安全
4,732 个结果
- OptimizeStackHawk, Inc.Analyze a codebase and produce an optimal HawkScan setup — tech flags, scan-policy plugin selection, and stackhawk.yml corrections — then apply it as a non-destructive trial, run ONE trial scan, and promote or discard. Use when the user asks to "optimize my scan", "tune HawkScan", "make my scan faster", "reduce false positives", "pick the right plugins/policy for my app", or invokes /optimize.
- Privacy CompliancejpoutrinGDPR, CCPA, and privacy compliance guidance for data protection. Use when handling personal data, implementing consent management, or ensuring regulatory compliance across jurisdictions.
- Proactive Self Improving Agentclaw-opus自动捕获经验并安全进化的技能。触发条件：(1)命令/操作失败时→记ERRORS.md (2)被用户纠正('不对'/'应该是')时→记LEARNINGS.md (3)用户需要不存在的能力时→记FEATURE_REQUESTS.md (4)外部API/工具出错时→记ERRORS.md (5)发现自己知识过时/错误时→记LEARNINGS.md (6)发现更好做法时→记LEARNINGS.md (7)每个任务完成时→回顾过程，有新经验则记LEARNINGS.md。去重原则：如果没有新经验或已有条目已覆盖则跳过不写。每次写入同时在.learnings/CHANGELOG.md追加JSONL日志。经验反复出现≥3次时晋升到AGENTS.md/TOOLS.md/SOUL.md。详见正文。
- Qianwenai Operateqianwen-ai诊断由 qianwenai-deploy 部署到阿里云国内站（aliyun.com）的应用为何不可用或明显变慢，并在用户 明确确认后执行安全恢复并验证结果。读取项目目录下的 .qianwenai-deploy 状态文件识别 ECS（及可选 RDS MySQL）资源，先做最小只读诊断，再一次只提议一个恢复动作（启动 ECS、重启应用服务、重载 Nginx），每个动作都先经过说明影响的确认。 使用场景：用户说应用打不开 / 返回 502 / 连不上数据库，或要求重启并确认应用恢复。 不使用场景：没有 .qianwenai-deploy 状态文件；目标是阿里云国际站（用 qwencloud-operate）； 用户只想要状态/成本概览（用 qianwenai-observe）。
- Skill AuthoringStackHawk, Inc.Guides authoring and maintaining agent skills in this repository — enforcing Anthropic best practices, bumping versions, regenerating Cursor rules, and keeping the plugin structure consistent. Use when editing SKILL.md files, reference files, or plugin manifests; creating a new plugin; or reviewing a skill for compliance with authoring standards.
- Skills Security CheckTugoukezhang腾讯云鼎实验室出品，Skill安全审查工具。对用户指定的skill.md文件及其配套的文档、程序、脚本等进行全面安全审计，确保引用安全
- Stackhawk APIStackHawk, Inc.Use this skill when a user or agent needs to query the StackHawk platform for security reporting, findings analysis, or app management. Triggers include: "stackhawk api", "security posture", "findings report", "show me findings", "untriaged findings", "which apps", "scan history", "security dashboard", "triage", "what needs attention".
- Stackhawk OptimizeStackHawk, Inc.Analyze a codebase and produce an optimal HawkScan setup — tech flags, scan-policy plugin selection, and stackhawk.yml corrections — then apply it as a non-destructive trial, run ONE trial scan, and promote or discard. Use when the user asks to "optimize my scan", "tune HawkScan", "make my scan faster", "reduce false positives", "pick the right plugins/policy for my app", or invokes /optimize.
- stackhawk/agent-skillsStackHawk, Inc.技能合集Security testing skills for AI coding agents. Find and fix exploitable vulnerabilities without leaving your workflow.
- Av SweavatsaevManage a large-scale software engineering project as a versioned, ordered, dependency-aware task plan, executed one sprint at a time through a backlog -> in_progress -> done state machine, with an auditable trail and PLAN.md as the single source of truth.
- Captain Obviousshmulc8Audit TypeScript and Python tests for assertions that cannot fail or check nothing, and guide test authoring with a contract and regression gate. Use when writing or changing tests to avoid low-value coverage, or cleaning redundant, tautological, duplicated, or AI-generated tests. Cleanup runs bundled deterministic scanners; authoring guidance needs no scan during red-green TDD.
- Carta Brand ExtractionCartaGenerates a brand board from a firm's website URL and optional user-provided assets. Analyzes the website to extract theme colors, typography, logos, and imagery, then produces a polished brand board as an HTML artifact, PDF, slide deck, or React component.
- Carta Compliance RoutingCartaRoutes to Form ADV for regulatory filing data. Trigger on any of: "Form ADV", "Schedule D", "regulatory AUM", "Form PF", "annual filing", "annual amendment", "SEC filing", "total AUM", "AUM for filing", "AUM for the SEC", "regulatory assets", "AUM across all funds", "filing season", "RAUM", "how much AUM to report", "pull our Form ADV data", /carta-compliance-routing.
- Carta IssuanceCartaIssue securities on a Carta cap table. Use when the user asks to issue certificates, stock certificates, option grants (ISO, NSO, EMI, CSOP, Unapproved, Startup Concessions, Non-Concessional, ZEPO), profits interest units (PIUs), to draft shares, grants or units, or to resume issuing from a draft set.
- Carta Portfolio Analytics RoutingCartaRoutes to the Portfolio Analytics App, Schedule of Investments, Co-Investor Lookup, or Performance Benchmarks. Trigger on any of: "portfolio analytics app", "analytics app", "portfolio analytics dashboard", "KPI dashboard", "company KPIs", "portfolio console", "microapp", "portfolio analytics for [firm]", "SOI", "schedule of investments", "fund holdings", "what is the fund invested in"…
- Carta ReportingCartaDefault skill for all cap table data-display queries — use this whenever the user wants to see, list, or explore equity data for a single company. Covers grants, vesting schedules, stakeholders, securities, SAFEs, convertible notes, round history, preferred holders, liquidation seniority, and rights & preferences.
- Carta Spa AuditCartaSPA coverage audit across your portfolio — categorizes every equity investment as missing, unexecuted, executed, or not needed, and can drill into a specific company's SPA documents. Use when asked about SPA coverage, missing SPAs, unexecuted SPAs, document completeness, or a named company's SPA.
- Code Review HelpergptmeSystematic code review workflows with bundled utilities for analyzing code quality, detecting patterns, and providing structured feedback. Use this skill when reviewing pull requests or conducting code audits.
- Enrich CompanyCartaResearches a company by fetching its website and returning structured profile data. Use this skill when the user says things like "enrich this company", "look up company info", "research this company", "what does [domain] do", "get company details for [url]", "find info on [company]", or "/enrich-company". Input: target (domain name or website URL).
- Aikido IssuesAikido SecurityList, count, summarize, or triage security issues from the Aikido security feed. Use when the user asks about Aikido findings, vulnerabilities, leaked secrets, SAST/IaC/SCA results, cloud or container security issues, or EOL/license/malware alerts surfaced by Aikido.
- Plugin Checkera-ariffUse this skill when asked to "validate plugin", "check plugin structure", "verify plugin", "audit plugin", "is my plugin correct", "plugin issues", or when troubleshooting plugin problems.
- ScanAikido SecurityRuns an Aikido security scan on generated, added, or modified code files to detect SAST vulnerabilities and exposed secrets. Use when the user wants to scan code for security issues, after writing or modifying code, or when they mention Aikido, security scan, or SAST. Always run an Aikido scan after generating code to verify the generated code is free of security issues.
- Security Stride Methodologyvinnie357Activate when conducting security analysis using STRIDE threat modeling, vulnerability assessment, and security architecture evaluation
- Using Technical Writertachyon-beepRouter for documentation tasks - routes to ADRs, APIs, runbooks, security docs, or governance docs