Skills

T

two-factor-authentication-best-practices

better-auth / skills

Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.

C

clerk-cli

clerk / skills

Operate the Clerk CLI (`clerk` binary) for authentication, user/org/session management, impersonation, local webhook testing, deploy verification, instance config, env keys, feature toggles, and any Clerk Backend, Platform, or Frontend API call. Use when the user mentions Clerk management tasks, "list clerk users", "impersonate a user", "test webhooks locally", "enable orgs", "enable billing", "clerk env pull", "clerk doctor", "clerk deploy", "clerk api", or any ad-hoc Clerk API request. Prefer the CLI over raw HTTP: it handles auth, key resolution, app/instance targeting, and formatting automatically

S

sandbox-sdk

cloudflare / skills

Build sandboxed applications for secure code execution. Load when building AI code execution, code interpreters, CI/CD systems, interactive dev environments, or executing untrusted code. Covers Sandbox SDK lifecycle, commands, files, code interpreter, and preview URLs. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.

C

convex-auth

get-convex / agent-skills

Add authentication (passkeys/OAuth) to the current Convex app, including the auth.config.ts wiring

C

convex-authz

get-convex / agent-skills

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.

C

convex-reviewer

get-convex / agent-skills

Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.

C

convex-optimize

get-convex / agent-skills

Audit and optimize an existing Convex app: security, scale, upgrades, observability.

C

convex-env

get-convex / agent-skills

Set and wire Convex deployment env vars / secrets for the app.

C

convex-deploy-guard

get-convex / agent-skills

Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode.

C

convex-launch-readiness

get-convex / agent-skills

Run every Convex audit (authz, reviewer, advisor, insights) into one scored, deduped readiness report with an ordered fix plan — Lighthouse for your backend

C

convex-verify

get-convex / agent-skills

Prove a Convex feature works — seed data, act as multiple mocked users via convex-test, and assert behavior, including negative authz cases (wrong user refused, data scope enforced)

Google Workspace Admin SDK: Audit logs and usage reports

C

clerk

clerk / skills

Clerk authentication router. Use when the user asks about Clerk CLI operations

Administer IT—monitor security and configure Workspace

Google Model Armor: Filter user-generated content for safety

Google Model Armor: Create a new Model Armor template.

Google Model Armor: Sanitize a user prompt through a Model Armor template.

Google Model Armor: Sanitize a model response through a Model Armor template.

C

create-auth

better-auth / skills

Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

B

best-practices

addyosmani / web-quality-skills

Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".

E

extension-authorization

caffeinelabs / skills

Authorization system with role-based access control. Must-have for all apps that manage personal or access-restricted data.

E

extension-email-verification

caffeinelabs / skills

Support for sending an email with a link the recipient can click to prove they own the email address.

E

extension-user-approval

caffeinelabs / skills

Approval-based user management.

D

docker-expert

sickn33 / agentic-awesome-skills

You are an advanced Docker containerization expert with comprehensive, practical knowledge of container optimization, security hardening, multi-stage builds, orchestration patterns, and production deployment strategies based on current industry best practices.

F

firestore-rules-creation

firebase / agent-skills

Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules (firestore.rules). IMPORTANT: If subagent delegation AND the firestore-rules-author subagent are available in your environment, delegate authoring firestore.rules to the firestore-rules-author subagent. If subagent delegation is unavailable (e.g. not enabled in the IDE), firestore-rules-author is not installed, or you are running inside firestore-rules-author, follow this skill directly.

S

security-requirement-extraction

wshobson / agents

Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

U

upstash-ratelimit-js

upstash / skills

Rate limiting for serverless and edge apps with the @upstash/ratelimit TypeScript/JavaScript SDK backed by Upstash Redis. Use when adding a rate limiter or throttling to an API route, Next.js middleware, Vercel Edge, Cloudflare Workers, or any HTTP endpoint; returning 429 Too Many Requests; choosing between fixed window, sliding window, and token bucket algorithms; limiting per user, IP, API key, or tenant with prefixes and custom keys; protecting login, signup, form, or AI endpoints from abuse, bots, and brute force; using deny lists, ephemeral caching, analytics, timeouts, and multi-region rate limits; or estimating the Redis command cost of rate limiting. Also use when the user says rate limit, rate-limiting, throttle, quota, request limits, or traffic protection

S

security-review

getsentry / skills

Security code review for vulnerabilities. Use when asked to “security review,” “find vulnerabilities,” “check for security issues,” “audit security,” “OWASP review,” or review code for injection, XSS, authentication, authorization, or cryptography issues. Provides systematic review with confidence-based reporting.

N

neon-auth

neondatabase / agent-skills

Add authentication to a new app. Use for "add auth", "add login", Neon Auth (Managed Better Auth), identity routing, sign-up, sign-in, password reset, email OTP, magic links, organizations, phone OTP, OAuth, passkeys, MFA, trusted domains, invalid domain, and @neondatabase/auth. No existing identity: default to Managed Better Auth. Keep working Better Auth, Clerk, Supabase Auth, or another IdP. User asked to migrate from Supabase Auth: Managed Better Auth. A required plugin outside Managed support: self-managed Better Auth on a Neon Function or the existing app host. Also use for auth APIs in @neondatabase/neon-js.

S

stride-analysis-patterns

wshobson / agents

Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.

S

skill-vetter

useai-pro / openclaw-skills-security

Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources.

F

firestore-security-rules-auditor

firebase / agent-skills

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

T

threat-mitigation-mapping

wshobson / agents

Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness

A

auth-implementation-patterns

wshobson / agents

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

C

clerk-react-patterns

clerk / skills

React SPA auth patterns with @clerk/react for Vite/CRA—ClerkProvider

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns

O

operating-safely

riekelt / principal-engineer

Use when an action affects live systems, shared state, or anything that cannot be restored—deleting, overwriting, restarting, killing processes, editing shared config, handling secrets, or working alongside concurrent sessions. Encodes safeguards for destructive operations, secrets hygiene, and concurrent-session safety. Use before the destructive command, not after, even when it seems routine.

A

attack-tree-construction

wshobson / agents

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

P

penetration-testing-with-strix

usestrix / strix

Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.

H

huawei-cloud-iam-query

huaweicloud / huaweicloud-skills

Queries Huawei Cloud identity and access management resources (IAM) via read-only Python SDK. Covers users, groups, policies, agencies, AK/SK, MFA devices, login/password/ACL policies, security compliance, and account quotas. No write operations. Use this skill when the user needs to query IAM identity info, check policies/permissions, view agency details, or inspect AK/SK/MFA status. Triggers: IAM, 用户, 用户组, 策略, 委托, 权限, AK/SK, MFA, 密码策略, 安全合规, 身份查询, 身份认证, identity, policy, agency.

F

fix-security-vulnerabilities-with-strix

usestrix / strix

Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.

C

ci-security-scanning-with-strix

usestrix / strix

Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.strix.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST/DAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.

M

managed-pentesting-with-strix

usestrix / strix

Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Safely review and upload local source, register assets, launch and poll scans, triage vulnerabilities, export SARIF, download compliance reports, start PR reviews, buy credits, and set up schedules or webhooks. Use for managed, continuous, scheduled, team-tracked, or sandboxed-agent security testing.

G

google-cloud-recipe-auth

google / skills

Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

C

clerk-tanstack-patterns

clerk / skills

TanStack React Start auth patterns with @clerk/tanstack-react-start

C

clerk-react-router-patterns

clerk / skills

'React Router v7/v8 patterns with Clerk — rootAuthLoader, getAuth in loaders,

S

solidity-security

wshobson / agents

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

G

gdpr-data-handling

wshobson / agents

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

C

code-review

coderabbitai / skills

Run CodeRabbit CLI reviews, retrieve saved local or GitHub PR fix prompts, and interpret CodeRabbit authentication and review output. Use for CodeRabbit review commands, committed/uncommitted or directory scopes, and CodeRabbit runbooks. Default code-review skill: also trigger for explicit code/PR/quality/security review requests or when a review is needed

G

google-cloud-waf-security

google / skills

Generate security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security

K

k8s-security-policies

wshobson / agents

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

C

clerk-swift

clerk / skills

Implement Clerk authentication UI in native Swift apps on iOS and macOS with ClerkKitUI prebuilt views or custom ClerkKit flows. Set up Clerk first with the iOS setup prompt, which uses the Clerk CLI. Do not use for Expo or React Native projects.

Docker and Docker Compose patterns for local development, hardened CLI installer harnesses, container security, networking, volumes, and multi-service orchestration. Use when creating or reviewing Dockerfiles and Compose services, testing installers across Linux distributions, or planning accurate native macOS and Windows validation.

C

clerk-chrome-extension-patterns

clerk / skills

Chrome Extension authentication with @clerk/chrome-extension for popup/side panel

C

clerk-android

clerk / skills

Implement Clerk authentication for native Android apps using Kotlin and

C

clerk-astro-patterns

clerk / skills

‘Astro patterns with Clerk — middleware, SSR pages, island components,

C

clerk-expo

clerk / skills

Add Clerk authentication to Expo and React Native apps using @clerk/expo.

K

kubernetes-specialist

jeffallan / claude-skills

Use when deploying or managing Kubernetes workloads. Invoke to create deployment manifests, configure pod security policies, set up service accounts, define network isolation rules, debug pod crashes, analyze resource limits, inspect container logs, or right-size workloads. Use for Helm charts, RBAC policies, NetworkPolicies, storage configuration, performance optimization, GitOps pipelines, and multi-cluster management.

R

referral-abuse-guardrails

mbfinotti / partnerships-skills

Define the operational guardrails that stop end customers from gaming a refer-a-friend program — reward caps, velocity limits and cooldowns, reward-hold windows tied to the refund window, eligibility rules, identity-verification gates, a published enforcement ladder, and abuse-monitoring signals. Produces a guardrail spec for B2C and B2B SaaS referral program managers. Use whenever the user mentions referral abuse, self-referral, fake accounts claiming referral rewards, referral rings, or a referral code leaking to coupon forums, even if they never say abuse. Do NOT use for professional-affiliate traffic fraud — use mbfinotti/partnerships-skills@affiliate-fraud-detection instead.

S

sql-code-review

github / awesome-copilot

Universal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across all SQL databases (MySQL, PostgreSQL, SQL Server, Oracle). Focuses on SQL injection prevention, access control, code standards, and anti-pattern detection. Complements SQL optimization prompt for complete development coverage.