Security

borkweb Skill

Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", "design polish", "does this look AI-generated", or "review the UI".

borkweb Skill

Eng manager-mode plan review. Lock in the execution plan — architecture, security, data flow, concurrency, diagrams, edge cases, test coverage, performance, observability, deployment. Supports Standard (per-section) and Quick-pass (grouped) pacing. Detects review context (git/PR, plan document, or hybrid). Walks through issues interactively with opinionated recommendations and produces a go/no-go readiness verdict. Use when asked to "review the architecture", "engineering review", or "lock in the plan". Proactively suggest when the user has a plan or design doc and is about to start coding — to catch architecture issues before implementation.

borkweb Skill

Deep plan review with four modes: SCOPE EXPANSION (dream big), SELECTIVE EXPANSION (hold scope + cherry-pick expansions), HOLD SCOPE (maximum rigor), SCOPE REDUCTION (strip to essentials). Supports Standard (per-section) and Batched (grouped) pacing. Detects review context (git/PR, plan document, or hybrid). Challenges premises, maps failure modes and concurrency risks, reviews architecture/security/performance/cost/deployment, evaluates API contracts, and produces structured outputs with error registries, diagrams, and a go/no-go readiness verdict.

borkweb Bundle

Developer experience plan review for developer-facing products (APIs, CLIs, SDKs, libraries, platforms, docs). Investigates developer personas, benchmarks against competitors, designs magical moments, traces friction points, then scores 8 DX dimensions 0-10. Three modes: DX EXPANSION (competitive advantage), DX POLISH (bulletproof every touchpoint), DX TRIAGE (critical gaps only). Use when asked to "DX review", "developer experience audit", "devex review", or "API design review". Proactively suggest when the user has a plan for a developer-facing product.

decocms Bundle

Create incident reports and post-mortems for platform issues. Supports both internal technical reports and client-facing communications. Use when documenting outages, security vulnerabilities, data leaks, performance degradation, or any production incident.

decocms Skill

Audit and fix the VTEX integration in @decocms/apps-start (TanStack Start). Covers cookie propagation (vtexFetchWithCookies, buildAuthCookieHeader), expectedOrderFormSections, salesChannel injection, HttpOnly cookie handling, Intelligent Search cookie generation, useCart/useUser/useWishlist hooks, and TypeScript validation. Use when reviewing vtex/ code quality, fixing authentication issues, debugging missing cart sections, or ensuring full parity with deco-cx/apps.

decocms Bundle

Perform a deep dive analysis of CDN metrics, cache performance, error rates, and traffic patterns for a Deco site. Use this skill to identify performance bottlenecks, optimize cache hit rates, and reduce error rates.

harshanandak Bundle

Forge DEV stage — implement an already-planned /plan task list into committed, test-backed code. Reads tasks.md + plan.md, then drives each task through a subagent TDD loop (implementer → spec-compliance reviewer → code-quality reviewer) with RED-GREEN-REFACTOR, HARD-GATE evidence checks, and a spec-gap decision score. Use when a plan and task list already exist and it is time to implement — triggers: "/dev", "start the dev stage", "build the tasks", "implement tasks.md test-first", "run the implementer/reviewer TDD loop", "write the code for the planned tasks one by one", "work through the task list with subagents". Per-task coding ONLY. Do NOT use for creating the design doc or task list (that is plan), for the post-build type-check/lint/security/test gate (validate), for pushing the branch or opening the PR (ship), for addressing PR review feedback (review), or for orchestrating several stages / taking an issue end-to-end to a merged PR (smith).

harshanandak Bundle

Forge PLAN stage — first stop when starting a NEW or unscoped feature. Sets up an isolated worktree up front, then runs one-question-at-a-time brainstorming for design intent, commits a design doc, does technical/OWASP/DRY + codebase research, and produces a TDD task list for /dev. Trigger on "let's plan X", "scope a new feature", "brainstorm before we build", "write a design doc", "break this into tasks", or "set up a worktree and task list before coding". Reach for this even when the ask sounds like only design or only scoping — plan owns intent → research → task-list setup as one stage. NOT for driving a feature to a merged PR (that is smith), NOT for implementing tasks that already exist (dev), NOT for a standalone deep-research pass into an approved design doc (research), NOT for reporting where work stands or what is stale (status), and NOT for everyday issue create/list/close or picking the next ready issue (issue-basics / triage-ready).

harshanandak Bundle

Forge VALIDATE stage — the pre-pull-request quality gate. Rebases the branch onto the current base branch, then runs type-checking, linting, code review, an OWASP Top 10 security review plus dependency scan, and the full test suite, demanding fresh passing output in THIS session before anything ships. Reach for this whenever a branch is code-complete and someone says: validate my changes, run the quality gates, run the pre-PR checks, type-check and lint before the PR, run the security scan, or run the full test suite before opening a PR — and for the literal `/validate` command or `bun run check`. This is the gate that runs AFTER code is written but BEFORE a PR exists, so discriminate carefully: it does not implement features or write tests (that is `/dev`), it does not push the branch or open the PR (that is `/ship`), it does not answer PR review feedback from Greptile / SonarCloud / CodeRabbit (that is `/review`), and it is not the post-merge CI health check (that is `/verify`).

harshanandak Bundle

SonarCloud deep-dive via its REST API: pull open issues (bugs, vulnerabilities, code smells), coverage/duplication metrics, quality-gate pass/fail with failed thresholds, security hotspots, and measure/analysis history for a whole project, branch, or PR, then return a ranked summary. Use whenever the user names SonarCloud or asks about code-quality metrics, technical debt, a red/failing quality gate, or static-analysis vulnerabilities/hotspots — e.g. 'why is the SonarCloud gate failing on this PR' or 'pull every BLOCKER vulnerability with file and line'. NOT for: the thin `/sonarcloud <query> <project>` slash command for a quick lookup (sibling 'sonarcloud'); replying to/resolving PR review threads across Greptile, CodeRabbit, or GitHub Actions ('review'); running local lint/type-check/test/security scans pre-ship ('validate'); implementing or patching a flagged issue ('dev'); or an external market/competitor report on SonarSource or DevSecOps vendors ('parallel-deep-research').

a-v-ershov Skill

Measure the built product's performance against the spec's quality-attribute scenarios — p50/p95 on the hot paths, throughput at the target load, asset weight and client render cost, query plans, the resource and cost envelope. Use in the release phase (run by release-product) or standalone once features are built. Read-only: it measures, reproduces the slow path and ranks what it finds, but never edits product code and never installs a profiler or load tool it wishes it had — an unavailable measurement is recorded as unmeasured, and tooling is setup-dev-environment's job. Files blockers and majors as rework tasks and writes .dev-skills/release/performance-audit.md.

fabioc-aloha Skill

Reviews a design or change for proportionate security controls, privacy boundaries, and safe Markdown-rendering practices without claiming external scans.

fabioc-aloha Skill

Reviews a knowledge, instruction, or skill library for purpose, coherence, duplication, gaps, maintainability, and evidence-based improvement proposals.

fabioc-aloha Skill

Assesses whether documentation or library content remains current and produces evidence-bounded, proposal-first update recommendations.

jsuvic Skill

Use to review a proposed change for correctness, security-sensitive behavior, readability, tests, performance when relevant, architecture and contract impact, and generated-file drift.

jsuvic Skill

Use to review a proposed change for correctness, security-sensitive behavior, readability, tests, performance when relevant, architecture and contract impact, and generated-file drift.

jsuvic Skill

Review exploit paths, secret exposure, unsafe permissions, injection, authentication and authorization, supply-chain risk, and data leakage.

qa-aman Skill

Rate any product, feature, or experience on the 11-star scale (Brian Chesky's Airbnb thought experiment). Use when user says "rate this experience", "11-star", "star rating", "experience audit", "how good is this", "experience rating", "product audit", "quality assessment", or wants to evaluate product quality and identify improvement paths. Also trigger when user wants to benchmark a feature, assess where a product stands, or map out what "great" looks like - even if they don't explicitly say "11-star".

qa-aman Skill

Audit feature specs against India's Digital Personal Data Protection (DPDP) Act. Use this skill when: - Writing or reviewing any feature that handles user data (especially children's data) - Auditing a spec's Personal Information section for completeness - Checking a feature against DPDP Act 2023 requirements - Preparing compliance documentation before engineering review - Verifying masking, retention, and consent policies are defined for all PII

ramboz Bundle

Cross-artifact consistency report for jig specs — a non-destructive six-category audit at CRITICAL/HIGH/MEDIUM/LOW severity, covering duplication, ambiguity, underspecification, principle violations, coverage gaps, and terminology drift. Auto-triggers when you say analyze this spec, check for inconsistencies, audit ADR vs spec drift, check whether the decision records still agree with the spec, cross-artifact alignment, find drift in this spec, or audit this spec for principle violations. Do not use for: pre-DRAFT ambiguity scanning (use `/jig:clarify` instead); structural frontmatter or slice-numbering validation (use `spec_lint.py` instead); spec-compliance review of a finished slice (use `/jig:independent-review` instead).

ramboz Bundle

Lightweight spec clarification scan for jig projects — a six-category ambiguity audit that asks up to five prioritized questions and appends them to the spec's `## Clarifications` section. Auto-triggers when you say clarify this spec, audit this spec for ambiguities, is this spec ready for review, find unknowns in this scope, surface what's still unclear or unspecified, scan for unanswered questions, or what's missing from this spec. Do not use for: spec-compliance review of a finished slice (use `/jig:independent-review` instead); cross-artifact consistency analysis or drift detection (use `/jig:analyze` instead); project-vision or architecture elicitation (use `/jig:vision-elicitation` instead).

ramboz Bundle

Run a static-analysis pass on a project — detect the ecosystem (Python or Node), drive its linter (ruff / eslint, plus advisory pyright/complexity/ prettier and a cross-ecosystem duplication signal) via the `health.py` helper, and act on the normalized exit code (0 clean / 1 findings / 2 no-linter). Auto-triggers when you say lint this, check code health, run the linter, ask is this code clean, ask any lint issues, or want a static analysis pass. Tools are resolved on PATH or run ephemerally via uvx / pipx / npx — it installs nothing. Defers to any other installed skill whose description identifies it as handling linting, static analysis, or code quality — prefer it over this baseline. Do not use for running tests (use `/jig:tdd-loop`), for security review (use `/jig:security-review`), for spec-compliance review of a finished slice (use `/jig:independent-review`), or for general PR craft review (use `/jig:pr-review`).

ramboz Skill

Team baseline for security review — a best-effort heuristic security pass over a diff or change-set. Auto-triggers for review this for security, any vulnerabilities here, security pass on this diff, is this code secure, check this for security issues, or security review this. Uses installed scanners when available; installs nothing. Defers to any other installed skill whose description identifies it as handling security review, SAST, or vulnerability analysis, including `adobe-security-*`; prefer it over this slim baseline. Do not use for spec-compliance review (use `/jig:independent-review`), general PR craft (use `/jig:pr-review`), or secret prevention (`jig-secret-scan`).

djalmajr Skill

Validates planning artifacts and reviews code for quality, consistency, and completeness. Use to lint planning documents (cross-references, dependencies, format) or to review changed code (security, coherence, scope, quality).

eugenezhangco-spec Skill

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

eugenezhangco-spec Skill

PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices.

zhnnky329 Skill

Audit whether the semantic evidence required by the active lean or submission profile exists and is current, without requiring one verbose artifact per skill or an arbitrary number of pass bullets.

zhnnky329 Skill

Map contest attachments to subquestions, audit and clean raw data, and emit one reusable data profile with quality, coverage, imbalance, concentration, and method-readiness evidence for downstream risk screening.

zhnnky329 Skill

Perform the final submission-level audit of mathematical-modeling workflow integrity, evidence quality, anti-fabrication, paper coherence, figures, references, and contest readiness after consistency and completeness audits pass.

klebersoncollab Bundle

Expert in the modern Python ecosystem with UV, focused on performance (Django/Async), security, and SDD v2.3.0 governance.

klebersoncollab Bundle

Expert level Django development focused on production architecture, security hardening, testing excellence, and deployment readiness.

archibate Skill

Review code for AI slop patterns. TRIGGER when user says "review for AI slop", "check for AI patterns", "clean up AI code", "audit AI-generated code", or "review AI slop".

krutikjain Bundle

Apply Android app security guidance around secrets, storage, network trust, exported components, and least privilege.

open-curiosity Bundle

Build and maintain a company knowledge base as a wiki of interlinked markdown notes in the workspace — a private, compounding Wikipedia. Use when the user wants to start or organize a knowledge base / wiki, ingest sources (URLs, documents, pasted notes) into it, ask questions answered from it, or audit (lint) it. Defines the wiki layout (SCHEMA / index / log / raw / pages), the frontmatter contract, [[wikilink]] conventions, and a deterministic lint script that catches broken links, orphan pages, index drift, and frontmatter problems.

robomotionio Bundle

Builds and queries multi-language source code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, and entry point enumeration. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, or building a code graph for audit prioritization. Prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.