Security AI Skills

Periodic dependency review for Node.js/pnpm projects — outdated package triage, security audit, update batching strategy (patch/minor/major), validation checklist. Run monthly or before major…

Enumerates and exploits Microsoft SCCM/MECM (System Center Configuration Manager / Microsoft Endpoint Configuration Manager) infrastructure for credential harvesting, lateral movement, and domain…

Master Unlock: Grants unlimited technical rights to unpack and deconstruct Electron Builder artifacts. Use this to extract app.asar, recover unpacked native resources, and expose update metadata…

AI agent and LLM system engineering reference covering single-agent dev (ReAct, tool calling, plan-execute), multi-agent coordination (swarm, role decomposition, file locking), LLM security (prompt…

Synthesizes supplied evidence-backed defensive assessment results and administrative receipts into a scope-bound control-evidence matrix that preserves lineage, freshness, contradictions, unknowns,…

Hardcoded secret detection and prevention in git repositories and codebases using Gitleaks. Identifies passwords, API keys, tokens, and credentials through regex-based pattern matching and entropy…

Reviewing code by dispatching the default reviewer subagents in parallel (plus conditional specialists for lib-observability, lib-systemplane, or lib-streaming when the diff triggers them), then…

Generate and improve prompts using best practices for OpenAI GPT-5 and other LLMs. Apply advanced techniques like chain-of-thought, few-shot prompting, and progressive disclosure.

Structured review of agent-generated code: a fixed pass order (behavior → structure → taste → security → performance → accessibility), severity-ranked findings, diff discipline, and a review checklist…

Create tactical implementation plan for a feature or task

Multi-Agent Project Manager orchestration - delegation patterns, agent types, and verification protocol

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security…

Keep the durable record that outlives a session — credential provenance, access inventory, artifacts left on target for cleanup, findings with evidence, and a dead-end log — so work spanning days or…

Interactive onboarding to create a structured knowledge base. Defines categories, scaffolds the directory structure, creates the index, and optionally imports initial content. Run this first before…

Creates a Spring Security configuration class with authentication, authorization, and HTTP protection setup. Use this skill when a security configuration needs to be created, either standalone or as…

Review a GitHub stacked pull request as one unit on `<upstream>`: resolve the stack from any member PR or its stack number, check that the chain is linear and current, map every file to the layers…

Use when creating or animating characters that need to connect with audiences—hero protagonists, memorable villains, lovable sidekicks, or any figure that must have personality and presence.

Use when an open-source developer tool, package, CLI, agent, or MCP server must be evaluated for legitimacy, supply-chain risk, telemetry, dangerous capabilities, claim accuracy, and adoption fit.

当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。

Start-Stop-Continue retrospective identifying what to Start doing, Stop doing, and Continue doing. Use for sprint retros, personal reflection, team process reviews, or habit audits.

Root cause investigation — structured debugging with module freeze. No fixes without investigation. Use when encountering any bug, error, or unexpected behavior.

Reviews a diff or security scope read-only using evidence-tiered findings, structural and context-error rubrics, and repository review policy. Use when asked to "review my changes", "structural…

发版自动化技能：CalVer 版本号 + 从 git log 生成 changelog + GitHub Releases。 覆盖完整发版流程：版本号生成→changelog 生成→git tag→GitHub Release（或本地 changelog 文件）。 在发版前自动触发 security-audit 安全审查（如果配置了 CI/CD 则检查 CI 状态）。…

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Business strategy expertise for strategic planning, competitive analysis, market entry, M&A strategy, portfolio management, and strategic decision-making. Use when analyzing competitive positioning,…

Use the private LearnWorlds CLI to inspect DevExpert Academy users, find students by email, list their enrolled courses/products, look up products, and perform safe enrollment workflows. Trigger when…

Performs a structured secrets management review against OWASP Secrets Management Cheat Sheet and NIST SP 800-57 Part 1 Rev 5 (Recommendation for Key Management). Auto-invoked when reviewing secret…

Parse and extract package information from npm package-lock.json files to identify dependencies and their installed versions.

Draft a provider-side Data Processing Agreement from the bundled DOCX template after structured intake covering party roles, processing details, security, subprocessors, incidents, audits, deletion,…

Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.

Dependency health management. Detects package manager, checks outdated packages and vulnerabilities, and produces a prioritized update plan.

Use when needing impartial architectural advice, security audit, spec integrity review, or a second opinion — operates outside the chain of command with standing authority to invoke truth checks

Engineering privacy and data governance: PII detection, data flow mapping, consent patterns, GDPR/CCPA-compliant implementation, DPIA. Use when privacy-by-design is needed.

Use when finding code smells, auditing TODOs, removing dead code, cleaning up unused imports, or assessing code quality. Triggers on: 'use tech-debt mode', 'tech debt', 'code smells', 'clean up',…

Use when auditing Go code involving file path operations, archive extraction, symlink handling, container volume mounts, or HTTP file serving. Covers CWE-22/59. Keywords: path traversal, directory…

CAN/CAN-FD bus analysis, UDS diagnostics, IVI pentest, OBD-II exploitation, key fob replay/relay attacks, GNSS spoofing, EV charging station (ISO 15118), and connected vehicle red team operations.

Use when starting a security conversation to understand the Perseus methodology

Applies Taleb's Black Swan theory to assess and mitigate exposure to rare, high-impact unpredictable events. Distinguishes between Mediocristan and Extremistan domains, designs barbell strategies,…

Validates practitioner credentials and license status against the NPI registry. Cross-references specialties, credentials, and practice addresses against official records. Returns Verified / Partially…

Triage a SaaS or tenant alert where a security control is weakened or admin control is seized — MFA, audit logging, or secret-scanning turned off, a security or tenant or cross-tenant policy edited, a…

Perform a full quality, stability, and architecture audit of a codebase. Identifies broken features, dead code, spaghetti coupling, missing error handling, security gaps, performance problems, and…

Use when registering WordPress REST API routes with register_rest_route or building custom endpoints. Sets a real permission_callback (never __return_true for writes), defines args with…

Manages R&D pipeline, technology scouting, prototyping, and IP tracking with traceable innovation-to-product handoff. Use when evaluating technologies, managing prototypes, or transferring validated…

This skill should be used to audit Row-Level Security and database permissions on a Postgres backend exposed through an auto-generated API — Supabase, InsForge, or any Postgres + PostgREST setup.…

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL…

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to…

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel",…

KubeSphere multi-tenant management Skill. Use when user requests to create users, workspaces, projects, or assign roles/permissions. Supports user lifecycle management, workspace configuration,…

Creates, syncs, audits and manages Prowler compliance frameworks end-to-end. Covers the two supported JSON schemas (universal multi-provider and legacy per-provider), the SDK model tree (legacy…

Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then…

Detect command injection, eval/exec usage, remote execution, or arbitrary code loading.