Security

Use the project's specific technology stack including Next.js, React, TypeScript, Hono, PostgreSQL, Chakra UI, and Temporal for workflow automation. When setting up new features, choosing libraries, or making architectural decisions. When working on frontend code using React and Next.js. When implementing backend APIs with Hono. When working with PostgreSQL databases via Drizzle or Prisma. When styling with Chakra UI components. When implementing authentication with better-auth or workflows with Temporal. When adding dependencies or configuring build tools. This skill ensures technology choices align with the project's established stack.

Security tool command reference

Row Level Security policy templates for Supabase - multi-tenant patterns, user isolation, role-based access, and secure-by-default configurations. Use when securing Supabase tables, implementing RLS policies, building multi-tenant AI apps, protecting user data, creating chat/RAG systems, or when user mentions row level security, RLS, Supabase security, tenant isolation, or data access policies.

Implement comprehensive input validation on both client and server sides, using allowlists over blocklists, sanitizing user input, and providing specific error messages to prevent security vulnerabilities. Use this skill when writing validation logic for forms, API endpoints, function parameters, or any user input. Use this skill when implementing server-side validation to ensure data integrity and security, adding client-side validation for immediate user feedback, or sanitizing input to prevent injection attacks. Use this skill when working with form components, API route handlers, data processing functions, or validation schemas. Use this skill when defining validation rules for data types, formats, ranges, required fields, or business logic constraints across all application entry points.

Automate container image updates for Kubernetes workloads managed by Argo CD. USE WHEN configuring ArgoCD Image Updater, setting up automatic image updates, configuring update strategies (semver, digest, newest-build, alphabetical), implementing git write-back, troubleshooting image update issues, or working with ImageUpdater CRDs. Covers installation, configuration, authentication, and best practices.

Next.js 14+ development with App Router, React Server Components, Server Actions, client components, streaming SSR, metadata API, parallel routes, intercepting routes, TypeScript best practices, TanStack Query for data fetching, Zustand state management, shadcn/ui components, Tailwind CSS styling, authentication patterns, API routes, middleware, error handling, performance optimization, SEO, and production deployment strategies.

Guide for using Repomix - a powerful tool that packs entire repositories into single, AI-friendly files. Use when packaging codebases for AI analysis, generating context for LLMs, creating codebase snapshots, analyzing third-party libraries, or preparing repositories for security audits.

Complete guide to integrating Supabase with Next.js 13+ App Router, including authentication, database setup, Row Level Security (RLS), and common patterns for production apps. Use when starting a new Next.js project with Supabase, need authentication with social providers, or building apps with user-specific data.

Design and implement RESTful API endpoints with proper HTTP methods, status codes, and consistent naming conventions. Use this skill when creating or modifying API routes, endpoints, or server-side request handlers. When working on files in src/pages/api/, files containing API route definitions, files implementing REST endpoints, files handling HTTP requests and responses, server middleware for API requests, API authentication and authorization logic, and files defining API versioning strategies. When designing URL structures for resources, implementing query parameter handling for filtering/sorting/pagination, setting up rate limiting for API endpoints, or configuring CORS and API security headers.

Legacy onboarding skill. Now redirects to /login for unified authentication and identity setup. Maintained for backward compatibility.

Generate Better Auth user schema configuration with custom additional fields for user profiles. Use when implementing authentication, user profiles, or extending user data models with Better Auth. Automatically generates TypeScript types and database schema.

Implement payment integrations with SePay (Vietnamese payment gateway with VietQR, bank transfers, cards) and Polar (global SaaS monetization platform with subscriptions, usage-based billing, automated benefits). Use when integrating payment processing, implementing checkout flows, managing subscriptions, handling webhooks, processing bank transfers, generating QR codes, automating benefit delivery, or building billing systems. Supports authentication (API keys, OAuth2), product management, customer portals, tax compliance (Polar as MoR), and comprehensive SDK integrations (Node.js, PHP, Python, Go, Laravel, Next.js).

Helps an agent analyze application logs and identify security issues.

Implement JWT custom claims authentication for Supabase to reduce API database queries. Use when building Next.js API routes that need user authentication and authorization (role, company_id, facility_id). Embeds user metadata into JWT tokens to eliminate 40% of database queries per API request. Triggers when implementing authentication in API routes, optimizing Supabase queries, or setting up user session management.

Security auditing for Rust/WebAssembly applications. Identifies vulnerabilities,reviews unsafe code, validates input handling, and ensures secure defaults.Follows OWASP guidelines and Rust security best practices.

Comprehensive FastAPI development skill covering REST API creation, routing, request/response handling, validation, authentication, database integration, middleware, and deployment. Use when working with FastAPI projects, building APIs, implementing CRUD operations, setting up authentication/authorization, integrating databases (SQL/NoSQL), adding middleware, handling WebSockets, or deploying FastAPI applications. Triggered by requests involving .py files with FastAPI code, API endpoint creation, Pydantic models, or FastAPI-specific features.

Manage Jira tickets from the command line using jira-cli. Contains essential setup instructions, non-interactive command patterns with required flags (--plain, --raw, etc.), authentication troubleshooting, and comprehensive command reference. This skill is triggered when the user says things like "create a Jira ticket", "list my Jira issues", "update Jira issue", "move Jira ticket to done", "log time in Jira", "add comment to Jira", or "search Jira issues". IMPORTANT - Read this skill before running any jira-cli commands to avoid blocking in interactive mode.

Validate SOPS encryption on secret files before committing. Use when staging secrets, committing encrypted files, or checking if secrets are properly encrypted. Prevents committing unencrypted secrets.

Add and configure domains in Plesk Panel via API. Use when setting up new domains on Plesk servers remotely including hosting setup, PHP configuration, and Let's Encrypt SSL certificates. Works from any machine with network access to Plesk.

OPA pod security policies preventing privileged containers, restricting Linux capabilities, and enforcing security contexts in Kubernetes.