Security

robomotionio Bundle

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.

robomotionio Bundle

Augments Trailmark code graphs with external audit findings from SARIF static analysis results and weAudit annotation files. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, cross-referencing Semgrep or CodeQL findings with call graph data, or visualizing audit findings in the context of code structure.

yejiming Bundle

Use this skill for security scanning: check transaction safety, is this transaction safe, pre-execution check, security scan, token risk scanning, honeypot detection, DApp/URL phishing detection, message signature safety, malicious transaction detection, approval safety checks, token approval management. Triggers: 'is this token safe', 'check token security', 'honeypot check', 'scan this tx', 'scan this swap tx', 'tx risk check', 'is this URL a scam', 'check if this dapp is safe', 'phishing site check', 'is this signature safe', 'check this signing request', 'check my approvals', 'show risky approvals', 'revoke approval', 'check if this approve is safe', token authorization, ERC20 allowance, Permit2. Covers token-scan, dapp-scan, tx-scan (EVM+Solana pre-execution), sig-scan (EIP-712/personal_sign), approvals (ERC-20/Permit2). Chinese: 安全扫描, 代币安全, 蜜罐检测, 貔貅盘, 钓鱼网站, 交易安全, 签名安全, 代币风险, 授权管理, 授权查询, 风险授权, 代币授权. Do NOT use for wallet balance/send/history — use okx-agentic-wallet.

baixuanzhu Bundle

Sa-Token（cn.dev33）Java 权限认证框架开发助手。 在 Java / Spring Boot 项目中开发任何登录、注册、登出、认证、鉴权、权限、角色、token、 会话管理、接口保护、路由拦截、SSO 单点登录、OAuth2.0、JWT、踢人下线、账号封禁、记住我、 二级认证、多账号体系、微服务网关鉴权相关功能时使用本技能——无论用户是否提到 Sa-Token （login / logout / authentication / authorization / permission / role / session / JWT / SSO / access control）。 项目依赖已含 sa-token（sa-token-spring-boot*-starter 系列，覆盖 SpringBoot 2/3/4 与 WebFlux 响应式变体）或代码出现 StpUtil / StpInterface / @SaCheckLogin / @SaCheckPermission / @SaCheckRole / SaInterceptor / SaRouter / SaSession 时必须使用本技能； 项目尚无任何认证框架时，先主动询问用户是否引入 Sa-Token 再开发。 不适用于：已使用 Spring Security / Shiro 的项目（不建议迁移）、纯 JWT 自实现方案、非 Java 语言。

aizech Bundle

Assesses medical image quality against clinical standards and identifies optimization opportunities. Use when user mentions "image quality audit", "artifact review", "dose analysis", "protocol deviation", "quality metrics", "diagnostic adequacy", or "technique optimization".

aizech Bundle

Monitors and improves radiology report quality through systematic audit and feedback. Use when user mentions "report quality review", "discrepancy audit", "report completeness", "addendum analysis", or needs quality assurance.

chonsong Skill

UX / usability audit — heuristic evaluation of INTERACTIVE UIs (not just visual polish). Load with design when a UI "feels off", "sucks to use", is hard to learn, needs an instruction wall, or before shipping an interactive tool/editor/app. Scores the RENDERED UI against Nielsen's 10 +...

chonsong Bundle

Supabase security and performance guidelines with Clerk authentication integration. Contains 40+ rules across 10 categories covering RLS policies, Clerk setup, database security, and more.

educlopez Bundle

Set up or audit GitLab project metadata hygiene (avatar, description, topics, badges, README) for Cinetic Digital's private client repos on gitlab.com. Use this whenever the user is starting a brand-new client project, asks to "configure" or "bootstrap" a GitLab project, wants project descriptions/tags/topics/badges set, mentions a project's README is missing/stock/hidden/needs improving, or asks what's missing / what should be set up on a GitLab repo. Also trigger when the user mentions a specific client project by name (e.g. a PrestaShop or Laravel repo) and asks about its GitLab page, its description, or wants it to "look proper." Works both for brand-new projects (apply everything from minute 1) and for auditing/fixing an existing one.

rweisssieker-xp Skill

Use when reviewing Power Apps, Dataverse, Dynamics, or Power Platform solution readiness for ALM, dependencies, environment variables, connection references, flows, security, and deployment planning. Produces review guidance only.

howarewoo Bundle

Use to explore a running web app in a real browser, reproduce confirmed bugs, and create sanitized, severity-ranked, non-authoritative diagnostic reports; use woostack-review for code diffs and woostack-audit for standing code. Report-only runs never mutate Linear, Plane, GitHub, or application source.

howarewoo Bundle

Initialize or repair a repository's .woostack workspace, diagnostic stores, non-secret policy, and safe Linear defaults. Guarded legacy migration is optional.

howarewoo Bundle

Use to audit standing code — an explicit file, directory, module, or whole repo at rest (not a diff) — from multiple angles, with optional exact verified read-only Linear, Plane, or GitHub context, code simplification, and production readiness. Synthesizes an all-added diff and drives woostack-review's swarm plus one evidence adjudicator, then writes a sanitized, non-authoritative diagnostic report under .woostack/audits/. Never mutates Linear, Plane, GitHub, or source, gates, posts, remediates, or merges. Invoke via /woostack-audit <target>.

mapletechlabs Bundle

Audit an already-instrumented project against Maple's OpenTelemetry conventions, report gaps per service, and fix them. Triggers on requests like 'audit my instrumentation', 'check my telemetry', 'review my OTel setup', 'why is my service map missing edges', 'is my Maple instrumentation correct'.

mapletechlabs Skill

Review a diff, PR, or specific file in this repo for OpenTelemetry *specification* compliance, grounded in the source-linked spec corpus at docs/otel-spec/ (snapshot v1.58.0). Triggers on requests like 'is this spec compliant', 'review this PR against the OTel spec', 'spec-review this diff', 'check my partial-success handling', 'are these retryable status codes right', 'does apps/ingest honor the OTLP spec', and on reviews of changes touching the OTLP server surface in apps/ingest (partial success, retryable set {429, 502, 503, 504}, protobuf Status bodies, gzip, OTLP/JSON encoding), self-instrumentation (apps/api tracer setup, apps/ingest/src/otel.rs, packages/effect-sdk), or consumers of span status / SeverityNumber / db.query.text (WarehouseQueryService, query-engine). Spec MUSTs and SHOULDs only — for Maple house conventions use maple-telemetry-conventions; for whole-project instrumentation audits use maple-audit; for general diff correctness use /code-review.

modest-curator478 Skill

AUTO-TRIGGER: Apply this skill when the user asks about auditing, cleaning up, reviewing, or improving their HubSpot instance. Trigger phrases include: "audit our HubSpot," "clean up HubSpot," "HubSpot is a mess," "inherited a HubSpot instance," "our workflows are broken," "deal stages don't make sense," "leads aren't routing correctly," "HubSpot hygiene," or any request to assess the health or structure of a HubSpot CRM. Also trigger when the user is starting a new role and mentions evaluating the existing HubSpot setup they inherited. Do NOT trigger for general HubSpot how-to questions or feature requests that are not about auditing an existing instance.

znlgis Skill

Audit code changes for security vulnerabilities before merging. Use when reviewing a diff/PR, hardening code, or the task mentions security, injection, XSS, SSRF, secrets, auth, deserialization, path traversal, or "is this safe?". Reports findings; never auto-fixes silently.

45ck Skill

Normalize UI terminology by creating a canonical glossary of nouns, verbs, statuses, and labels used across the system.

45ck Skill

Audit a prototype for cross-screen consistency in navigation, actions, states, patterns, and interaction rules.

45ck Skill

Audit all failure paths, edge cases, and non-happy-path states -- empty states, validation errors, permission failures, loading, undo, and recovery.

kunanonj Bundle

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output.

kunanonj Bundle

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

alsk1992 Bundle

VPS security auditing and hardening

alsk1992 Bundle

Token security audit via GoPlus API

amplitude Skill

Finds and analyzes Amplitude Session Replays to surface UX friction patterns across multiple sessions. Produces a ranked friction map showing where users struggle, hesitate, or abandon. Use when a PM or designer asks "where's the friction", "what's confusing users", "UX issues on this page", "why is this flow clunky", "audit the user experience", or wants qualitative evidence of usability problems in a specific feature or flow.

somnio-software Bundle

Execute a comprehensive, framework-agnostic SOC 2 readiness audit of an entire repository or application. Detects project type and stack at runtime and adapts evidence gathering accordingly. Inspects the whole project for observable evidence of AICPA Trust Services Criteria controls (Common Criteria CC1-CC9 plus the optional Availability, Confidentiality, Processing Integrity, and Privacy categories), organized around eleven control families (A-K). For every control it records a Status (met / partial / gap / organizational) with concrete evidence and an ownership lane (platform-auditable / organizational / client-CUEC), scores readiness per control family, lists gaps mapped to criteria references, and produces a prioritized remediation plan with an overall readiness score /100 and a readiness band. Read-only and evidence-based: never invents controls; absent evidence is a Gap; secret values are always redacted. Use when the user asks for a SOC 2 audit, SOC 2 readiness assessment, Trust Services Criteria revie

somnio-software Bundle

Execute a comprehensive, framework-agnostic AI Harness Audit. Scores how complete a project's AI coding harness is — CLAUDE.md, .claude/rules, settings.json permissions and hooks, commands/skills, custom agents, and the autotest-to-green-PR lifecycle — then returns a /100 score, a maturity band, and a prioritized action plan. Read-only: never modifies the audited repo. Use when the user asks to audit the AI harness, score their Claude setup, assess AI adoption maturity, or check how paved the quality path is. Triggers on: 'harness audit', 'ai harness', 'claude harness score', 'ai adoption audit', 'harness health'.

somnio-software Bundle

Execute a comprehensive, framework-agnostic ISO/IEC 27001:2022 readiness audit of an entire repository or application. Detects the stack at runtime and adapts evidence gathering accordingly. Inspects the whole project for evidence of an Information Security Management System (ISMS clauses 4-10) and Annex A controls (93 controls across 4 themes), organized into 11 auditable control categories. Records a Status and Owner/lane for every control, scores readiness per category, lists gaps mapped to Annex A references, and produces a prioritized remediation plan, a Statement of Applicability starter, and an ISMS clause coverage check - with an overall readiness score /100 and a readiness band. Read-only and evidence-based: never invents controls; absent evidence is marked a Gap. Use when the user asks to run an ISO 27001 readiness audit, an ISMS audit, an Annex A gap analysis, or an ISO compliance audit. Triggers on: 'iso 27001 audit', 'iso27001 readiness', 'isms audit', 'annex a gap analysis', 'iso compliance audi

somnio-software Bundle

Execute a comprehensive, framework-agnostic Security Audit. Detects project type at runtime and adapts security checks accordingly. Analyzes sensitive files, source code secrets, dependency vulnerabilities, and optionally uses Gemini AI for advanced analysis. Produces a severity-classified report. Use when the user asks to audit security, scan for vulnerabilities, check for secrets, or assess dependency risks. Triggers on: 'security audit', 'vulnerability scan', 'secret scan', 'dependency audit', 'security check', 'pentest', 'owasp'.

somnio-software Bundle

Execute a micro-level NestJS code quality audit. Validates code against live GitHub standards for testing, architecture, DTO validation, error handling, and code implementation. Produces a detailed violations report with prioritized action plan. Use when the user asks to check NestJS code quality, validate best practices, or review backend code standards. Triggers on: 'nestjs best practices', 'backend code quality', 'code review', 'nestjs standards', 'dto validation', 'error handling review'.

somnio-software Bundle

Execute a micro-level Python code quality audit. Validates code against live GitHub standards for typing, code style, function design, data validation, error handling, module structure, and testing. Produces a detailed violations report with prioritized action plan. Use when the user asks to check Python code quality, validate best practices, or review Python code standards. Triggers on: 'python best practices', 'python code quality', 'code review', 'python standards', 'type hints review', 'pytest review', 'pydantic validation'.

somnio-software Bundle

Execute a micro-level Flutter code quality audit. Validates code against live GitHub standards for testing, architecture, and code implementation. Produces a detailed violations report with prioritized action plan. Use when the user asks to check Flutter code quality, validate best practices, or review code standards compliance. Triggers on: 'flutter best practices', 'code quality', 'code review', 'flutter standards', 'architecture compliance', 'testing quality'.

timsmykov Bundle

Create and audit truthful, accessible, publication-ready scientific figures with Matplotlib, Seaborn, or Plotly. Use for figure design, multi-panel layouts, uncertainty and missing-data displays, color/contrast review, image metadata validation, and journal export planning.

timsmykov Bundle

Audit scientific claims, assumptions, causal language, bias, confounding, and evidence quality without drafting a formal referee report. Use for critical appraisal, evidence grading, or teaching claim evaluation; use peer-review for a manuscript review and statistical-analysis for new calculations.

cockroachlabs Bundle

Configures and enforces password policies on CockroachDB clusters including minimum length, complexity requirements, and hash cost settings. Use when strengthening authentication requirements, setting up password policies for a new cluster, or meeting compliance password standards.

databricks-solutions Bundle

Unity Catalog system tables and volumes. Use when querying system tables (audit, lineage, billing) or working with volume file operations (upload, download, list files in /Volumes/).