Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Run a bounded second-model code review with Codex Sol or Claude Fable. Use one combined correctness, security, structural-simplicity, modularity, and reuse contract for one initial review plus up to two convergence retries when accepted findings change the source. Use when the user asks for agent review, a second opinion, security review, adversarial review, or deep code-quality review.
Audit websites for SEO, performance, security, technical, content, and 15 other issue categories with 230+ rules using the squirrelscan CLI. Returns LLM-optimized reports with health scores, broken links, meta tag analysis, and actionable recommendations. Use to discover and assess website or webapp issues and health.
Specialized skill for working with NextAuth.js authentication including session management, JWT tokens, role-based access control, and protected routes. Use when implementing authentication features, securing routes, managing user sessions, or debugging auth issues.
Use when encrypting data, signing payloads, verifying signatures, generating keys, using Secure Enclave, migrating from CommonCrypto, or adopting quantum-secure cryptography. Covers CryptoKit design philosophy, AES-GCM, ECDSA, ECDH, Secure Enclave keys, HPKE, ML-KEM, ML-DSA, and cross-platform interop with Swift Crypto.
Use when implementing passkey sign-in, replacing passwords with WebAuthn, configuring ASAuthorizationController, setting up AutoFill-assisted requests, adding automatic passkey upgrades, or migrating from password-based authentication. Covers passkey creation, assertion, cross-device sign-in, credential managers, and the Passwords app.
Use when the user has concrete failing cases in code or a guardrail/classifier/filter/prompt/API they own — a red-team failure catalogue OR a CI/CD test-failure report (failing pytest/JUnit tests) — and wants the target patched until those failures are closed without breaking what already works. It points straight at the failed cases (normalize any source with tools/ingest.py), fixes one root-cause class per iteration, and re-checks with tools/verify.py — oracle mode against a red-team oracle, or tests mode against the test suite — keeping a patch only if it closes a class while nothing that passed before regresses, else reverting; loops until every class is closed (dry) or the budget runs out, then opens a pull request with the patch set. The defensive fixer half of a find→fix setup. Not for discovering new failures (that is red-team), and not for editing the oracle, tests, or holdout that define ground truth.
Review PRs, MRs, and Gerrit changes with focus on security, maintainability, and architectural fit. Leverages github, gitlab, or gerrit skills based on repository context. Use when asked to review my code, check this PR, review a pull request, look at a merge request, review a patchset, or provide code review feedback.
Structured code review workflow for .NET projects using Roslyn MCP tools. Multi-dimensional review covering correctness, security, performance, architecture compliance, and test coverage. Load when: "review PR", "review code", "code review", "PR review", "review changes", "review my code", "check code quality".
CPRA §1798.121 sensitive personal information restrictions and compliance. Covers all 9 sensitive PI categories including SSN, precise geolocation, racial/ethnic origin, biometric, genetic, health, and sex life data. Right to limit use/disclosure, permitted purposes, and implementation.
Drop-in crypto subscription paywall for creator products (not fiat/Stripe). EVM wallet login (SIWE) + on-chain payment verification. Users sign in with their wallet, pay a monthly/yearly subscription by transferring tokens (ETH/Base/BSC, any ERC20 incl. custom tokens) to the creator's Starchild agent wallet, and get gated access — verified on-chain with no payment processor or third-party account. Use when a creator wants to add "sign up → pay → use" monetization to something they built (e.g. "add a paywall", "let users pay to subscribe", "gate my app behind a crypto payment", "收款", "订阅付费", "wallet login + subscription"). Not for fiat/Stripe, not for pay-per-use metering.
Harmonises data classification across jurisdictions mapping GDPR special categories vs CCPA sensitive PI (1798.140(ae)) vs HIPAA PHI (160.103) vs LGPD sensitive data (Art. 5-II). Provides cross-regulation mapping matrix for multinational compliance. Keywords: cross-jurisdiction, GDPR, CCPA, HIPAA, LGPD, sensitive data, multinational, classification mapping.
Guides systematic mapping of international personal data flows across an organisation. Covers system-by-system inventory methodology, third-party identification, transfer mechanism assignment, gap analysis, and data flow visualisation. Keywords: data flow mapping, international transfers, data inventory, transfer register, cross-border data flows.
Implements data lineage tracking for privacy compliance including origin tracking, transformation logging, access auditing, deletion verification, and cross-system lineage graphs. Covers source-to-sink mapping, GDPR Art. 30 RoPA integration, automated lineage discovery, and breach impact scoping. Keywords: data lineage, data provenance, data flow mapping, transformation logging, deletion verification.
PostgreSQL database specialist for query optimization, schema design, security, and performance. Use PROACTIVELY when writing SQL, creating migrations, designing schemas, or troubleshooting database performance. Incorporates Supabase best practices.
Design and audit enterprise security exception workflows covering customer security requirements, compensating controls, risk acceptance, expiry, evidence, owner approval, contract commitments, product gaps, supportability, escalation, renewal impact, and remediation tracking. Use when an enterprise buyer asks for a security exception or deviation from standard controls.
Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.
Guidance for filtering JavaScript and XSS attack vectors from HTML while preserving original formatting. This skill should be used when tasks involve removing script content, sanitizing HTML, filtering XSS payloads, or creating security filters that must preserve the original document structure unchanged.
Manages HIPAA Business Associate Agreements under 45 CFR §164.502(e) and §164.504(e). Covers required BAA provisions, business associate vs subcontractor obligations, breach notification chain, downstream BA requirements, and termination remedies. Keywords: BAA, business associate, subcontractor, HIPAA compliance, PHI disclosure, termination.
Implements HIPAA minimum necessary standard under 45 CFR §164.502(b). Covers role-based access policies per workforce member category, routine vs non-routine disclosure protocols, reasonable reliance doctrine, documentation requirements, and HITECH amendments. Keywords: minimum necessary, role-based access, workforce, routine disclosure, HIPAA.
Implements HIPAA Privacy Rule requirements under 45 CFR §164.500-534 for covered entities and business associates. Covers minimum necessary standard, treatment-payment-operations exceptions, directory opt-out, personal representative rules, and authorization requirements. Keywords: HIPAA Privacy Rule, PHI, minimum necessary, TPO, authorization, covered entity.
Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.
Implements HIPAA Security Rule technical safeguards under 45 CFR §164.312 for electronic protected health information. Covers access controls with unique user identification, emergency access procedures, automatic logoff, encryption, audit controls, integrity controls, and transmission security. Keywords: HIPAA Security Rule, ePHI, access controls, encryption, audit controls, technical safeguards.
Technical implementation of GDPR Article 25(2) data protection by default. Covers strictest privacy settings as default configuration, minimum data collection, limited storage duration, restricted accessibility, and opt-in rather than opt-out patterns. Includes implementation checklist and system design requirements.
Use this skill when the user asks to review or audit source code, a PR, diff, commit, or recent changes for bugs, security, performance, tests, compatibility, or maintainability, duplicated code or logic across files, or hard-coded values. Also use it after an AI agent finishes modifying code to inspect the current uncommitted working tree before handoff and report actionable findings with file and line evidence.
Guides implementation of EU Standard Contractual Clauses under Commission Decision 2021/914 across all four modules (C2C, C2P, P2P, P2C). Covers clause-by-clause completion, Annex I-III drafting, and SCC module selection. Keywords: SCCs, standard contractual clauses, module selection, data transfers, Annex completion.
Standardizes security review procedures for Ruby code mapped to OWASP Top 10: allowlist all input params before processing, forbid SQL interpolation (`#{}`), verify no secrets committed or logged, run `bundle exec bundle-audit check --update`, check for shell injection (`system()`, backticks, `exec()`), and discard instruction-like keys (`prompt`, `instructions`) in JSON payloads. Covers input validation, secrets management, and dependency audits. Trigger words: security review, check security, audit code, security vulnerability, secrets check, OWASP.
Comprehensive PET selection guide covering differential privacy, homomorphic encryption, secure multi-party computation, federated learning, zero-knowledge proofs, and trusted execution environments. Includes use-case matching matrix, performance comparison, and GDPR alignment assessment for each technology.
Up-to-date security check of the project at hand. Your training data does not know the vulnerabilities, security releases and exploits published this week, and dependency audits (npm audit, composer audit, pip-audit) only see library advisories: they miss flaws in the runtime itself (PHP, Node.js, Python), Docker base images, self-hosted tools such as GitLab, and security releases announced but not yet out. This skill fetches the latest advisories from vendors, CVE databases and CERTs, matches them against the repository, and says what to update or patch first. Use it when the user runs /stackalarm, and BEFORE running any audit or outdated command whenever the user asks whether the project has security flaws to fix or security updates to apply ("des failles à corriger ?", "on est vulnérables ?", "anything to patch?", "any security news affecting us?"), wants a security check before a deployment, or mentions a vulnerability, CVE or security release by name.
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
Builds or changes an Apigee X proxy that acts as an AI or LLM gateway. Use it to route between models with aliases, or to add token quotas, spending budgets, Model Armor prompt and response inspection, prompt-token burst limits or FAQ semantic caching.
Use when the user asks to fix, patch or upgrade a Node.js vulnerability (e.g. 'Please fix my Node vulnerability'), the October 21, 2026 Node.js security release, CVE-2026-111497 (Brotli RCE), or end-of-life Node 20, across Docker images, .nvmrc/.tool-versions, setup-node CI, Lambda and IaC. Read-only inventory, approval gate, regression tests, focused PRs.
Use when the user asks to fix, patch or upgrade a PHP vulnerability (e.g. 'Please fix my PHP vulnerability'), PHP2Shell, CVE-2026-109618 or CVE-2026-109619, or to find vulnerable PHP versions in Dockerfiles, distro packages, source builds, setup-php CI, Helm/IaC or Ansible/Chef/Puppet. Read-only inventory, approval gate, regression tests, focused PRs.
Use when the user asks to fix, patch or upgrade a self-managed GitLab vulnerability (e.g. 'Please fix my GitLab vulnerability'), CVE-2026-110264 or the GitLab 19.5.1 critical patch release, across Omnibus, Docker, Helm chart and IaC deployments. Read-only inventory, approval gate, post-deploy checklist, focused PRs.
Audit a Feast strategy script before it may run with real money — the runtime's static rules first, then a model read against a fixed checklist — and record the verdict, bound to the file's exact bytes. Use when the user has a strategy script for their Feast agent, asks you to write one, or asks whether a script is safe to run.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.