Security

Coordinates 9 specialized audit workers (security, build, architecture, code quality, dependencies, dead code, observability, concurrency, lifecycle). Researches best practices, delegates parallel audits, aggregates results into single Linear task in Epic 0.

Build production-ready frontend for Morpho Blue lending protocol on Solana. Covers all 26 program instructions across supply/borrow, flash loans, liquidations, authorization, and admin features. Uses Next.js 14, Anchor client, Jupiter wallet adapter, and Kamino-style UI/UX. Integrates with morpho-solana-builder skill for contract understanding.

foundational definitions for GitHub skills, safety rules, tool escalation, and security boundaries

Keycloak identity and access management including realms, clients, authentication flows, themes, and user federation. Activate for OAuth2, OIDC, SAML, SSO, identity providers, and authentication configuration.

Guide for implementing Better Auth - a framework-agnostic authentication and authorization framework for TypeScript. Use when adding authentication features like email/password, OAuth, 2FA, passkeys, or advanced auth functionality to applications.

Comprehensive REST and GraphQL API design patterns, best practices, OpenAPI specifications, versioning, authentication, error handling, pagination, rate limiting, and security. Use when designing APIs, creating endpoints, reviewing specifications, implementing authentication, or building scalable backend services.

Performs Firebase Firestore operations. Use when querying collections, creating/updating/deleting documents, using batch writes, or working with Timestamps. Includes pagination, transactions, and security rules patterns.

Securely upload GitHub Actions secrets via gh CLI. Stdin pipe (preferred) or temp script fallback. NEVER commits secrets.

Validate backend development environment and authentication status. Use when (1) new backend developer onboarding, (2) checking required tools (gh CLI, Git, Node, pnpm, Supabase), (3) verifying GitHub auth and repo access, (4) orchestrator auto-runs at work start.

Comprehensive purple team security assessment skill that analyzes codebases like a skilled penetration tester, identifies attack vectors, and provides remediation guidance. Use this skill when: (1) Performing security audits or code reviews, (2) Identifying vulnerabilities before deployment, (3) Running purple team exercises (offensive analysis + defensive remediation), (4) Checking for OWASP Top 10 vulnerabilities, (5) Scanning for hardcoded secrets, API keys, or credentials, (6) Analyzing authentication/authorization flaws, (7) Reviewing cryptographic implementations, (8) Auditing infrastructure-as-code (Terraform, K8s, Docker), (9) Generating security reports in Markdown, HTML, or JSON format. Triggers: "security audit", "purple team", "penetration test", "find vulnerabilities", "security review", "attack vectors", "remediate vulnerabilities", "OWASP", "security scan".

Guidance for configuring MCP servers in Claude Code projects. Covers transport selection, scopes, authentication, and security patterns. Use whenever adding MCP servers - projects, plugins, or any context.

Comprehensive system design skill for creating professional software architecture specifications. Use this skill when asked to design systems (e.g., "Design a chat application", "Design an e-commerce platform", "Create system architecture for X"). Generates complete technical specifications with architecture diagrams, database schemas, API designs, scalability plans, security considerations, and deployment strategies. Creates organized spec folders with all documentation following professional software engineering standards, from high-level overview down to detailed implementation specifications.

WHEN: Infrastructure security audit, secrets management, network policies, compliance checksWHAT: Secrets scanning + Network policies + IAM/RBAC audit + Compliance validation + Security hardeningWHEN NOT: Application security → security-scanner, Docker only → docker-reviewer

Enterprise-grade FastAPI development covering complete full-stack architecture with Next.js/React frontend, Neon Serverless PostgreSQL, SQLModel ORM, security hardening, payment integrations (Stripe, JazzCash, EasyPaisa), async patterns, real-time features, microservices, and production deployment. Use when building APIs, integrating with databases, implementing authentication/authorization, payment systems, real-time functionality, or deploying to production.

Review security of command execution, tool permissions, and API key handling. Use when user mentions "security review", "audit", "check security", "vulnerabilities", or before deploying to production.

Fastify Node.js expert for .ts API files, REST endpoints, routes, middleware, handlers, PostgreSQL, SQL queries, pg.Pool, Zod schemas, validation, authentication, authorization, async/await, database connections, camelCase, type safety, error handling

Create optimized Dockerfiles with multi-stage builds, security hardening, layer caching, and health checks. Includes docker-compose patterns for development and production environments.

This skill should be used when the user asks to "add Keycloak authentication", "implement OIDC", "configure SSO", "validate JWT token", "add role-based access", "protect API endpoint", or mentions Keycloak, OAuth2, OpenID Connect, identity provider, or authentication in FastAPI. Provides Keycloak/OIDC integration patterns.

Extract and analyze security controls from OSCAL catalogs, profiles, and SSPs. Use this skill to get detailed information about control hierarchies, statements, parameters, and implementation status for compliance analysis.

Master API documentation creation including OpenAPI/Swagger specifications, REST endpoint documentation, authentication flows, and error handling guides. Use this skill when documenting APIs, creating endpoint specifications, or writing API reference guides.