security-audit
Performs security audits checking for exposed secrets, weak authentication, SQL injection, XSS vulnerabilities, and validates security best practices
agent-os-verificador-spec
Agent OS skill: verificador-spec
workflowescalate-to-human
Escalates a session issue to a human reviewer.
user-management
Implement user CRUD operations within an account with permission controls and feature flags. Use when building team member management, user administration, or account user settings in multi-tenant Rails applications.
oauth-user-authentication
OAuth flows for user-context operations. Web application patterns, device flow for CLI tools, and token refresh strategies for GitHub Apps.
vulnerability-scanner
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
file-upload-handling
Implement secure file uploads with validation, size limits, type checking, virus scanning, and UUID naming. Use when handling file uploads like profile photos, documents, or resources.
seo-security-guardrails
Checklists mínimos obligatorios de SEO y seguridad antes de confirmar cambios en archivos sensibles.
laravel-auth
Implement authentication with Sanctum, Passport, Socialite, Fortify, policies, and gates. Use when setting up user authentication, API tokens, social login, or authorization.
moai-domain-security
OWASP Top 10, SAST/DAST, dependency security, and secrets management.
authentication-security-pattern
Security pattern for implementing authentication in software systems. Use when designing or reviewing authentication mechanisms, implementing login systems, verifying user identity, protecting system access, or addressing OWASP authentication flaws. Provides guidance on enforcers, verifiers, evidence providers, subject registration, credential management, and security considerations.
security-audit
Security vulnerability scanning and audit. Use when user needs security check, dependency updates, vulnerability scan, or says "check security", "audit code", "security vulnerabilities", "update gems", "CVE check".
agentuity-cli-auth-logout
Logout of the Agentuity Cloud Platform. Use for managing authentication credentials
auth-web-cloudbase
Complete guide for CloudBase Auth v2 using Web SDK (@cloudbase/js-sdk@2.x) - all login flows, user management, captcha handling, and best practices in one file.
encrypted-tunnel
Security pattern for channel-level encryption (TLS/SSH). Use when implementing HTTPS, securing all communication between endpoints, setting up TLS connections, or when infrastructure should handle encryption transparently. Addresses "Leak action request or data in transit" problem.
web-security-expert
Expert knowledge of web application security including OWASP Top 10 vulnerabilities, input validation, authentication, authorization, API security, secrets management, security headers, and secure coding practices. Use when implementing security features, reviewing code for vulnerabilities, adding authentication, validating user input, or addressing security concerns.
fact-check
Verify claims in generated output against sources. Use as a separate pass AFTER content generation to catch hallucinations. Critical constraint - cannot be reliably combined with generation in a single pass.
microservice-auth
IOE-DREAM微服务认证架构规范。涵盖Gateway集中认证(JWT验证、Token黑名单)、业务层授权(@PermissionCheck注解)、Spring Security依赖管理(业务服务排除)、Gateway身份头转发(X-User-Id等HTTP头)、RBAC规则引擎。使用时机:实现权限验证、配置Gateway、调试认证问题时。
security-engineer
Audits RLS policies, validates security implementations, and identifies vulnerabilities
login-redirector
Handle WordPress login/logout redirects. Use when implementing custom redirect logic.
hsm-security-audit
Comprehensive security verification - audit dependencies, check for vulnerabilities, verify constant-time ops
openwebf-security-remote-content
Review security risks and mitigations for remote WebF content (untrusted bundles, URL allowlists, HTTPS, trust boundaries, clickjacking). Use when the user mentions untrusted remote bundles, bundle URL validation/allowlists, or remote updates risk.
