MCP App StoreMCP App Store
from igmarin
Performs a focused security audit of Ruby on Rails applications: auth/authz checks, parameter handling, query safety, output encoding, file handling, and secret
The Security Check skill provides a structured security-audit workflow for Ruby on Rails codebases. It guides an agent through prioritized inspections (authentication & authorization first, then parameter handling, query safety, output encoding, file handling/network calls, and secrets/logging). The skill enforces a HARD-GATE ordering so that auth/authz findings are reported first and requires explicit "No issues found" statements where appropriate. Outputs are checklist-style findings with severity, attack path, affected file hints, and minimal mitigations.
Use this skill when reviewing Rails controllers, models, background jobs, or deployment artifacts for security issues. It's appropriate for post-PR reviews, pre-release audits, or triage of reported vulnerabilities. Trigger it when the input mentions Rails, controllers, params, SQL, file uploads, credentials, or security review.
Best used by code-aware assistants that can parse code snippets or repository context (Code-capable LLMs: Copilot/Code, Claude Code, Gemini code-focused agents).
Security-check is a pure-prompt security scanning suite that instructs AI agents to perform a 4-phase pipeline (Recon→Hunt→Verify→Report) covering 48 OWASP skills and 7 language-specific scanners. No bundled scripts — relies entirely on the agent's natural language capabilities. The SKILL.md is well-structured with clear triggers and a comprehensive skill taxonomy, but lacks error handling guidance, output format contracts beyond directory structure, and has no programmatic verification. Security score reduced for instructing agents to perform penetration testing and active scanning which could be misused without proper guards; no hardcoded secrets or destructive commands found.
Well-organized SKILL.md with good frontmatter. The 48-skill taxonomy is impressive but the actual depth of each check depends on the agent's knowledge — no checklists or reference files are bundled. The claim of '3000+ checklist items' and '7 language-specific deep scanners' isn't backed by any included data files. Would benefit from references/ directory with actual checklist content.
Reverse Engineer
Provides step-by-step guidance and best practices for binary reverse engineering: static analysis, dynamic tracing, disassembly, and documentation workflows for
Run Execute
Orchestrates execution of work items across modes (autopilot, confirm, validate) with scripted init/complete tooling, plan/test/report artifacts and strict gati
Sandbox0 Integration
Guidance and templates for integrating Sandbox0 sandboxing into AI agents — CLI/SDK patterns, templates, volumes, network policy, and deployment choices.
Clerk Vue Patterns
Vue 3 integration patterns for Clerk: composables, router guards, and Pinia auth store integration.
CTF Write-up Generator
Generate a concise, reproducible submission-style CTF writeup with a one-path solution script, metadata, and a short checklist for fast verification.
Codex Collab
Bridge Claude and Codex to run tasks, perform code reviews, and run background jobs for research or implementation workflows.
Cognitive Accessibility Specialist
Audits content, forms and authentication flows for cognitive accessibility (WCAG 2.2 / COGA) and gives prioritized remediation and plain-language guidance.
Azure External Attack Surface Management
Provides expert guidance for Azure External Attack Surface Management (EASM): quotas, configuration, integrations, and exporting inventory to analytics platform