Security

Implement Terraform provider ephemeral resources with the Plugin Framework: the Open/Renew/Close lifecycle, ephemeral schema design, registration via…

What to do the moment a secret is exposed — pasted into chat, committed, logged, shown in a transcript or a screenshot.

The pinned default technology stack for SMB Product-Builder products.

Use when checking for security vulnerabilities in NanoClaw skills, before installing new skills, or when asked about security advisories affecting the bot

Postgres best practices maintained by Supabase, for Postgres running anywhere.

Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis.

Harness-neutral community incident reporting for AI agents.

Audit and improve website readiness for AI agents using the Cloudflare "Is It Agent Ready?" scanner (isitagentready.com).

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis.

Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value.

Analyzes smart contract codebases to identify state-changing entry points for security auditing.

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions.

Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files).

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset…

Builds and queries multi-language source and binary code graphs for security analysis.

Guides authoring of high-quality YARA-X detection rules for malware identification.

Audits AI-assisted legal, compliance, governance, and institutional decisions before reliance to determine whether the responsible human or institution has…

Audits the transition from legal AI output to reliance, recommendation, execution, or real-world commitment.

Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR…

Drafts, reviews, rewrites, and coaches outcome-based OKR sets across team, department, product, or company scopes.

Run a repo-wide cross-cutting governance audit via the pm-skill-auditor sub-agent.

Audit Xberg before a push or release by reconciling CI, Publish Release dry-run, Benchmarks, generated freshness, changelog, and remote branch state.

Use when reading or changing anything in ClickUp via the `cup` CLI - tasks, sprints, comments, Docs, Chat, views, webhooks, or workspace structure.

Defines the local standard for standalone Pi extension repositories.