fortify-security
Expert in Gravito security and authentication. Trigger this when setting up Auth, configuring CSP, or implementing security middleware.
task-coding-loop
Earn trust through verification. Invoke at session start to establish verifiable checkpoints (environment, baseline, completion). Trust comes from gates, not claims.
fix-google-auth
Diagnose and resolve Google OAuth 'server_error' caused by credential mismatches.
ask-questions-if-underspecified
Clarify requirements before implementing. Do not use automatically, only when invoked explicitly.
security-audit
Identify and fix security vulnerabilities in code and infrastructure
limit-request-rate
Security pattern for implementing rate limiting and throttling. Use when protecting against brute-force attacks, DoS/DDoS mitigation, preventing resource exhaustion, or limiting API abuse. Addresses "Entity absorbs excessive resources" problem.
workflowescalate-to-human
Escalates a session issue to a human reviewer.
agentuity-cli-auth-whoami
Display information about the currently authenticated user. Requires authentication. Use for managing authentication credentials
security
Expert security architect providing comprehensive security guidance, architecture assessments, threat modeling, and compliance verification. Follows OWASP, NIS2, ISO 27001, NIST, and industry best practices. Use for security architecture design and review, threat modeling, security strategy, compliance assessment (OWASP, NIS2, GDPR, PCI DSS, SOC 2), infrastructure security, API security patterns, and incident response planning. For code-level security reviews, use the code-review skill.
security-owasp
Comprehensive secure coding instructions for all languages and frameworks, based on OWASP Top 10 and industry best practices.
csp-header-generator
Generate Content Security Policy (CSP) header configurations for web security. Triggers on "create csp header", "generate content security policy", "csp config", "security headers".
permission-doctor
Diagnose permission issues across settings files (read-only analysis)
oss-release-checklist
Comprehensive checklist for releasing OSS projects. Covers security (CSP, PII, secrets), legal compliance (licenses, API terms, trademarks), privacy (GDPR, telemetry opt-out), and documentation. Use when preparing to open source a project, adding telemetry/error monitoring, auditing dependencies, or creating privacy policies.
output-filter
Security pattern for filtering data before sending to external entities. Use when preventing excessive data exposure, implementing data minimization, protecting sensitive information in API responses, or ensuring clients receive only necessary data. Addresses "Entity receives excessive data" problem and OWASP API3:2019 Excessive Data Exposure.
moai-security-ssrf
Enterprise SSRF protection with URL validation and network segmentation
code-security-review
Conducts comprehensive security code reviews including vulnerability detection (OWASP Top 10, CWE), authentication/authorization flaws, injection attacks, cryptography issues, sensitive data exposure, API security, dependency vulnerabilities, security misconfigurations, and compliance validation (PCI-DSS, GDPR, HIPAA). Produces detailed security assessment reports with CVE references, CVSS scores, exploit scenarios, and remediation guidance. Use when reviewing code security, performing security audits, checking for vulnerabilities, validating security controls, assessing security risks, or when users mention "security review", "vulnerability scan", "security audit", "penetration test", "OWASP", "security assessment", "secure coding", or "security compliance".
data-exfiltration-skill
【恶意示例】演示数据外泄攻击的 skill。窃取 AWS 凭证、GitHub Token、SSH 私钥等敏感信息。仅用于安全测试演示。
kyc-verification
African KYC/AML verification system supporting NIN, BVN, NIMC, passport validation for Nigeria, Cameroon, CEMAC region with real-time compliance scoring
transparent-encrypted-storage
Security pattern for full-disk or database-level encryption at rest. Use when implementing Transparent Data Encryption (TDE), full-disk encryption, or when storage infrastructure should handle encryption without application changes. Addresses "Leak data at rest" problem.