All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,807
- 1,326
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,681–19,704 of 31,807 skills
- Implementing Rbac Hardening For KubernetesHarden Kubernetes RBAC by enforcing least privilege, reducing cluster-admin sprawl, and establishing repeatable access audits with remediation gates.Votes: 0GitHub stars: 72
- Analyzing Kubernetes Audit LogsAnalyze Kubernetes API audit logs to detect high-risk behaviors (privilege escalation, secret access, lateral movement patterns) and produce actionable detection and response artifacts.Votes: 0GitHub stars: 72
- LemmaflowMake an app production ready by finding and fixing trust leakage — PII committed to the repo, leaked secrets, privacy gaps, GDPR basics, missing data retention. Use whenever the user asks to make a project production ready, run a trust/compliance/privacy scan, check for PII or leaked secrets, audit a codebase before launch or release, asks whether they are compliant, or mentions lemmaflow — even when they name none of these checks explicitly. Free checks run fully local via npx; the deeper AI...Votes: 0GitHub stars: 2
- Nuxt StudioConfigure and operate the self-hosted Nuxt Studio editor for Nuxt Content. Use when working with nuxt-studio installation, editor customization, OAuth or custom authentication, media, drafts, Git publishing, or production deployment.Votes: 0GitHub stars: 724
- Security Audit SkillOWASP Top 10-driven security audit methodology with severity grading and fix-example discipline. Complements code_review_skill.md's general review process.Votes: 0GitHub stars: 3
- Multi-Review HTML SkillGenerate self-contained HTML reports for batch PR reviews with fixed left sidebar tabs, summary dashboard, and per-PR detailed review panels. All CSS/JS inline, zero external dependencies. Supports tabbed navigation, filtering, and PDF/JSON export.Votes: 0GitHub stars: 3
- Code Review Skill v3 (Requirement-Driven)Reusable 6-phase requirement-driven code review logic. Validates that PR/MR changes implement JIRA requirements, with comprehensive code quality analysis, scoring, and grading. Tech-agnostic patterns for requirement validation, code quality review, test coverage analysis, documentation analysis, and scorecard calculation.Votes: 0GitHub stars: 3
- Senior EngineerOperate as a senior engineering organization (principal engineer, senior fullstack, senior DBA, senior DevOps/SRE, security, QA, accessibility and privacy leads) for any non-trivial software work. Use when the user asks to audit, review, assess, harden, refactor, architect, scaffold, plan, build or ship a project or feature; when they say "is this production ready", "review my project", "build me a", "start a new project", "make this professional", "senior level", "best practices", "what am I...Votes: 0GitHub stars: 3
- Security HardeningApplication security engineering — OWASP Top 10, authentication and object-level authorization, injection, XSS/CSP, CSRF, SSRF, secrets management, file uploads, security headers, dependency and supply-chain risk, and threat modelling. Use when reviewing or building anything touching login, sessions, tokens, passwords, permissions, roles, payments, file uploads, webhooks, user-generated content or personal data; when the user says "is this secure", "security review", "pentest", "harden", "vul...Votes: 0GitHub stars: 3
- Release ReadinessThe go/no-go gate before shipping — a structured launch checklist across security, data, legal, operations, performance, accessibility and rollback, producing an explicit ship or do-not-ship decision with named blockers. Use when the user says "ready to launch", "go live", "ship it", "pre-launch", "launch checklist", "release checklist", "production ready", "deploy to production", "v1", "MVP launch", "are we ready" or "what's left before we ship"; and after any project audit, to convert findi...Votes: 0GitHub stars: 3
- Project BlueprintArchitect, scaffold and guide the construction of a new project to senior professional standards — requirements, stack selection, architecture, data model, security baseline, CI/CD, testing, observability, legal and SEO surface — built in the right order so nothing expensive has to be retrofitted. Use when the user says "build me a", "start a new project", "create an app", "scaffold", "set up a new repo", "I want to build", "help me plan a system", "design the architecture", "what stack shoul...Votes: 0GitHub stars: 3
- Secure CodingLanguage-agnostic OWASP Top 10:2025 rules for writing and reviewing backend/API code, plus per-stack idiom files for NestJS, Laravel and Spring Boot. Use before writing or modifying any route handler, controller, guard/policy, query, auth flow, app config, or dependency — in any language. Also use when the user asks what security guidance applies, or asks to check code against OWASP.Votes: 0GitHub stars: 2
- Api Secure ReportFull security inventory of every HTTP route in a backend project — each route marked clean or carrying findings, with the exploitation path and the mitigation, written in the user's language (pt-BR by default). Use when the user runs /api-secure-report, or asks for a security report, audit or inventory of the project's APIs.Votes: 0GitHub stars: 2
- Jaw Structured RenderersNative Web UI structured renderer schemas for compose-block drafts, search-results cards, dataframe tables, chart-json charts, and diff outputVotes: 0GitHub stars: 5
- Jaw Dev SecurityMUST USE for security-sensitive code — XSS, CSRF, SQL injection, JWT, OAuth, secrets, OWASP, auth hardening, supply chain, threat model. Triggers: auth/login/token code, input validation at trust boundaries, dependency/release surface, security/threat_model task_tags.Votes: 0GitHub stars: 5
- Web PentestRun an authorized black-box, gray-box, or white-box web security assessment and write a severity-rated report. Use when asked to pentest, attack, or security-test a site the user owns or authorized.Votes: 0GitHub stars: 3
- Security Review安全审查清单 (源自 ECC security-review)Votes: 0GitHub stars: 189
- Security Review安全审查 — T 阶段 (Path C+)Votes: 0GitHub stars: 189
- Cfn Security ReviewMUST BE USED before merging any change that touches auth, DB schema, HTTP handlers, or input parsing. Post-implementation security gate mirroring cfn-dry-review: reviews the working diff for injection, authz/authn gaps, secret exposure, missing RLS, missing security headers, unscoped DELETE/TRUNCATE, unsafe input. Emits a JSON manifest for cfn-vote-implement. Never auto-fixes.Votes: 0GitHub stars: 14
- HooksComplete automated post-edit workflow with validation, security scanning, and intelligent auto-resolution. This skill combines:Votes: 0GitHub stars: 14
- Cfn Dep AuditSupply-chain gate for new and existing dependencies. Enforces the ~90-day cooldown on NEW deps and the take-CVE-fixes-immediately carve-out. Runs npm audit / osv-scanner / cargo audit when present, flags newly added deps younger than the cooldown, and emits a manifest for cfn-vote-implement. Degrades gracefully when a tool is absent. Never auto-fixes.Votes: 0GitHub stars: 14
- Cfn DataForward database / data-layer design phase of the MegaPlan pipeline. Designs schema, indexes, RLS, migration up+down, lifecycle, concurrency, and privacy FORWARD instead of tracing them backward at review time. Emits the field-bindings table that cfn-ux consumes to derive UI controls. Use after cfn-spec + cfn-decide when the build touches a database.Votes: 0GitHub stars: 14
- Cfn ArchSPARC Architecture phase. Define component boundaries, interface contracts, integration points, DRY reuse BEFORE implementation. Use after cfn-spec and cfn-pseudo to lock structure, catch integration mismatches early.Votes: 0GitHub stars: 14
- XxeUse when an application parses XML from untrusted sources — XML or SOAP request bodies, SAML assertions, RSS or sitemap imports, SVG and Office documents accepted as uploads, configuration or feed ingestion — or when XML parser factories appear without hardening options, or when asked to find XXE, external entity resolution, DTD processing, or XInclude issues.Votes: 0GitHub stars: 2