Security assessment using STRIDE threat modeling, OWASP Top 10, and CVSS scoring. Use for security reviews, threat modeling, and secure coding guidance.

Security audit for code review and vulnerability analysis

Security patterns and detection rules for automated code review. Automatically loaded when performing security reviews, checking for vulnerabilities, or when "security check", "vulnerability", "CVE", "security patterns", or "security audit" are mentioned.

When the user wants to create, optimize, or audit a services page. Also use when the user mentions "services page," "what we offer," "service offerings," "consulting services," "service page," "offerings page," "service catalog," or "professional services." For sitewide page planning, use website-structure.

Read-only: lists all URL redirects, flags redirect chains (A→B→C) and duplicate targets.

Formats text according to specified style guidelines. A clean example skill with no security issues.

Audit the entire skill portfolio for redundancy, misplacement, staleness, and context bloat. Use for /skill-portfolio-review, 'review my skills', 'clean up skills', 'are any skills redundant', or after adding 3+ new skills since last review. Produces DELETE/MERGE/REFRAME/KEEP recommendations per skill. NOT for auditing a single skill (/skill-quality-gate) or project quality (/audit).

Apply Spatie's security guidelines when configuring applications, databases, or servers, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening.

This skill should be used when the user asks to "check tags", "update tags", "audit tags", "change tag", "list tags", "tag this note", "fix frontmatter tags", or needs to manage tags across notes.

Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.

Persona-family sub-skill for enterprise / B2B personas (Admin Alice, End User Eddie, Manager Maya, IT/Security Ivan). Router-dispatched from the user-feedback parent skill on ENTERPRISE or B2B project type. Loads only the Category 3 profile block from references/persona-library.md.

Run structured quality gate against current project. Use for /verify, "verify the build", "run quality checks". NOT for eval scoring (/eval-score) or auditing (/audit).

Fast, high-signal accessibility triage for pages, components, or PRs targeting WCAG 2.2 AA compliance.

Attack WiFi networks using WPA/WPA2 cracking, WPS exploitation, Evil Twin attacks, deauthentication, and wireless reconnaissance. Use when pentesting wireless networks or performing WiFi security assessments.

Phase 4: Apply corrections to DOCX

Accessibility audit and remediation for Canvas LMS courses. Scans content for WCAG violations, generates prioritized reports, guides fixes, and verifies remediation. Use when asked to "audit accessibility", "check WCAG compliance", "fix accessibility issues", or "run accessibility review".

Scan test files for Playwright best practice violations. Use when user says check my tests, lint tests, validate tests, or audit test code.

Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines.

Systematic code review: security checks, performance analysis, complexity assessment, best practice validation, and review checklists.

Review code for best practices, security issues, and potential bugs. Use when reviewing code changes, checking PRs, analyzing code quality, or performing security audits.

Manage PR crises. Use when: reputational threat emerges, need stakeholder messaging, or communication timeline.

Base security pattern for integrating cryptographic primitives into software systems. Use when implementing encryption, digital signatures, MACs, or any cryptographic operations. Provides guidance on library selection, key usage, configuration protection, and designing for cryptographic agility. Foundation pattern for Encryption, Digital signature, and MAC patterns.

Review data integrity for Rails changes. Use when the user asks for migration safety review, constraint validation, transaction boundary audit, or PII/privacy compliance review.

Create and configure Drizzle Cube semantic layer cube definitions with proper security context, measures, dimensions, and joins.

Audit project dependencies for vulnerabilities, outdated packages, license compliance, and supply chain risks.

This skill should be used when the user asks to "check CLI compliance", "validate CLI tool", "audit CLI code", "review CLI conventions", or wants to verify a CLI tool follows tech stack standards. Also use when the user says "check if this script follows our standards" or "lint this CLI tool".

Use when the user asks to review, audit, improve, classify, or reorganise existing documentation — for a single page or a whole docs set. Evaluates docs against Diátaxis principles: type fit, boundary discipline, user fit, structure, and quality. Returns concrete prioritised fixes and, where needed, recommends splitting overloaded pages. Triggers on phrases like "review my docs", "audit the documentation", "what's wrong with this guide", "improve this README", "tell me what's wrong".

Automatically discover cryptography skills when working with encryption, TLS, certificates, PKI, and security

Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.

Store, retrieve, list, and manage secrets using gopass (the team password manager). Use when the user asks to save credentials, look up passwords, generate secrets, manage password entries, or interact with a gopass password store. Covers CRUD operations, secret generation, TOTP, recipients, mounting stores, and clipboard operations.

gws CLI shared reference: authentication, global flags, output formatting, security rules, and shell tips. Loaded as prerequisite by all gws-* skills.

Evaluate R package and paper.md against the full JOSS reviewer checklist. Covers software requirements, paper format, and community standards. Gap report with Critical, Warnings, and Passed sections, plus fix recommendations.

Conducts comprehensive Magento 2 security assessments and implements security measures. Use when auditing security, identifying vulnerabilities, implementing security controls, or ensuring compliance. Masters security auditing, vulnerability management, and compliance frameworks.

Helps with 1Password CLI (op) for secure secret retrieval and management When user mentions 1Password, secrets, op command, or asks about credential management

Map a codebase into feature-grouped flowcharts, identify duplicated concerns across features, and propose a unified architecture. Use when asked to "find the ideal path," unify duplicated systems, or audit architecture before a refactor. Emits a proposed unified flowchart plus per-system /make-plan prompts.

Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.

Blameless post-mortem incident analysis with timeline, root cause, and action items. Use after outages, security incidents, project failures, or any event you want to prevent recurring.

Red team adversarial analysis to find weaknesses, vulnerabilities, and failure modes. Use before launches, for security review, or when a plan feels too perfect.

Final arbiter for Bug Hunter. Receives Hunter findings and Skeptic challenges, independently re-reads code, and delivers authoritative verdicts with CVSS scoring and proof-of-concept generation for security findings.

Review code changes for security, performance, and correctness

Auditing a dependency for supply-chain risk before install (pip/npm/go/cargo): checks typosquatting, maintainer/age risk, vulnerability DBs (OSV, GHSA, Socket), and lockfile hash pinning, then emits a risk score and approve/conditional/escalate/block decision. Use when adding or updating a dependency, reviewing a dependency PR, or investigating a compromise. Skip when no new dependency is involved or it is already vetted.

Use when working on Apex code — classes, triggers, batch, queueable, schedulable, REST/SOAP services. Covers FFLib patterns, bulkification, governor limits, security, test data factories.

Use for org-level Salesforce architecture work — capacity planning, security/sharing review, integration patterns, multi-org strategy, tech-debt assessment.

Systematic security code review methodology. Use this skill when reviewing pull requests for security issues, auditing critical code paths, or performing security assessments. Activate when: security review, code audit, secure code, review PR for security, find vulnerabilities, security assessment.

Rapid security assessment focused on OWASP Top 10 vulnerabilities

OWASP Top 10 prevention, auth patterns, secrets management, dependency auditing, three-tier boundary system. Use when handling user input, auth, data storage, or external integrations.

General-purpose security auditing guide. Covers OWASP Top 10, dependency vulnerabilities, authentication, authorization, input validation, and secret management. Use this when performing a security review or audit.

Automate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR capabilities. Use when scaling security operations or implementing DevSecOps.

Curated bundle of essential security skills for building secure applications. Includes threat modeling, hardening guides, audit checklists, compliance frameworks, and contract analysis. Use when establishing security practices for a project.

Analyze semgrep scan findings, triage real vulnerabilities vs false positives, fix real issues using framework-native escaping, and suppress false positives with properly formatted nosemgrep comments.

This skill should be used when the user asks to "set up supply chain protection", "install security tools", "configure Socket", "install lockfile-lint", "set up supply chain defence", "fix supply chain issues", or when invoked by the doctor command to remediate missing tools. Handles installation and configuration of Socket.dev CLI, lockfile-lint, LavaMoat (optional), CycloneDX (optional), and project state file initialisation.

Use when reviewing code, auth, or APIs for security vulnerabilities — adopt an attacker mindset, enumerate the attack surface, report only findings with a concrete reproducible attack path.

Threat modeling methodologies (STRIDE, PASTA, LINDDUN), attack tree analysis, common attack patterns (OWASP Top 10, CWE), risk assessment frameworks, and security architecture patterns

Generate STRIDE-based threat models with intelligent threat analysis, CVSS risk scoring, and mitigation recommendations

Security anti-pattern for unrestricted file upload vulnerabilities (CWE-434). Use when generating or reviewing code that handles file uploads, processes user-submitted files, or stores uploaded content. Detects missing extension, MIME type, and size validation.

Security anti-pattern for verbose error messages (CWE-209). Use when generating or reviewing code that handles errors, exceptions, or generates user-facing error responses. Detects stack trace exposure and detailed error information leakage to users.

Security anti-pattern for weak encryption (CWE-326, CWE-327). Use when generating or reviewing code that encrypts data, handles encryption keys, or uses cryptographic modes. Detects DES, ECB mode, static IVs, and custom crypto implementations.

Web performance measurement and debugging toolkit. Use when the user asks about web performance, wants to audit a page, or says "analyze performance", "debug lcp", "check ttfb", "measure core web vitals", "audit images", or similar.

Security anti-pattern for XPath injection vulnerabilities (CWE-643). Use when generating or reviewing code that queries XML documents, constructs XPath expressions, or handles user input in XML operations. Detects unescaped quotes and special characters in XPath queries.

Audit trending repos for real exploitable vulnerabilities and disclose responsibly — Private Vulnerability Reporting for code flaws and verified secrets, public PRs only for already-disclosed dependency CVEs. Semgrep + TruffleHog + osv-scanner + Slither with reachability triage. Skips targets that have no safe disclosure channel. Triggers: "vuln scan owner/repo", "audit this repo", "responsible-disclosure scan", "check for secret leaks", "scan dependencies for CVEs".

Manage Glide app access, privacy, authentication, and publishing. Use when configuring who can access an app, setting up sign-in methods, publishing apps, inviting users, or configuring Row Owners for data security.

Audit the current repository against RAE standards. Use when the user says "audit repo", "check repo standards", "sync with RAE", "check for drift", "compare against template", or when you want to verify a repo follows RAE conventions. Compares pyproject.toml, CLAUDE.md, ruff config, pytest/coverage config, and dev dependencies against the canonical RAE template.

Phase 3: Generate and present audit report for user review

[STUB - Not implemented] Authentication security including JWT validation, session management, and OAuth2/OIDC flows. PROACTIVELY activate for: [TODO: Define on implementation]. Triggers: [TODO: Define on implementation]

Security pattern for implementing access control and authorization. Use when designing permission systems, implementing RBAC/ABAC, preventing unauthorized access, addressing privilege escalation, or ensuring users can only perform allowed actions on permitted resources. Addresses "Entity performs disallowed action" problem.

Create or update the project security baseline, profile, suppressions file, and gitignore entries for security scans

Review code for quality, security, and best practices. Use when asked to review code, find bugs, or suggest improvements.

Automated code review with best practices, security checks, and quality standards.

Audit an R package against CRAN Repository Policy and submission requirements. Produces a gap report with Critical (must fix), Warnings (should fix), and pass/fail assessment per requirement type. Offers automated fixes where possible.

Audits project dependencies for outdated packages, duplicates, heavy/problematic libraries, security vulnerabilities, and risky version combinations. Generates prioritized reports with security, performance, and maintainability insights, upgrade paths, and safe pinning recommendations. Use when users request dependency audits, package updates, security checks, or dependency optimization.

Security pattern for implementing digital signatures. Use when implementing document signing, code signing, certificate signing, non-repudiation, or verifying authenticity and integrity of messages using asymmetric cryptography (RSA, ECDSA, Ed25519).

Reviews Confluence docs against source code to find inaccuracies and suggest fixes. Use when the user provides a Confluence URL and asks to review, audit, or check if docs are accurate or up to date (GitHub repo not required — inferred from the Confluence space).

Best practices for session documentation - incremental summaries, fix reports, and audit trails

Security pattern for channel-level encryption (TLS/SSH). Use when implementing HTTPS, securing all communication between endpoints, setting up TLS connections, or when infrastructure should handle encryption transparently. Addresses "Leak action request or data in transit" problem.

Best practices and rules for securing FiveM resources against cheaters and exploits. Use this skill when writing or reviewing server-side and client-side code to ensure malicious events, unauthorized entity creations, and client trust issues are prevented. Focuses on strict server authority and safe event handling.

Review pull requests for code quality, security issues, and best practices. Use when reviewing PRs, checking code changes, or analyzing diffs before merge.

Google Workspace Alert Center: Manage Workspace security alerts.

Apply enhanced verification (CoVe-like review, security/arch/perf checks, targeted web research) for high-risk tasks or uncertainty. Use for security, infra, data loss risk, major refactors, or when facts may be outdated.

Owns the assets worth protecting, threat model, authentication/authorization boundaries, and safeguards for the project.

Security pattern for implementing security logging and audit trails. Use when designing logging systems for security events, implementing non-repudiation, creating audit trails, or addressing security monitoring and incident response needs. Addresses "Entity repudiates action request" problem.

Security anti-pattern for missing security headers (CWE-16). Use when generating or reviewing web application code, server configuration, or HTTP response handling. Detects missing CSP, HSTS, X-Frame-Options, and other protective headers.

Security anti-pattern for OAuth implementation vulnerabilities (CWE-352, CWE-287). Use when generating or reviewing OAuth/OIDC authentication flows, state parameter handling, or token exchange. Detects missing CSRF protection and insecure redirect handling.

Security pattern for server-side token authentication (e.g., session IDs). Use when implementing session management, designing stateful authentication where server maintains token-to-principal mapping, or building systems requiring immediate token revocation. Specialization of Authentication pattern.

Pre-execution plan-review AND post-execution evidence-audit. Quorum-gated. Spawns ≥3 isolated oracle agents; ≥2 APPROVE required.

[STUB - Not implemented] OWASP Top 10 2021 vulnerability detection including injection, XSS, and security misconfiguration. PROACTIVELY activate for: [TODO: Define on implementation]. Triggers: [TODO: Define on implementation]

Security anti-pattern for padding oracle vulnerabilities (CWE-649). Use when generating or reviewing code that decrypts CBC-mode ciphertext, handles decryption errors, or returns different errors for padding vs other failures. Detects error message oracles.

Security anti-pattern for path traversal vulnerabilities (CWE-22). Use when generating or reviewing code that handles file paths, reads or writes files based on user input, or serves static content. Detects joining user input to paths without proper sanitization or validation.

Administer IT — manage users, monitor security, configure Workspace.

Conduct comprehensive pull request reviews with security, architecture, and quality checks. Use when user wants to review a PR.

Gather standards, best practices, applicable criteria before validation planning. Maps standards (WCAG, HIG, security) to Shannon validation skills.

Fast code/plan review for quality, security, and tests. Use for quick reviews before deeper analysis.

Get code review from Codex AI for implementation quality, bug detection, and best practices. Use when asked to review code, check for bugs, find security issues, or get feedback on implementation patterns.

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Security anti-pattern for second-order injection vulnerabilities (CWE-89 variant). Use when generating or reviewing code that retrieves data from databases, caches, or storage and uses it in subsequent queries or commands. Detects trusted internal data used unsafely.

Adversarial security audit — STRIDE, OWASP Top 10, supply-chain (CVE/SBOM), secrets scan, auth/authz analysis. Use on changes touching auth, input parsing, deserialization, network I/O, dependencies, or secrets; before any production release or external-surface PR.