honorx12/VibeGuard

code-review-testing

Review code changes and test them: correctness, security-sensitive paths, AI-generated code scrutiny, regression tests and verification discipline. Use when reviewing a diff or PR or when remediation needs tests.

Quellsprache: Englisch

skill-supply-chain-review

Review third-party agent skills, rules and scripts before adoption: provenance, licence, hidden instructions, exfiltration, downloads and excessive permissions. Use before installing or copying any external SKILL.md, plugin or agent rule.

Quellsprache: Englisch

accessibility-responsive

Implement and verify accessibility and responsive behaviour: focus and hover states, skip links, mobile navigation, sticky headers, image alt text, colour contrast and mobile layouts. Use when building or reviewing UI components and pages.

Quellsprache: Englisch

consent-and-privacy-ui

Handle privacy and consent interfaces: cookie banner and preferences, UTM tracking, analytics configuration, privacy policy and terms drafting based on actual behaviour. Use when a site uses cookies, trackers, analytics or collects personal data.

Quellsprache: Englisch

forms-validation

Build and review forms: password visibility toggle, success and error states, confirmation dialogs, validation, and spam protection. Use when creating or auditing any user input form.

Quellsprache: Englisch

website-interactions

Implement optional site interactions: dark mode, site search, back-to-top, loading and skeleton states, scroll progress, copy-to-clipboard, print stylesheet, expandable FAQ and floating contact action. Use only when the feature fits the product's actual needs.

Quellsprache: Englisch

performance

Measure and improve page-load performance: Core Web Vitals, bundle size, image compression, caching and font loading. Use when pages are slow, before launch, or when adding heavy assets or scripts.

Quellsprache: Englisch

production-readiness

Run a pre-launch production-readiness review: HTTPS, custom 404, broken links, primary call to action, deployment checks and rollback planning, mapping every launch checklist item to a responsible skill. Use before releasing or handing over a website or web…

Quellsprache: Englisch

seo-metadata

Implement and verify SEO and sharing metadata: titles, descriptions, social preview image, favicon, sitemap, robots.txt, canonical URLs and accurate last-updated dates. Use when launching or restructuring a public site.

Quellsprache: Englisch

ai-agent-security

Secure AI-powered features and coding agents: prompt injection, unpermissioned AI access, invalid AI output and excessive AI permissions. Use when an LLM reads untrusted content, calls tools, runs code, queries data or generates HTML/SQL/URLs/commands.

Quellsprache: Englisch

api-access-control

Detect and fix object-level and tenant-level access problems in APIs: cross-user access, IDOR/BOLA, mass assignment, unsafe API inputs, poor tenant isolation and unsecured endpoints. Use when reviewing REST/GraphQL/RPC endpoints or multi-tenant data access.

Quellsprache: Englisch

authentication-authorization

Review and fix authentication and authorization: weak login, missing authz checks, admin routes, password reset, default credentials, MFA, account enumeration and client-only security. Use when building or auditing login, roles, admin areas or account…

Quellsprache: Englisch

cloud-config

Audit deployment and cloud configuration: open DB permissions, cloud misconfiguration, admin/debug exposure, verbose errors, exposed environments, logs, source maps, dashboards and DB roles. Use when reviewing IaC, hosting settings, Docker/Kubernetes config…

Quellsprache: Englisch

crypto-data-protection

Protect sensitive data: unencrypted data in transit or at rest, password storage, key handling and sensitive information leakage through responses, URLs, caches and analytics. Use when handling PII, credentials, payments or health/financial data.

Quellsprache: Englisch

dependency-supply-chain

Assess dependency and build supply-chain risk: vulnerable and malicious packages, insecure CI/CD, untrusted build actions and unpinned dependencies. Use when adding packages, editing workflows, building images or auditing lockfiles.

Quellsprache: Englisch

injection-prevention

Prevent injection and unsafe input handling: missing validation, SQL and NoSQL injection, command injection, insecure deserialization and path traversal. Use when code builds queries, shell commands, file paths or deserializes data.

Quellsprache: Englisch

logging-monitoring-backups

Establish audit logging, security monitoring and tested backups: missing audit logs, missing alerts, untested backups. Use when assessing operational readiness, incident detection or recovery capability.

Quellsprache: Englisch

payment-business-logic

Protect payment and business-logic integrity: frontend-only payment verification, workflow abuse and race conditions. Use when handling checkout, subscriptions, credits, coupons, inventory, refunds or any multi-step stateful workflow.

Quellsprache: Englisch

rate-limits-abuse

Add and verify rate limiting and abuse controls on login, signup, reset, OTP, search, costly and AI endpoints. Use when endpoints can be brute-forced, scraped, spammed or used to run up cost.

Quellsprache: Englisch

secrets-detection

Find and remediate exposed credentials: hardcoded secrets, public .env files, secrets in Git history, frontend bundles and logs, and exposed database credentials. Use when reviewing config, preparing a release, or after a suspected leak.

Quellsprache: Englisch

security-audit

Orchestrate an evidence-based security audit of a web app, API or AI-powered project: map trust boundaries, select specialist skills, rank findings, plan fixes, verify and report. Use when asked to audit, harden or review security of a codebase, or before…

Quellsprache: Englisch

session-jwt-oauth

Review sessions, JWTs and OAuth/OIDC: weak session management, weak or exposed JWT secrets and validation, and misconfigured OAuth. Use when implementing or auditing login sessions, token issuance or social login.

Quellsprache: Englisch

ssrf-cors-webhooks

Secure outbound requests, cross-origin policy and webhooks: SSRF, permissive CORS, unsigned webhooks, webhook replay and missing timeouts. Use when code fetches user-supplied URLs, configures CORS, or receives provider webhooks.

Quellsprache: Englisch

web-input-security

Secure the browser-facing surface: XSS, CSRF, file uploads, security headers, cookie flags, sensitive browser storage and open redirects. Use when building or auditing pages, forms, uploads, cookies or redirect logic.

Quellsprache: Englisch