Security skills

Sync program scope, policy, and hacktivity from a bug bounty platform. Usage: /sync hackerone tesla or /sync bugcrowd uber

Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage

Validate a finding through the 7-Question Gate + 4 gates. Kills weak findings FAST. Usage: /validate <finding description>

Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.

Implements authentication/authorization, secures user input, and prevents OWASP Top 10 vulnerabilities with bcrypt/argon2, parameterized queries, CORS/CSP, and JWT tokens.

Scan security advisories and vulnerability disclosures

Perform a focused 3-phase security review with vulnerability identification, false-positive filtering, and confidence scoring (>80% exploitability threshold) covering Input Validation, Auth, Crypto, Injection, and Data…

GitHub Actions workflow for automated security review on pull requests with confidence-gated PR comments

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for SAST, DevSecOps, and compliance.

Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments,…

Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis. Integrates with /handoff-verify --security and /commit-push-pr. CWE Top 25 based.

对前端代码进行安全审计,检测 XSS、CSRF 等漏洞。当用户请求代码审查或询问代码安全性时使用。

基于 IEG 安全规范,覆盖输入校验、鉴权、数据加密三大高危领域

检查 XSS、CSRF、原型污染等安全问题,支持 React/Vue/Angular

检查 RCE、SSRF、SQL 注入、路径穿越等安全问题,支持 Express/Koa/NestJS

OWASP 十大漏洞原理、影响与修复方案,覆盖 Python/Java 场景

Codebase intelligence for AI. Detects patterns & conventions + remembers decisions across sessions. MCP server for any IDE. Offline CLI.

Codebase intelligence for AI. Detects patterns & conventions + remembers decisions across sessions. MCP server for any IDE. Offline CLI.

Claude Code Agent Teams - default team-based development with strict TDD pipeline enforcement

AI-driven testing agent that auto-discovers, generates, executes, evaluates, and fixes tests for any project type

Best practices for sharing engineering work publicly — what to post, what to withhold, and channel-specific guidance

AST-based code graph for fast symbol lookup, dependency analysis, and blast radius via codebase-memory-mcp MCP server

Deep code property graph analysis with Joern CPG (AST+CFG+PDG) and CodeQL for control flow, data flow, taint analysis, and security auditing

Cross-agent task routing — Codex auto-review, Kimi delegation by complexity score (iCPG + Claude reasoning), iCPG + Mnemos mandatory for all agents