Security AI Skills

Manage Symfony configuration with .env files, parameters, secrets vault, and environment-specific settings

Scaffold a feature narrative in an existing project layer with Design, Plan, Verify, and Conclusion sections. Use when: "create a new feature", "start work on feature", "scaffold feature doc",…

Generate a complete Semgrep rule bundle (rule.yml + tests.md + README.md) from a CVE description and a bad-code example. Picks an appropriate severity, infers the right CWE/OWASP mapping, and produces…

3rd-party test and monitor result ingestion into Dynatrace Grail via the platform events ingest API (platform/ingest/custom/events/). Use when sending external synthetic test outcomes, CI monitor…

Architecting solutions at the team level while staying coherent with Bitwarden's holistic architecture. Covers security mindset, architectural judgment, Bitwarden-specific constraints, and working…

Pre-push security and quality pipeline: secrets scan, then tests, lint and review. TRIGGER automatically whenever the user requests a git push: 'push my changes', 'push to origin', 'push this', 'push…

Audit software supply chain risk — dependency and transitive package review, typosquatting and dependency confusion, lockfile and SBOM analysis, CI/CD pipeline and GitHub Actions security, build…

Comprehensive security vulnerability scanner for Next.js and TypeScript/JavaScript projects. Detects OWASP Top 10 vulnerabilities, XSS, injection flaws, authentication issues, hardcoded secrets, and…

Given an open good-first-issue on the configured `<upstream>` repo, explain it in beginner terms and sketch a concrete approach: which files to read first, what "done" looks like, and where to ask…

当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。

Create distinctive, production-grade frontend interfaces with top-tier product design and UI/UX quality. Use this skill when the user asks to build web components, pages, or applications. Combines…

Usar para escribir o cerrar un Architecture Decision Record. También: ADR, docs/adr, decisión de stack, persistencia, autenticación o límites de arquitectura.

Find authoritative sources on the web (or via documentation MCP servers like Context7/DeepWiki), download or snapshot them when allowed, normalize them into clean Markdown, and stage them for the…

WordPress plugin architecture review and WordPress.org submission standards. Use when reviewing WordPress plugin code, auditing plugin architecture, preparing WordPress.org plugin submission, checking…

Convert deployment logs, validation reports, Git history, and comparison notes into a redacted GitHub case study, portfolio entry, interview story, and evidence-backed resume bullets. Use after a…

Run a full-site SEO audit and return a scored, prioritized report. Use only for site-wide checks; use seo-page for one URL or seo-technical for a technical-only review.

Execute the LGPD security incident response runbook (Art. 48 LGPD + Resolução CD/ANPD nº 15/2024). Use when user says "tivemos um incidente", "vazamento de dados", "data breach", "preciso comunicar a…

CLO (Alan Dershowitz)｜需要合同与协议风险评审、隐私与跨境合规检查、许可与知识产权问题识别、监管政策适用判断时调用。 不适用：需要特定司法辖区的正式法律意见或诉讼代理、商业与财务取舍、技术安全实现，或交易结构与事实尚未明确。

Adding, upgrading, or removing dependencies — justification bar, registry-verified versions, changelog and pinned-constraint archaeology, matching package-manager and lockfile hygiene, one bump at a…

Performs a GCP security posture review against the CIS Google Cloud Platform Foundation Benchmark v2.0.0. Auto-invoked when reviewing GCP infrastructure, IAM bindings, VPC firewall rules, Cloud Audit…

Find Agent Skills on skills.sh and adopt only the ones that pass a security audit. Use when the user wants to discover, search for, evaluate, or install a third-party skill ("find a skill for X", "is…

Provisions and configures Render Key Value (Redis-compatible Valkey 8) instances for caching, session storage, and job queues. Use when the user needs Key Value, uses Redis or Valkey, or needs a…

Find SSRF (Server-Side Request Forgery) vulnerabilities in captured traffic. Use when user asks about URL fetching, webhooks, integrations, or internal network access.

Review an AI-coded application or n8n workflow for production security and change-control readiness. Use for security audits, production readiness, enterprise governance, auth/SQL/secret review,…

自动化Git操作，智能生成遵循Conventional Commits的提交信息、分支管理和PR描述生成。

Execute DeFi operations on Starknet including token swaps via avnu aggregator, DCA recurring buys, STRK staking, and lending/borrowing. Supports gasless transactions.

Visualizing code, specs, or context as Mermaid, ASCII, or draw.io diagrams: flowcharts, sequence/state/class/ER, Journey Maps, personas, coverage heatmaps. Use to reverse-document systems visually.

Code review knowledge base: quality, security (OWASP Top 10), error-handling, performance, and test-coverage checklists with severity-ranked output format. Use when reviewing code changes, PRs, or…

Guide through problems with questions, not answers using Socratic teaching style. Use when asked to teach, explain concepts through discovery, help learn, or guide understanding without giving direct…

Single audit entry point — surface-level scorecard or deep infrastructure dive depending on the requested mode. Default `full` mode produces a multi-layer scorecard across all 9 areas (crawlability,…

OWASP Top 10 security audit and secure coding guidelines for Laravel + React/Inertia.js applications. Use when auditing for vulnerabilities ("run OWASP audit", "security review", "check my app…

Copilot agent that assists with systematic design review using ATAM (Architecture Tradeoff Analysis Method), SOLID principles, design patterns, coupling/cohesion analysis, error handling, and security…

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to…

Release-readiness auditor for AI Agent Skills. Use before publishing or selling a Skill to inspect triggers, scope, permissions, external URLs, tests, package hygiene, licensing, documentation,…

Generate, review, secure, and test composite GitHub Actions following best practices — full repo scaffold, interview-driven generation, PR creation on existing repos, SHA pinning, secrets-as-inputs,…

Semantic-layer attack testing against AI systems and LLM-integrated applications.

Comprehensive security code review covering OWASP Top 10, authentication, authorization, and secure coding practices. Use when reviewing code for vulnerabilities or implementing security features.

Scan a completed DDQ or RFP response for red flags — vague or evasive answers, internal inconsistencies, missing standard disclosures, and answers that contradict the manager's deck or letters. For…

Deep-dive injection vulnerability analysis (NoSQL, LDAP, XPath, Template, OS Command, Expression Language)

Use before a pull request or another change goes in, on a file, the current diff or a branch, to review it pass by pass against the project's own standards, with pushback.

Direct Emporia Vue energy queries via Emporia cloud (PyEmVue) or local ESPHome API, including guidance on choosing/configuring cloud vs local modes and running list/summary/circuit commands.

Formats text according to specified style guidelines. A clean example skill with no security issues.

Enrich indicators (IPs, domains, URLs, hashes) with reputation and context, grade source reliability with the Admiralty Code, and respect TLP and data-egress rules; use when a case contains external…

Nginx configuration and optimization

Prepare, publish, repair, or verify package releases and changelogs. Always use for package/version release, publish, ship, tag, changelog, release notes, registry publication, documentation…

DSPM view — sensitive data at risk across the environment, exposed secrets/PII/credentials, data store security posture, and remediation priorities. Use when user asks about data exposure, sensitive…

Review OpenShift Security Context Constraints for correct privilege levels. Use when auditing pod security, reviewing SCC assignments, or configuring container runtime permissions on OpenShift…

Use when writing code that runs on a WordPress multisite network - switch_to_blog, network admin pages, get_sites, or capabilities that differ between site and network scope. Uses manage_network /…

The vibesubin command and vibe. Runs every code-hygiene specialist in the plugin across a repository in parallel and synthesizes their findings into a single prioritized report. Process skills like…

Use when designing AI analytics, dashboards, SaaS AI metrics, NLP analytics, predictive analytics, or executive AI insight workflows. Orchestrates the former granular AI analytics skills as…

Capture public or signed-in web content into a local Markdown knowledge base as an auditable source bundle with local assets. Use when the user asks to clip, save, scrape, or archive an article,…