Security Skills

Perform dynamic application security testing with OWASP ZAP, Burp Suite, and Nikto. Test running applications for security vulnerabilities through automated and manual testing. Use when testing web applications, APIs, or performing penetration testing.

Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check. Identify and remediate vulnerable libraries in your software supply chain. Use when managing third-party dependencies or implementing software composition analysis.

Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management.

Manage secrets and PKI with HashiCorp Vault. Configure secret engines, authentication methods, and policies. Use when implementing centralized secrets management, dynamic credentials, or certificate management.

Закрыть занятие, открытое скиллом /lesson. Финализирует lesson/YYYY-MM-DD.md (frontmatter status, метаданные времени, длительность), делает commit + push в репо personal-guide. Триггерит замкнутый контур доставки — после push → GitHub webhook → bot oauth_server.py:/webhook/github/workbook → sync_one_user_to_dt → ЦД обновляется в Neon. Используй когда пилот говорит «закрываем», «всё», «закончили», «закрой урок» — или после явного завершения задания в /lesson.

AI trustworthiness testing using OWASP AI Testing Guide v1. Execute 32 test cases across 4 layers (Application, Model, Infrastructure, Data) with practical payloads and remediation.

Security audit for LLM and GenAI applications using OWASP Top 10 for LLM Apps 2025. Assess prompt injection, data leakage, supply chain, and 7 more critical vulnerabilities.

> 🔒 Security & Compliance skill suite derived from borghei/Claude-Skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.

Verify code for security issues including hardcoded secrets, input validation, error exposure, and dependency vulnerabilities. Use when asked to "verify security", "check for secrets", or "scan for vulnerabilities".

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

The ultimate authentication and authorization skill. Implement login, signin, signup, registration, OAuth, 2FA, MFA, passkeys, and user session management. Secure your application with RBAC and access control.

Clerk modern authentication, WebAuthn, passkeys ve social auth entegrasyonu rehberi.

Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking, and security automation. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or ensuring compliance requirements.

Helps agents develop, review, test, secure, optimize, design, integrate, package, and release modern WordPress plugins. Use for WordPress plugin architecture, Gutenberg block work, block.json, REST API, WP admin screens, shortcode implementation, Settings API, WP-CLI workflows, PHPUnit tests, wp-env environments, Plugin Check, WordPress.org release preparation, security audit, performance optimization, plugin UI/UX design, Classic Editor compatibility, SEO/cache/theme/page-builder integrations, and compatibility audits.

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

Real-time web research using Google Search via Google's Antigravity (`agy`) CLI — the replacement for the deprecated `gemini-cli`. Trigger when user needs current information ("search with agy", "search with Google Antigravity", "find current info about X with agy", "what's the latest on Y"), library/API research, security vulnerability lookups, or comparisons requiring recent data.

Real-time web research using Gemini's Google Search. Trigger when user needs current information ("search with Gemini", "find current info about X", "what's the latest on Y"), library/API research, security vulnerability lookups, or comparisons requiring recent data.

> 🔒 Security & Compliance skill suite derived from GetBindu/awesome-claude-code-and-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Add authentication (passkeys/OAuth) to the current Convex app, including the auth.config.ts wiring.

Audit and harden Convex authorization: identity-from-arg impersonation, missing per-document ownership checks, PII-leaking public queries, and writes into containers the caller doesn't own. Deterministic scan + canonical requireIdentity/requireOwner fix + tsc verify. Use for 'secure my app' / 'audit auth' / 'who can access this data', not generic code review.

Use ONLY when the user's message contains the exact command `/special-debug tool-trace` (optionally with `--full`); run the task normally, then write `tool_trace.json` summarizing tool/action/connector calls in order. Sensitive values (secrets, tokens, PII/PHI) are redacted by default; `--full` keeps them verbatim for an authorized admin.

MAC-Telnet protocol (MikroTik Layer-2 terminal/exec over UDP 20561) wire format, session handshake, and MD5 + MTWEI (EC-SRP) authentication. Use when: implementing or debugging a MAC-Telnet client/server, reaching a RouterOS device by MAC address without IP, parsing MAC-Telnet packets, understanding the WinBox-style L2 terminal, deciding between classic MD5 and modern MTWEI auth, or when the user mentions MAC-Telnet, mactelnet, mactelnetd, port 20561, or MTWEI/EC-SRP RouterOS login.

Check SKILL.md files for security risks including prompt injection, hardcoded secrets, and compliance with security best practices. Use when creating or reviewing Skills in the your skills repository.

Perform a structured security and compliance review using evidence from code/config/docs. Use for MR/PR review, architecture review, and periodic full scans. Detects secrets exposure, PII leakage, access control gaps, and compliance violations.

API security best practices and common vulnerability prevention. Enforces security checks for authentication, input validation, SQL injection, XSS, and OWASP Top 10 vulnerabilities. Use when building or modifying APIs.

Audit the security domain - auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Scan a project to identify Kafka applications, extract schemas from data models, tag PII fields, generate Terraform for Confluent Schema Registry registration, and produce a migration report with rollout ordering. Use this skill when a user asks to analyze a folder or repo for Kafka usage, extract schemas, audit producer/consumer configurations, or generate Terraform for Schema Registry.

Build an OAuth + MCP protocol facade in front of Bedrock AgentCore Gateway or Runtime so strict MCP clients (Claude Code, Cursor, Amazon Quick, mcp-remote) can connect. Use when an MCP client fails OAuth discovery ("Fix highlighted fields", DCR errors), when tools beyond 30 silently disappear (Gateway tools/list pagination), when tool calls return 404 or "Unknown tool" (dual session-id, tool name prefix), or when adapting Cognito to RFC 9728/8414 metadata, redirect_uri rewriting, or Gateway schema limits.

Publish HTML/Markdown design documents on GitLab Pages with selection-driven discussion. Reviewers select any text in the published doc; a floating 💬 bubble opens a prefilled GitLab Issue (title + anchor link + selection quote + label) in a new tab. GitLab handles auth via the user's existing session — no OAuth, no PAT, no API calls. Works on gitlab.com, self-hosted, and proxy-fronted GitLab.

Comprehensive security and compliance scanning for AWS CDK projects. Use when running security audits, checking license compliance, scanning container vulnerabilities, or running aggregated SAST/IaC/secret analysis before deployment.

Use for security review, auth/permission changes, secrets, dependency risk, injection, SSRF, XSS, CSRF, data exposure, unsafe hooks, or supply-chain concerns.

Audit a game feature, combat system, loot table, reward loop, procedural system, chance mechanic, or uncertainty-driven design by how players are likely to perceive its randomness. Use when you need to evaluate whether a system will feel fair, streaky, rigged, sabotaging, manipulable, or skill-undermining; when players may misread independent events as patterned; or when randomness may sit too close to player action and create frustration. Analyze expectation gaps, gambler's-fallacy-style reactions, hidden pattern-seeking, input-versus-output randomness, perceived fairness, exploit risk, and ways to reshape presentation or mechanics.

> 🔒 Security & Compliance skill suite derived from glebis/claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

This skill should be used when the user asks about a "caching strategy", "cache invalidation", "what to cache", "read-through vs write-through vs write-back", "cache eviction" (LRU/LFU/TTL), "Redis vs Memcached", "stale reads", or hits "thundering herd", "cache stampede", "cache penetration", or "hot key" problems. Use it whenever a design is read-heavy or a datastore is overloaded by reads, even if the user doesn't say "cache".

> Automatically triggered when running security scans, auditing code for vulnerabilities, checking dependencies for CVEs, reviewing code for security issues, or hardening Python pip-audit, dependency vulnerabilities, OWASP, injection, path traversal, secrets detection, insecure deserialization, auth bypass, or "is this code secure?". "check for CVEs", "audit dependencies", "security lint", "pen test this code", "harden this application", "check for secrets", "SAST scan", "code security scan", "security pipeline", "supply chain security".

> SOC Analyst role bundle covering Tier 1 through Tier 3 operations. Orchestrates alert triage, threat hunting, incident investigation, and detection engineering workflows. Auto-invoked when the user needs help with security monitoring, alert analysis, threat hunting hypotheses, incident timelines, or detection rule development. Sequences the appropriate security skills based on the operational engagement type.

> Reviews AI agent architectures for security risks including permission model design, least-privilege enforcement, human-in-the-loop gate placement, blast radius containment, audit trail completeness, rollback capability, and multi-agent trust boundaries. Auto-invoked when reviewing agentic AI systems where LLMs invoke tools, take autonomous actions, or operate in multi-agent configurations. Produces a structured architecture security assessment mapped to OWASP Agentic AI threats and NIST AI RMF 1.0.

> Reviews agentic AI systems against the OWASP Top 10 security risks for autonomous AI agents. Auto-invoked when reviewing multi-agent architectures, AI agent deployments, or systems where LLMs have tool access and act autonomously. Covers permission models, tool security, memory integrity, trust boundaries, and human oversight. Produces a structured assessment with risk ratings and architectural recommendations.

> Security Engineer role bundle for building security into products and infrastructure. Orchestrates code review, pipeline hardening, vulnerability response, and infrastructure review workflows. Auto-invoked when the user needs help with secure development practices, CI/CD security, vulnerability management, or infrastructure security assessment. Sequences the appropriate security skills based on engineering engagement type.

> Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication, rate limiting, and SSRF. Produces findings mapped to API1-API10 with remediation guidance.

> Analyzes project dependencies for known vulnerabilities, license risks, and supply chain integrity. Auto-invoked when package manifests (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml) are shared or when discussing dependency security. Produces an SBOM assessment with CVE findings triaged by EPSS and CISA KEV, license compliance check, and supply chain risk rating.

> Runs a structured STRIDE threat model on any system design, API specification, or codebase. Auto-invoked when the user discusses architecture, shares a system diagram or design document, or asks "what could go wrong?" Produces threat actor profiles, component-threat matrix, a threat register with STRIDE classification, data-flow diagram template, trust boundary identification, and prioritized mitigations mapped to MITRE ATT&CK techniques.

> Auto-invoked when reviewing web application code, server configurations, or when a user asks for a general security review of a web application. Produces structured findings mapped to A01-A10 with CWE references, severity ratings, and specific remediation guidance.

> Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or Pulumi configurations. Detects hardcoded secrets, public exposure patterns, encryption gaps, overly permissive IAM, and misconfigurations equivalent to Checkov, tfsec, and KICS rules. Produces a structured findings report with remediation guidance.

> Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI integration patterns.

> Guide v4.2. Auto-invoked when reviewing OWASP ZAP configurations, DAST CI/CD integration, scan policies, or authenticated scanning setups. Produces a DAST maturity assessment covering scan policy configuration, active vs passive scanning, API scanning, authentication handling, and results deduplication.