Segurança

Push current branch and create a pull request. Rebase workflow, auto-PR, merge prompt after checks pass. Triggers: "push-and-pr", "/push-and-pr", "push and pr", "create pr", "сделай пр"

Design logging that supports investigations without becoming a privacy liability. Covers what to log and what never to log (PII, secrets), structured logging, retention tiers, centralization choices, alert routing, and the operational-versus-access-versus-audit log split. Invoke when starting a new service, when investigation revealed missing log fields, or when log volume is becoming expensive.

Find Next.js-specific security issues across App Router, Pages Router, and Server Actions. Covers the middleware-bypass class, NEXT_PUBLIC environment leakage, RSC over-fetch, CSP for App Router, open redirects, and next/image SSRF via permissive remotePatterns. Invoke when reviewing a Next.js app before launch, after a major version upgrade, or when adding authenticated routes.

Composes multi-step exploit chains by correlating vulnerabilities across domains, calculates real impact of chained findings, generates end-to-end PoC scripts, and produces bug bounty ready reports. Use when user asks to "chain vulnerabilities", "compose exploit chain", "correlate findings", "calculate real impact", "write bug bounty report", "combine findings", or has multiple vulnerability findi

Audit Model Context Protocol server configurations and apply least-privilege scoping. Covers MCP inventory, capability risk-tiering, secret detection in configuration, malicious or compromised package indicators, and the lifecycle from install through rotation to revocation. Invoke before granting an MCP write access to production, after an MCP security advisory, or as periodic audit.

Esta skill oferece melhores práticas de segurança e prevenção de vulnerabilidades para Golang, abrangendo injeção, criptografia, segurança de sistema de arquivos, rede, cookies, gerenciamento de segredos, segurança de memória e log. Use-a ao escrever, revisar ou auditar código Go para segurança, ou em código de risco envolvendo criptografia, I/O, segredos, entrada de usuário ou autenticação.

Use when working with non-admin groups that have pynchy_repo_access, understanding git worktree isolation, diagnosing uncommitted work left in a worktree after a service restart, or understanding post-run merge behavior.

Refresh expired Slack browser tokens (xoxc/xoxd) using persistent browser sessions. Use when Slack MCP tools fail with authentication errors.

Reverse engineer and security-test Telegram bots — API analysis, callback interception, exploit discovery, and vulnerability documentation

Add Telegram as a channel. Can replace WhatsApp entirely or run alongside it. Also configurable as a control-only channel (triggers actions) or passive channel (receives notifications only).

Debug container agent issues. Use when things aren't working, container fails, authentication problems, or to understand how the container system works. Covers logs, environment variables, mounts, and common issues.

Smart contract security patterns, vulnerability prevention, gas optimization, and audit preparation for Solidity development. Use when writing, auditing, or hardening smart contracts against reentrancy, overflow, access control, oracle manipulation, and front-running attacks.