安全
安全审查、认证、权限和风险检查
Skills 列表
resilience-hub-failure-mode-assessment
Runs and interprets AWS Resilience Hub v2 failure mode assessments. Covers starting assessments, understanding findings (severity, categories, recommendations), triaging by achievability, working with AI-generated service functions, and resolving findings. Applies when the user wants to run an assessment, review findings, or understand failure modes, or has a specific finding and asks how to resolve, remediate, or fix it. Does not apply to initial setup (use resilience-hub-getting-started) or FIS experiments.
awsresilience-hub-multi-account
Configures AWS Resilience Hub v2 for multi-account resilience management across an AWS Organization. Covers the per-service cross-account permission model, cross-account IAM roles, and centralized assessment from a single account. Applies when the user wants to set up org-wide resilience or assess workloads that span multiple AWS accounts.
awstransitgateway
Configures AWS Transit Gateway: creating a hub and attaching VPCs, segmenting traffic with route tables, centralizing egress and inspection through a hub (appliances or a Gateway Load Balancer endpoint), forcing east-west traffic between VPCs through AWS Network Firewall, connecting on-premises networks over the transit-gateway side of a Site-to-Site VPN or Direct Connect attachment (including ECMP to aggregate bandwidth across multiple VPN tunnels), peering transit gateways across Regions, migrating from a VPC peering mesh, and routing IP multicast. Applicable when connecting many VPCs through one router, isolating environments, forcing VPC-to-VPC traffic through a central Network Firewall, reaching on-premises over the hub, linking Regions, or moving off a peering mesh. Not applicable for single-VPC routing, VPC peering between two VPCs (vpcpeering skill), Direct Connect gateway or virtual interface setup (directconnect skill), or Route 53 DNS work.
awsdirectconnect
Configures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private, public, and transit virtual interfaces and bringing up BGP; reaching many VPCs through a Direct Connect gateway including cross-account transit gateway associations; encrypting traffic with MACsec or a private IP Site-to-Site VPN; making the connection resilient and tuning failover; managing link aggregation groups; SiteLink; and migrating from a virtual private gateway to a transit gateway. Use when the user wants a private, consistent network link between a data center and AWS, or operates an existing Direct Connect setup and needs to extend, encrypt, or harden it. Routes to the right per-task procedure in references. Do NOT use for transit gateway route tables and attachments (transitgateway skill), Site-to-Site VPN without Direct Connect (sitetositevpn skill), or Route 53 DNS routing (route53 skill).
awsshieldadvanced
Configures AWS Shield Advanced for enhanced Distributed Denial of Service (DDoS) protection: subscribing accounts and adding resource protections, enabling automatic application layer (layer 7) mitigation through AWS WAF, configuring health-based detection with Route 53 health checks, setting up Shield Response Team (SRT) access and proactive engagement, reviewing DDoS events and requesting cost protection credits, and aggregating resources into protection groups. Applicable when the user wants stronger DDoS protection for internet-facing resources (CloudFront, Application or Network Load Balancers, Elastic IP addresses, Global Accelerator, or Route 53 hosted zones), wants expert help during an attack, or wants to recover attack-driven scaling charges. Routes to the right per-task procedure in references. Not applicable for authoring AWS WAF rules (waf skill), creating Route 53 health checks (route53 skill), or org-wide Shield Advanced rollout with Firewall Manager (firewallmanager skill).
awsroute53
Configures Amazon Route 53 DNS: public and private records, traffic-steering routing policies, health checks, DNS Firewall, Route 53 Profiles, VPC Resolver (also known as Route 53 Resolver) for hybrid and Outposts networks, and Global Resolver. Applicable when the customer wants to point a hostname at a target, split or fail over traffic across endpoints, monitor an endpoint, block malicious domains, centralize DNS across accounts, or resolve private DNS across a hybrid network. Routes to the right per-task procedure in references. Does not cover CloudFront-specific setup (see the route53-cloudfront skill) or non-DNS networking.
awstimestream-influxdb
Retrieves authoritative guidance on Amazon Timestream for InfluxDB (managed InfluxDB 2, InfluxDB 2 Read Replica Clusters, InfluxDB 3 Core and Enterprise). Applicable to any InfluxDB-on-AWS request including engine selection, provisioning (Marketplace + AmazonTimestreamInfluxDBFullAccess/ConsoleFullAccess IAM), schema design (tags vs fields, cardinality, HTTP/sensor/metric data modeling), migration from LiveAnalytics, Processing Engine plugins, connectivity (port 8086 V2, port 8181 V3, VPC-only by default), and write/query errors.
awsrds-sqlserver
Provides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server. Applicable when users ask about SSMS times out connecting from EC2, Cannot generate SSPI context with Windows auth, connect RDS SQL Server from Lambda with pymssql, auth_scheme shows NTLM instead of KERBEROS on ECS Fargate, SSM tunnel to RDS SQL Server from laptop, port 1433 security group, TrustServerCertificate=True for localhost tunnels, SPN MSSQLSvc, AWS Managed Microsoft AD, CNAME not RDS endpoint for Kerberos, tds_version='7.4', encryption='require', port-as-string for pymssql, Secrets Manager credential caching in Lambda, error 18456 login failed. Covers Python (pymssql, pyodbc), .NET (Microsoft.Data.SqlClient), Java (JDBC mssql-jdbc), Node.js (tedious), IAM auth via RDS Proxy, and VPC/ECS/EKS/Lambda deployment.
awsaws-network-monitoring
Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health. Covers agent installation, IAM permissions, monitoring network paths, and troubleshooting agents reporting no metrics, HTTP 403 errors, or connectivity failures.
awsrds-db2
Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400) or z/OS mainframe (ADB2GEN, Q Replication), choosing code page/collation (EBCDIC, CCSID), S3 backup/restore, Multi-AZ and cross-region standby replicas, RDSADMIN procedures, customer-managed KMS BYOK, self-managed Active Directory Kerberos, Db2 audit to S3, minimum IAM, or colocation.
awsrds-oss
Advises on Amazon RDS open-source engines (MySQL, MariaDB, PostgreSQL) for instance creation, upgrade planning, commitment pricing, proxy evaluation, and Blue/Green deployments. Handles any RDS MySQL, MariaDB, or PostgreSQL question, including create a production-ready RDS MySQL instance, provision an RDS PostgreSQL database, run the RDS upgrade advisor for my RDS MySQL instance, what are my upgrade options, upgrade RDS MariaDB from 10.6 to the latest version, should I buy reserved instances or a savings plan for db.r7g.2xlarge RDS MySQL, change a VARCHAR to INT column on RDS MySQL 8.0 with Blue/Green, and does RDS Proxy help when PgBouncer already runs in transaction mode. Covers instance creation with production best practices, describe-db-instances and describe-db-engine-versions upgrade-target workflow, live prechecks via SSM or direct connection, RI versus DSP commitment pricing, RDS Proxy versus PgBouncer, and Blue/Green lifecycle with binlog replay compatibility.
aws
golang-security
Golang 安全最佳实践与漏洞防护。涵盖注入（SQL、命令、XSS）、密码学、文件系统安全、网络安全、Cookie、密钥管理、内存安全与日志记录。适用于编写、审查或审计 Go 代码的安全性，或处理涉及密码学、I/O、密钥管理、用户输入处理或身份验证的高风险代码。包含安全工具的配置。
sambergolang-dependency-management
Golang 项目的依赖管理策略——go.mod 管理、安装/升级包、最小版本选择、漏洞扫描、过时依赖跟踪、二进制体积分析、Dependabot/Renovate 配置、冲突解决以及 go.work 工作区。在添加、删除或升级 Go 依赖、审计漏洞、解决版本冲突或设置自动依赖更新时使用。
sambergolang-swagger
使用 swaggo/swag 为 Golang 项目生成 OpenAPI/Swagger 文档——注解注释（@Summary, @Param, @Success, @Router, @Security）、swag init 代码生成、框架集成（gin, echo, fiber, chi, net/http）、安全定义（Bearer/JWT, OAuth2, API key）以及结构体标签（swaggertype, enums, example, swaggerignore）。适用于在 Go 项目中添加或维护 Swagger/OpenAPI 文档，或当代码库导入了 github.com/swaggo/swag、github.com/swaggo/gin-swagger、github.com/swaggo/echo-swagger、github.com/swaggo/http-swagger 或 github.com/swaggo/files 时。
samber
supabase
在执行任何涉及 Supabase 的任务时使用。触发条件：Supabase 产品（数据库、认证、边缘函数、实时功能、存储、向量、定时任务、队列）；客户端库和 SSR 集成（supabase-js、@supabase/ssr）在 Next.js、React、SvelteKit、Astro、Remix 中；认证问题（登录、登出、会话、JWT、Cookie、getSession、getUser、getClaims、RLS）；Supabase CLI 或 MCP 服务器；模式变更、迁移、安全审计、Postgres 扩展（pg_graphql、pg_cron、pg_vector）。
supabasesetting-up-cloudtrail-multi-region
开启 AWS 全区域（Multi-Region）CloudTrail 追踪，配置 S3 日志存储并集成 CloudWatch Logs，支持通过 CloudWatch Logs Insights 开展安全监控、合规审计与日志查询。适合用于在 AWS 所有区域建立集中式的 API 活动日志记录。
awsconfiguring-vpc-endpoints-for-private-aws-service-access
配置 VPC 端点（接口和网关），通过 AWS PrivateLink 实现私有 AWS 服务访问。适用于在不使用互联网网关、NAT 设备或公共 IP 地址的情况下，设置到 S3、DynamoDB 及其他 AWS 服务的安全私有连接。涵盖端点创建、安全组、路由表和 DNS 配置。
awsfinding-data-lake-assets
跨 Glue Data Catalog、S3、S3 Tables 以及 Redshift 快速解析数据湖与湖仓一体（lakehouse）中的资产引用。适用场景/触发词：查找表、数据存放在哪、某数据在哪个表、定位数据集、查找...的数据、搜索 Catalog、哪些表匹配、Redshift 表、湖仓表、数据湖表、数仓表、反查 S3 路径。切勿用于：全量 Catalog 审计（请使用 exploring-data-catalog）、执行查询（请使用 querying-data-lake）、建表（请使用 creating-data-lake-table）。
awscreating-secrets-using-best-practices
按照安全最佳实践在 AWS Secrets Manager 中创建和管理密钥。创建密钥时始终使用此技能——它会设置专用的 KMS 加密密钥、自动轮换、最小权限 IAM 策略、CloudTrail 审计以及生命周期管理，这些对于生产级密钥处理至关重要。
awsconnecting-lambda-to-api-gateway
将现有的 AWS Lambda 函数连接到 Amazon API Gateway，通过创建 REST 或 HTTP API 并完成资源/方法设置、Lambda 代理集成、权限配置和部署。在连接 Lambda 到 API Gateway 时始终使用此技能——它处理了 CORS、限流、访问日志以及生产环境安全加固等容易遗漏的细节。
awsconnecting-to-data-source
创建并排查针对 JDBC 数据库（Oracle、SQL Server、PostgreSQL、MySQL、RDS）、Redshift、Snowflake 和 BigQuery 的 AWS Glue 连接。收集用户的连接提示信息，自动发现已有连接及候选 RDS/Redshift 资源，在 Secrets Manager 或通过 IAM 数据库身份认证注册凭据，配置 VPC 并进行连接测试。触发场景：连接数据库、配置 Glue 连接、注册数据源、连接 Snowflake/BigQuery/RDS、连接超时、测试连接、排查连接故障。切勿用于：数据搬运/迁移（请使用 ingesting-into-data-lake）、创建数据表（请使用 creating-data-lake-table）、查询数据（请使用 querying-data-lake）、目录检索/探索（请使用 exploring-data-catalog）或 SaaS 应用（Salesforce、ServiceNow、SAP、MongoDB、Kafka）。
awssecuring-s3-buckets
按照 AWS 最佳实践创建和保护 S3 存储桶，涵盖访问控制、加密、监控和错误配置修复。当用户想要保护新存储桶、审计现有存储桶、修复安全发现、配置加密或启用日志和监控时使用。请勿用于常规 S3 数据操作、S3 Tables 设置或发现现有数据资产。
aws
improve-business
Guided journey from a stalled, plateaued business to one with an honest diagnosis, a working operating rhythm, and offers repriced to real value. Orchestrates eight skills phase by phase - good-strategy-bad-strategy, traction-eos, high-output-management, team-topologies, drive-motivation, lean-analytics, negotiation, monetizing-innovation - asking the user questions at every decision point and recording results in the project docs/ folder (STRATEGY.md, OPERATIONS.md, METRICS.md, IMPROVE-BUSINESS-PLAN.md) so the journey resumes across sessions. Use when the user wants to fix a business that has plateaued, diagnose why growth stalled, tighten strategy and execution, re-motivate a team, or says ''revenue is flat and I do not know why''. Starting from scratch with no customers: use create-business. Once the fundamentals work and the goal is expansion: use grow-business. When the product itself drags the business down: use improve-app. For one framework in isolation, invoke that skill directly.
wondelai
wp-abilities-verify
Verify a WordPress plugin's Abilities API registrations: enumerate abilities, check that callback behavior matches each annotation's claim (the adversarial readonly-but-writes detection), validate permissions and schemas, and validate audit documents produced by wp-abilities-audit.
wordpress