leaked-secrets
Use when reviewing client-side JavaScript, HTML source, or git history for exposed credentials, API keys, or tokens.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security
DevOps & Security skills
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
mixed-content
Use when reviewing an HTTPS page for resources (scripts, images, stylesheets, iframes) that are loaded over plain HTTP.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security
performance-budget
Use when reviewing CI configuration, bundle analysis workflows, or pull requests that add dependencies and assets. Distinguish bundle-size budgets from runtime budgets such as Lighthouse or Core Web Vitals so teams can enforce both.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security
permissions-policy
Use when reviewing HTTP response headers for defense-in-depth security hardening on any web application.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security
referrer-policy
Use when reviewing HTTP response headers for privacy hardening on any website that handles authentication, session state, or sensitive URL parameters.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security
right-to-erasure
Use when auditing account settings pages, privacy dashboards, or API routes to verify that a complete data deletion path exists for users.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security
session-cookie-flags
Use when reviewing server-side session management, setting up authentication middleware, or auditing cookie configuration in HTTP response headers.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security
stack-trace-exposure
Use when reviewing error handling middleware, API route handlers, or server responses for security-sensitive information disclosure.
☆73.22k repo stars⑂6.65k repo forks
DevOps & Security