Explore skills

Systematic false positive verification for security findings. Provides structured methodology to confirm or dismiss scanner results, manual audit findings, and automated alerts. Adapted from Trail of Bits. Use when triaging security scan results or verifying audit findings.

Detect fail-open configurations, hardcoded secrets, weak authentication defaults, permissive CORS, disabled security features, and other insecure-by-default patterns. Adapted from Trail of Bits. Use during security review or when auditing configuration and initialization code.

Security scan, dead code detection, and code quality audit for any project

Security audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan

Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.

Checks application security boundaries: secrets, injection, XSS, input validation, and sensitive env defaults. Use when auditing exploitable code paths.

Sets up security scanning for secrets and dependency vulnerabilities. Use when adding security infrastructure to a project.

This skill should be used when the user asks to "audit claude permissions", "audit permissions", "review local claude settings", "promote permissions to global", "clean up claude settings", "find permission patterns", or wants to identify project-local Claude Code permissions that should be added to global configuration.

Run a Maestro-style accessibility audit for WCAG compliance, ARIA usage, keyboard navigation, and screen reader compatibility

Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and exploitability risks

Run a Maestro-style SEO assessment for meta tags, structured data, crawlability, and Core Web Vitals

Run a Maestro-style accessibility audit for WCAG compliance, ARIA usage, keyboard navigation, and screen reader compatibility