dsh-skill-pack-security

In the author's own words, from each skill's SKILL.md.

• dependency-audit

  Dependency supply-chain audit: reading pnpm/npm audit output and exit codes, a license and poisoning risk checklist, and lockfile-drift detection commands. Use when the task requires auditing a project dependencies known vulnerabilities, license risks, suspicious packages, or lockfile consistency and writing a conclusion; installing/upgrading one dependency or plain feature work does not expand t…

  skills-en/dependency-audit/SKILL.md on GitHub (opens in a new tab)

• incident-response

  Security incident response for agent environments: a staged flow of classification, containment, evidence collection, recovery, and postmortem — covering secret leaks, prompt-injection triggers, dependency poisoning, and unauthorized actions, with command evidence for every step. Use when a DSH/agent environment shows a suspected security incident needing response and postmortem; not for day-to-d…

  skills-en/incident-response/SKILL.md on GitHub (opens in a new tab)

• prompt-injection-review

  Injection-surface review for agent projects: a checklist covering AGENTS.md, skill directories, tool descriptions, MCP sources, and web-fetched content, with data-versus-instruction distinction criteria and mitigations. Use when the review target is content that enters the model context and its injection risk must be assessed; code or configuration reviews unrelated to model context do not use th…

  skills-en/prompt-injection-review/SKILL.md on GitHub (opens in a new tab)

• secret-scan

  Credential/secret exposure audit: gitleaks and trivy full-history scan commands and arguments, false-positive alert tiers, the redacted-report spec, and the remediation flow ordered rotate → revoke → purge history → CI gate. Use for detecting secrets/tokens/passwords/private keys in a repository, investigating leaked history commits, judging whether scan alerts are real, or writing a leak report;…

  skills-en/secret-scan/SKILL.md on GitHub (opens in a new tab)

• security-audit

  Repository/software security audit overview: a staged flow of scope definition, asset inventory, risk tiering, item-by-item verification, and a report template, dispatching to the four specialist skills secret-scan, dependency-audit, supply-chain-review, and prompt-injection-review as needed. Use when the user asks for a whole-repo audit, an audit plan, or a consolidated multi-class findings repo…

  skills-en/security-audit/SKILL.md on GitHub (opens in a new tab)

• supply-chain-review

  Quick PR/new-dependency supply-chain review: dangerous install/postinstall script checks, typosquat name-similarity judgment, reproducible-build verification, each with false-positive criteria and a pass / request-changes / block three-tier decision threshold. Use when reviewing a PR that introduces new dependencies or when a quick verdict on new-dependency risk is needed; ordinary code review un…

  skills-en/supply-chain-review/SKILL.md on GitHub (opens in a new tab)

• threat-model

  Lightweight threat modeling for new features/systems: fix the target, scope and trust boundaries, asset inventory, per-asset STRIDE table, optional attack tree, mitigations and priority — producing a threat-model document ready for design review. Use for design-stage security review of new features/changes, mapping trust boundaries, or drawing attack trees; not for unrelated pure bug fixes, and t…

  skills-en/threat-model/SKILL.md on GitHub (opens in a new tab)

• vuln-intel

  Vulnerability intelligence lookup and triage: query commands for the four authoritative sources NVD/CISA-KEV/GHSA/OSV, response interpretation, and misjudgment criteria — turning a CVE/GHSA id into an evidence-backed verdict of "actively exploited? × does it affect this project?". Use when given a CVE/GHSA id to look up details and impact, to judge active-exploitation status, or to write a vulner…

  skills-en/vuln-intel/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reactive-resumeby reactive-resume A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Tr… 45.3k stars · 9 skills
• OpenVikingby volcengine Self-evolving Context Database for AI Agents. Unify Agent Memory, Knowledge RAG and Skills. 41.5k stars · 22 skills
• skillby anbeime 收录最全、更新最快的技能Skills商店：精选原创技能包（涵盖文档处理、内容创作、编程开发、机器学习、自动化工作流），全部打包好可直接安装使用！同时自动抓取GitHub上万个Skills项目，按分类、更新时间、Star数量整理。The most comprehensive an… 9.2k stars · 29 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 431k stars · 5 skills
• skillsby mattpocock Skills for Real Engineers. Straight from my .agents directory. 313k stars · 30 skills
• superpowersby obra An agentic skills framework & software development methodology that works. 312k stars · 15 skills