Security

hetcreep Bundle

Testability and design decoupling canary — checks for tight coupling, lack of Dependency Injection (DI), hardcoded constructors, Single Responsibility Principle (SRP) violations, and mockability gaps. Triggers on keywords: "/testability-canary", "testability-canary", "testability audit", "decoupling". Use when refactoring coupling, introducing DI, or making code unit-testable.

stoica-mihai Bundle

Line-level code audit skill. Surfaces concrete, actionable findings — perf hotspots, error-handling correctness bugs, memory-shape problems, function-level complexity, and semantic coupling — that file-level architectural analysis cannot see. Use this skill when the user asks to audit code, find perf issues, hunt bugs, review error handling, do a deep code review, find what is slow, look for syscalls in loops, check memory footprint, or get specific `file:line — finding — fix` recommendations. Also trigger on "audit this", "review this code", "find bugs in X", "what's wrong with X", "deep review", "perf review", "look for correctness issues", "what can go wrong here", even when the user does not literally say "audit". Pairs with the companion `architectural-hotspots` skill — that one says *which files* to look at, this one says *what is wrong inside them*.

stoica-mihai Bundle

Line-level code audit skill. Surfaces concrete, actionable findings — perf hotspots, error-handling correctness bugs, durability / ordering bugs, memory-shape problems, function-level complexity, semantic coupling, and concurrency-primitive scope mistakes — that file-level architectural analysis cannot see. Language-agnostic. Use this skill when the user asks to audit code, find perf issues, hunt bugs, review error handling, do a deep code review, find what is slow, look for syscalls in loops, check memory footprint, or get specific `file:line — finding — fix` recommendations. Also trigger on "audit this", "review this code", "find bugs in X", "what's wrong with X", "deep review", "perf review", "look for correctness issues", "what can go wrong here", even when the user does not literally say "audit". Pairs with the companion `architectural-hotspots` skill — that one says *which files* to look at, this one says *what is wrong inside them*.

jsuvic Skill

Use to review a proposed change for correctness, security-sensitive behavior, readability, tests, performance when relevant, architecture and contract impact, and generated-file drift.

jsuvic Skill

Use to run a bounded security-review, patch, and retest loop that stops on green, on no diff, or on a repeated identical finding.

lu1sdv Bundle

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output.

joneqian Skill

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

yushui2022 Bundle

Plan, draft, audit, globally revise, format, and verify a formal mathematical-modeling paper after the Standard evidence gate passes. Use for the sole S7/S8 formal manuscript path, not for legacy micro-unit scaffolds.

yushui2022 Bundle

Plan, draft, audit, globally revise, format, and verify a formal mathematical-modeling paper after the Standard evidence gate passes. Use for the sole S7/S8 formal manuscript path, not for legacy micro-unit scaffolds.

jordanchoo Skill

Audit, diagnose, or optimize website loading and interaction performance, Core Web Vitals, and Lighthouse performance scores.

jordanchoo Bundle

Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security. Use for architecture and product selection, including when the user describes a need without naming a Cloudflare product; then find the relevant skill or documentation.

viewway Bundle

Systematic code review patterns covering security, performance, maintainability, correctness, and testing

dills122 Bundle

Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review.

dills122 Bundle

Review Playwright tests for quality. Use when user says "review tests", "check test quality", "audit tests", "improve tests", "test code review", or "playwright best practices check".

xiaolai Skill

Audit EOU specs for Foundry V2 faceted classification, authority limits, schemas, validation, failure modes, trace, blast radius, and responsibility ownership.

xiaolai Skill

Generate candidate EOU refactor options from an audit or incident. Does not apply changes directly.

xiaolai Skill

Audit the EOU Foundry itself for schema drift, self-approval risk, generation overreach, weak validators, and missing governance evidence.

xiaolai Skill

Audit a generated candidate EOU set for boundary quality, minimality, overlap, authority, operational value, and governance risk.

thesmokedev Skill

Auto-generate a professional, client-ready GEO service proposal from audit data. Creates a full proposal in markdown and PDF including executive summary, findings, recommended service packages (Basic/Standard/Premium), pricing, timeline, and terms. Use when user says "proposal", "proposta", "offerta", "preventivo", "generate proposal", or after completing a GEO audit for a prospect.

kunalsuri Bundle

Bootstrap the ai/ knowledge layer for a repo that has none — draft the MODULE_MAP, diagrams, and guide docs as [inferred] for a human to audit, touching no source code. Use when the maps are still placeholders or the user asks to cold-start, bootstrap, or onboard a repository.

defaultperson Bundle

Codex CLI variant. Compile a charter for Codex's native /goal command. Runs an Intake Compiler (11 fields), a diagnostic ladder (6 questions in 3 batches), classifies the goal, seeds per-kind anti-patterns, and emits a copy-pasteable native /goal command pointing at the on-disk charter (anti-patterns + completion audit live in the charter file). Strictly non-execution: never performs the user's requested work, never reads implementation files, never browses reference repos. Triggers: "goal-prep", "/goal-prep", "prepare goal", "intake", "compile goal charter", "подготовка цели", "интейк", "прогрев цели".

superinstance Skill

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

hoangsonww Bundle

Use this skill when you want Claude Code to audit this repository for docs-to-code drift, broken paths, stale scripts, inconsistent environment assumptions, or mismatches between implementation and operational docs.

kaggle Skill

Audit a game environment's README.md and AGENTS.md against its engine implementation (stale constants, unreachable caps, undocumented preconditions, wrong observation fields). Also use proactively after changing an environment engine that has sibling docs. The engine is the source of truth.

krkrkrr Bundle

Periodic dependency review for Node.js/pnpm projects — outdated package triage, security audit, update batching strategy (patch/minor/major), validation checklist. Run monthly or before major releases. Use when asked to review or update dependencies in a repo.

krkrkrr Bundle

Meta-skill for auditing and rewriting SKILL.md `description` fields per the agentskills.io optimizing-descriptions framework, layered with mizchi's two-track trigger policy (Meta = explicit-invoke-only, Project = pushy auto-trigger). Invoke ONLY when the user explicitly asks to "optimize a skill description," "audit descriptions," or "rewrite descriptions per agentskills." Do NOT auto-invoke after every SKILL.md edit; description tuning is a deliberate batch, not a per-edit reflex.

krkrkrr Bundle

One-shot helper for registering a utels.dev project and writing the returned ingest token straight into a wrangler secret. Use when wiring server-side error tracking for a Cloudflare Worker without leaking tokens through the shell.

coleam00 Skill

Performs a technical code review of recently changed files for bugs, security issues, and standards compliance, then writes a report. Use before committing, as a pre-commit quality gate.

nahisaho Bundle

security-auditor skill Trigger terms: security audit, vulnerability scan, OWASP, security analysis, penetration testing, security review, threat modeling, security best practices, CVE Use when: User requests involve security auditor tasks.

open-gsd Bundle

Deep code optimization audit using parallel specialist agents that hunt performance anti-patterns via pattern-based detection, avoiding anchoring bias. Covers DB queries, memory leaks, algorithmic complexity, concurrency, bundle size, dead code, I/O/network, rendering, caching, and build config. Use when asked to optimize code, find performance issues or bottlenecks, speed up an app, reduce latency, detect code smells, or run a performance/quality audit.

lqf0624 Bundle

Workflow-first research skill pack for computer systems, networking, and AI papers. Use when Codex needs to scope a paper or multi-paper program, design methods within a fixed topic, test novelty, map literature, plan and audit experiments, write and visualize results, simulate review, or prepare a submission and rebuttal for systems and AI venues.

lqf0624 Bundle

Experiment-planning skill for research papers in systems, networking, and AI. Use when Codex must design or audit baselines, metrics, workloads, ablations, statistical checks, scaling studies, sensitivity analysis, and failure tests so that a paper's claims are actually supported.

motormetrics Skill

Upgrade dependencies safely using pnpm catalog, checking for breaking changes, and testing upgrades. Use when updating packages, applying security patches, upgrading major versions, resolving dependency conflicts, or modernizing tech stack.

karlorz Bundle

Audit and improve CLAUDE.md files. Use when asked to check, update, or fix CLAUDE.md or project memory files.

marmelab Skill

Whole-repo audit for over-engineering. Like ponytail-review, but scans the entire codebase instead of a diff: a ranked list of what to delete, simplify, or replace with stdlib/native equivalents. Use when the user says "audit this codebase", "audit for over-engineering", "what can I delete from this repo", "find bloat", "ponytail-audit", or "/ponytail-audit". One-shot report, does not apply fixes.

metagalaxy-crystal Skill

使用可视浏览器自动完成 CoPaw 的钉钉频道接入。适用于用户提到钉钉、DingTalk、开发者后台、Client ID、Client Secret、机器人、Stream 模式、绑定或配置 channel 的场景；支持遇到登录页时暂停，等待用户登录后继续。