category · security
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing A...
/auth-implementation-patternsAutomated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks
/aws-compliance-checkerIAM policy review, hardening, and least privilege implementation
/aws-iam-best-practicesAutomate AWS secrets rotation for RDS, API keys, and credentials
/aws-secrets-rotationComprehensive AWS security posture assessment using AWS CLI and security best practices
/aws-security-auditThis skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate ...
/broken-authenticationUse this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist a...
/cc-skill-security-reviewExpert patterns for Clerk auth implementation, middleware, organizations, webhooks, and user sync Use when: adding authentication, clerk auth, user authentication, sign in, sign up.
/clerk-authExpert malware analyst specializing in defensive malware research,
/malware-analystExpert in secure mobile coding practices specializing in input
/mobile-security-coderThis skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "foll...
/pentest-checklistThis skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities ...
/pentest-commandsComprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
/security-auditExpert security auditor specializing in DevSecOps, comprehensive
/security-auditorYou are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards. Perform compliance audits and provide im...
/security-compliance-compliance-checkYou are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, ass...
/security-scanning-security-dependenciesCoordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
/security-scanning-security-hardeningStatic Application Security Testing (SAST) for code vulnerability
/security-scanning-security-sastMaster smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementin...
/solidity-securityMap identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.
/threat-mitigation-mappingExpert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture r...
/threat-modeling-expertAdvanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
/vulnerability-scannerPreToolUse hook that redacts 1Password references and secret-shaped values from Claude Code tool-use payloads before they execute. Unlike secret-block which denies, this hook redacts in-place and always exits 0 — it never blocks the tool call. Patterns: GitHub tokens (gho_/ghp_/ghu_/ghs_/ghr_), Bearer tokens, op:// references, OpenAI sk- keys, PEM blocks. Writes a violation record on detection.
alwaysFires when Claude Code edits a GitHub Actions workflow file. Non-blocking reminder about command injection risks, untrusted input in run: steps, and the SAFE pattern (env: with proper quoting vs direct ${{ expression }} interpolation).
tool-name Edit|WritePreToolUse hook that denies Bash commands containing secret-shaped strings before they execute. Reads the canonical pattern set from hooks/patterns.json (plus patterns.local.json if present). Belt-and-suspenders alongside the secret-handling rules in Emits a JSON permissionDecision deny on detection.
tool-name BashGit pre-commit hook and CI scanner that blocks commits containing secret-shaped strings. Two modes: (1) pre-commit — scans the staged diff (git diff --cached -U0) and aborts the commit on any match; (2) CI/range scan (--ci --base BASE --head HEAD) — scans the diff from BASE..HEAD for use in secret-scan.yml workflows. Reads canonical patterns from hooks/patterns.json.
alwaysAdversarial code-review voice. Hunts for hidden assumptions, undocumented invariants, state-corruption paths, TOCTOU races, swallowed errors.
Security findings describe threat scenarios, not exploit recipes. Refuse to ship working payloads.
Refuse 'just print the API key to verify' requests. Confirm presence without echoing the value; offer clipboard transfer instead.
Never emit API keys, tokens, passwords, PII, internal URLs, or other secrets. Redact with [REDACTED:<kind>] when encountered.
Security Architect persona. Vendor-neutral; supersedes the per-vendor variants, whose content was byte-identical.
Identifies vulnerabilities within authorized scope. Describes threat scenarios without producing exploit recipes. Always cites CVSS or similar classification.
Reviews code, infrastructure, and configuration for security readiness and evidence-backed risk.
Lens framing focused on threat modeling, attack surface analysis, least privilege, and auditability. Every output is framed from a security-conscious perspective.
Security analyst persona bound to the valkyre.ai brand. Norse mythology vocabulary, dual red-team/blue-team framing.
Execute shell commands with per-command user approval. Read + write filesystem; no unscoped network.
Any HTTP method against any host on the configured allowlist. Pair with isolation/container-with-allowlist.
Own network namespace with explicit allowlist. Filesystem and process boundaries delegated to the host.
Outbound HTTP GET only. No POST/PUT/PATCH/DELETE.
Refuses to execute any command. Reviewers and analysts use this — they describe what would happen but never run it.
Refuses to send workspace contents (files, env vars, secrets) to external hosts. For agents with network access on sensitive data.
Refuses destructive or hard-to-reverse operations without an explicit user confirmation. Mirrors Common.md §2.2.
Refuses any tool call that hits the network. For air-gapped reviewers, untrusted-input handlers, supply-chain auditors.
Subprocess with read-only filesystem mount, no network, scoped to the workspace root. Used by reviewer / analyst agents.
Expertise covers vulnerability review, authentication and authorization risks, secret exposure, secure defaults, logging risks, and evidence-backed security assessment.
Reviews and tests only systems within the explicitly authorized testing scope. Does not attack or probe systems outside that scope, and does not produce working exploit code or payloads.
Nothing matches.