All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,105
- 1,297
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 18,841–18,864 of 31,105 skills
- Code AuditUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.Votes: 0GitHub stars: 4
- Cloud K8sUse for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.Votes: 0GitHub stars: 4
- Attack ChainUse for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.Votes: 0GitHub stars: 4
- Api SecurityUse for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.Votes: 0GitHub stars: 4
- ReverseOps-routerRoutes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct ReverseOps entrypoint is unclear.Votes: 0GitHub stars: 4
- Security AuditUse when the user asks for a security review, security audit, vulnerability scan, secret scan, dependency or CVE check, OWASP review, pentest review, compliance evidence, or asks "is this safe to ship". Runs real scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner) over code, full git history, dependencies, IaC, and Supabase/Firebase row-level security, verifies each finding against source, and writes one severity-ranked report.Votes: 0GitHub stars: 4
- 20 Supply Chain SecuritySoftware supply chain security — SBOM generation and analysis, dependencyVotes: 0GitHub stars: 552
- Apple DeveloperConfigure and verify Apple Developer signing, bundle identifiers, capabilities, provisioning, entitlements, App Store Connect, TestFlight, Developer ID, notarization, and release readiness for any iOS, iPadOS, macOS, watchOS, tvOS, visionOS, or app-extension target. Use when creating a new Apple app or extension, repairing Xcode signing, selecting an Apple team, registering App IDs, adding widgets or App Groups, preparing archives/uploads, or auditing signed artifacts and Apple release eviden...Votes: 0GitHub stars: 9
- saas-preflightAudit a vibe-coded or AI-generated SaaS for security and payment failures before it ships, focused on the Next.js + Supabase + Stripe stack. Use this whenever the user is about to deploy, launch, or "ship" a web app that handles authentication, user data, or payments. Trigger on phrases like "is my app secure", "can someone read other users' data", "is my Stripe integration safe", "will someone get a free subscription", "review my SaaS before launch", "I'm going to production", or any review ...Votes: 0GitHub stars: 2
- Requirements ElicitationGuide structured discovery of business requirements through stakeholder interviews, workshops, and document analysis. Use when starting a new project, feature, or initiative that needs clear requirements.Votes: 0GitHub stars: 8
- Cross Cutting ReviewMulti-domain review across performance, security, operations, reliability, and data axes for changes that span concerns.Votes: 0GitHub stars: 8
- ElectronZoom Meeting SDK for Electron desktop applications. Use when embedding Zoom meetings in an Electron app with the Node addon wrapper, JWT auth, join/start flows, settings controllers, and raw data integration.Votes: 0GitHub stars: 4
- Finding DiscoveryUse when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.Votes: 0GitHub stars: 4
- Attack Path AnalysisUse when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.Votes: 0GitHub stars: 4
- Netlify IdentityUse when the task involves authentication, user signups, logins, password recovery, OAuth providers, role-based access control, or protecting routes and functions. Always use `@netlify/identity`. Never use `netlify-identity-widget` or `gotrue-js` — they are deprecated.Votes: 0GitHub stars: 4
- Threat ModelingDecide what a design must be true before code exists: naming assets and actors, locating trust boundaries, producing a written (asset, boundary, threat, control, owner) list, recording the assumptions the design rests on, and knowing when a change invalidates the model. Use when scaffolding a new feature, service, or endpoint, writing or reviewing a design doc, RFC, or ADR, or introducing a new trust boundary, integration, or data flow.Votes: 0GitHub stars: 22
- Supply Chain SecurityVet dependencies before they enter the build: typosquats, dependency confusion, malicious packages, known vulnerabilities, unlocked resolution, risky install and build hooks, EOL embedded runtimes, and the authenticity and freshness of your own release channel. Use when adding or upgrading a dependency, reviewing package manifests or lockfiles, configuring package sources or internal namespaces, or publishing a package or application update.Votes: 0GitHub stars: 22
- Serverless SecurityWhat a function-as-a-service platform changes: an execution environment reused between invocations so /tmp and module globals outlive a request, an event envelope that is attacker-influenced whichever trigger delivered it, encrypted-at-rest configuration that the control-plane API still returns in cleartext, and concurrency as the boundary between an incident and a bill. Use when generating Lambda, Cloud Functions, or Azure Functions code, serverless.yml or SAM templates, or wiring API Gatewa...Votes: 0GitHub stars: 22
- Secure Code ReviewThe sinks and boundaries that belong to no framework: passing input to a shell or an evaluator, letting input choose a filesystem path, validating at a boundary that is not an HTTP request, and handling regulated data (PII, PHI, cardholder data) so it does not spread into paths nobody reviews. Use when generating or reviewing code that shells out, touches the filesystem, reads a queue message, CLI argument, or parsed file, or when a change crosses a PII, PHI, or PCI boundary.Votes: 0GitHub stars: 22
- Saas SecurityWiring your application to a third-party SaaS platform: verifying an inbound webhook against the vendor's own scheme rather than a generalized one, why a valid signature identifies the sender and not the user in the payload, replay windows, one credential per integration and per environment, least-privilege scopes, and treating a bulk export as a data boundary. Use when writing a webhook receiver, an OAuth integration, a SCIM endpoint, or any code that authenticates to or from a SaaS vendor.Votes: 0GitHub stars: 22
- Protocol SecurityTransport security where the client establishes trust: TLS version floor, certificate chain and hostname verification, the trust store, connecting by IP, mTLS and workload identity as authentication, gRPC channel credentials, and SMTP STARTTLS. Use when generating HTTP, gRPC, or SMTP clients and servers, configuring TLS in code or platform config, wiring service-to-service authentication, or when tempted to disable certificate verification.Votes: 0GitHub stars: 22
- Ml SecurityThe model and data artifacts: checkpoint formats that execute code on load, provenance for a model you did not train, training-data poisoning and the ingestion controls that bound it, PII that survives into weights, and notebooks that commit their own output. Use when loading a model from disk, a Hub, or object storage, ingesting user content for training or fine-tuning, or writing training, evaluation, or notebook code.Votes: 0GitHub stars: 22
- Logging SecurityKeep secrets and personal data out of logs at the call site rather than relying on redaction, neutralize log and field injection, record audit events that survive, and treat log read access as data access. Use when generating logger calls or structured-logging schemas, wiring log shippers, sinks, retention, and access controls, or specifying audit-logging requirements.Votes: 0GitHub stars: 22
- Llm App SecuritySecuring a feature that calls an LLM: prompt injection as an unsolved input problem, bounding what model output is allowed to reach, tool authorization against the human rather than the model, approval gates on consequential actions, RAG context provenance, system-prompt leakage, and cost limits. Use when sending prompts to an LLM API, building a RAG pipeline, giving a model tools, rendering or executing model output, or exposing an LLM-backed endpoint.Votes: 0GitHub stars: 22