Security
4,732 results
- Skill Security AuditsmartchainarkDetect malicious patterns in AI Agent skills — 13 detectors for backdoors, credential theft, data exfiltration, and supply-chain attacks. Based on SlowMist's ClawHub threat intelligence (472+ malicious skills). Pure Python, zero dependencies.
- Vulnerability ExplainerEndor LabsExplains a CVE, GHSA, or Endor vulnerability, optionally in the context of a supplied package and version. It summarizes severity, exploitability signals, affected and fixed versions, recommended remediation, and relevant reachability or repository context when supported by exact Endor evidence. It clearly identifies missing information rather than inferring package or project applicability.
- Vulnerability PatternsZateIndex of vulnerability detection pattern skills. Routes to core patterns (universal) and language-specific patterns for security scanning.
- Aspnetcore AuthenticationDuende SoftwareASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication, authentication schemes, challenge/forbid flows, and external identity provider integration.
- Aspnetcore AuthorizationDuende SoftwareASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations, scope-based authorization for APIs, authorization middleware configuration, and minimal API authorization.
- Audit AccessibilitykenjiWCAG 2.2 AA audit via playwright-cli: axe-core, keyboard, contrast, target size, focus, ARIA. Use when "audit accessibility", "check a11y", "WCAG audit", "check keyboard nav", or "test screen reader".
- Audit Backend ArchitecturekenjiRead-only backend-architecture audit and pattern advisor, gated by stack. Use when "audit backend architecture", "which pattern should I use", "am I over-engineering", or "sync vs event-driven". Enforced boundaries → enhance-arch-boundaries.
- Audit Bundle SizekenjiAnalyse and shrink a web app's JavaScript bundle. Use when "reduce bundle size", "code splitting", "slow initial load", or "why is the bundle so big". Runtime → audit-performance.
- Audit CicdkenjiAudit GitHub Actions CI/CD for cost, speed, and safety. Use when the Actions bill or minutes are high, runners cost too much, CI is slow, cache storage grows, or "CI/CD / workflow audit". Bypass or ratchet gaming → audit-gate-logic.
- Audit Code QualitykenjiDetect and fix repo-wide anti-patterns and consistency drift (naming, organisation, repeated smells). Use when "code smell", "anti-pattern", "technical debt", or "standardize the codebase". This PR/diff review → audit-code-review.
- Audit Code ReviewkenjiReview a PR or diff for correctness, security, and maintainability. Use for a pull request, a named change set, or "review my changes". Repo-wide anti-patterns → audit-code-quality. Bulk transforms → audit-codemod-safety.
- Audit Codemod SafetykenjiRead-only check that a codemod or bulk transform preserved behavior — compiling is not proof. Use when "did this codemod break anything", "audit this bulk refactor", or before merging a mass find-replace. SQL → plan-data-integrity.
- Audit Db SchemakenjiAudit a database schema for consistency, constraints, naming, indexes, and migrations. Use when reviewing schema design. Destructive-op gates → plan-data-integrity. RLS → plan-rls-audit. Restore/RPO → plan-backup-dr.
- Audit Fe APIkenjiAudit frontend API calls against backend implementation for contract alignment and network shape. Use when "API audit", "FE-BE contract", or "review frontend API integration". Live 4xx/5xx reproduction → debug-fe-be-integration.
- Audit I18nkenjiAudit and fix internationalisation in web or mobile apps. Use when "audit i18n", "fix translations", "add locale", "hardcoded strings", "localisation", "translation quality", or "the Japanese feels like Google Translate".
- Audit Langfuse LlmkenjiPDCA quality audit of LLM features: traces, prompts, costs, evals, grounding, hallucination. Use for "audit LLM quality", "check Langfuse", or "audit AI costs". Jailbreaks → audit-llm-security. Cost caps → plan-llm-cost-guardrails.
- Audit Payment SystemkenjiRead-only audit of payment and money-movement code, scoped from Stripe Checkout to in-house ledgers. Use when "audit payment system", "double charge / idempotency", "ledger / reconciliation", or "webhook / 3DS / PCI". IAP → audit-monetization-iap.
- Audit PerformancekenjiAudit and fix runtime performance (Core Web Vitals, load priority). Use when "slow page", "LCP/INP/CLS", "fetchpriority", "long tasks", or "bfcache". JS payload → audit-bundle-size. Instant nav → enhance-web-instant-nav. Load limits → test-load.
- Audit ResiliencekenjiRead-only production-resilience audit: timeouts, bounded retries, circuit breakers, idempotency, rate limits, graceful degradation, PII in logs. Use when "resilience audit" or "will this survive real traffic?".
- Audit ResponsivekenjiAudit and fix layouts at every breakpoint; desktop is not a wide phone. Use when "responsive audit", desktop looks stretched, there is no max-width, or 1440 looks like a phone. Touch-first build → design-mobile-first.
- Audit SecuritykenjiAudit and fix app code against OWASP (injection, headers, dependencies). Use when "review security" or "check vulnerabilities". Auth gates → audit-auth-flows. Plan-only → plan-security-audit. RLS → plan-rls-audit. LLM → audit-llm-security.
- Audit Uiux Design SystemkenjiAudit visual-system coherence: tokens, component variants, color, type, spacing, dark mode. Use for "design drift", inconsistent UI, or duplicate primitives. Per-page usability → audit-ux. Plan-only unification → plan-uiux-unification.
- Audit UXkenjiPer-page UX audit with NN/g heuristics, microcopy review, and Google HEART. Use when evaluating usability, auditing microcopy, or assessing cognitive load. Cross-page flows/IA → audit-ux-journeys.
- Audit UX JourneyskenjiCross-page UX audit of user stories, task completion, and IA. Use when "audit user flows", "IA audit", "can users find X", "navigation audit", or "funnel drop-off". Per-page heuristics → audit-ux.