Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Manages deletion requests for children's personal data. Covers parental-initiated versus child-initiated requests, age of capacity assessment, identity verification, scope determination, third-party notification obligations, and regulatory timelines under GDPR Art. 17, COPPA Section 312.6, and UK AADC Standard 15. Keywords: deletion, children, right to erasure, parental request, data deletion, COPPA.
Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021). Covers consent requirements, cross-border transfer mechanisms (CAC security assessment, standard contracts, certification), separate consent triggers, and critical information infrastructure obligations. Keywords: PIPL, China data protection, CAC security assessment, cross-border transfer, separate consent, CIIO.
Develops data classification policies with tiered handling (public, internal, confidential, restricted), labeling requirements, enforcement mechanisms, and procedures per tier. Covers policy governance, exception handling, and compliance monitoring. Keywords: classification policy, data tiers, handling procedures, labeling, enforcement, data governance, information security.
Cloud service provider privacy assessment framework. Covers ISO 27018 cloud privacy controls, CSA STAR certification, SOC 2 Type II evaluation, shared responsibility model mapping, data residency verification, and cloud-specific privacy risk analysis.
Use this skill as the FINAL step after writing or modifying code — reviews for logic bugs, architecture violations, security issues, and performance problems. Trigger after completing a feature, fixing a bug, before merging, or when asked to "review this code", "check my changes", or "is this ready to merge". Fixes issues directly and runs quality gates (lint, typecheck, build, tests). Delegates style to automation, focuses on what matters.
Validates code against project skills and standards. Use this skill when the user asks for a "code review", "review this PR", "check this code", "security audit", or wants to verify code matches project conventions. This skill does not define its own architectural or styling standards — it checks code against FDD-architecture, tailwind-v4-best-practices, and frontend security best practices. Also use this when merging, approving PRs, or when the user asks "does this follow our standards?"
Colorado Privacy Act (CPA) compliance implementation. Covers universal opt-out mechanism required since July 2024, profiling opt-out rights, sensitive data consent requirements, AG rulemaking under 4 CCR 904-3, and consumer rights framework. Effective July 1, 2023.
Compares PIA/DPIA methodologies: CNIL PIA tool, ICO DPIA template, NIST Privacy Framework, and ISO 29134. Provides methodology selection criteria based on regulatory jurisdiction, organisation maturity, processing complexity, and resource availability. Covers regulatory acceptance, tool features, and cross-methodology mapping. Keywords: PIA methodology, CNIL, ICO, NIST Privacy Framework, ISO 29134, DPIA comparison, assessment.
Complete guide to LINDDUN privacy threat modeling methodology covering seven threat categories: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance. Includes DFD-based analysis, threat tree catalogs, mitigation mapping to privacy design patterns, and step-by-step process.
Connecticut Data Privacy Act (CTDPA) compliance. Covers consumer rights, controller obligations, dark pattern prohibition, loyalty program exemption, universal opt-out requirement effective January 2025, sensitive data consent, and AG enforcement. Effective July 1, 2023.
Guide for obtaining explicit consent for international data transfers under GDPR Article 49(1)(a). Covers informed consent requirements including risks of transfers without adequacy decisions or appropriate safeguards, specific destination country disclosure, and the narrow scope of derogation-based transfers.
Implementation guide for GDPR Article 7(3) consent withdrawal mechanisms. Covers the equal ease requirement ensuring withdrawal is as easy as giving consent, one-click withdrawal implementation, cascading effects on downstream processing, third-party notification workflows, and technical architecture for real-time consent revocation.
Design and audit data residency and regional operating models covering customer region commitments, data classification, storage, processing, backups, logs, analytics, search, AI providers, subprocessors, support/admin access, replication, failover, deletion, migrations, contracts, and proof. Use when customers or regulators require clarity about where data lives and moves.
Delaware Personal Data Privacy Act (DPPA) compliance implementation. Covers consumer rights (access, correct, delete, portability, opt-out), controller obligations, processor requirements, sensitive data consent, universal opt-out recognition, DPIA requirements, and AG enforcement. Effective January 1, 2025, with no revenue threshold for applicability.
Docker best practices for VPS deployments in 2026. Use this skill when writing Dockerfiles, docker-compose.yml, or managing containers on a Linux VPS. Covers multi-stage builds, uv-based Python images, Xvfb/virtual display containers, volume management, security hardening, and service orchestration with Docker Compose v2. NEVER use legacy docker-compose v1 (hyphenated), old Python base images, or root containers.
Pre-deploy security checklist for Postgres with Electric. Checks REPLICATION role, SELECT grants, CREATE on database, table ownership, REPLICA IDENTITY FULL on all synced tables, publication management (auto vs manual with ELECTRIC_MANUAL_TABLE_PUBLISHING), connection pooler exclusion for DATABASE_URL (use direct connection), and ELECTRIC_POOLED_DATABASE_URL for pooled queries. Load before deploying Electric to production or when diagnosing Postgres permission errors.
Manages Data Subject Access Request procedures for employee requests under Art. 15 GDPR. Covers scope of disclosable HR records, emails, CCTV footage, performance reviews, monitoring data, and training records. Implements third-party data redaction, legal professional privilege, exemptions for ongoing proceedings, and the one-month response timeline. Keywords: DSAR, subject access request, Art. 15, employee records, redaction, privilege, HR data, SAR.
Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence/backdooring modules like iam__backdoor_users_keys. Use for authorized AWS penetration tests or red-team engagements, assessing blast radius from a compromised IAM credential, or generating attacker telemetry for purple-team detection testing.
Guides development of GDPR Article 40-41 codes of conduct for industry sectors including drafting, submission, and monitoring body requirements. Activate when creating industry codes or establishing monitoring bodies. Keywords: codes of conduct, Article 40, Article 41, monitoring body, industry code.
Guides cooperation with GDPR supervisory authorities under Article 31, including procedures for responding to investigations, information requests, and on-site inspections. Covers controller and processor obligations during supervisory authority interactions. Keywords: supervisory authority, Article 31, cooperation, DPA investigation, information request, inspection.
Guides appointment of GDPR Article 27 EU representative for non-EU controllers or processors. Covers criteria, responsibilities, and documentation. Activate when a non-EU entity processes EU data. Keywords: EU representative, Article 27, non-EU controller, territorial scope.
Use ghidra-cli for reverse engineering tasks: binary analysis, decompilation, function inspection, cross-reference analysis, pattern discovery, binary patching, and type system management. Activate when the user requests binary analysis or reverse engineering; decompilation or disassembly; function listing, inspection, or renaming; cross-reference or call graph analysis; string or byte pattern searches; binary patching or modification; Ghidra project management; type management (structs, enums, typedefs, struct fields); function signature editing (return type, calling convention, full signature); or variable retyping in decompiled functions.
Integrating Global Privacy Control (GPC) signals with cookie consent platforms. Covers GPC signal detection in browsers, automatic opt-out triggering, mapping GPC to US state privacy laws, and CMP integration for CCPA, CPA, and CTDPA compliance.
Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.
Author and manage an IndyKite KBAC (Knowledge-Based Access Control) authorization policy - a single subject type, an actions list, a single resource type, and a Cypher condition over the IKG - through the Config API (`/configs/v1/authorization-policies` - create / read / list `?type=kbac` / update / delete, ETag-guarded). Use when the user wants to write, publish, inspect, change the status of, update, or delete a `2.0-kbac` policy - e.g. "write a policy letting a Person PROVISION a Server within budget and publish it", "list the active KBAC policies", "deactivate this policy". This authors the rule; it does NOT make decisions - for "can X do Y on Z?" use indykite-authzen-evaluation (single) or indykite-authzen-evaluations (batch), and to enumerate allowed actions/resources/subjects use indykite-authzen-search-action / -search-resource / -search-subject. This is KBAC, not ContX IQ - for CIQ read/write data policies use the indykite-ciq-* skills.
Use when dynamically testing whether untrusted input reaches an interpreter — SQL/NoSQL injection (incl. blind/time-based), OS command injection, server-side template injection (SSTI), XXE, LDAP/XPath, and CRLF/header injection. Confirms on a running app what security-code-audit finds in source.
Build confidential smart contracts and dApps on EVM with Inco's TEE-based confidential computing: encrypted types (euint256/ebool/eaddress), encrypted ops (add/sub/mul/select/eq/rand), access control (e.allow), and attestation verification. Use for @inco/lightning Solidity + @inco/lightning-js SDK encrypt/decrypt, Foundry/Hardhat with a local covalidator or Base Sepolia, create-inco-app scaffolding, and confidential tokens, auctions, voting, or lottery dApps. Also covers confidential / hidden-information GAMES — deciding what stays private and which Inco feature goes where, then building fast: casino, cards, board, sealed auction, social deduction, fog-of-war, word/code-guessing. TRIGGER: imports "@inco/lightning" or "@inco/lightning-js" (or legacy "@inco/js"), mentions Inco, confidential EVM contracts, encrypted types, "what should be private in my game", on-chain poker/mafia/minesweeper/word-guessing, fog of war, provably fair. NOT for: ZK proofs, FHE/fhevm circuits.
Implement Litestar authentication with custom authentication middleware, built-in security backends, JWT and session flows, route inclusion and exclusion rules, and typed auth context on `Request` / `ASGIConnection`. Use when establishing identity, issuing or validating credentials, or attaching authenticated user context in Litestar. Do not use for generic request parsing, broad security audits, or unrelated transport concerns.
Design and apply Litestar middleware for cross-cutting concerns such as CORS, CSRF, allowed-host checks, compression, rate limiting, logging, sessions, request enrichment, policy enforcement, and custom ASGI pipeline control. Use when behavior must wrap broad route sets consistently across the ASGI stack. Do not use for route-specific business rules, simple response mutation better handled by lifecycle hooks, or auth/guard policy work that belongs in security-focused skills.
Review code changes from multiple specialist perspectives in parallel. Use when you want a thorough review of a PR, branch, or set of changes covering security, performance, correctness, edge cases, and ripple effects. Spawns parallel reviewer agents that each focus on a different lens, then synthesizes into a unified review.
Use when building Rails features that handle personal data, adding encryption to models, implementing consent flows, building DSAR endpoints, or adding anonymization/pseudonymization. Also use when reviewing code for compliance with privacy laws like GDPR and LGPD, or when asked about privacy-by-design patterns in Rails
Run privacy impact assessments for new features, data collection, analytics, AI processing, profiling, vendors, retention, consent, legal basis, minimization, sensitive data, children/regulated users, DSAR, cross-border transfer, security controls, mitigations, launch gates, and record keeping. Use when product changes may affect personal data or user trust.
Red-team operator discipline—the mindset corrections that distinguish offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when the scope is "external red team," not "bug bounty / WAPT".
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) scanning code for security vulnerabilities across multiple languages, (2) performing security code reviews with pattern-based detection, (3) integrating SAST checks into CI/CD pipelines, (4) providing remediation guidance with OWASP Top 10 and CWE mappings, (5) creating custom security rules for organization-specific patterns, or (6) analyzing dependencies for known vulnerabilities
Enforces a rolling seven-day minimum release age for registry packages to reduce npm and PyPI supply-chain risk (compromised releases are often pulled quickly). Covers npm, pnpm, Bun, and uv with the correct file, key, and units for each tool. Use when hardening installs, onboarding package managers, reviewing CI, or when the user mentions supply chain, minimum release age, or release-age gating.
Skill lifecycle management system that uses LLMs to intelligently analyze skill types, evaluate quality, and audit security. Supports search across three data sources: GitHub, the skills.sh marketplace, and Skills CLI (npx skills). Use when the user needs to: (1) discover and evaluate new skills, (2) audit the security of existing skills, (3) adapt skills to the local environment, (4) test the effects of skill merging, or (5) collect feedback on skill usage.
Implements compliance with South Africa's Protection of Personal Information Act (POPIA), Act No. 4 of 2013. Covers conditions for lawful processing, data subject rights, cross-border transfer restrictions, Information Regulator enforcement, and responsible party obligations. Keywords: POPIA, South Africa, Information Regulator, responsible party, operator, prior authorisation.
Spring Security JWT authentication for Spring Boot 3. Covers SecurityFilterChain, JWT filter, authentication, authorization, CORS, rate limiting, and security headers. USE WHEN: user mentions "security", "JWT", "authentication", "authorization", asks about "login", "token", "CORS", "roles", "permissions", "@PreAuthorize" DO NOT USE FOR: Spring Boot basics (use `spring-boot`), OAuth2 details (use OAuth2 skill if available), general encryption (use security-expert)
Secure Uniswap v4 hook development assistant. Activates when: - Working with Uniswap v4 hooks, PoolManager, or hook contracts - Keywords: uniswap, v4, hook, hooks, beforeSwap, afterSwap, PoolManager, IHooks, BaseHook - Creating, reviewing, or auditing hook contracts - Implementing custom AMM logic, dynamic fees, or swap modifications - User says "uniswap hooks" or invokes "/uniswap-v4-hooks"
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.