699 个 · 按相关度排序
Implementation guide for secure multi-party computation enabling privacy-preserving analytics across organizations. Covers secret sharing, garbled circuits, reference frameworks MP-SPDZ and CrypTen, practical deployment patterns, and GDPR alignment for joint controller analytics without revealing individual party inputs.
中文简介正在准备中。当前显示原文说明。
Implements federated learning architecture patterns for GDPR compliance. Covers secure aggregation protocols, differential privacy integration, communication protocols, and privacy-by-design distributed ML training. Keywords: federated learning, distributed training, secure aggregation, differential privacy, privacy-preserving ML.
中文简介正在准备中。当前显示原文说明。
Assists with building secure JavaScript and TypeScript applications using the Deno runtime. Use when creating servers, CLI tools, or scripts with Deno's built-in tooling, permission model, npm compatibility, and web standards APIs. Trigger words: deno, deno deploy, deno serve, deno kv, deno permissions, secure runtime, jsr.
中文简介正在准备中。当前显示原文说明。
Stack-specific security implementation guidance (backend, frontend, database, infrastructure, operations) with auto-detection from your changes. Use when implementing a feature securely or hardening code as you write it. Trigger on "how do I secure this", "security best practices", "is this secure", "harden this". For scanning existing code use /security-verify.
中文简介正在准备中。当前显示原文说明。
Detects sensitive data stored insecurely on mobile devices (Android/iOS). Trigger on: SharedPreferences, NSUserDefaults, SQLite, Room DB, DataStore, Core Data, Keychain misconfiguration, external storage, backup exposure, plaintext files, unencrypted databases, adb backup, iCloud backup, NSFileProtection, EncryptedSharedPreferences, SQLCipher, allowBackup, FLAG_SECURE, keyboard cache, sensitive logs. Covers MASVS-STORAGE-1 (local storage) and MASVS-STORAGE-2 (exposure to unauthorized actors).
中文简介正在准备中。当前显示原文说明。
Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.
中文简介正在准备中。当前显示原文说明。
Guideline for designing, implementing, and verifying secure TypeScript and JavaScript applications following OWASP Top 10 best practices. Use when the user wants to: (1) review TypeScript or JavaScript code for security vulnerabilities, (2) design a secure Node.js, Deno, or browser application architecture, (3) implement security features (authentication, authorization, cryptography, input validation), (4) audit npm/yarn/pnpm dependencies for known vulnerabilities, (5) create security checklists or verification plans, (6) fix security bugs or harden existing TypeScript or JavaScript code, (7) set up security testing and static analysis (ESLint security plugins, Semgrep, Snyk), or (8) handle any TypeScript/JavaScript security concern including injection prevention, prototype pollution, XSS protection, SSRF prevention, secrets management, and secure deployment.
中文简介正在准备中。当前显示原文说明。
Drafts filing-ready proofs of claim for U.S. bankruptcy proceedings using Official Form B 410 under FRBP 3001. Handles secured, unsecured priority, and general unsecured claims with proper valuation, documentation, and bar date compliance. Use when a creditor needs to file or amend a proof of claim in a bankruptcy case.
中文简介正在准备中。当前显示原文说明。
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
中文简介正在准备中。当前显示原文说明。
Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks.
中文简介正在准备中。当前显示原文说明。
Knowledge base from NIST Secure Software Development Framework (SSDF) v1.1 (SP 800-218). Use for secure software development practices, SDLC security integration, software supply chain security, vulnerability disclosure, SBOM, threat modelling, secure coding, build hardening, EO 14028 compliance. Covers the four SSDF practice groups (PO, PS, PW, RV) only; does not cover NIST CSF, SP 800-53 controls, or cloud-specific security frameworks in depth.
中文简介正在准备中。当前显示原文说明。
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
中文简介正在准备中。当前显示原文说明。
Secure iOS apps with Keychain Services, CryptoKit encryption, biometric authentication (Face ID, Touch ID), Secure Enclave key storage, LAContext, App Transport Security (ATS), certificate pinning, data protection classes, and secure coding patterns. Use when implementing app security features, auditing privacy manifests, configuring App Transport Security, securing keychain access, adding biometric authentication, or encrypting sensitive data with CryptoKit.
中文简介正在准备中。当前显示原文说明。
Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.
中文简介正在准备中。当前显示原文说明。
Harden an application against common security risks — validate inputs at boundaries, least-privilege access, safe secrets handling, dependency hygiene, and secure defaults. Load when shipping user-facing code, adding auth/session flows, handling untrusted data, exposing APIs, or the user asks for "security hardening", "OWASP hardening", "secure this feature". Not for skill-library security gates (use secure-skill family).
中文简介正在准备中。当前显示原文说明。
Use this skill when the user asks about cargo securement requirements under 49 CFR 393 Subpart I — Working Load Limit (WLL), tiedown counts, tiedown types, commodity-specific securement rules (lumber, metal coils, paper rolls, concrete pipe, intermodal containers, vehicles, large boulders, dressed lumber, building materials), CVSA out-of-service criteria, and how to calculate aggregate WLL. Cite 49 CFR 393.100-136.
中文简介正在准备中。当前显示原文说明。
Review JavaScript libraries for outdated versions, known security flaws, and unnecessary size. Use performance measurements to identify costly dependencies, then recommend secure updates or lighter alternatives with specific files and requests to investigate.
中文简介正在准备中。当前显示英语简介。
Learn to create, discover, invoke, secure, evaluate, package, and port Agent Skills through one interactive lesson at a time. Practical checkpoints and quizzes track demonstrated progress in a local file, so later sessions resume where you stopped.
中文简介正在准备中。当前显示英语简介。
Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.
中文简介正在准备中。当前显示英语简介。
Plan and configure connections between on-premises data centers and AWS, Azure, GCP, or OCI using VPNs or dedicated links. Cover routing, redundant connections, security controls, monitoring, troubleshooting, and connection costs.
中文简介正在准备中。当前显示英语简介。
Set up mutual TLS, where services verify each other's certificates, to secure internal communication. The skill guides certificate hierarchy, rotation, gradual enforcement, and troubleshooting connection failures across services and clusters.
中文简介正在准备中。当前显示英语简介。
Configure TLS 1.3, a protocol for encrypted connections, on nginx, Apache, and Python applications. Select encryption settings and key exchange groups, disable outdated protocols, and use openssl s_client and testssl.sh to check connections and configuration weaknesses.
中文简介正在准备中。当前显示英语简介。
Create and manage MySQL, PostgreSQL, and SQL Server databases on Google Cloud. Covers instance setup, users, backups, availability, and secure connections, with a PostgreSQL walkthrough and references for application connectors and Terraform configuration.
中文简介正在准备中。当前显示英语简介。
Review security across web apps, APIs, mobile apps, Kubernetes, and AI agents using six OWASP references. Identify risky authentication, access controls, configurations, and prompt handling, then use examples and checklists to plan fixes.
中文简介正在准备中。当前显示英语简介。