.NET library for local user authentication with email verification, MFA, password resets, and account management. Use when implementing username/password authentication instead of external OAuth providers.
Hunt for hardcoded secrets, API keys, tokens, credentials, private keys, and sensitive configuration. Use when auditing code for credential exposure or before committing code.
Enforce public-sources-only verification for legal authority checking and hallucination classification.
Comprehensive security validation for password generator applications. Use when auditing, implementing, or reviewing security measures for password handling and generation.
Use when building MCP servers in TypeScript, Python, or C#; when implementing tools, resources, or prompts; when configuring Streamable HTTP transport; when migrating from SSE; when adding OAuth authentication; when seeing MCP protocol errors
Application security, vulnerability assessment ve secure coding practices için kullanılır. Authentication, authorization, OWASP Top 10 ve security audit konularında uzman.
Эксперт ISO 27001. Используй для ISMS, security controls и compliance implementation.
badge-system for credentials, recognition, and competency validation.
Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.
Reviews code for security vulnerabilities and adherence to the project's Gate vs Policy authorization rules. Use before committing changes involving permissions or routes.
Next.js/TypeScriptプロジェクト向けセキュリティ診断スキル。OWASP準拠。 以下の場合に使用: (1) PRレビュー時のセキュリティチェック (2) API Routes のセキュリティ検証 (3) 認証・認可ロジックの確認 (4) 依存パッケージの脆弱性確認 (5) 環境変数・シークレット管理の確認
Review test cases for ID Token validation. Covers ID Token structure, required/conditional claims, signature validation (RS256), and all validation rules per OIDC Core 1.0 Section 2 and 3.1.3.7.
iOS app permissions request and management guide. When to use: when adding camera access, microphone usage, speech recognition, photo library access, or any iOS system resource requiring user authorization. What problems it solves: prevents app crashes due to missing permissions, ensures App Store approval by including proper usage descriptions, handles permission request flows properly, and manages permission denial states gracefully.
Comprehensive guide to preventing PII and secrets from appearing in logs through redaction strategies, safe logging practices, and automated filtering.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.
Validate config at startup, secrets in memory only. Never read config during requests, never store secrets in env vars. Use node-env-resolver for multi-source config.
Use when Codex must browse, interact with, or test web flows via the remote Playwright MCP server hosted on Glama.
Write and manage tests using TDD with Pest (PHP), Vitest (React), pytest (Python), and Playwright (E2E). Use when writing feature tests, unit tests, component tests, visual regression tests, or improving test coverage. EXCLUSIVE to testing-expert agent.
Iterate on UI visuals by editing code, hot reloading, capturing screenshots, and refining in loops.
后端测试开发规范。强调函数式测试优先，详细说明了 fixtures 的使用、pytest markers 的分类约定以及数据库隔离策略。
Writing high-quality unit tests for JavaScript and TypeScript using Jest. Covers test structure (AAA pattern, USE naming), breaking dependencies (stubs, mocks, dependency injection), testing async code (promises, callbacks, timers), avoiding flaky tests, and test-driven development. Use when writing tests, debugging test failures, refactoring tests for maintainability, or questions about Jest, TDD, mocks, stubs, or test best practices.
