Factory Security Engineer
nonlinear-xyz/factory-kitUse to threat-model a feature, audit AI-generated code, design sensitive-data handling, or review auth/authz boundaries. Carries the factory's security conventions — KMS encryption at rest, BAA verification for PHI, safe URL redirects, admin-client bypass guardrails, in-memory rate-limiter caveats, read-only-by-default for AI-generated code, mandatory review queue, request tracing, audit logging at the mutation boundary. Outputs a threat assessment with concrete fixes, not generic OWASP boilerplate.
At a glance
This skill is for Legal and helps you threat-model a feature, audit ai-generated code, and design sensitive-data handling.
/plugin marketplace add nonlinear-xyz/factory-kit
/plugin install factory-security-engineer
Setup, runtime and requirements describe nonlinear-xyz/factory-kit, the repo this skill ships in.
securitycomplianceThreat ModelingPhiauditKms
Also in nonlinear-xyz/factory-kit
View the repoMotion discipline distilled across builds. Attention as a fixed per-viewport budget, figure/ground separation (calm the ground, load motion...
API conventions for both server actions and tRPC builds. Covers the decision between them, per-mutation Zod input schemas, central router co...
Use when designing or implementing API endpoints — server actions, tRPC procedures, REST routes for external consumers. Carries the factory'...
Auth and authorization conventions distilled across builds with three different auth stacks (Better Auth + orgs, Supabase Auth + RLS, Clerk)...
Use when wiring auth into a new project, switching auth providers, or adding role/org features. Carries the factory's auth conventions — the...
CI and pull-request review conventions. One canonical `.github/workflows/ci.yml` is the merge gate (typecheck, lint, test, build, claude-rev...
Close out a Linear issue — move to Done, add a closing comment, and clean up the local branch/worktree
Use to review a PR, diff, or recently-written code against the factory's conventions. Read-only — outputs structured review, not diffs. Carr...
Commit message and branch convention — Conventional Commits format with a Linear issue reference required in subject or body. Includes the c...
Database schema, ORM, and migration conventions across builds. Drizzle as default with domain-partitioned schema modules, shared `timestamps...
Use when designing or implementing data ingestion, CSV imports, time-series storage, Python services that sit alongside Next.js, simulation...
Data ingestion and pipeline conventions for projects that import CSVs, run simulations, or operate Python services alongside Next.js. Covers...
Other Legal skills
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use...
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's doc...
Meeting notes page — title bar with attendees, agenda checklist, decisions block, action items table with owners + dates, and a "next meetin...
An editorial-style poster — newsprint paper, dateline, oversized serif headline with a struck-through word and italic accent, a 2-column bod...
A standalone pricing page — header, plan tiers, feature comparison table, and an FAQ. Use when the brief asks for "pricing", "plans", "subsc...
Apple Human Interface Guidelines as 14 agent skills covering platforms, foundations, components, patterns, inputs, and technologies for iOS,...