password-based-authentication-pattern
Security pattern for implementing password-based authentication. Use when designing login systems with username/password, implementing password storage,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-23 00:13
Security & auditing
7,320 results
path-traversal-anti-pattern
Security anti-pattern for path traversal vulnerabilities (CWE-22). Use when generating or reviewing code that handles file paths, reads or writes files based…
selective-encrypted-transmission-pattern
Security pattern for encrypting specific data before transmission. Use when only certain data elements need encryption, implementing field-level encryption for…
session-based-access-control-pattern
Security pattern combining session authentication with authorization. Use when implementing web application security requiring both user authentication via…
verbose-error-messages-anti-pattern
Security anti-pattern for verbose error messages (CWE-209). Use when generating or reviewing code that handles errors, exceptions, or generates user-facing…
verifiable-token-based-authentication-pattern
Security pattern for self-contained token authentication (e.g., JWT). Use when implementing stateless authentication, designing tokens with embedded claims, or…
weak-password-hashing-anti-pattern
Security anti-pattern for weak password hashing (CWE-327, CWE-759). Use when generating or reviewing code that stores or verifies user passwords. Detects use…
xpath-injection-anti-pattern
Security anti-pattern for XPath injection vulnerabilities (CWE-643). Use when generating or reviewing code that queries XML documents, constructs XPath…
harden
Use this skill to stress-test a change against production-only failure modes — edge cases, concurrency, scale, and security. Run /harden after the code works…
integrate-anything
This skill should be used only when an external-app action must be executed through the Membrane CLI and an authenticated Membrane connection, such as sending…
okta-identity-integration-patterns
Integrate Okta for enterprise identity workflows including OIDC login, group claims, and policy-based access controls. Use when implementing workforce or B2B…
secrets-vault-manager
Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key…
securing-s3-buckets
Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user…
minimize-api-responses
Minimize API response data while preserving required consumer contracts and enforcing field-level authorization. Use when Codex builds, changes, audits, or…
axiom-app-composition
Use when structuring app entry points, managing authentication flows, switching root views, handling scene lifecycle, or asking 'how do I structure my @main',…
axiom-privacy-ux
Use when implementing privacy manifests, requesting permissions, App Tracking Transparency UX, or preparing Privacy Nutrition Labels - covers just-in-time…
zero-trust-architecture
Use when designing security architectures, implementing zero trust principles, or evaluating security posture. Covers never trust always verify,…
security-threat-guide
security-threat-guide skill for security threat modeling and attack surface analysis. Use when a developer needs to think through the security properties of a…
pp-authentik
Agent-native admin CLI for authentik identity provider with offline SQLite cache and an MCP server for Claude Desktop. Trigger phrases: `audit authentik…
security-auditor
security-auditor skill Trigger terms: security audit, vulnerability scan, OWASP, security analysis, penetration testing, security review, threat modeling,…
flowchart-generator
Internal control and audit flowchart generation tool. Use when users need to draw swimlane flowcharts, approval processes, reimbursement processes, internal control processes, fund processes, procurement processes, or any business process diagrams. Supports generating .drawio/PNG/SVG/VSDX formats from natural language descriptions. Even if "flowchart" is not explicitly mentioned, it should be triggered as long as it involves "drawing", "visualization", or "drawing" business processes. It also applies when users say "help me draw an XX process" or "turn...
sensitive-logging-audit
Audit or fix sensitive-data exposure in JS SDK diagnostics, exceptions, logging, and telemetry.
propose-security-hardening
Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment…
local-file-organizer
Break down a messy directory file by file, reclassify and rename according to actual purpose and content ownership, and execute safely with a rollback-capable ledger.