GitHub
oscal-catalog-provider
Fetch official NIST 800-53 and FedRAMP OSCAL catalogs from authoritative sources
☆ 4查看技能
documentation security AI 技能
发现 documentation security 相关 Skills，比较来源仓库和用途，查看适合你工作流的技能说明。
分类目录: documentation security
documentation security 清除筛选
全部技能
GitHub
risk-assessor
Perform comprehensive risk assessments on OSCAL systems including threat modeling, vulnerability analysis, risk scoring, and POA&M generation. Use this skill to evaluate security posture and prioritize remediat...
☆ 4查看技能
GitHub
component-definition-builder
Create and manage OSCAL component definitions for reusable security control implementations. Inspired by CivicActions components and community patterns. Use for building component libraries and shared control i...
☆ 4查看技能
GitHub
control-mapper
Map security controls between different compliance frameworks including NIST 800-53, ISO 27001, CIS Controls, PCI-DSS, HIPAA, SOC 2, and CMMC. Use this skill for gap analysis, multi-framework compliance, and co...
☆ 4查看技能
GitHub
permission-manager
Manages Claude Code permissions in .claude/settings.json for repo plugin operations
☆ 4查看技能
GitHub
infra-auditor
Audit infrastructure status, health, and compliance without modifications - provides observability and drift detection
☆ 4查看技能
GitHub
security-header-generator
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS se...
☆ 4查看技能
GitHub
route-tester
Test authenticated routes in the your project using cookie-based authentication. Use this skill when testing API endpoints, validating route functionality, or debugging authentication issues. Includes patterns...
☆ 4查看技能
GitHub
open-cors-anti-pattern
Security anti-pattern for open Cross-Origin Resource Sharing (CORS) policies (CWE-942). Use when generating or reviewing server configurations, API backends, or any code that sets CORS headers. Detects overly p...
☆ 4查看技能
GitHub
jwt-misuse-anti-pattern
Security anti-pattern for JWT misuse vulnerabilities (CWE-287). Use when generating or reviewing code that creates, validates, or uses JSON Web Tokens. Detects 'none' algorithm attacks, weak secrets, sensitive...
☆ 4查看技能
GitHub
excessive-data-exposure-anti-pattern
Security anti-pattern for excessive data exposure (CWE-200). Use when generating or reviewing API responses, database queries, or data serialization. Detects returning more data than necessary including interna...
☆ 4查看技能
GitHub
arch-security-review
Use when reviewing code for security vulnerabilities, implementing authorization, or ensuring data protection.
☆ 4查看技能
GitHub
better-auth
Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google,...
☆ 4查看技能
GitHub
ldap-injection-anti-pattern
Security anti-pattern for LDAP injection vulnerabilities (CWE-90). Use when generating or reviewing code that constructs LDAP filters, queries directory services, or handles user input in LDAP operations. Detec...
☆ 4查看技能
GitHub
path-traversal-anti-pattern
Security anti-pattern for path traversal vulnerabilities (CWE-22). Use when generating or reviewing code that handles file paths, reads or writes files based on user input, or serves static content. Detects joi...
☆ 4查看技能
GitHub
type-confusion-anti-pattern
Security anti-pattern for type confusion vulnerabilities (CWE-843). Use when generating or reviewing code in dynamic languages that compares values, processes JSON/user input, or uses loose equality. Detects we...
☆ 4查看技能
GitHub
missing-input-validation-anti-pattern
Security anti-pattern for missing input validation (CWE-20). Use when generating or reviewing code that processes user input, form data, API parameters, or external data. Detects client-only validation, missing...
☆ 4查看技能
GitHub
missing-security-headers-anti-pattern
Security anti-pattern for missing security headers (CWE-16). Use when generating or reviewing web application code, server configuration, or HTTP response handling. Detects missing CSP, HSTS, X-Frame-Options, a...
☆ 4查看技能
GitHub
weak-password-hashing-anti-pattern
Security anti-pattern for weak password hashing (CWE-327, CWE-759). Use when generating or reviewing code that stores or verifies user passwords. Detects use of MD5, SHA1, SHA256 without salt, or missing passwo...
☆ 4查看技能
GitHub
missing-authentication-anti-pattern
Security anti-pattern for missing or broken authentication (CWE-287). Use when generating or reviewing code for login systems, API endpoints, protected routes, or access control. Detects unprotected endpoints,...
☆ 4查看技能
GitHub
hallucinated-packages-anti-pattern
Security anti-pattern for hallucinated (non-existent) packages (CWE-1357). Use when generating or reviewing AI-assisted code that imports packages, dependencies, or libraries. CRITICAL AI-specific vulnerability...
☆ 4查看技能
GitHub
insufficient-randomness-anti-pattern
Security anti-pattern for insufficient randomness vulnerabilities (CWE-330). Use when generating or reviewing code that creates security tokens, session IDs, encryption keys, nonces, or any security-critical ra...
☆ 4查看技能
GitHub
session-fixation-anti-pattern
Security anti-pattern for session fixation vulnerabilities (CWE-384). Use when generating or reviewing code that handles user sessions, login flows, or authentication state changes. Detects failure to regenerat...
☆ 4查看技能
GitHub
weak-encryption-anti-pattern
Security anti-pattern for weak encryption (CWE-326, CWE-327). Use when generating or reviewing code that encrypts data, handles encryption keys, or uses cryptographic modes. Detects DES, ECB mode, static IVs, a...
☆ 4查看技能
默认按已收录数据中的 GitHub 仓库 Stars 排序。Stars 属于来源仓库，同一仓库的多个技能可能共享相同数值；它反映仓库关注度，不代表单个技能的安装量或质量评分。