Find the perfect capability for your agent.
This skill should be used when the user asks to "scan for vulnerabilities", "check for security issues", "find secrets in code", "audit dependencies", "detect SQL injection", "find XSS vulnerabilities", "check for OWASP issues", "scan for hardcoded credentials", or mentions security analysis of code.
Personal TypeScript/React code style preferences including naming conventions, formatting rules, and review severity labels. Use this skill when: (1) Writing new TypeScript/React code, (2) Reviewing code or PRs, (3) Refactoring existing code, (4) Setting up linting/formatting configuration.
Review code for Playwright Guidelines compliance. Use when asked to "review my playwright tests", "check accessibility", or "check my tests against best practices".
Checklist for security-sensitive coding, ensuring MaiHouses guards and policies are respected.
Dependency security scanning. Use when auditing npm packages for vulnerabilities.
Use when user needs Active Directory security analysis, privileged group design review, authentication policy assessment, or delegation and attack surface evaluation across enterprise domains.
Validates TRUST 5-principles (Test 85%+, Readable, Unified, Secured, Trackable). Use when aligning with TRUST governance.
Clerk session handling, JWT verification, token management, and multi-session workflows. Use when implementing session validation, JWT claims customization, token refresh patterns, session lifecycle management, or when user mentions session errors, authentication tokens, JWT verification, multi-device sessions, or session security.
Implement database-backed session management with cookie handling, audit trails, and multiple device support. Use when building authentication systems that need session tracking, device management, or security audit capabilities.
Use when need to bypass Cloudflare protection, scrape websites with anti-bot measures, render JavaScript pages, or simulate real browser behavior for web scraping
DEPRECATED umbrella Skill (backward compatibility). Use only for cross-cutting security reviews spanning remote content + XSS/sanitization + store compliance. Prefer focused openwebf-security-* Skills.
Review and mitigate XSS risks in WebF apps (sanitize HTML, validate input, avoid unsafe string rendering). Use when the user mentions XSS, sanitize HTML, innerHTML-like rendering, user-generated HTML, or “untrusted input”.
סיוע באבטחת אפליקציות ווב ו-APIs. השתמש כשמבקשים לאבטח פרויקט, לבדוק חולשות, להגדיר הרשאות, לנהל API keys, או להגן על נתונים. מותאם ל-Vibe Coders שעובדים עם Supabase, FastAPI, ו-Claude Code. מסביר מושגי אבטחה בשפה פשוטה עם צ'קליסטים מעשיים.
Implement an RFC-compliant OAuth 2.1 authorization server in Rails applications. Use when building apps that need to authorize third-party clients (like MCP clients, API consumers, or external integrations) using industry-standard OAuth flows with PKCE, dynamic client registration, and token management.
security-auditor skill Trigger terms: security audit, vulnerability scan, OWASP, security analysis, penetration testing, security review, threat modeling, security best practices, CVE Use when: User requests involve security auditor tasks.
Implement comprehensive validation on server and client sides with fail-fast checks, specific error messages, input sanitization, and consistent validation across all entry points. Use this skill when validating user input or form data, implementing server-side validation logic, adding client-side validation for user experience, creating validation schemas or rules, implementing type and format checks, sanitizing input to prevent injection attacks, validating business rules, creating field-specific error messages, implementing allowlist validation patterns, or ensuring consistent validation across web forms, API endpoints, and background jobs. Use when working with validation libraries, form handlers, API request validators, or any code that processes user input.
Earn trust through verification. Invoke at session start to establish verifiable checkpoints (environment, baseline, completion). Trust comes from gates, not claims.
