incident-response-plan

95

aj-geddes

Create and execute incident response procedures for security breaches, data leaks, and cyber attacks. Use when handling security incidents, creating response playbooks, or conducting forensic analysis.

security-convex

88

IgorWarzocha

Review Convex security audit patterns for authentication and authorization. Use for auditing query/mutation auth, row-level security, and validators. Use proactively when reviewing Convex apps (convex/ directory present). Examples: - user: "Audit these Convex mutations" → check for missing ctx.auth and input validators - user: "Check for IDOR in Convex queries" → verify ownership checks on document access - user: "Review Convex HTTP actions" → check for signature verification on webhooks - user: "Secure these Convex queries" → implement custom functions for enforced auth - user: "Check for data leaks in subscriptions" → verify filtered result sets

LLM Security Testing

71

PramodDutta

Security testing for LLM-powered applications including prompt injection, jailbreak detection, data leakage prevention, and AI safety testing.

multi-tenant-safety-checker

12

patricio0312rev

Ensures tenant isolation at query and policy level using Row Level Security, automated testing, and security audits. Prevents data leakage between tenants. Use for "multi-tenancy", "tenant isolation", "RLS", or "data security".

qa-security-auditor

9

QoreDB

Security and QA auditing workflow for QoreDB. Use when the user asks to "check security", "audit code", or before merging critical features. Checks for sensitive data leaks, dangerous permissions, and unsafe SQL patterns.

security-convex

6

justinlevinedotme

Review Convex security audit patterns for authentication and authorization. Use for auditing query/mutation auth, row-level security, and validators. Use proactively when reviewing Convex apps (convex/ directory present). Examples: - user: "Audit these Convex mutations" → check for missing ctx.auth and input validators - user: "Check for IDOR in Convex queries" → verify ownership checks on document access - user: "Review Convex HTTP actions" → check for signature verification on webhooks - user: "Secure these Convex queries" → implement custom functions for enforced auth - user: "Check for data leaks in subscriptions" → verify filtered result sets

skill-public-git-sync

4

tekliner

Automatically sync Claude Code skills to public GitHub repository with security sanitization. Use when updating public skills repo, syncing new skills, or ensuring no sensitive data leaks. Checks for API keys, credentials, absolute paths, and client-specific info before copying.

exploiting-insecure-data-storage-in-mobile

2

mukul975

Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.

testing-android-intents-for-vulnerabilities

2

mukul975

Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.

exploiting-excessive-data-exposure-in-api

2

mukul975

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.

analyzing-ransomware-leak-site-intelligence

2

mukul975

Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.

review-data-analysis

2

pjt222

Review a data analysis for quality, correctness, and reproducibility. Covers data quality assessment, assumption checking, model validation, data leakage detection, and reproducibility verification. Use when reviewing a colleague's analysis before publication, validating an ML pipeline before production deployment, auditing a report for regulatory or business decision-making, or performing a second-analyst review in a regulated environment.

intercepting-mobile-traffic-with-burpsuite

2

mukul975

Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.

review-data-analysis

2

pjt222

Review a data analysis for quality, correctness, and reproducibility. Covers data quality assessment, assumption checking, model validation, data leakage detection, and reproducibility verification. Use when reviewing a colleague's analysis before publication, validating an ML pipeline before production deployment, auditing a report for regulatory or business decision-making, or performing a second-analyst review in a regulated environment.

moltguard

frekyr17-png

MoltGuard — runtime security plugin for OpenClaw agents by OpenGuardrails. Helps users install, register, activate, and check the status of MoltGuard. Use when the user asks to: install MoltGuard, check MoltGuard status, register or activate MoltGuard, configure the AI Security Gateway, or understand what MoltGuard detects. Provides local-first protection against data exfiltration, credential theft, command injection, and sensitive data leakage. Source: https://github.com/openguardrails/openguardrails/tree/main/moltguard

ML Pipeline Debugger

Eli-yu-first

Debugs ML pipelines by identifying data leakage, overfitting, and distribution shift issues

ml-review

jbo-tech

Best practices for machine learning, deep learning and data analysis. Activates when the user mentions "model", "training", "features", "cross-validation", "accuracy", "overfitting", "data leakage", "preprocessing", "sklearn", "pytorch", "tensorflow", "neural network", "regression", "classification". Do NOT use for ETL pipelines or data quality (use data-engineering).

security-hardening

theagentledger

Security audit and hardening for AI agents — credential hygiene, secret scanning, prompt injection defense, data leakage prevention, and privacy zones.

Test Data Management

sharp-skills

Manages test fixtures, factories, and seed data so tests are fast, isolated, and don't break each other. Use when tests share state, when seeding becomes a maintenance burden, or when production data leaks into test environments. Triggers on: test fixture, factory, seed data, test isolation, database seed, factory_boy, faker, fixtures vs factories, test database, cleanup strategy.

agentprivacy-metadata-resistance

mitchuski

Traffic analysis resistance, timing obfuscation, and metadata stripping for 0xagentprivacy swordsman operations. Activates when designing defences against metadata correlation, implementing mixnet routing, padding strategies, timing decorrelation, or any protection that targets the signals AROUND encrypted content rather than the content itself. Triggers: "metadata", "traffic analysis", "timing attack", "correlation", "mixnet", "padding", "network fingerprint", "side channel", "metadata leakage".