Project (OWASP) agentic failure-cascade identifier ASI08 and rogue-agent identifier ASI10: blast-radius isolation, bounded trust, circuit breakers, checkpoints, retry and fan-out limits, drift detection, inventory, and kill switches that sever authority. Inputs are agent topology, autonomy boundaries, and kill/rollback paths. Composes ai-cost-guardrail-designer for spend bounds and i...securityrustgoVotes: 0GitHub stars: 4
Admin Console ArchitectADesign the internal ops/support/superadmin CONSOLE for a multi-tenant SaaS — the surface operators act THROUGH: cross-tenant read/write with MANDATORY audit on every action, impersonation/support-mode with hard boundaries + consent + audit, least-privilege admin tiers (view-ops / write-ops / superadmin), break-glass elevation (time-boxed, approved, auto-expiring, logged), and the operator control-plane (health, manual failover/retry, data-repair). Produces the console architecture, admin-tier...securityrustgoVotes: 0GitHub stars: 4
Websocket ExpertAUse when implementing websocket functionality with production-grade patterns and safeguards.securitytestingdebuggingVotes: 0GitHub stars: 3
Team ReviewerAUse when team changes need rigorous review for correctness, risk, and release readiness.securitygosqlVotes: 0GitHub stars: 3
SecurityAUse for identifying security vulnerabilities and hardening code.securitygoshellVotes: 0GitHub stars: 3
Security ExpertAUse when specialized implementation support is needed for reliable delivery.securitypythonrustVotes: 0GitHub stars: 3
Security AuditorAUse before release to assess vulnerabilities, auth gaps, and security compliance risks.securityrustgoVotes: 0GitHub stars: 3