Security

ai-driven-dev Bundle

Improve code across four axes (cleanup, performance, security, architecture) by scanning and fixing, or applying a pushed audit report. Use when the user wants to refactor, optimize, harden, or remove code. Not for read-only diagnosis or adding tests.

ai-driven-dev Bundle

Perform deep codebase analysis to identify technical debt, dead code, and improvement opportunities.

ai-driven-dev Bundle

Optimize code for performance and fix security vulnerabilities following OWASP guidelines.

ai-driven-dev Bundle

Toggle terse output mode with intensity levels (lite, full, ultra) so prose drops articles, filler, and pleasantries while code, quoted errors, and security warnings stay verbatim. Use when the user says "condense", "condense output", "be more concise", "shorter answers", "tighten output", "/condense", "/condense full", "/condense ultra", or "stop condense". Do NOT use for editing existing prose, summarizing a long document, or compressing source code (only output style is affected, not content).

stacksjs Skill

Use when reviewing code changes in the Stacks project — two-pass code review with critical issue detection, test coverage audit, and auto-fix workflow. Invoke with /stacks-review.

stacksjs Skill

Use when implementing security in Stacks — password hashing (bcrypt/argon2), app key generation, AES encryption/decryption, hash verification, rehashing detection, or security configuration (firewall, rate limiting, IP allowlists). Covers @stacksjs/security and config/security.ts.

jovanipink Bundle

Audit whether a web property, service, application, or major relaunch is ready for public use, separating repository checks from provider and live-runtime evidence. Use for launch checklists, release readiness, and go or no-go reviews.

jovanipink Skill

Review an exact code change for correctness, regressions, security, compatibility, test quality, and maintainability using the diff and repository evidence. Use before commit, pull request, merge, or release when the user wants findings rather than implementation.

jovanipink Skill

Analyze the blast radius of a proposed or completed change across callers, contracts, storage, jobs, clients, security, rollout, and operations. Use before review, merge, or release when downstream effects may be missed; do not substitute speculation for traced dependencies.

jovanipink Bundle

Audit whether exact source identity and expected values survive parsing or extraction, validation, persistence, and readback using source-cited oracles and mutation-sensitive tests. Use for end-to-end source-to-output fidelity claims; use test-quality-review for test-suite quality and authority-boundary-review for ownership architecture alone.

mrciphersmith Bundle

Comprehensive code review with 4 parallel agents: correctness/logic, security, performance, style/maintainability. Produces unified severity report (CRITICAL/HIGH/MEDIUM/LOW). Use for thorough PR reviews and pre-merge checks.

mrciphersmith Bundle

Use when a performance review is requested, checking for N+1 queries, unnecessary re-renders, memory leaks, missing indexes, large bundle imports, and synchronous blocking in changed code. NOT for security, logic correctness, style, or architecture.

mrciphersmith Skill

Use when: reviewing code for style, naming conventions, readability, and DRY violations — without touching logic, architecture, security, or performance. Covers "review style", "style review", "check naming", "check readability", or dispatched by review-orchestrator with --style flag. NOT for: logic bugs, architectural violations, security vulnerabilities, performance anti-patterns, or any finding that could cause a functional regression.

mrciphersmith Bundle

Use when a code-level security review is requested, checking for injection vulnerabilities, auth gaps, insecure cryptography, secrets, and OWASP Top 10 patterns in changed code. NOT for infrastructure, deployment, or dependency audits.

stacksjs Skill

Use when performing security analysis on a Stacks application — OWASP Top 10, STRIDE threat modeling, attack surface mapping, dependency audit. Requires concrete exploit scenarios. Invoke with /stacks-security-audit.

joabgonzalez Skill

Node.js quality patterns: observability, security, and graceful shutdown. Trigger: When reviewing Node.js service quality or operational readiness.

keyvaluesoftwaresystems Skill

Clarify material architecture decisions before an HLD is finalized. Generate feature-specific technical Grill questions, audit prior answers and contradictions, and collect grouped answers without drafting design prose.

keyvaluesoftwaresystems Skill

Clarify only material repository implementation decisions before one repo LLD is written. Audit existing answers, inspect the bounded implementation seam, and ask feature-specific questions in grouped native popups.

keyvaluesoftwaresystems Skill

Review the backend implementation — security, contract adherence, correctness, backward compatibility, rate-limiting, performance/scaling, migrations, test gaps, observability. Read-only; writes a review artifact. Front door for /backend-review.

keyvaluesoftwaresystems Skill

Implement an approved backend scope against the cross-repo contract, test-first, meeting the backend engineering standards (security, backward compatibility, rate limiting, idempotency, migrations, observability, performance). Edits code within the approved scope only. Front door for /backend-implement.

keyvaluesoftwaresystems Skill

PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices.

mrciphersmith Skill

Use when: reviewing code against Clean Code principles (Uncle Bob) and SOLID at the function/class level — meaningful names, small functions, single level of abstraction, argument count, error handling, DRY, comment quality, and SOLID (SRP, OCP, LSP, ISP, DIP) as applied to individual classes and functions. Triggered by: "review clean code", "check clean code", "Uncle Bob review", "SOLID review", "review --clean-code", or dispatched by review-orchestrator. NOT for: architectural layer violations (review-architecture), naming convention formatting (review-style), logic correctness bugs (review-logic), or security (review-security-code).

pixartseu Skill

Anti-AI-slop design skill with four explicit modes — build (new pages), audit (score existing UI against 57 slop-test gates), redesign (rebuild with a different fingerprint while preserving copy and IA), and study (extract design DNA from a URL or screenshot into a portable design.md). Use when the user says audit, redesign, or study, invokes Hallmark by name, or wants a greenfield page that does not look AI-generated. Includes 20 built-in themes and a pre-emit self-critique pass.

pixartseu Skill

Aesthetic-direction design skill: reads a brief, infers the right visual style and direction, and ships interfaces that do not look templated. Umbrella for concrete style variants — minimalist, brutalist, soft/premium-agency. Use when the user wants a particular vibe or aesthetic, or wants a landing page or portfolio to feel handcrafted and expensive. For explicit build/audit/redesign/study modes use hallmark; for data-backed tokens use ui-ux-pro-max.

pixartseu Skill

Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines. Use when writing unit tests, integration tests, or E2E tests; creating test strategies or automation frameworks; analyzing coverage gaps; performance testing with k6 or Artillery; security testing with OWASP methods; debugging flaky tests; or working on QA, regression, test automation, quality gates, shift-left testing, or test maintenance.

keyvaluesoftwaresystems Skill

Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.

keyvaluesoftwaresystems Skill

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

dobroslavradosavljevic Bundle

Build, review, debug, configure, migrate, or plan evlog TypeScript logging with current docs. Use for evlog, initLogger, createLogger, createRequestLogger, useLogger, log.set, createError, parseError, withEvlog, createEvlog, drain pipelines, Axiom/Sentry/PostHog/OTLP/fs adapters, sampling, redaction, catalogs, log.audit, createAILogger, client HTTP drains, @evlog/cli map/doctor/init, Nuxt/Next/Nitro/TanStack Start/Hono/Express/Elysia integrations, and wide-event observability.

dobroslavradosavljevic Bundle

Evidence-first research workflow for external web/source research and internal codebase investigation. Use when the user invokes $research, asks to research, investigate, audit what exists, compare options, understand current implementation, gather evidence, inspect docs, look up current facts, or answer repo-grounded questions before implementation. Prefer optional parallel agents for broad, separable research lanes such as external sources, codebase evidence, docs, risks, and competitor or alternative analysis.

tfcbot Skill

Audit a connected Zernio account's token and permissions.

francostino Bundle

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

francostino Bundle

Markdown project memory for AI agents. Use for decisions, architecture, conventions, monorepo scopes, `.lore/`, or `lore` commands; not native `/init`/`/compact` or generic init/compress/audit/query.

francostino Skill

Run read-only exposure checks for security advisories and write a structured local audit report.

njs14 Skill

Audit and update an existing verification workflow against current user-visible behavior while preserving scope, safety, and executable proof.

domehahn Bundle

Identify assets, trust boundaries, abuse cases, attack paths, threats, and required security controls.

domehahn Bundle

Review code vulnerabilities such as injection, path traversal, SSRF, XSS, deserialization, crypto misuse, and race conditions.