Security

quantumquirkxyz Skill

Design and review smart contracts — security, gas optimization, upgradeability, access control — with an adversarial review step.

swestash Bundle

Comprehensive security analysis — OWASP Top 10, auth/authz flows, injection vulnerabilities, data exposure, secrets detection, dependency CVEs, hardening recommendations. Reviews EXISTING code/config — design-time analysis of a system not yet built → threat-modeling.

swestash Bundle

Write project docs — README, contributing guides, API docs, changelogs, inline docs — and reconcile existing docs after a change made them wrong. Owns doc drift from the change in front of you; a repo-wide doc-rot audit belongs to technical-debt-review.

swestash Bundle

Strip AI slop from a branch diff before PR — judge each hunk against the surrounding file's conventions, remove without changing behavior, re-run tests. Removal only: hunting bugs → code-reviewing; structural improvement → refactoring; repo-wide audit → technical-debt-review; pruning tests → test-suite-design.

steipete Bundle

Read-only Google Drive sharing and permission audits with gog.

tenequm Bundle

Writes or audits READMEs against the Standard Readme spec. Use whenever the user asks to create, rewrite, improve, audit, or fix a README, or asks about README quality or structure - even if they never mention "standard readme".

u9401066-rootcause-mcp Skill

安全性審查技能

swestash Bundle

Engineer for regulatory and privacy obligations — GDPR/CCPA privacy-by-design, PII data mapping and minimization, retention and deletion (right to erasure), data subject requests, consent, SOC 2 controls (access, change management, audit logging). Triggers: GDPR, CCPA, SOC 2, HIPAA, compliance, privacy review, PII, personal data, data retention, right to be forgotten, DSR, audit requirements, are we compliant. Vulnerabilities in code → security-audit; attack analysis of a design → threat-modeling.

swestash Bundle

Evaluate, audit, and upgrade project dependencies — assess libraries before adoption, audit CVEs, plan major upgrades, resolve conflicts.

dragoon0x Skill

Audit ARIA attributes. Ensure proper usage without over-specification.

dragoon0x Skill

Comprehensive design quality report with specific findings per axis, line references, severity ratings, and fix instructions.

dragoon0x Skill

Audit visual density and whitespace balance across sections.

dragoon0x Skill

Audit nesting depth. Maximum 4 levels of visual containment.

dragoon0x Skill

Audit visual depth. Count distinct heading levels, weight differentiation, size ratios.

dragoon0x Skill

Audit all font-family, font-size, font-weight, line-height, letter-spacing across the codebase.

dragoon0x Skill

Find every color not in the palette or token system.

dragoon0x Skill

Map all layout patterns. Identify grid/flex, spacing, nesting depth, responsive breakpoints.

meaningfy-ws Bundle

The Meaningfy release lifecycle — semantic versioning policy (MAJOR/MINOR/PATCH + -rc.N pre-releases), GitFlow release/hotfix branches, changelog + GitHub release notes, semi-automated releases via release-please, publishing Python libraries to PyPI with Trusted Publishing (OIDC, no tokens), opt-in supply-chain hardening (signing/provenance/SBOM), and release governance (SECURITY.md, yanking, deprecation). Use when cutting, versioning, publishing, or documenting a release. Trigger on "cut a release", "bump the version", "publish to PyPI", "write release notes", "release branch / hotfix", "yank a bad release", "how do we version this", "set up the release workflow".

eroslifestyle Skill

Run a security audit on the codebase checking for common vulnerabilities. Use /security-scan for OWASP-style review.

bahayonghang Bundle

Create, advise on, or audit academic figures in four modes. advise profiles the data and recommends a chart type when none is fixed. journal-spec creates or reviews publication-ready figures for journal submission specs using matplotlib, seaborn, plotly, industrytslib, or the optional pubfig backend. from-data fills a named paper-style catalog with user data. from-image reproduces an uploaded paper figure as a matplotlib script and 300 dpi PNG. Use for 论文配图, 期刊图, 科研绘图, 审阅投稿图, 用某论文风格画数据, 复现这张图, a named catalog style, 不知道用什么图 / 选图 / 怎么展示这份实验数据, what chart should I use, 投稿前审计图的字号 DPI 与导出合规, pre-submission figure audit, or 参考图筛选 with AgentFigureGallery. An explicit journal target takes precedence over a style or reference image. Exploratory data checks with no publication goal, paper reading, and multi-paper synthesis route to their dedicated skills.

abagames Bundle

Explores a broad game-design space by generating structurally varied concepts, attacking obvious failures, mutating promising mechanisms, and returning a small set of distinct testable hypotheses without ranking speculative fun. Use for open-ended game ideation, mechanic-space exploration, game-jam concept search, or deriving multiple mechanical directions from a seed. Do not use merely to audit one existing concept or to choose among a supplied shortlist.

abagames Bundle

Audits a stateful game's specification, phase/state machine, implementation, presentation, and tests for scenario-specific omissions such as one phase missing an input alias, one actor skipping a rule, a state change lacking HUD feedback, an event lacking audio, or a lifecycle boundary failing to reset or freeze state. Use when a game mostly works but may contain unimplemented sibling cases, inconsistent behavior across phases or actors, or important rules with no concrete probe; scope the audit to behavior surfaces changed or plausibly reached by a cross-cutting mechanic, to named high-risk surfaces before release, or to a family implicated by repeated forgotten-case bugs. Do not use for a small isolated change already covered by a direct distinguishing assertion, and do not expand into unrelated behavior surfaces. Not for localizing an already-reproduced semantic divergence, validating an existing patch, measuring balance, or proving exhaustive correctness.

sgcarstrends Skill

Audit PostHog survey SDK features and version requirements

sgcarstrends Skill

Upgrade dependencies safely using pnpm catalog, checking for breaking changes, and testing upgrades. Use when updating packages, applying security patches, upgrading major versions, resolving dependency conflicts, or modernizing tech stack.

sgcarstrends Skill

Upgrade dependencies safely using pnpm catalog, checking for breaking changes, and testing upgrades. Use when updating packages, applying security patches, upgrading major versions, resolving dependency conflicts, or modernizing tech stack.

sgcarstrends Bundle

Guides Stripe integration decisions — API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, Treasury financial accounts, integration surfaces (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, restricted keys, webhooks, OAuth). Use when building, modifying, or reviewing any Stripe integration — including accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, creating connected accounts, or implementing secure key handling.

jefflyt Skill

Evaluate compliance for Mandate 2.4.2 (Secure Output Handling) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate compliance for Mandate 2.2.1 (AI Supply Chain Security) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate compliance for Mandate 2.3.5 (Secure Input and Goal Management) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate compliance for Mandate 2.4.5 (Context Isolation and Memory TTL) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate compliance for Mandate 2.4.3 (Prevention of Unintended Consequences) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate compliance for Mandate 2.3.3 (Human Verification for Critical Actions) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate compliance for Mandate 2.3.6 (UI Transparency and Manifest Validation) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate compliance for Mandate 2.4.7 (Restricted Execution and Function Banning) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.

jefflyt Skill

Evaluate static code indicators for Mandate 2.3.2 (Anomaly Detection). Use when assessing partial code-evaluable controls and producing a confidence-scored static finding package before requesting runtime/process evidence.

jefflyt Skill

Evaluate static code indicators for Mandate 2.4.1 (Resource Consumption Limits). Use when assessing partial code-evaluable controls and producing a confidence-scored static finding package before requesting runtime/process evidence.