All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,069
- 1,212
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 2,353–2,376 of 29,069 skills
- Security ScanSecurity review in one pass, design first and code second: identity, authentication and permission design, secrets by design and in the tree, boundary validation and injection (command, SQL, path, template), crypto and randomness, unsafe and dynamic code, trust in third-party code (plugins, models, dependencies), with a posture stating what was swept clean and what was not covered. Use for security reviews or audits, auth or permission design, secrets, injection, crypto, unsafe code, plugin t...Votes: 0GitHub stars: 3
- Django AdminUse when customizing Django Admin - save_formset, get_search_results, formsets, queryset optimization, db_index, custom URLsVotes: 0GitHub stars: 21
- LockdownUse when auditing or hardening a repository against software supply-chain attacks — including dependency lockfile integrity, CVE scanning, malware/typosquat detection, GitHub Actions SHA pinning, secrets scanning, provenance/signing, and SLSA/HIPAA control mapping. Triggers on phrases like "lock down dependencies", "supply chain audit", "is this repo secure", "dependency poisoning", "typosquat", "harden actions", "pin actions", "audit deps", or any concern about consuming or shipping third-pa...Votes: 0GitHub stars: 2
- Otopcy AuditUse before shipping to production, or when asked to audit, review or harden the security of an app — including a vibe-coded or AI-generated one, with or without access to the source. Runs 20 controls, ranks findings by real impact, and refuses to mark anything green without evidence. Also covers what to do when a key has been exposed (revoke first, investigate second).Votes: 0GitHub stars: 2
- Vp Woo Pont Shipping LabelsIntegrate with the shipping-label workflow in Csomagpontok és Címkék WooCommerce-hez. Covers the PRO boundary, normalized label payload, `generate_label()` and idempotency, HPOS-safe parcel meta, payload filters, label-created/error/removed actions, provider selection, PDF links, permissions, remote voiding versus local clearing, Számlázz.hu invoice references, and safe external side effects. Use when another WooCommerce plugin must add label fields, trigger generation, sync tracking numbers,...Votes: 0GitHub stars: 22
- Firestore Rules Creation"Designs, authors, refactors, and hardens production-grade CloudVotes: 0GitHub stars: 16
- Firebase Security Rules AuditorAudits Firebase (Firestore, Cloud Storage) security rules forVotes: 0GitHub stars: 16
- Firestore Rules CreationDesigns, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subagent are available in your environment, delegate authoring firestore.rules to the firestore-rules-author subagent. If subagent delegation is unavailable (e.g. not enabled in the IDE), firestore-rules-author is not installed, or you are running inside firestore-rules-author, follow this skill directly.Votes: 0GitHub stars: 16
- Clickhousectl Cloud DeployUse when a user wants to deploy ClickHouse to the cloud, go to production, use ClickHouse Cloud, host a managed ClickHouse service, or migrate from a local ClickHouse setup to ClickHouse Cloud.Votes: 0GitHub stars: 1,799
- Web SecurityUse when preparing a public launch of a site or app that has client and server code, environment variables, accounts, or APIs, to find launch-blocking security mistakes: exposed secrets and client-side env misuse, missing authorization on routes and APIs, publicly reachable private routes, debug endpoints, unsafe redirects and rendering, and insecure session handling. It reports evidence and fixes clear low-risk issues. Do not use it as a penetration test, to claim a site is secure, to use or...Votes: 0GitHub stars: 2
- X RayGenerates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping), invariants, integrations, docs quality, test analysis, and developer/git history. Triggers on 'x-ray', 'audit readiness', 'readiness report', 'pre-audit report', 'prep this protocol', 'protocol prep', 'summarize this protocol'.Votes: 0GitHub stars: 1,225
- FizzGenerate Echidna/Medusa-compatible Solidity fuzz suites from Foundry or Hardhat projects. Trigger on "fizz", "generate fuzz suite", "build fuzz harness", "stateful fuzzing", "fuzzing harness", "property testing", and "invariant suite".Votes: 0GitHub stars: 1,225
- Zero Trust PrinciplesNIST SP 800-207 reference: core tenets, logical components (policy decision and enforcement points), deployment models, the CISA maturity model, and patterns such as BeyondCorp-style access, conditional access, ZTNA replacing VPN, and SPIFFE workload identity. Use when designing or explaining a zero trust architecture.Votes: 0GitHub stars: 4
- Microsegmentation PatternsImplementation patterns for microsegmentation: default-deny Kubernetes NetworkPolicy, Cilium L7 and DNS-aware policies, Istio mTLS and authorization, tiered AWS security groups in Terraform, and PCI DSS cardholder data isolation. Use when writing segmentation policies for a cluster, service mesh, or cloud network.Votes: 0GitHub stars: 4
- Owasp Top 10Knowledge base for all ten OWASP Top 10 (2021) categories with vulnerable and fixed code examples, detection techniques, universal defense patterns, and framework security checklists. Use when reviewing web code for a specific vulnerability class or explaining an OWASP category and its fix.Votes: 0GitHub stars: 4
- Cvss ScoringReference for CVSS v3.1 and v4.0 metrics, scoring guidance, and the difference between severity and remediation priority. Use when scoring a vulnerability, checking a vendor score, or explaining a CVSS vector.Votes: 0GitHub stars: 4
- Threat ModelingChecklist-level threat modeling reference: STRIDE and DREAD summaries, a trust boundary checklist, common STRIDE threats per component, frequent MITRE ATT&CK techniques, example attack trees for tenant data theft and account takeover, and a catalog of common threat modeling mistakes. Use when you need a compact checklist while building or reviewing a threat model.Votes: 0GitHub stars: 4
- Stride MethodologySTRIDE-per-element analysis with threat catalogs and mitigation patterns for common components (web applications, APIs, databases, message queues, cloud services) and an incremental threat modeling process. Use when walking a system or data flow diagram through STRIDE in depth.Votes: 0GitHub stars: 4
- Attack TreesAttack tree methodology: notation, AND/OR decomposition, reusable tree templates, path analysis, advanced techniques, and using trees to make defense decisions. Use when decomposing an attacker goal into analyzable paths.Votes: 0GitHub stars: 4
- Sbom GenerationReference for generating SPDX and CycloneDX SBOMs: NTIA minimum elements, Package URLs, Syft usage, CI generation in GitHub Actions, VEX enrichment, and diffing SBOMs between versions. Use when producing or automating SBOMs for compliance or release artifacts.Votes: 0GitHub stars: 4
- Dependency Risk AssessmentMethodology for scoring dependency risk across vulnerability history, maintainer health, dependency depth, license compatibility, and provenance, with a triage matrix, a new-dependency evaluation checklist, automated monitoring, and a pinning strategy. Use when deciding whether to adopt, update, or replace a package.Votes: 0GitHub stars: 4
- Social Engineering AttacksTaxonomy of social engineering attack types with their psychological mechanisms, technical indicators, case studies, and detection patterns for phishing, BEC, and multi-channel attacks. Use when analyzing a suspected attack or explaining how one works so defenses can be designed.Votes: 0GitHub stars: 4
- Defense StrategiesTechnical and human controls for preventing, detecting, and responding to social engineering across email, phone, SMS, and physical channels, including SPF, DKIM, DMARC, payment verification callbacks, dual authorization, and response procedures. Use when designing layered defenses or responding to a phishing or BEC incident.Votes: 0GitHub stars: 4
- Siem Query LanguagesReference for Splunk SPL, Elastic KQL/EQL, and Microsoft Sentinel KQL with security query examples, a cross-platform conversion cheat sheet, Sigma for write-once rules, and query performance tips. Use when writing or translating SIEM queries.Votes: 0GitHub stars: 4