Advanced vulnerability analysis principles. OWASP Top 10 baseline + current threat landscape awareness, Supply Chain Security, attack surface mapping, risk prioritization. Use when performing security audits, threat modeling, or OWASP reviews. NOT for STRIDE/CSO-mode infrastructure audits (see mk:cso).
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Think like an attacker, defend like an expert.
| Principle | Application |
|---|---|
| Assume Breach | Design as if attacker already inside |
| Zero Trust | Never trust, always verify |
| Defense in Depth | Multiple layers, no single point |
| Least Privilege | Minimum required access only |
| Fail Secure | On error, deny access |
references/scanning-methodology.mdBefore scanning, ask: What are we protecting? Who would attack? How? What's the impact?
| Reference | When to load | Content |
|---|---|---|
| scanning-methodology.md | Step 2 — executing scan | OWASP Top 10, supply chain, code patterns, risk prioritization, reporting format |
| Script | Purpose | Usage |
|---|---|---|
security-scan.py | Security pattern scanning | .claude/skills/.venv/bin/python3 .claude/scripts/security-scan.py |
injection-audit.py | Prompt injection detection | .claude/skills/.venv/bin/python3 .claude/scripts/injection-audit.py |
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Use this skill to generate well-branded interfaces and assets for MeowKit (AI Agent Toolkit for Claude Code), either for production or throwaway prototypes/mocks/etc. Contains essential design guidelines, colors, type, fonts, assets, and UI kit components for prototyping.
The English summary is being prepared. Showing the original description.
Turn a raw idea into ONE honest recommendation: interview one question at a time until confirmed, then give a verdict with trade-offs and a checklist. Not for options or debate.
The English summary is being prepared. Showing the original description.
Browser automation CLI for agents: navigate, click/fill, screenshot, extract data, test apps, Electron/Slack, cloud browsers. NOT for the user's real Chrome profile/cookies (mk:chrome-profile).
The English summary is being prepared. Showing the original description.
Detects the right agent and complexity tier at Phase 0 orient; runs first in every workflow. NOT for runtime agent routing inside a single skill.
The English summary is being prepared. Showing the original description.
Angular v20+ patterns: components, signals, services, forms, routing, HTTP, testing, SSR. Auto-activates on .ts files in Angular projects (angular.json detected).
The English summary is being prepared. Showing the original description.
Design and review durable REST, GraphQL, RPC, or event API contracts: shape, compatibility, pagination, error semantics. Discovers existing consumers first. Not implementation, schema, or release.
The English summary is being prepared. Showing the original description.