All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,105
- 1,297
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 14,665–14,688 of 31,105 skills
- Auditing SecurityPerform a systematic security audit of a codebase, checking for OWASP Top 10 vulnerabilities, secrets exposure, and insecure patterns.Votes: 0GitHub stars: 4
- Security Audit ChecklistProvides exhaustive security vulnerability checklists with severity classifications, point deductions, and detection commands. Use when performing security audits, code reviews, penetration testing preparation, or checking OWASP compliance.Votes: 0GitHub stars: 4
- Review Scoring RubricProvides the complete code review scoring rubric with 10 weighted categories, severity multipliers, and deduction calculations. Use when performing quantified code reviews, calculating quality scores, or creating improvement roadmaps.Votes: 0GitHub stars: 4
- PassportImplements Passport.js authentication middleware with local, OAuth, and JWT strategies for Express/Node.js. Use when building Node.js APIs, implementing custom auth flows, or needing flexible authentication strategies.Votes: 0GitHub stars: 4
- NextauthImplements authentication with Auth.js/NextAuth.js v5 including OAuth providers, credentials, sessions, and route protection. Use when adding authentication to Next.js, configuring OAuth providers, or protecting routes.Votes: 0GitHub stars: 4
- ExpressBuilds APIs with Express including routing, middleware, error handling, and security. Use when creating Node.js APIs, building REST services, or adding middleware-based server functionality.Votes: 0GitHub stars: 4
- Code QualityAudits code for security vulnerabilities, performance issues, accessibility, complexity metrics, and infrastructure security. Use when reviewing code quality, performing security audits, checking OWASP compliance, analyzing complexity, auditing IaC, or finding dead code.Votes: 0GitHub stars: 4
- Vulnerability TriageParse, normalize, group, and prioritize security findings from GitLab vulnerability reports (JSON), and produce evidence-backed dispositions (fix vs. justified false positive). Triggers on phrases like: vulnerability report, gl-dependency-scanning-report.json, gl-sast-report.json, GitLab security report, CVE, CVSS, EPSS, KEV, triage findings, group vulnerabilities, deduplicate findings, false positive, is this exploitable, reachability, severity, prioritize remediation. Use whenever a GitLab ...Votes: 0GitHub stars: 10
- Gitlab MrLocate GitLab vulnerability reports and deliver remediations back to GitLab — branch/commit strategy, raising merge requests via glab CLI, the GitLab REST API, or a GitLab MCP, MR descriptions that carry the triage rationale, and optional write-back of dispositions (dismiss/comment findings). Triggers on phrases like: raise MR, merge request, glab, GitLab API, create branch, commit the fix, where is the vulnerability report, CI artifacts, security dashboard, dismiss finding, write back to Git...Votes: 0GitHub stars: 10
- Dependency RemediationRemediate security vulnerabilities in Node.js/npm projects — map a CVE to the offending package and fixed version, choose between a direct bump, a transitive-dependency override, or a code change, assess semver/breaking-change risk, update the lockfile, and verify the fix didn't break anything. Triggers on phrases like: fix vulnerability, upgrade dependency, npm audit, npm audit fix, package-lock.json, transitive dependency, overrides, resolutions, semver, breaking change, bump version, remed...Votes: 0GitHub stars: 10
- Connecting Lambda To Api GatewayConnects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration, permissions, and deployment. Always use this skill when connecting Lambda to API Gateway — it handles CORS, throttling, access logging, and production security hardening that are easy to miss.Votes: 0GitHub stars: 10
- Signing In To AwsGets AWS credentials for CLI/SDK access via `aws login`. Activates when a developer needs to authenticate to AWS for local development, when an AWS operation fails due to missing or expired credentials, or when someone asks about setting up AWS access. Triggers: "set up AWS", "configure AWS", "aws login", "get credentials", "authenticate", "session expired", "token expired", "no credentials", "AccessDeniedException" with no configured credentials.Votes: 0GitHub stars: 10
- Aws CloudformationAuthor, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation.Votes: 0GitHub stars: 10
- Aws Step FunctionsAuthors and edits AWS Step Functions state machines: writes Amazon States Language (ASL) in JSONata, and chooses and structures state types (Task, Choice, Map, Parallel, Pass, Wait, Succeed, Fail). Covers ASL syntax, JSONata data transformation and variables, Retry/Catch error handling, service integrations (.sync, waitForTaskToken callbacks), Distributed Map for large-scale S3/CSV processing, saga/compensation patterns, Standard vs Express workflow choice, TestState API unit testing, and mig...Votes: 0GitHub stars: 10
- Aws Messaging And StreamingGuides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK). Use when reasoning about messaging and streaming patterns. In general, use specific skills or documentation searches for detailed service-specific questions. Do NOT use for MSK or Managed Service for Apache Flink questions, pref...Votes: 0GitHub stars: 10
- Threat Model CheckVerify attack prerequisites are realistic. Block unrealistic threat models pre-submission. Matches "threat model", "attack prerequisites", "prereq check"Votes: 0GitHub stars: 6
- Slop CheckMeasure AI slop score (0-10) in reports. Used by triager-sim/reporter. Matches "slop", "AI detection", "ai detection", "template language"Votes: 0GitHub stars: 6
- ScoutUse when firmware binary analysis, attack surface mapping, or endpoint discovery is needed for a targetVotes: 0GitHub stars: 6
- Oos CheckPre-check if a Bug Bounty finding is Out-of-Scope. Auto-triggered at Phase 0 (full scan) and Phase 1 (per-finding). Matches "OOS", "out of scope", "exclusion check"Votes: 0GitHub stars: 6
- Infer Quality Profile From CodeInfer the product's ISO 25010:2023 quality-profile.yaml (characteristic-level targets, security profile, risk register) from scan-index.json during /codify, grounding every characteristic level and every risk entry in concrete scan-index signals and tagging source_type=inferred_from_code. Used exclusively by test-engineer in the /codify play.Votes: 0GitHub stars: 3
- Enrich Capability IceDetail one capability that /vision seeded — promote its capability.md from the directional stage to the detailed stage (benefit hypothesis, boundary, guiding rules, functionalities), author a detailed functionality.md grounding doc for each functionality it identifies, set the capability's structured nfr_needs + compliance_needs, and emit the implied per-dimension levels. Grounded in the capability's KB shelf. Generative artifact production for the /understand play. Under direct-model-write (...Votes: 0GitHub stars: 3
- Derive Quality VisionRead quality-profile, nfr-spec, logical architecture, and physical architecture to produce quality-vision.yaml — a vision statement plus per-ISO-25010-characteristic entries carrying vision narrative, target level, design linkage, concrete named tooling, quantified thresholds, and lifecycle gates. Merges and extends the prior quality-standards artifact.Votes: 0GitHub stars: 3
- Deploy To Cloud EnvDeploy a delivered increment to ONE resolved cloud environment exactly as the slice's run lens (run.yaml) declares it — run the environment's declared deploy command honoring its provider, region, compute, services, and networking; read secrets only from the declared secrets-manager binding (never print or store them); then prove the increment answers with an independent reachability/health check and capture a deploy record (environment, what ran, address, health proof, secrets source). On fa...Votes: 0GitHub stars: 3
- VerboseThreat modeling asks what could go wrong in a design. Vulnerability assessment asks what *is* wrong in the thing you actually built and deployed. The first is predictive and cheap; the second is empirical and finds the gap between the design you modeled and the system you shipped — the misconfigured bucket, the forgotten staging host, the library that went stale.Votes: 0GitHub stars: 2