💻 Development & Engineering
4,316 skills
affaan-m/quarkus-verification
development
VerifiedTrustedCommunity
Bucle de verificación para proyectos Quarkus: build, análisis estático, pruebas con cobertura, escaneos de seguridad, compilación nativa y revisión de diff antes del lanzamiento o PR.
240,526SKILL.mdUpdated Jun 8, 2026
affaan-m/quarkus-verification
tools
VerifiedTrustedCommunity
Quarkusプロジェクト検証ループ：ビルド、静的分析、カバレッジ付きテスト、セキュリティスキャン、ネイティブコンパイル、本番環境またはPR前の差分レビュー。
240,526SKILL.mdUpdated May 18, 2026
addyosmani/security-and-hardening
development
VerifiedTrustedCommunity
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
92,321SKILL.mdUpdated Mar 27, 2026
addyosmani/constraint-driven-development
development
VerifiedTrustedCommunity
Establishes a project's quality bar as a written contract and stops agents quietly lowering it. Interviews the user on which dimensions matter, supplies sane default thresholds when they have no number in mind, records everything in CONSTRAINTS.md, and watches the diff for a weakened bar — new @ts-ignore or eslint-disable suppressions, skipped or deleted tests, assertions stripped out, unimplemented stubs, thresholds edited down. Use when no quality bar is written down, when the user says "set up constraints" or "define our standards", when an agent keeps silencing checks or skipping tests to get to green, when you need a coverage or performance threshold and don't know what number to pick, or when an agent writes more code than anyone will read.
92,049SKILL.mdUpdated Sep 4, 2026
garrytan/cso
testing
VerifiedTrustedCommunity
Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".
71,662SKILL.mdUpdated Apr 4, 2026
paperclipai/deal-with-security-advisory
tools
VerifiedTrustedCommunity
Handle a GitHub Security Advisory response for Paperclip, including confidential fix development in a temporary private fork, human coordination on advisory-thread comments, CVE request, synchronized advisory publication, and immediate security release steps.
53,860SKILL.mdUpdated Apr 15, 2026
wshobson/stride-analysis-patterns
testing
VerifiedTrustedCommunity
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
35,806SKILL.mdUpdated Apr 25, 2026
wshobson/deployment-pipeline-design
development
VerifiedTrustedCommunity
Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout strategies, setting up multi-environment promotion workflows, or debugging failed deployment gates in CI/CD.
35,806SKILL.mdUpdated Apr 25, 2026
sickn33/api-security-best-practices
development
VerifiedTrustedCommunity
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities
33,084SKILL.mdUpdated Apr 13, 2026
sickn33/007
development
VerifiedTrustedCommunity
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
33,084SKILL.mdUpdated Apr 13, 2026
mukul975/detecting-mobile-malware-behavior
testing
VerifiedTrustedCommunity
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
31,851SKILL.mdUpdated Sep 1, 2026
mukul975/detecting-malicious-npm-packages
development
VerifiedTrustedCommunity
Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.
31,851SKILL.mdUpdated Sep 1, 2026
github/security-review
tools
VerifiedTrustedOfficial
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
27,569SKILL.mdUpdated Mar 30, 2026
github/doublecheck
development
VerifiedTrustedOfficial
Three-layer verification pipeline for AI output. Extracts verifiable claims, finds supporting or contradicting sources via web search, runs adversarial review for hallucination patterns, and produces a structured verification report with source links for human review.
25,862SKILL.mdUpdated Mar 18, 2026
davila7/github-actions-templates
development
VerifiedTrustedCommunity
Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications.
24,615SKILL.mdUpdated Apr 15, 2026
davila7/WordPress Penetration Testing
tools
VerifiedTrustedCommunity
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
24,615SKILL.mdUpdated Apr 15, 2026
alirezarezvani/fda-consultant-specialist
development
VerifiedTrustedCommunity
FDA regulatory consultant for medical device companies. Provides 510(k)/PMA/De Novo pathway guidance, QMSR (21 CFR 820, which incorporates ISO 13485:2016 by reference since 2026-02-02; formerly QSR) compliance, HIPAA assessments, and device cybersecurity. Use when user mentions FDA submission, 510(k), PMA, De Novo, QMSR, QSR, ISO 13485 for FDA, premarket, predicate device, substantial equivalence, HIPAA medical device, or FDA cybersecurity.
19,611SKILL.mdUpdated May 18, 2026
alirezarezvani/skill-security-auditor
tools
VerifiedTrustedCommunity
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".
17,936SKILL.mdUpdated May 15, 2026
rightnow-ai/security-audit
development
VerifiedTrustedCommunity
Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology
16,813SKILL.mdUpdated Apr 20, 2026
rightnow-ai/ci-cd
tools
VerifiedTrustedCommunity
CI/CD pipeline expert for GitHub Actions, GitLab CI, Jenkins, and deployment automation
16,813SKILL.mdUpdated Apr 20, 2026