Security

REST API and GraphQL design with OpenAPI 3.1, authentication, versioning, and rate limiting.

Expert in searching and retrieving API information from L'Oréal's API Portal. **Use this skill whenever the user mentions 'API search', 'find API', 'API information', 'API spec', 'API schema', 'Swagger', 'OpenAPI', or asks about available APIs in the API portal.** Handles searching APIs by pattern, retrieving API metadata, and fetching OpenAPI specifications using Azure OAuth authentication.

Download and transcribe videos from YouTube, Bilibili, TikTok and 1000+ platforms. Use when user requests video download, transcription (转录/字幕提取), or converting video to text/markdown. Supports quality selection, audio extraction, playlist downloads, cookie-based authentication, and AI-powered transcription via SiliconFlow API (免费转录).

This skill should be used when conducting comprehensive code reviews and codebase audits. Invoke when the user requests to review code quality, security vulnerabilities, performance issues, or best practices across entire codebases, directories, or specific files. Typical requests include "Review the codebase in ./src", "Audit this project for security issues", or "Review all Python files for quality".

Use when you need to plan technical solutions that are scalable, secure, and maintainable.

Review code changes for bugs, security, and design issues. Use when user wants to review code, check a PR, review changes, or says 'review this', 'check my code', 'PR review', or 'code review'.

Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.

Kyverno image validation: registry allowlists, digests, signatures, and CVE scanning gates for K8s supply chain security.

Conducts comprehensive vendor security assessments. Evaluates vendor security posture, identifies risks, and generates assessment reports with recommendations.

Generate comprehensive network infrastructure reports including health status, performance analysis, security audits, and capacity planning recommendations.

Crack password hashes using hashcat/john, perform password spraying, brute force authentication, and execute pass-the-hash attacks. Use when cracking credentials or performing password-based attacks.

Audit system security configuration for vulnerabilities. Use when the user says "audit security", "harden server", "check security", "is my server secure", "security review", or asks about server hardening.

Use this skill whenever the user wants to design, implement, or refactor authentication and authorization in a Hono + TypeScript backend, including JWT, sessions/cookies, middleware, guards-like patterns, and route protection for Node/Edge/Workers runtimes.

Use when fetching oil/gas trade flow data from Kpler. Covers authentication, trade queries, flow aggregations, entity search, vessel positions, and company fleet data.

Enforce consistent API route patterns including auth, rate limiting, validation, and error handling. Reduces boilerplate and prevents security issues.

WooCommerce REST API authentication and credential-based onboarding patterns for VioletConnect

Configure organization-level GitHub Apps for secure cross-repository automation. Machine identity, audit trails, and enterprise-grade authentication.

Review Server Actions for security, validation, and best practices in React 19. Use when reviewing forms, mutations, or server-side logic.

Master OAuth 2.0 authorization patterns with OpenIddict and ABP Framework including permission-based authorization, role-based access control, custom claims, and multi-tenant security. Use when implementing authentication/authorization for ABP applications.

Teach Data Access Layer pattern to prevent CVE-2025-29927 middleware authentication bypass. Use when implementing authentication, authorization, protecting routes, or working with server actions that need auth.