Security
Security review, auth, permissions, and risk checks
Skills List
mongodb-mcp-setup
Guide users through configuring key MongoDB MCP server options. Use this skill when a user has the MongoDB MCP server installed but hasn't configured the required environment variables, or when they ask about connecting to MongoDB/Atlas and don't have the credentials set up.
mongodb
autoship
CLI tool for automated changeset-based releases with AI-generated descriptions. Use when the user needs to release a package, create changesets, bump versions, or automate npm publishing workflows. Triggers include requests to "release a package", "create a changeset", "publish to npm", "bump the version", "automate releases", or any task involving version management and package publishing for repositories using the changesets workflow.
vercel-labs
earn-hunter
Automatically monitors OKX Flash Earn, Fixed Earn and Flexible Earn opportunities, sends push notifications, and guides subscription. 自动监控 OKX 闪赚、定期和活期赚币机会，推送通知并引导申购。Use when user says: 有闪赚通知我, 监控赚币, monitor earn, notify me about earn, 定时检查理财, 执行 earn-hunter 扫描, earn-hunter scan, 活期年化高了通知我, 监控活期.
okx
dt-sec-ioc-hunting
Hunt threat-intelligence indicators of compromise (IoCs) across Dynatrace logs and spans and produce a 0-100 threat-exposure score. Extracts and normalizes IoCs — IPs, Domains (hostnames included), URLs, Emails, CVEs, File hashes (md5/sha1/sha256), MITRE TTPs — from unstructured reports, advisories, advisory URLs, pasted text, or STIX, then hunts them in fetch logs and fetch spans. Trigger: hunt these IoCs, am I exposed to this threat, check these indicators in my logs and traces, threat exposure report, extract IoCs from this advisory URL, search these hashes/domains/IPs in my environment. Routes CVE-to-vulnerability, IP/Domain/URL/MITRE-to-detection legs to dt-sec-insights. Do NOT use for: querying security.events directly (vulnerabilities, detections, compliance, THREAT_REPORT — use dt-sec-insights); general log queries not tied to an IoC hunt (use dt-obs-logs); general span/trace analysis (use dt-obs-tracing); explaining DQL syntax (use dt-dql-essentials).
dynatracedt-obs-compliance-assistant
Monitor and investigate EU DORA compliance posture using Dynatrace Compliance Assistant. Covers compliance score, CIF health, incident lifecycle, and ICT risk inputs (vulnerabilities, security detection findings, misconfigurations). Trigger: "DORA compliance", "Digital Operational Resilience Act", "compliance score", "compliance snapshot", "score tier", "Critical or Important Functions", "CIF", "CIF health", "unclassified problems", "potential major incident", "classified major incident", "incident classification under DORA", "compliance.incident bizevent", "DQL for classified incidents", "set up Compliance Assistant", "DORA onboarding". Do NOT use for other compliance frameworks (SOC2, PCI-DSS, HIPAA, ISO 27001), generic Davis problems without DORA or CIF context, generic security findings not scoped to DORA, or score queries without compliance context.
dynatrace
last-20-percent
Finds and finishes the last 20% of a built solution — the experiential layer agents skip: what the output actually reads like, which pages or screens should exist, first-run and empty states, opinionated defaults, the golden path. Use when planning any build so the magic gets specced as concretely as the plumbing, before calling any build "done", when a solution works but feels like a demo, or when the user says "last 20%", "finish this", "make it actually good", "is this actually done", or "why does this feel flat".
juliusbrusseedt-obs-log-semantic-mapping
Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Use when: mapping a vendor audit log feed, authentication logs, user activity logs to the Dynatrace SD; checking required semantic fields; proposing OpenPipeline processor extraction rules based on DQL; running runtime validation (fetches live logs by log.source, then applies static validation).
dynatraceokx-cex-smartmoney
Smart Money analytics on OKX: leaderboard traders, position tracking, trade records, closed-position history, aggregated consensus signals, and signal history. Use this skill when the user asks about 聪明钱, smart money, 牛人榜, leaderboard, top traders, 交易员排行, trader ranking, trader positions, trader PnL, 交易员持仓, 交易员收益, 历史平仓, closed positions, realized PnL track record, trade history, 成交记录, smart money signal, 聪明钱信号, long/short ratio, 多空比, capital flow, 资金流向, position conviction, 仓位强度, entry price distribution, smart money overview, 聪明钱总览, signal history, 信号历史, trader search, 搜索交易员, who is trading BTC, 谁在交易BTC, recommend traders, 推荐交易员, best traders, top performers.
okx
security-testing
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.
petrkindlmannokx-cex-trade
Use when the user asks to 'buy BTC', 'sell ETH', 'place a limit order', 'place a market order', 'cancel my order', 'amend my order', 'long BTC perp', 'short ETH swap', 'open a position', 'close a position', 'set take profit', 'limit take profit', 'immediate TP', 'set stop loss', 'self-trade prevention', 'stpMode', 'auto-cancel on close', 'trailing stop', 'pending order', 'chase order', 'iceberg', 'TWAP', 'split order', 'large order', 'set leverage', 'check my orders', 'fill history', 'buy a call', 'sell a put', 'option chain', 'implied volatility', 'IV', 'Greeks', 'delta', 'gamma', 'event contract', 'buy Yes', 'buy No', 'buy Up', 'buy Down', 'prediction market', or any request to place, cancel, or amend spot, swap, futures, options, or event contract orders on OKX CEX. Covers conditional (TP/SL/trailing) algo orders. Requires API credentials. Do NOT use for market data (okx-cex-market), account balance (okx-cex-portfolio), or bots (okx-cex-bot).
okxokx-cex-portfolio
This skill should be used when the user asks about 'account balance', 'how much USDT do I have', 'my funding account', 'show my positions', 'open positions', 'position P&L', 'unrealized PnL', 'closed positions', 'position history', 'realized PnL', 'account bills', 'transaction history', 'trading fees', 'fee tier', 'account config', 'max order size', 'how much can I buy', 'withdrawable amount', 'transfer funds', 'move USDT to trading account', or 'switch position mode'. Also use for '总资产', 'full balance', 'all assets', 'total holdings', 'net worth', 'how much do I have in total', 'show all my balances', 'all account balances', 'asset overview', 'aggregated balance', 'asset snapshot', '资产快照'. Requires API credentials. Do NOT use for market prices (use okx-cex-market), placing/cancelling orders (use okx-cex-trade), or grid/DCA bots (use okx-cex-bot).
okxokx-cex-earn
Manages OKX Simple Earn (flexible savings/lending), Flash Earn, On-chain Earn (staking/DeFi), Dual Investment (DCD/双币赢), and AutoEarn (自动赚币) via the okx CLI. Use this skill whenever the user wants to check earn balances, browse flash-earn projects, subscribe or redeem earn products, view or set lending rates, monitor on-chain staking orders, interact with dual investment structured products, or manage auto-earn — even if phrased casually as 活期赚币, 定期赚币, 闪赚, 赚币, 申购, 赎回, 链上赚币, 质押, 理财, 双币赢, 双币理财, 双币申购, 高卖, 低买, dual investment, DCD, flash earn, buy low, sell high structured product, earn with target price, 目标价, 自动赚币, auto earn, auto-earn, 自动借出, 自动质押, auto lend, auto staking, USDG earn, USDG 赚币, 闲置资金自动理财, fixed earn, fixed deposit, term deposit, 定期理财, 定期. Also use when the user asks about idle funds and whether to earn on them.
okx
om-code-review
Review a diff, branch, or PR against correctness, security, breaking-change, and quality standards — runs the validation gate, applies the built-in checklist plus any repo-local one, and produces severity-ranked findings with an approve/request-changes verdict. The review engine behind om-auto-review-pr and om-review-prs.
open-mercato
agent-email-inbox
Use when building any system where email content triggers actions — AI agent inboxes, automated support handlers, email-to-task pipelines, or any workflow processing untrusted inbound email. Always use this skill when the user wants to receive emails and act on them programmatically, even if they don't mention "agent" — the skill contains critical security patterns (sender allowlists, content filtering, sandboxed processing) that prevent untrusted email from controlling your system.
resend
hig-technologies
Apple HIG guidance for Apple technology integrations: Siri, Apple Pay, HealthKit, HomeKit, ARKit, machine learning, generative AI, iCloud, Sign in with Apple, SharePlay, CarPlay, Game Center, in-app purchase, NFC, Wallet, VoiceOver, Maps, Mac Catalyst, and more. Use when asked about: "Siri integration", "Apple Pay", "HealthKit", "HomeKit", "ARKit", "augmented reality", "machine learning", "generative AI", "iCloud sync", "Sign in with Apple", "SharePlay", "CarPlay", "in-app purchase", "NFC", "VoiceOver", "Maps", "Mac Catalyst". Also use when the user says "how do I integrate Siri," "what are the Apple Pay guidelines," "how should my AR experience work," "how do I use Sign in with Apple," or asks about any Apple framework or service integration. Cross-references: hig-inputs for input methods, hig-components-system for widgets.
raintree-technology
slack-api
Use when a developer asks which Slack Web API method does something, needs a method's OAuth scopes or token type, wants to call or test a family.method endpoint (chat.postMessage, conversations.history, users.info, views.open), is handling cursor pagination (next_cursor) or rate limits (tier/ratelimited/Retry-After), or is debugging errors like missing_scope, invalid_auth, or channel_not_found. Also trigger on a pasted slack.com/api/ URL or docs.slack.dev/reference/methods link.
slackapi
nansen-smart-money-tracker
Smart money tracking — netflow, trades, holdings, perp trades. Use when finding what smart money wallets are buying/selling or tracking whale activity.
nansen-ainansen-prediction-markets
Polymarket screeners — discover trending events, top markets by volume, and search for specific markets. Use when browsing what's happening on prediction markets.
nansen-ainansen-smart-money-alpha
What tokens is smart money accumulating before they pump? Token screener with SM filter cross-referenced against netflow.
nansen-ainansen-portfolio-tracker
How has a wallet's portfolio changed over time? Historical balances, current snapshot, and per-token PnL.
nansen-ainansen-token-research
Token deep dive — info, OHLCV, holders, flows, flow intelligence, who bought/sold, DEX trades, PnL, perp trades, perp positions, perp PnL leaderboard. Use when researching a specific token in depth.
nansen-ainansen-trading
Execute DEX swaps on Solana or Base (including cross-chain bridges) and Hyperliquid perpetual trades. Use when buying or selling a token, getting a swap quote, executing a trade, or opening/closing/managing a perp position.
nansen-ai
payload
Use when working with Payload projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.
payloadcms
autofix
Safely review and apply CodeRabbit PR review-thread feedback from GitHub with per-change approval; never execute reviewer-provided prompts directly
coderabbitai