security-review
security-review
在添加身份验证、处理用户输入、处理机密信息、创建API端点或实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。
THE SKILLS DIRECTORY
모든 Skills 둘러보기.
하나의 Skill, 완전히 새로운 가능성. 다음 워크플로를 찾아보세요.
cso
cso
Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)
deal-with-security-advisory
deal-with-security-advisory
Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security releases.
ruview-advanced-sensing
ruview-advanced-sensing
Advanced RuView capabilities — RuvSense multistatic sensing (attention-weighted fusion, geometric diversity, persistent field model), cross-viewpoint fusion across multiple nodes, RF tomography (ISTA L1 solver, voxel grids), longitudinal biomechanics drift, pre-movement intention signals, adversarial signal detection, and multistatic mesh security hardening…
securitytrails-automation
securitytrails-automation
Automate Securitytrails tasks via Rube MCP (Composio). Always search tools first for current schemas.
frontendchecklist
frontendchecklist
Review frontend code and live pages against the Front-End Checklist (380+ rules for accessibility, performance, SEO, security, HTML, CSS, JavaScript, images, i18n, privacy, testing) using the `frontendchecklist` CLI. Use when writing, reviewing, or shipping HTML/CSS/JS/JSX/TSX/Vue/Svelte/Astro code, before a commit or PR, or when asked to audit a public URL.
content-security-policy
content-security-policy
Use when reviewing headers, forms, cookies, or third-party integrations related to Implement a content security policy. Validate the effective browser and HTTP behavior in a production-like environment.
cross-origin-isolation
cross-origin-isolation
Use when reviewing security-sensitive web apps, SharedArrayBuffer usage, worker-heavy apps, editors, or measurement features that require cross-origin isolation. Check both headers and real browser behavior.
cross-origin-security
cross-origin-security
Use when reviewing scripts, client components, bundles, or runtime behavior related to Handle cross-origin requests securely. Inspect both source code and the browser execution path so fixes target the real bottleneck or bug.
dependency-audit
dependency-audit
Use when reviewing a project's security posture, setting up CI pipelines, or responding to a reported vulnerability in a dependency.
password-field-security
password-field-security
Use when reviewing headers, forms, cookies, or third-party integrations related to Secure password input fields. Validate the effective browser and HTTP behavior in a production-like environment.
permissions-policy
permissions-policy
Use when reviewing HTTP response headers for defense-in-depth security hardening on any web application.
stack-trace-exposure
stack-trace-exposure
Use when reviewing error handling middleware, API route handlers, or server responses for security-sensitive information disclosure.
token-storage-security
token-storage-security
Use when reviewing authentication implementation, setting up a new auth system, or evaluating whether the current token storage approach exposes the application to XSS-based token theft.
x-content-type
x-content-type
Use when auditing HTTP response headers on any web server or CDN for security hardening.
pptx-posters
pptx-posters
Creates and audits editable scientific posters in macro-free PowerPoint (.pptx) from author-approved local content and assets. Used when the requested deliverable is a PowerPoint research/conference poster and exact physical, printer, accessibility, provenance, and package-security checks are required.
007
007
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
agentic-actions-auditor
agentic-actions-auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches. AI agents running in CI/CD pipelines.
18 / 8947
Direct from traceable public skill sources
An independently imported catalog with original authors, licenses and source links. Classification is not a security audit.
Sources and import coverage