安全
安全审查、认证、权限和风险检查
Skills 列表
mantis-plan
Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap (workspace/plan.json). Don't use for executing code reviews, writing test scripts, or patching code.
googlemantis-critic
Assesses the production viability of findings, filtering out debug-only features and assertion traps. Use when findings have been validated and you need to confirm they are triggerable in production release builds (with assertions disabled). Don't use for writing reproduction scripts or patches.
googlemantis-researcher
Audits production source code files based on the strategy in workspace/plan.json. Use when a review plan exists and you need to perform static analysis and deep-dive reviews of targeted files. Don't use for planning, deduplicating, or writing patches.
googlemantis-report
Generates a human-readable security review packet compiled from confirmed findings and exploit chains. Use at the end of a review cycle to produce stakeholder-facing documentation. Don't use for auditing code or verifying patches directly.
googlemantis-reproduce
Generates and runs crash reproducers to verify security flaws. Use when viable findings exist and you need to write and execute a script or payload to verify the crash. Don't use for code auditing or patching.
googlemantis-dedupe
Consolidates raw security findings to eliminate redundant reports. Use when raw findings have been generated by the researcher and need consolidation before review. Don't use for initial code auditing or patch generation.
googlemantis-calibrate
Calculates the final risk score based on empirical evidence and architectural impact. Use when findings have been fully processed by previous stages and you need to append final risk scores to the finding files. Don't use for discovering new vulnerabilities or writing patches.
googlemantis-patch
Generates minimal security fixes using transactional isolation (shadow directories or file backups), applies patches, and verifies them. Use when security findings are successfully reproduced and need patches applied and verified. Don't use for initial vulnerability research or reproduction payload generation.
googlemantis-history
Analyzes the repository's version control system (VCS) history to extract past vulnerabilities, security fixes, and vulnerability patterns. Use as an initial pre-processing step to build a historical vulnerabilities database (workspace/historical_learnings.jsonl) that informs subsequent stages about past issues and fixes. Don't use for code reviews, writing test scripts, or patching code.
googlemantis-threat-model
Synthesizes trust boundaries, attack surfaces, and attacker profiles into a living threat model. Use as Stage B of the Knowledge Base generation process, reading architecture and entity definitions from the KB. Don't use for analyzing source code or extracting raw learnings from JSONL files.
google
domain-web
Use when building web services. Keywords: web server, HTTP, REST API, GraphQL, WebSocket, axum, actix, warp, rocket, tower, hyper, reqwest, middleware, router, handler, extractor, state management, authentication, authorization, JWT, session, cookie, CORS, rate limiting, web 开发, HTTP 服务, API 设计, 中间件, 路由
actionbook
github-ops
Operates GitHub through gh CLI and the REST/GraphQL APIs with explicit target, authorization, impact preview, and independent readback. Use for pull requests, issues, Actions, repositories, collaborators, teams, organization member privileges, base permissions, 2FA enforcement, repository settings, API automation, parallel or superseded PR convergence, and public or enterprise GitHub. Also use when a GitHub write returned success but the requested state did not change, or when deciding whether a setting is writable through CLI, REST, GraphQL, or only the GitHub UI.
daymadetwitter-reader
抓取 Twitter/X 帖子及长文章（X Articles）内容，支持完整图片与元数据提取。当 Claude 需要获取推文/文章正文、作者信息、互动数据及嵌入媒体时使用。支持单条推文与 X 长文章，自动将所有图片下载至本地附件目录，并生成带有正确图片引用的完整 Markdown。对于带有图片的 X 长文章，优先推荐使用本工具而非 Jina。
daymade
kimi-delegate
Delegate a coding task to the Kimi Code CLI (`kimi`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Kimi - phrasings like "have Kimi implement X", "delegate this to Kimi", "run it through Kimi Code", or "use Kimi to implement/fix/refactor" - or wants to run a queue of coding tasks through Kimi while staying the reviewer. DO NOT USE for tasks small enough to do inline, or when the user wants the code written directly without delegating.
amelnagdy
entra-agent-id
通过 Microsoft Graph 预配 Microsoft Entra 代理标识蓝图、蓝图主体和每个实例的代理标识，并配置 OAuth 2.0 令牌交换（fmi_path、OBO、跨租户），包括用于 AgentID 边车的 Microsoft Entra SDK。用于：代理标识蓝图、蓝图主体、代理 OAuth、fmi_path 令牌交换、代理 OBO、代理的工作负载标识联合、多语言代理认证、Microsoft.Identity.Web.AgentIdentities。不用于：标准 Entra 应用注册（使用 entra-app-registration）、Azure RBAC（使用 azure-rbac）、Microsoft Foundry 代理创作（使用 microsoft-foundry）。
microsoftazure-cost
Azure 成本管理：查询成本、预测支出、优化以减少浪费。适用场景："Azure 成本"、"Azure 账单"、"成本明细"、"我花了多少钱"、"预测支出"、"优化成本"、"减少支出"、"孤立资源"、"调整 VM 大小"、"成本激增"、"降低存储成本"、"AKS 成本"。不适用于：部署资源、预配、诊断或安全审计。
microsoftentra-app-registration
指导 Microsoft Entra ID 应用注册、OAuth 2.0 身份验证和 MSAL 集成。用途：创建应用注册、注册 Azure AD 应用、配置 OAuth、设置身份验证、添加 API 权限、生成服务主体、MSAL 示例、控制台应用身份验证、Entra ID 设置、Azure AD 身份验证。不适用于：Azure RBAC 或角色分配（使用 azure-rbac）、Key Vault 机密（使用 azure-keyvault-expiration-audit）、一般 Azure 资源安全指导。
microsoftazure-rbac
帮助用户为标识找到具有最低权限的合适 Azure RBAC 角色，然后生成 CLI 命令和 Bicep 代码来分配该角色。同时提供分配角色所需的权限指导。适用场景：bicep 用于角色分配、我应该分配什么角色、最低权限角色、RBAC 角色、读取 blob 的角色、托管标识的角色、自定义角色定义、为标识分配角色、我需要什么角色来授予访问权限、分配角色的权限。
microsoftazure-kusto
使用KQL查询和分析Azure Data Explorer（Kusto/ADX）中的数据，适用于日志分析、遥测和时间序列分析。适用场景：KQL查询、Kusto数据库查询、Azure Data Explorer、ADX集群、日志分析、时间序列数据、IoT遥测、异常检测。
microsoftazure-compliance
使用 azqr 和 Key Vault 过期检查运行 Azure 合规性与安全审计。涵盖最佳实践评估、资源审查、策略/合规性验证以及安全态势检查。适用场景：合规性扫描、安全审计、运行 azqr（合规性 CLI 工具）之前、Azure 最佳实践、Key Vault 过期检查、过期证书、即将过期的机密、孤立资源、合规性评估。
microsoft
eval-engineering
Inspect an agent repository and optional traces, interview the user, write reviewed Task Specs, build and audit Harbor tasks, and bootstrap reusable project World Knowledge Skills. Use for agent evals, benchmark design, Task generation, controlled Environments, synthetic data, Verifiers, Harbor runs, calibration, or continuous benchmark maintenance.
langchain-ai
ios-security
Secure iOS apps with Keychain Services, CryptoKit encryption, biometric authentication (Face ID, Touch ID), Secure Enclave key storage, LAContext, App Transport Security (ATS), certificate pinning, data protection classes, and secure coding patterns. Use when implementing app security features, auditing privacy manifests, configuring App Transport Security, securing keychain access, adding biometric authentication, or encrypting sensitive data with CryptoKit.
dpearson2699
github-release
Prepare and publish GitHub releases. Sanitizes code for public release (secrets scan, personal artifacts, LICENSE/README validation), creates version tags, and publishes via gh CLI. Trigger with 'release', 'publish', 'open source', 'prepare for release', 'create release', or 'github release'.
jezwebswift-security
Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.
dpearson2699