security-karen
OWASP-obsessed security reviewer. Will find your vulnerabilities and make you feel bad about them.
wsdiscovery
WS-Discovery protocol scanner for discovering and enumerating ONVIF cameras and IoT devices on the network. Use when you need to discover ONVIF devices, cameras, or WS-Discovery enabled equipment on a network.
security-architect
Expert security and solutions architect providing sophisticated, pragmatic security architectures. Use when designing secure systems, evaluating security postures, threat modeling, implementing Zero Trust, defense-in-depth strategies, secure cloud architectures, compliance frameworks (NIST, ISO 27001, SOC 2), or when security expertise is needed in system design. Combines technical rigor with elegant, practical solutions.
better-auth-configuration
Creates Better Auth configuration for frontend and backend: handlers, providers, middleware, session/token options. Uses Context7 MCP to retrieve Better Auth docs.
maverick-python-security
Python security patterns and OWASP vulnerability detection
dependency-security
Dependency security scanning. Use when auditing npm packages for vulnerabilities.
error-handling-reviewer
Review test cases for OAuth/OIDC error handling. Covers authorization endpoint errors, token endpoint errors, error response formats, HTTP status codes, and all error codes per OAuth 2.1 and OIDC Core 1.0.
owasp-top10-2025
OWASP Top 10:2025 웹 보안 취약점 가이드. 보안 전문가 서브에이전트가 코드 리뷰, 보안 감사, 취약점 분석 시 참조하는 스킬. A01 Broken Access Control부터 A10 Mishandling of Exceptional Conditions까지 10가지 주요 웹 보안 위협에 대한 배경, 설명, 예방법, 공격 시나리오, 관련 CWE 정보 제공.
auditproxy-audit-session
Issues a proxy audit verdict for a session.
ad-security-reviewer
Use when user needs Active Directory security analysis, privileged group design review, authentication policy assessment, or delegation and attack surface evaluation across enterprise domains.
global-validation
Implement server-side validation with allowlists, specific error messages, type checking, and sanitization to prevent security vulnerabilities and ensure data integrity. Use this skill when creating or editing form request classes, when validating API inputs, when implementing validation rules in controllers or services, when writing client-side validation for user experience, when sanitizing user input to prevent injection attacks, when validating business rules, when implementing error message display, or when ensuring consistent validation across all application entry points.
security-compliance
Implement comprehensive security for shared library. Use when working with security audits, dependency vulnerabilities, API security, token encryption, or secure coding practices for library consumers. Library security impacts all consuming plugins.
bandit-security-scan
Run Bandit security analysis to find common security issues and vulnerabilities in Python code. Use when the user mentions Bandit, security analysis, vulnerability scanning, security audit, software composition analysis (SCA), or wants to check for security issues in Python code.
moai-foundation-trust
Validates TRUST 5-principles (Test 85%+, Readable, Unified, Secured, Trackable). Use when aligning with TRUST governance.
auth-expert
Senior expert in Auth.js v5 (NextAuth), Edge-First authentication and security.
session-management
Clerk session handling, JWT verification, token management, and multi-session workflows. Use when implementing session validation, JWT claims customization, token refresh patterns, session lifecycle management, or when user mentions session errors, authentication tokens, JWT verification, multi-device sessions, or session security.
agentuity-cli-auth-whoami
Display information about the currently authenticated user. Requires authentication. Use for managing authentication credentials
security-practices
Security best practices for Python development. Activated when working with security concerns, input validation, injection prevention, or threat modeling.
astroapps-client-msal
Microsoft Authentication Library (MSAL) integration for @astroapps/client with Azure AD/Entra ID authentication. Use when building React apps that need Azure AD authentication with popup or redirect flows.
ip-whitelist
Manage IP whitelist for Provider Nexus API clients using TypeScript scripts that make curl calls to the admin API endpoints.
