Security

domehahn Bundle

Design and generate unit, integration, regression, security, and end-to-end test strategies.

domehahn Bundle

Review AI-assisted changes before execution for automation boundaries, human approval, affected-system criticality, and audit evidence.

domehahn Bundle

Review evidence, approvals, tickets, logs, test protocols, risk decisions, versioning, and accountable owners.

domehahn Bundle

Review GitLab Security Policies, OPA/Rego, Kyverno, Conftest, Sentinel, admission policies, compliance pipelines, and central guardrails.

domehahn Bundle

Review automated repair actions for safe limits, dry runs, approval modes, rollback, audit logs, blast radius, and loop protection.

domehahn Bundle

Review Dockerfiles, base images, user rights, capabilities, SBOM, image signing, distroless or slim images, CVEs, and runtime hardening.

domehahn Bundle

Link requirements, controls, implementation, tests, tickets, and evidence into an auditable trace.

domehahn Bundle

Create and maintain ADRs with context, decisions, alternatives, risks, security impact, compliance relation, and review points.

jmagar Bundle

Create a sourced investigation, audit, benchmark, comparison, incident-analysis, or research report in the personal knowledge base. Use when the user says "write a report", "document the investigation", "capture the audit", "summarize the benchmark", or needs conclusions that are broader than a session or maintenance log. This skill writes a report from observed evidence and never performs unrelated remediation, commits, or publishes it.

jmagar Bundle

Audit the current Git checkout, open worktrees, local branches, stale or merged cleanup candidates, merge readiness, conflicts, PR/CI/test state, blockers, and safest merge order. Use when the user asks for repo status, branch/worktree cleanup candidates, stale branch review, conflict investigation, merge readiness, or what must be done before open branches can merge.

jmagar Bundle

Drive Microsoft Sysinternals CLI tools on a remote Windows machine over SSH — list/kill processes (pslist, pskill), inspect open handles (handle), audit autoruns (autorunsc), check TCP/UDP connections (tcpvcon), verify file signatures + VirusTotal (sigcheck), audit permissions (accesschk), find alt data streams (streams), measure disk usage (du), check who's logged in (psloggedon), and run remotely (psexec). Use whenever the user wants kernel-level handle inspection, signed-binary process control under EDR, autorun forensics, file signature verification, security/permission audits, or anything from Mark Russinovich's suite. Sibling to the nircmd / NirSoft skill — prefer Sysinternals when the answer needs Microsoft-signed tooling (works under stricter AV, deeper system access) or covers kernel handles, autoruns, or signature/permission audits. Defaults to `ssh steamy-wsl` and `C:\tools\sysinternals\`; override via `SYSINTERNALS_HOST` and `SYSINTERNALS_DIR` env vars.

h-mmer Skill

Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast <repo_path> [--lang c|cpp|rust|java|python|go|php] [--min-score 4] [--max-files 30] [--skip-static] [--best-of N]

h-mmer Skill

Record a platform response and update learning. Usage: /learn <report_id> <status> [--bounty 500] [--vuln-type XSS]

h-mmer Skill

Check if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck <vuln_type> e.g. /dupcheck XSS in search endpoint

h-mmer Skill

Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.

h-mmer Skill

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

francostino Skill

Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

apache Bundle

Read-only audit of GitHub Actions workflow runner compatibility for one repository, an explicit repository set, one Apache project with multiple repositories, or the full Apache GitHub org. Finds obsolete GitHub-hosted runner labels and macOS runner/tool architecture mismatches. Produces TSV evidence files; never edits workflows, opens PRs, or posts comments.

apache Skill

Read-only dependency vulnerability audit for one repository or a local checkout. Detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. Never modifies manifests or lock files and never opens update PRs.

apache Skill

For a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against `<upstream>`, draft the smallest fix for each finding. Re-runs the tool after each batch to confirm the findings are cleared. Produces a commit and a hand-back artefact; never opens a PR on autopilot or merges.

apache Bundle

Attempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from the user's fork, and updates the `<tracker>` tracking issue. Public PR content is scrubbed so it does **not** reveal the CVE, the security nature of the change, or any link back to `<tracker>`.

apache Skill

Run a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default branch), checks correctness, security, and project conventions, and returns a structured report to the developer. No state changes, no PR, no external writes — the report is the output.

apache Bundle

Synchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals and proposes label / milestone / assignee / field / draft-email updates — applying only what the user has explicitly confirmed. Suggests the next step in the handling process and prints the CVE allocation link when a CVE is needed.

apache Skill

Answer a newcomer's "how do I contribute here" question by grounding the response in `CONTRIBUTING.md` and the project's own docs. Classifies the question (setup / workflow / first-issue / out-of-scope), retrieves the relevant guide excerpt, and drafts a concise answer in the Agentic Mentoring teaching register. Routes out-of-scope questions (design, security, deprecation, architectural taste) to a human maintainer. Read-only; produces a draft answer text — no files are written and no comments are posted without the maintainer's explicit action.

apache Bundle

Assemble a per-release audit record from lifecycle artefacts (planning issue, vote thread, artefact list, promote revision, and announcement URL) and propose a PR appending it to the project's audit log. Read-only on every release surface; the only write is a PR the RM reviews and a committer merges.

apache Skill

Walk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: CVE tool link field, cve allocated label, status-change comment, CVE JSON. Chains into `security-issue-sync` afterwards to reconcile the rest of the tracker.

apache Skill

Read-only GitHub Actions workflow security audit for one repository, an explicit repository set, or a whole GitHub org. Runs `zizmor` to surface injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks. Produces a grouped, prioritised finding report; never edits workflow files, opens PRs, or posts comments.

apache Skill

Read-only license compliance audit for one repository or a local checkout. Checks that a LICENSE file exists, that a NOTICE file is present and complete when required by the declared license, and that source files carry SPDX-License-Identifier headers consistent with the project's declared license. Produces a grouped compliance report and proposes remedies for maintainer review. Never modifies any file.

apache Skill

Given an open good-first-issue on the configured `<upstream>` repo, explain it in beginner terms and sketch a concrete approach: which files to read first, what "done" looks like, and where to ask follow-up questions — without writing any code or fix. First runs an issue assessment to confirm the issue is open, non-security, and scope-clear. Then drafts the explanation for maintainer review. Read-only; nothing is posted without explicit maintainer confirmation.

apache Skill

Close an `<tracker>` tracking issue as invalid: apply the `invalid` label, remove the scope label, post a short closing comment, archive the item from the project board, and — for trackers imported from `<security-list>` — draft a polite-but-firm reply to the reporter on the original Gmail thread explaining the team's reasoning (extracted from the tracker's discussion). For trackers opened via `security-issue-import-from-pr`, the email-draft step is skipped per the *no outreach to the PR author* rule of that skill.

apache Skill

Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and regenerates the CVE JSON attachment so both finders land in `credits[]`.

jmagar Bundle

Use this skill when the user asks to check source files against the monolith policy, find oversized files, audit Rust function size, run a whole-repo monolith report, or verify staged changes stay under file/function size limits.

jmagar Bundle

Measure repositories or homelab configuration against canonical standards, distinguish documented policy from actual enforcement, produce a drift report, and optionally reconcile explicitly selected gaps. Use when the user says "align standards", "audit repo standards", "check fleet drift", "standardize the Rust repos", or asks whether repositories match the policies in the knowledge base. Default to audit mode. Apply changes only when the user explicitly requests implementation.

jmagar Bundle

Create, scaffold, develop, test, and package every supported Unraid plugin architecture: (1) an Unraid OS/webGUI plugin distributed as a .plg with dynamix .page UI, PHP/bash backend, flash-safe persistence, and reproducible packaging; or (2) an Unraid API plugin distributed as a NestJS/npm peer-dependency package exporting adapter and ApiModule/CliModule; or (3) a coordinated hybrid with classic host lifecycle plus API/GraphQL functionality. Use when a user asks to create, scaffold, develop, review, audit, explain, migrate, package, test, repair, or troubleshoot an Unraid plugin implementation; build a .plg; add an Unraid Settings page or host service; create an Unraid API plugin; extend @unraid/api; inspect an existing plugin's architecture or build workflow; or coordinate a hybrid plugin. Do not use for Community Applications metadata, listing, moderation, or submission alone; use submit-unraid-community-app after the plugin itself works.

jmagar Bundle

Create a factual homelab maintenance record for live infrastructure, hosts, services, networking, storage, security, deployments, upgrades, migrations, repairs, audits, and routine operations. Use when the user says "write a maintenance log", "log this homelab work", "document the deployment", "record this repair", or when wrap-session routes a session containing live operational changes. This skill writes the maintenance artifact only and never commits, pushes, deploys, restarts, or changes infrastructure.

brucevanfdm Bundle

Rule matrix negative fixture - plain text file with .pdf extension marker; not intended for production deployment.