Use this skill when integrating an external Go project with consent testing utilities. Triggers include testing authenticated routes, setting up dev mode login, writing tests for authorization, using TestVerifier, creating authenticated test requests, or local development without a real consent server.
Dev docs system for maintaining context across sessions
Review test cases for Scope and Claims handling. Covers openid scope requirement, standard scopes (profile, email, address, phone), claims request parameter, and claim types per OIDC Core 1.0 Section 5.4 and 5.5.
Validate code for Zod v4 compatibility by detecting deprecated APIs and ensuring adherence to v4 patterns
Generate secure random passwords or memorable passphrases. Use when user needs a password, passphrase, secret key, or asks for help creating secure credentials.
Validate inputs and preconditions before work begins using symmetric validation across layers, allowlist thinking, and contextual business rules with auditability. Use this skill when writing input validation, form handling, API request validation, or domain logic checks. Applies to all boundary validation requiring structured error responses, edge-case coverage, sanitization, escaping, and contract tests ensuring consistent validation across clients, APIs, background jobs, and CLIs.
Implement role-based (RBAC) and attribute-based (ABAC) access control in Go using Casbin. Covers model configuration, GORM adapters, Chi/gRPC middleware, and production patterns. Use when implementing authorization in Go services.
보안, 보안 리뷰, 보안 검토, 취약점, 보안 분석 - Use when reviewing code for security vulnerabilities, designing authentication/authorization, or ensuring secure architecture. Provides systematic security analysis based on OWASP guidelines.
Connectivity phase for /verify command - validates cross-references
Security and environment configuration standards for web applications, including environment variable management, secure coding practices, and production deployment security. Use when setting up environments, configuring security, or deploying applications.
Creates TanStack Query hooks for API features with authentication. Use when connecting frontend to backend endpoints, creating data fetching hooks.
Use the 1Password CLI (`op`) to securely retrieve secrets. Load this skill when users ask to 'get a password from 1Password', 'retrieve a secret', 'fetch credentials from the vault', 'use op to read', or need to pass secrets to commands, environment variables, or files. CRITICAL: Never display secret values in conversation - always consume them inline with redirection or command substitution.
Clarify requirements before implementing. Do not use automatically, only when invoked explicitly.
Audits Python libraries for security vulnerabilities using Bandit, pip-audit, Semgrep, and detect-secrets. Identifies SQL injection, command injection, hardcoded credentials, weak cryptography, and insecure deserialization. Use when reviewing library security, setting up security scanning in CI, or implementing secure coding patterns.
RLS policy testing patterns for Supabase - automated test cases for Row Level Security enforcement, user isolation verification, multi-tenant security, and comprehensive security audit scripts. Use when testing RLS policies, validating user isolation, auditing Supabase security, verifying tenant isolation, testing row level security, running security tests, or when user mentions RLS testing, security validation, policy testing, or data leak prevention.
Configure YARP reverse proxy for affolterNET.Web.Bff. Use when setting up API proxying, route configuration, or backend service integration.
Audits created issue drafts for quality, clarity, and template compliance. Ensures alignment with SSOT via active-reconnaissance and ssot-verification, while enforcing core agent values.
List all secrets. Requires authentication. Use for Agentuity cloud platform operations
Active Directory 攻撃・検知に関する包括的な知識スキル。Kerberos 認証プロトコル、権限昇格、ドメイン間信頼悪用、LDAP 攻撃、Windows ログ分析による脅威検知など、AD セキュリティの多岐にわたるトピックをカバーしています。ELKと統合し、IT セキュリティの基盤を提供。認証フロー、権限昇格経路、永続化技術、ドメイン間信頼悪用、ログ分析検知、LDAP 操作、防御戦略の 8 つの主要機能をサポートします。
Handle team confirmation with automatic bypass mode detection for /orca
