安全

使用 CodeRabbit 进行 AI 驱动的代码审查。默认的代码审查技能。当有明确的审查请求时触发，并在代理认为需要审查时（代码/PR/质量/安全）自主触发。

coderabbitai

planetscale-mcp-agent-operating-model

Configure safe agent behavior around PlanetScale MCP, Insights, schema recommendations, and repository work without autonomous production mutation.

planetscale

planetscale-autonomous-execution-mode

Execute approved PlanetScale changes end-to-end without per-step approval when the operator has explicitly acknowledged the risk. Defines the risk-acknowledgment contract, scoped autonomy levels, sensible execution ordering, continuous status reporting, halt conditions, and rollback discipline. Extremely safe, very enabling.

planetscale

humanizer-ru

Не для обхода детекторов; не для текста, который тебе не принадлежит. Находит следы машинного текста в русском и объясняет их; переписывает только по явной просьбе; вердиктов об авторстве нет. Отвечает на просьбы вида «очеловечь», «убери гпт-шность», «звучит как нейросеть», «проверь на ИИ», «убери штампы», «убери канцелярит», «сделай живым», «вставка из чата», «копипаста из ChatGPT», contentReference, utm_source, невидимые символы, машинная типографика (40 regex-маркеров, у 38 полная запись доказательств). Finds machine-text traces in Russian and explains them; rewrites only on explicit request; no authorship detection verdict. Английский профиль: только артефакты/факты; исходный код не обрабатывается; юридические и художественные тексты — только детерминированная очистка артефактов. Демо: vladimir-human.github.io/humanizer-ru

vladimir-human

redis-security

125security

Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules, and disabling dangerous commands. Use when deploying Redis to production, defining ACL users for an application, configuring TLS connections, locking down a Redis instance behind a firewall, or auditing a Redis deployment for security hardening.

redis

neo4j-security-skill

Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER),

neo4j-graphql-skill

Build and configure a GraphQL API backed by Neo4j using @neo4j/graphql v7 (current) or v5 (LTS).

neo4j-driver-dotnet-skill

Neo4j .NET Driver v6 — IDriver lifecycle, DI registration (singleton), ExecutableQuery

neo4j-snowflake-graph-analytics-skill

Run Neo4j Graph Analytics algorithms (PageRank, Louvain, WCC, Dijkstra, KNN,

neo4j-mcp-skill

Use when installing, configuring, or troubleshooting the official Neo4j MCP server

apollo-router

108security

Version-aware guide for configuring and running Apollo Router for federated GraphQL supergraphs. Generates correct YAML for both Router v1.x and v2.x. Use this skill when: (1) setting up Apollo Router to run a supergraph, (2) configuring routing, headers, or CORS, (3) implementing custom plugins (Rhai scripts or coprocessors), (4) configuring telemetry (tracing, metrics, logging), (5) troubleshooting Router performance or connectivity issues, (6) securing the graph with JWT, declarative field-level authorization directives, or persisted-query safelisting, (7) managing router.yaml as version-controlled config with CI/CD validation.

apollographql

owasp-security-check

91security

Security audit guidelines for web applications and REST APIs based on OWASP Top 10 and web security best practices. Use when checking code for vulnerabilities, reviewing auth/authz, auditing APIs, or before production deployment.

sergiodxa

stripe-webhooks

89backend-api

Receive and verify Stripe webhooks. Use when setting up Stripe webhook handlers, debugging signature verification, or handling payment events like payment_intent.succeeded, customer.subscription.created, or invoice.paid.

hookdeck

github-webhooks

89testing-qa

Receive and verify GitHub webhooks. Use when setting up GitHub webhook handlers, debugging signature verification, or handling repository events like push, pull_request, issues, or release.

hookdeck

webhook-handler-patterns

89mcp-integrations

Best practices for webhook handlers. Use when implementing the handler sequence (verify first, parse second, handle idempotently), idempotency, error handling, retry logic, or framework-specific issues with Express, Next.js, or FastAPI.

hookdeck

newapi

88security

Assistant for newapi (new-api), an open-source unified AI gateway platform (https://github.com/QuantumNous/new-api). Use when the user asks about New API, managing models, groups, balance, or tokens, or securely copying keys, applying them to config files, or using them in commands without exposing secrets.

quantumnous

qianwen-find-skills

87security

Discover, compare, and optionally install published Agent Skills from QianWen. TRIGGER when: user asks to find or recommend a skill, asks whether a skill exists for a task, wants to browse skills by category, wants to compare candidates, asks to install a discovered skill, or explicitly invokes this skill by name (e.g. use qianwen-find-skills). DO NOT TRIGGER when: user already selected an installed skill and only wants to run it, or the request is unrelated to skill discovery or installation.

qianwen-ai

muse

86design-ui

Defining and managing design tokens, applying token systems to existing codebases, building design system foundations. Use for spacing, color, typography, dark mode, cross-platform output.

simota

voice

86prompting-reasoning

Collecting user feedback via NPS surveys, review analysis, sentiment analysis, feedback classification, and insight extraction reports. Use when establishing feedback loops.

simota

jira-communication

86security

Use when handling Jira issues, sprints, boards, links, fields, worklogs, attachments, or users, or on any Jira intent without a key (\"create/find a ticket\", \"pick a project\"). Auto-triggers on Jira URLs and issue keys (PROJ-123). Also use when MCP Atlassian tools fail or are unavailable for Jira Server/DC.

netresearch

squirrelscan

85security

squirrelscan 通过 squirrel CLI 对网站进行 SEO、性能、安全性、可访问性、内容和结构化数据问题审计（260+ 条规则），并评估网站健康评分。当用户想要检查、审计或改进网站的 SEO、排名、速度或健康状态时，以及涉及 squirrelscan 本身（安装或更新 CLI、登录和 API 密钥、运行审计、发布和分享报告、云积分、MCP 服务器设置、配置或故障排除）时使用。

squirrelscan

mastra-factory

85security

Operate and supervise Mastra Factory through `mastra api factory`. Use for Factory status or queue summaries, project and work-item inspection, metrics, health, decisions, attention, supervisor sessions, and user-authorized autonomous or interactive Factory operations on hosted, local, remote, or self-hosted servers.

mastra-ai

integrating-jupiter

85security

Comprehensive guidance for integrating Jupiter APIs (Swap, Lend, Perps, Trigger, Recurring, Tokens, Price, Portfolio, Prediction Markets, Send, Studio, Lock, Routing). Use for endpoint selection, integration flows, error handling, and production hardening.

jup-ag

technical-debt

84security

Technical debt inventory, prioritization, and audit for PHP/Laravel (MySQL) and Node/TypeScript/React projects. Use when assessing code health, identifying refactoring candidates, planning debt paydown, or auditing a codebase for accumulated debt. Triggers on "audit technical debt", "find tech debt", "debt inventory", "what should we refactor first", or tasks involving code health, security debt, performance debt, data debt, observability debt, debt prioritization, or remediation planning.

asyrafhussin