Total 50,369 skills, Security & Compliance has 1967 skills
Showing 12 of 1967 skills
Rust CESR primitives library for KERI protocol. Auto-activates when working with cesride imports, Matter/Indexer traits, CESR primitive types (Verfer, Diger, Signer, Salter, Siger, Cigar), Serder/Sadder serialization, or Rust CESR encoding/decoding. Covers the full API: primitive construction, cryptographic operations, SAD serialization, threshold logic, and error handling. Defers to cesr/spec/acdc for protocol theory; focuses on Rust API specifics.
MANDATORY when touching auth tables, tenant isolation, RLS policies, or multi-tenant database code - enforces Row Level Security best practices and catches common bypass vulnerabilities
Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.
Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover producer-consumer dependencies between requests, and find security and reliability bugs. The tester compiles an OpenAPI specification into a RESTler fuzzing grammar, configures authentication, runs test/fuzz-lean/fuzz modes, and analyzes results for 500 errors, authentication bypasses, resource leaks, and payload injection vulnerabilities. Activates for requests involving API fuzzing, RESTler testing, stateful API testing, or automated API security scanning.
Use this skill when drafting offer letters, handling terminations, classifying workers, or creating workplace policies. Triggers on offer letters, termination process, contractor vs employee, workplace policies, employment agreements, severance, non-compete, and any task requiring employment law guidance or HR legal compliance.
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
SOC 2 Type I and Type II compliance management. Use when conducting SOC 2 readiness assessments, performing gap analysis against Trust Services Criteria, collecting audit evidence, validating infrastructure security controls, preparing for CPA firm audits, managing the observation period, or building continuous compliance programs. Covers all TSC categories (CC1-CC9, A1, PI1, C1, P1) with infrastructure validation for cloud, DNS, TLS, endpoints, and CI/CD pipelines.
Clarity smart contract security audit — structured review covering correctness, security vulnerabilities, design concerns, and deployment readiness.
Query MaximumSats Web of Trust scores, sybil detection, trust paths, and follow recommendations for Nostr pubkeys via wot.klabo.world. Free tier: 50 req/day; L402 Lightning auth for more.
Scan extension source code for Chrome Web Store rejection risks. Generates report with issues, root causes, and fixes. Use when: review, pre-submit, rejection, CWS compliance, store review.
Produce a report-only HIPAA, PHI, and PII audit for healthcare codebases and delivery systems. Inspects code, configs, data flows, integrations, logging, and deployment boundaries for privacy and security gaps without modifying code.
Safety guardrails that warn before destructive commands. Use to protect beginners from accidentally running dangerous operations like rm -rf, DROP TABLE, git push --force, or git reset --hard. Provides beginner-friendly explanations of WHY a command is dangerous and suggests safer alternatives. Activate when the user mentions safety, careful mode, guardrails, protection, or when working with beginners on tasks involving file deletion, database changes, or git operations.