4.9K skills · sorted by relevance
Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".
The English summary is being prepared. Showing the original description.
Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.
The English summary is being prepared. Showing the original description.
Stellar smart contract development (Rust, soroban-sdk). Entry point with project setup, contract anatomy, and build/deploy workflow, routing to three companion files in this directory — development.md (storage/TTL, authorization, cross-contract calls, tokens, events, errors, upgrades, fees, troubleshooting), testing.md (unit, fuzz, property, fork, mutation, integration), and security.md (vulnerability classes, checklists, tooling, audits). Use when writing, testing, reviewing, securing, debugging, or shipping Stellar smart contracts, including anything the user calls "Soroban" — Soroban contracts, soroban-sdk, Soroban auth/storage/TTL errors, SEP-41 tokens, or SAC integration from contract code.
The English summary is being prepared. Showing the original description.
Review changes for correctness, security, accessibility, and performance. Use for scoped quality reviews or verification plans; bug fixes use oma-debug.
The English summary is being prepared. Showing the original description.
Full QA review pipeline — security audit (OWASP Top 10), performance analysis, accessibility check (WCAG 2.1 AA), and code quality review
The English summary is being prepared. Showing the original description.
Supabase (オープンソース Firebase 代替・BaaS) リファレンス。 PostgreSQL ベース、Auth (Email / OAuth / Magic Link / Phone / SSO)、Storage、 Edge Functions (Deno)、Realtime (subscriptions / presence / broadcast)、Vector embeddings、 supabase-js、@supabase/server (withSupabase)、supabase CLI (supabase stack)、 Supabase MCP サーバー、RLS (Row Level Security)、migrations。 SQL Server / node-mssql は別スキル mssql。
The English summary is being prepared. Showing the original description.
Hermes Agent (Nous Research の AI CLI エージェント)。インストール、 CLI コマンド (chat, model, gateway, config, cron, webhook, mcp, skills, profile, hermes pm)、 Configuration (Terminal Backends, Memory, TTS / STT, Auxiliary Models, Compression, Display, Local Models llama.cpp, Egress / Secrets)、 Features (Tools, Skills, Hooks, Delegation, Kanban, Cron, Voice Mode, Personality, Context Files)、 Messaging Gateway (Platform Support, Bot Mode, Connectors)、Security、Architecture、 Hermes Desktop、Plugin Catalog、Profiles、Developer Guide、Nous Portal (Tool Gateway)。
The English summary is being prepared. Showing the original description.
This skill should be used when users need to lint, format, or validate Python code using the Ruff command-line tool. Use this skill for tasks involving Python code quality checks, automatic code formatting, enforcing style rules (PEP 8), identifying bugs and security issues, or modernizing Python code. This skill should be invoked PROACTIVELY whenever Python code is written or modified to ensure code quality.
The English summary is being prepared. Showing the original description.
Automate detection, enrichment, and response playbooks for a SOC you operate. Keep humans in the loop for destructive actions.
The English summary is being prepared. Showing the original description.
Harden network architecture, segmentation, TLS, and allowlists for systems you operate. Defensive design and review only.
The English summary is being prepared. Showing the original description.
Secures Spring Security filters, JWT validations, OAuth2 setups, and CORS/CSRF headers.
The English summary is being prepared. Showing the original description.
Plan and report authorized vulnerability assessments on owned systems. Prioritize evidence, severity, and remediations. Do not deliver exploit payloads.
The English summary is being prepared. Showing the original description.
Hunt for adversary techniques in telemetry you are authorized to query. Hypothesis-driven, evidence-first, no live offensive operations.
The English summary is being prepared. Showing the original description.
Analyze suspicious artifacts in an isolated lab to contain and recover. For incident responders on owned estates. Never write, improve, or distribute malware.
The English summary is being prepared. Showing the original description.
Map owned assets, attack surface, and inventory for systems the requester is authorized to assess. Use for asset discovery, service catalogs, and exposure reviews — never unauthorized scanning.
The English summary is being prepared. Showing the original description.
Plan purple-team / adversary-simulation exercises against systems you are contracted to test. High-level objectives and detection gaps only. No live attack procedures or payloads.
The English summary is being prepared. Showing the original description.
Harden iOS/Android apps you ship: storage, TLS pinning policy, IPC, and backend trust. You still enforce authz on the server.
The English summary is being prepared. Showing the original description.
Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.
The English summary is being prepared. Showing the original description.
Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
The English summary is being prepared. Showing the original description.
Harden LLM and agent integrations you operate: prompt injection, tool allowlists, secret leakage, and supply-chain of models. Defensive only.
The English summary is being prepared. Showing the original description.
Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.
The English summary is being prepared. Showing the original description.
Coordinate containment, eradication, and recovery for an authorized incident. Preserve evidence, communicate facts, and avoid destructive actions without approval.
The English summary is being prepared. Showing the original description.
Choose and review cryptographic usage in your codebase: TLS, hashing, KMS, secret storage. Prefer standard libraries and vetted constructions.
The English summary is being prepared. Showing the original description.
Harden IAM, storage, keys, and org policies in cloud accounts you administer. Focus on identity, logging, and public-exposure controls.
The English summary is being prepared. Showing the original description.