Security

yaniv-golan Bundle

Verify numerical equivalence of two EML trees (interior samples + branch-cut probes), search for shorter trees via witness-swap peephole, or enumerate shortest trees bottom-up via beam search with function-hash deduplication, meet-in-the-middle complement lookup, backward goal-propagation priority population, and optional library-witness seeding. Use when a user wants to confirm two EML trees compute the same function, audit whether a subtree collapses to a known library entry (exp, ln, e, add, mult, sub, pow, neg, inv), or rediscover the shortest EML witness for a named claim (exp, ln, e, mult, sub, neg, inv, simple composites) within a K budget up to K=17. Produces delta-K, equivalence verdict with branch flags, or best-K tree with per-K candidate counts.

hugoduncan Skill

Use gordian to analyse Clojure code structure at namespace and executable-unit level. Invoke when asked to audit architecture, assess coupling, identify hidden dependencies, interpret suspicious namespace pairs, review test structure, compare architectural snapshots, inspect a subsystem, find local cyclomatic/LOC hotspots, or find local comprehension-burden hotspots. Produces structural, conceptual, change-coupling, local-metric, and local-burden signals plus triage and workflow commands.

larlarua Bundle

DeepAudit Finding overlay for source-code auditing with code-audit-main references, mandatory reading routes, and progressive WooYun disclosure.

gemini-cli-extensions Skill

Expert guidance for proactive threat hunting. Use this when the user asks to "hunt" for threads, IOCs, or specific TTPs.

haroontrailblazer Skill

Use when a video hides text in moving dots or noise — "ghost font" clips, motion-defined text, random-dot kinematograms, TV-static videos with a secret message, text readable only while playing but invisible in any paused frame, or the user asks what a ghost-font video says.

haroontrailblazer Skill

Use when a video hides text in moving dots or noise — "ghost font" clips, motion-defined text, random-dot kinematograms, TV-static videos with a secret message, text readable only while playing but invisible in any paused frame, or the user asks what a ghost-font video says.

kofiloski Bundle

Audit Apple-platform app code, configuration, metadata, release branches, or Git diffs for likely App Store Review, TestFlight, and notarization rejection risks. Use when someone asks "will Apple reject this?", "is this ready to submit?", "why was my app rejected?", or requests an App Store preflight for iOS, iPadOS, macOS, Mac Catalyst, watchOS, tvOS, or visionOS. Trigger for Info.plist permission strings, PrivacyInfo.xcprivacy and required-reason APIs, entitlements, tracking and App Privacy answers, StoreKit paywalls, subscriptions and restore flows, external purchase links, Guideline 4.8 or social login, account deletion, UGC moderation, screenshots, review notes, demo access, and target-specific pull request changes. Run the deterministic scanner, verify findings in context, and report file-backed fixes without promising approval.

sockudo Skill

Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.

irahardianto Skill

Generates technical implementation plans and architectural strategies that enforce the Project Constitution. Use when designing new features, starting implementation tasks, refactoring code, or ensuring compliance with critical standards like Testability-First Architecture, security mandates, testing strategies, and error handling.

yashhsm Bundle

Security vulnerability detection and variant analysis skill. Use when hunting for dangerous APIs, footgun patterns, error-prone configurations, and vulnerability variants across codebases. Combines sharp edges detection with variant hunting methodology.

beautsgo Skill

Book appointments at 1300+ top-rated Korean dermatology & plastic surgery clinics in Seoul, Busan, Jeju directly from your AI assistant. Supports laser, injection, Botox, skin boosters, double eyelid, rhinoplasty, anti-aging, acne treatment in Chinese/English/Japanese/Thai. Keywords: Korea medical tourism, Seoul skin clinic, Korean dermatology, plastic surgery Korea, 韩国医美预约, 韩国皮肤科, 韩国整形外科, 首尔美容院, 医疗旅游韩国, 韩国整容, 水光针预约, 肉毒素预约, 韩式双眼皮. 热门医院: 江南 — 梅宗德/Barog/JD皮肤科/hev赫熙/鹿美人/secret希瑞特/金泰拉/伊美芝/爱妮/美LAB/Oganacell奥嘉娜/reberry/Shinebom/ELEV/Pind/GD医院/ID医院/陶瓷医院; 明洞 — UMI优美/reberry/丹雅/lijin/可丽/daybeau/奥缇娜/本思; 弘大 — 罗薇lovae/凯特kate/丽诺芙/思丽本/可丽/本思/桔艺菲/mind; 东大门 — doctors/夏恩/德希尔; 清潭 — 伊瓷美/minit/jionu/ruby抗衰/antian; 圣水 — serene/melting/iris艾瑞诗/newlline; 光化门 — Heritique赫瑞缇/赫利缇可; 舍堂 — Essential艾森秀; 釜山 — 德佛斯特/JRYN/米米/丽诺博renovo/Star/奥纳比/本思/genius; 济州 — NowMedi/with皮肤科/4ever/miwoo整形/Wyne; 连锁 — 本思/daybeau/朵戈芙蒂/doctors/丽芬聚/Toxnfill/Barog/德希尔/reberry/cnp/you&i/gu/dayone/VSLINE/Kbeauty.

fracerqueira Skill

Use whenever the user wants to create, review, approve, reject, version, revise, supersede, undo, migrate, configure, audit, or fix the header/format of Architecture Decision Records (ADRs) via the `adrplus` CLI tool — including bringing pre-existing, hand-written ADR files into compliance with the adrplus schema, and managing adrplus's own plugin system (`adrplus plugins`/`sync`). Trigger on requests like "create an ADR for X", "approve this ADR", "supersede ADR 0001", "set up adrplus in this repo", "fix these ADR headers to match adrplus", "adjust our ADRs to the adrplus standard", "list/activate/install an adrplus plugin", or any mention of ADRs/architecture decision records in a repo that could use adrplus.

maester365 Skill

Write, validate, and document Maester security checks for Microsoft 365 tenants. Use when asked to create, edit, review, or debug a Maester Pester test file, its companion markdown documentation, or its tagging. Covers Graph API data retrieval, Add-MtTestResultDetail formatting, the tagging taxonomy (CIS, CISA, EIDSCA, ORCA, MT), helper function patterns, remediation guidance, Entra ID, Exchange, SharePoint, Teams, Defender, Conditional Access, and the validation checklist for new checks.

prismer-ai Skill

Cryptographic signing for every tool call with Ed25519 audit trail

rhino-ty Skill

UI 코드베이스를 인상이 아니라 숫자로 감사하는 방법. 지표를 세는 grep의 함정, 실제 렌더로 검증하는 절차, 배율 때문에 없는 버그가 보이는 스크린샷 함정, 그리고 판정을 기록해 같은 논의가 반복되지 않게 하는 베이스라인 구조를 다룬다. "UI 감사", "디자인 점검", "이 UI 측정해줘", UI audit, design audit, 레이아웃이 깨져 보인다는 요청에 사용. 무엇을 좋은 디자인으로 볼지는 정하지 않는다 — 그건 프로젝트 베이스라인이 정한다.

svedbg Skill

Старши експертиза по ТРЗ (труд и работна заплата) за България. Анализира ведомости, фишове за заплати, трудови договори, графици и присъствени форми спрямо Кодекса на труда, КСО, ЗДДФЛ и Наредбата за структурата и организацията на работната заплата. Използвай при работа с ведомост, рекапитулация, фиш за заплата, трудов договор, допълнително споразумение, график при СИРВ, осигуровки, декларация обр. 1 и обр. 6, МОД, МРЗ, извънреден труд, нощен труд, клас прослужено време, обезщетение при уволнение, удръжки и запори върху заплата, или когато потребителят иска проверка дали заплащането в дадена фирма е законосъобразно. Also use for English requests to audit or check a Bulgarian payroll, payslip, employment contract or shift schedule for compliance with Bulgarian labour, social-security and income-tax law, including checking Декларация обр. 1 or обр. 6 against the payroll.

wordpress Skill

Review the current branch against this repo's architecture, security, performance, cross-platform and test-coverage rules before opening a PR. Use when the user asks to self-review, review my changes, check my branch before a PR, or says they are about to open a PR.

yanacuti1121 Skill

Merkle Tree Audit

yanacuti1121 Skill

Dompurify Xss Prevention

aibot88 Bundle

Network Security Setup SOP

aibot88 Bundle

Sandbox Security Configuration SOP

fandhe-ai-agent-reference-skil Bundle

GitHub 公式ドキュメント リファレンス。 REST API、GraphQL API、GitHub Actions (workflow, jobs, steps, expressions)、 Webhooks、GitHub Apps、gh CLI、認証 (PAT / GITHUB_TOKEN / OAuth Apps)、 pull requests, issues, projects (Projects v2), releases, Codespaces, Packages, Copilot API, security (code scanning / secret scanning / Dependabot), activity (events / notifications)。

fandhe-ai-agent-reference-skil Skill

Conventional Commits 形式で GitHub PR を作成する。OWASP Top 10 のセキュリティチェック必須で、問題があれば PR 作成を中止。Summary/Test plan/Design を含む body を生成。「PR 作って」「プルリク」「`gh pr create`」などで使用。別リポジトリ (upstream) への貢献は contribute-skill。

fandhe-ai-agent-reference-skil Skill

GitHub Issue を読み込み、`_/local-plans/<issue-number>-<slug>.md` に詳細計画を作成して**ユーザー承認後**にコードを実装する。実装後はセキュリティレビュー (OWASP Top 10) → テスト実行 → Conventional Commits でコミット。Issue 番号や URL を渡された実装依頼、「Issue #N を実装して」「この Issue を着手」などで使用。

fandhe-ai-agent-reference-skil Skill

GitHub PR の CI ステータス (`gh pr checks`)・コード品質・セキュリティ (OWASP Top 10)・Conventional Commits 準拠をレビューする。`gh pr review --approve/--request-changes/--comment` でレビュー投稿も可能。「PR #N をレビュー」「PR レビューして」などで使用。ローカル diff のレビューには implement-review を使用。

seanspiesman Bundle

Security vulnerability detection patterns including OWASP Top 10, language-specific vulnerabilities, and remediation guidance. Load when reviewing code for security issues, conducting audits, or implementing authentication/authorization.

bouclem Skill

Audits .NET test mock usage by tracing each mock setup through the production code's execution path to find dead, unreachable, redundant, or replaceable mocks. Use when the user asks to audit mock usage, find unused or unnecessary mock setups, check if mocks are needed, reduce mock duplication or over-mocking, simplify test setup, or review whether mock configurations like ILogger/IOptions should use real implementations instead. Supports Moq, NSubstitute, and FakeItEasy.

bouclem Skill

Scan C# source files for hard-to-test static dependencies — DateTime.Now/UtcNow, File.*, Directory.*, Environment.*, HttpClient, Console.*, Process.*, and other untestable statics. Produces a ranked report of static call sites by frequency. USE FOR: find untestable statics, scan for static dependencies, testability audit, identify hard-to-mock code, find DateTime.Now usage, detect static coupling, testability report, static analysis for testability. DO NOT USE FOR: generating wrappers (use generate-testability-wrappers), migrating code (use migrate-static-to-wrapper), general code review, or finding statics that are already behind abstractions.

demerzels-lab Bundle

Security suite for OpenClaw agents.

demerzels-lab Bundle

Run a structured quality control audit on any codebase.

jclfocused Skill

Audit and improve SwiftUI runtime performance. Use for requests to diagnose slow rendering, janky scrolling, high CPU/memory usage, excessive view updates, or layout thrash in SwiftUI apps.

hnabyz-bot Bundle

Electron 33+ desktop app development specialist covering Main/Renderer process architecture, IPC communication, auto-update, packaging with Electron Forge and electron-builder, and security best practices. Use when building cross-platform desktop applications, implementing native OS integrations, or packaging Electron apps for distribution. [KO: Electron 데스크톱 앱, 크로스플랫폼 개발, IPC 통신] [JA: Electronデスクトップアプリ、 クロスプラットフォーム開発] [ZH: Electron桌面应用、跨平台开发]

demerzels-lab Bundle

Send and close SIGNL4 alerts using the SIGNL4 inbound webhook (team secret in URL).

demerzels-lab Bundle

Security

demerzels-lab Bundle

Manage application secrets with the Redshift CLI (https://redshiftapp.com) — decentralized, encrypted secret.

demerzels-lab Bundle

Transform an Android phone with IP Webcam into an intelligent Edge AI security system with OpenClaw.