Security
supabase
Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...
2.7K 308.9K
View 
Find Bugs
find-bugs
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
SKILL.md
Full skill instructions
Find Bugs
Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
Phase 1: Complete Input Gathering
- Get the FULL diff:
git diff master...HEAD - If output is truncated, read each changed file individually until you have seen every changed line
- List all files modified in this branch before proceeding
Phase 2: Attack Surface Mapping
For each changed file, identify and list:
- All user inputs (request params, headers, body, URL components)
- All database queries
- All authentication/authorization checks
- All session/state operations
- All external calls
- All cryptographic operations
Phase 3: Security Checklist (check EVERY item for EVERY file)
- Injection: SQL, command, template, header injection
- XSS: All outputs in templates properly escaped?
- Authentication: Auth checks on all protected operations?
- Authorization/IDOR: Access control verified, not just auth?
- CSRF: State-changing operations protected?
- Race conditions: TOCTOU in any read-then-write patterns?
- Session: Fixation, expiration, secure flags?
- Cryptography: Secure random, proper algorithms, no secrets in logs?
- Information disclosure: Error messages, logs, timing attacks?
- DoS: Unbounded operations, missing rate limits, resource exhaustion?
- Business logic: Edge cases, state machine violations, numeric overflow?
Phase 4: Verification
For each potential issue:
- Check if it's already handled elsewhere in the changed code
- Search for existing tests covering the scenario
- Read surrounding context to verify the issue is real
Phase 5: Pre-Conclusion Audit
Before finalizing, you MUST:
- List every file you reviewed and confirm you read it completely
- List every checklist item and note whether you found issues or confirmed it's clean
- List any areas you could NOT fully verify and why
- Only then provide your final findings
Output Format
Prioritize: security vulnerabilities > bugs > code quality
Skip: stylistic/formatting issues
For each issue:
- File:Line - Brief description
- Severity: Critical/High/Medium/Low
- Problem: What's wrong
- Evidence: Why this is real (not already fixed, no existing test, etc.)
- Fix: Concrete suggestion
- References: OWASP, RFCs, or other standards if applicable
If you find nothing significant, say so - don't invent issues.
Do not make changes - just report findings. I'll decide what to address.
More Security skills
Security
neon-postgres
Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.
98 216.2K
View 
Security
firebase-auth-basics
Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
462 163.8K
View Security
firebase-security-rules-auditor
A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.
462 127.7K
View Security
firebase-ai-logic-basics
Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.
462 125.1K
View 
Security
better-auth-best-practices
Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.
222 118.2K
View 
Security
vercel-cli-with-tokens
Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".
31.9K 116.1K
View 
Security
cloudflare
Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.
3K 110.7K
View 
Security
azure-compliance
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
253 103K
View 
Security
gws-gmail
Send, read, and manage Gmail messages, drafts, labels, and account settings.
31.2K 78.9K
View 
Security
audit-website
Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.
94 72.3K
View Security
gws-shared
Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.
31.2K 63.4K
View Security AI tools
Security
StarByFace
Discover your celebrity doppelgänger with StarByFace!
Free
View Security
GeoSpy
GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams
Free
View Security
AI Voice Detector
Detect AI-generated voices to protect against audio fraud.
Paid
View Security
Paraphrasing Tool
Ensure Your Content's Originality with AI Plagiarism Checker
Freemium
View Security
Img Upscaler
Upscale images by 400% without quality loss
Freemium
View C
Security
Copyright Check AI
Protect your social media from copyright disputes
Paid
View Security
AICheatCheck
Accurately Detect AI-Generated Content with TheChecker.AI
Free
View D
Security
Detect GPT
Chrome extension that detects and flags AI-generated content
Free
View