Security

theheavenlyd3mon Bundle

Comprehensive security hardening for Hermes installations — fixes permissions, sets up secret scanning, configures macOS Keychain integration, creates security policies, and installs pre-commit hooks.

jsmastery-pro-skills Bundle

Run /audit on a greenfield project, an existing codebase with missing docs, or one area (/audit src/auth) to bootstrap the project's AI context, the AGENTS.md files every later skill reads. Writes tool agnostic AGENTS.md plus thin CLAUDE.md pointers, adding only what is missing; never overwrites curated content.

sergebulaev Skill

Repurpose existing content into a native LinkedIn post. Take a tweet, thread, YouTube video, blog, or newsletter and rebuild it for LinkedIn: re-hook before the fold, expand to the 900 to 1300 char sweet spot, add whitespace and a CTA, move links to the first comment, run the humanizer, publish via Publora on approval. Not for writing from scratch (use linkedin-post-writer), not for auditing a draft (use linkedin-humanizer --mode audit).

sergebulaev Bundle

Draft a new LinkedIn post from scratch using one of 20 2026 hook formulas (anaphora, R.I.P., time-anchor, curiosity-gap, contrarian, controlled A/B, false-binary, and more) plus a founders-edition angle library, picked by engagement goal (comments, reposts, likes, saves). Runs the humanizer pass and schedules via Publora on approval. Use to write a post, find a hook or proven format, or get founder-specific angles. Not for reviewing existing drafts (use linkedin-humanizer --mode audit).

sergebulaev Bundle

Audit and rewrite a LinkedIn profile end-to-end for 2026: headline, About 7-step, Featured, banner, photo, Experience metrics, Skills, custom URL, recommendations. Triggers on "review my profile", "rewrite my headline", "fix my About", "optimize banner", "profile audit", "LinkedIn bio". Converts resume-style profiles to ones that convert 3-5x better.

noartem Skill

Remove unneeded Composer packages and assets to improve boot time, memory, and security surface

cacr92 Bundle

安全审查 Skill

microsoft Skill

Audit Teams channels across your teams — identify inactive channels, low‑engagement conversations, channels with no recent posts, and recommend cleanup actions.

nagisanzenin Bundle

[production-grade internal] Audits code for security vulnerabilities — OWASP top 10, auth flaws, injection, data exposure, dependency risks. Routed via the production-grade orchestrator.

neonwatty Bundle

Analyzes web apps for free-value trust-building opportunities — features, tools, and offerings that demonstrate genuine utility before asking for commitment. Use this when the user says "trust builder", "trust audit", "find free offerings", "free value analysis", "trust building opportunities", or "how can I build trust with users". Explores the codebase and live app, interviews the user about audience and goals, then generates a prioritized report with full mini-specs for the top trust-building features.

neonwatty Bundle

Audits web apps for resilience against unexpected user behavior — accidental, edge-case, and chaotic. Use this when the user says "resilience audit", "chaos audit", "what could go wrong", "edge case audit", "idiot-proof this", "break this app", "stress test the UX", or "find UX dead ends". Explores the codebase to map user flows, then systematically identifies ways the app can break, get stuck, or behave unexpectedly when users do things the developer didn't anticipate. Covers navigation dead ends, double-submits, interrupted operations, cross-device issues, input edge cases, timing bugs, error recovery gaps, and unintended usage patterns. Produces a prioritized report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.

neonwatty Bundle

Audits SaaS and usage-based web apps for adversarial usage patterns — accidental, opportunistic, and deliberate. Use this when the user says "adversarial audit", "abuse case audit", "idiot-proof this app", "find usage exploits", "business logic audit", or "how could users break this". Explores the codebase to map the economic surface area (pricing tiers, usage limits, free trials, costly resources), then generates abuse cases where user behavior — intentional or not — could break assumptions, bypass limits, amplify costs, or corrupt state. Produces a prioritized markdown report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.

sergebulaev Skill

Audit and rewrite a Facebook Page for 2026: Page name, username and vanity URL, profile picture and cover photo, Intro/About and category, the CTA button (Shop, Book, Sign Up, Contact matched to your goal), pinned post, tabs order, and contact/link fields. Triggers on "review my Facebook Page", "fix my Page about", "optimize my cover", "set my CTA button", "Page audit". Converts a default Page into one that turns a visitor into a follower or a lead. Not for writing Page posts (use fb-post-writer).

sergebulaev Bundle

Remove the AI-script tells viewers hear in a TikTok spoken script and caption: 2026 vocabulary by density, reveal bridges, staccato stacks, stacked triads, performed sincerity, written-not-spoken phrasing, "hey guys" filler; caps em dashes. Includes --mode audit pre-film check (hook, completion design, caption fit) and --mode profile. Not for beating AI detectors (no edit reliably does). Not for writing from scratch (use tt-hook-scripter). Keywords: humanize script, de-AI, audit before filming.

sergebulaev Skill

Repurpose content into a native TikTok script and caption. Take a LinkedIn post, blog, newsletter, or X thread that worked elsewhere and rebuild it as a spoken script: hook in the first second, every line sayable in one breath, open on the payoff, a trend angle where it fits, plus a caption, published via Publora on approval. Adapts content across platforms. Not for a fresh hook (use tt-hook-scripter), not the caption only (use tt-caption-writer), not auditing a script (use tt-humanizer --mode audit).

get-convex Skill

Manage Convex env vars / secrets (set, wire into actions, never hardcode). TRIGGER on an API-key/secret/env-var request.

sergebulaev Skill

Repurpose existing content into a native X (Twitter) post or thread. Take a LinkedIn post, blog, YouTube script, or newsletter and rewrite it for X: re-hook for the no-fold first line, refit to 280 chars or a thread, strip off-platform artifacts, run the humanizer, publish via Publora on approval. Not for writing from scratch (use x-post-writer or x-thread-builder), not for auditing a draft (use x-humanizer --mode audit).

sergebulaev Bundle

Draft a single tweet or short auto-thread for X (Twitter) using a 2026 X hook formula (one-liner contrarian, data-point, build-in-public, mini-list, relatable cold-open), picked by goal (replies, reposts, likes, bookmarks). Respects the 280-char limit (25,000 on Premium), runs the humanizer pass, and publishes via Publora on approval. Use to write a tweet from notes. Not for long threads (use x-thread-builder) or auditing a draft (use x-humanizer --mode audit).

sergebulaev Bundle

Build a long-form X (Twitter) thread (tweetstorm) using a 2026 thread formula (listicle-thread, story thread, curiosity-gap opener, how-I teardown), picked by goal (bookmarks, likes, reposts, replies). Structures tweet 1 as a promise plus open loop, paces one beat per tweet, and closes for the repost. Publishes via Publora, which auto-splits long content into a numbered (1/N) thread. Not for single tweets (use x-post-writer) or auditing a draft (use x-humanizer --mode audit).

sergebulaev Skill

Audit and rewrite an X (Twitter) profile end-to-end for 2026: bio (160 chars), display name with a searchable keyword, @handle, header image, pinned tweet, link, and location. Triggers on "review my X profile", "fix my bio", "rewrite my Twitter bio", "optimize my header", "pin the right tweet", "X profile audit". Turns a default profile into one that converts visitors into followers. Not for writing tweets (use x-post-writer).

sergebulaev Skill

Repurpose existing content into a native Instagram post. Take a LinkedIn, blog, YouTube script, or X tweet or thread and rebuild it for Instagram: a long piece becomes a carousel or a caption, re-hooked before the 125-char fold, off-platform artifacts stripped (X @-handles, link in bio), published via Publora on approval. Use to adapt content across platforms into Instagram. Not for writing from scratch (use ig-caption-writer or ig-carousel-planner), not for auditing a draft (ig-humanizer --mode audit).

sergebulaev Bundle

Draft an Instagram caption with the hook in the first 125 characters, a skimmable body, and one clear CTA, using a 2026 hook formula chosen by goal (saves, shares, comments, follows). Runs the humanizer pass and, on approval, publishes with the image or video you supply via the Publora media flow. Use to caption a single image or a Reel. Not for slide-by-slide carousels (use ig-carousel-planner) or auditing a draft (use ig-humanizer --mode audit).

sergebulaev Skill

Audit and rewrite an Instagram profile end-to-end for 2026: profile photo, searchable NAME field weighted with a keyword, @handle, bio (150 chars: value plus topic plus proof), goal-matched link, category label, story highlights, the first-9 grid, and up to 3 pinned posts. Triggers on "review my Instagram profile", "fix my bio", "optimize highlights", "profile audit". The whole follow decision happens on the profile header. Not for writing captions (use ig-caption-writer).

sergebulaev Skill

Audit and rewrite a YouTube channel end-to-end for 2026: name and @handle, banner (2560x1440 with the 1235x338 mobile/TV safe area), profile picture, About plus searchable keywords, trailer for non-subscribers vs featured video for subscribers, sections and playlist layout, watermark, links. Triggers on "optimize my YouTube channel", "rewrite my channel about", "fix my banner", "channel audit", "set my trailer". Converts a viewer into a subscriber. Not for writing a video title (use yt-title-optimizer).

nandkapadia Skill

Use when preparing codebase for production commit, removing dead code, cleaning debug artifacts, auditing security, or performing pre-merge cleanup passes

marckohlbrugge Skill

Build and review Rails webhook systems with safe delivery, retries, observability, and tenant-aware security controls. Use when adding webhook endpoints, outbound deliveries, retry logic, or webhook admin tooling.

marckohlbrugge Skill

Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.

awrshift Skill

Audit MEMORY.md against the memory discipline — oversized sections, settled multi-session patterns that belong in knowledge/concepts/, stacked chronicle blocks, stale entries. Produces a move plan as a table for approval, then executes the approved moves atomically. Use when the SessionStart hook reports a tripped cap, when PreCompact blocks on an oversized cache, or when the user says "/memory-kit:memory-audit", "audit memory", "проверь память", "почисти память". Refuses only when no cap is tripped AND no settled-pattern candidate exists.

awrshift Skill

End-of-session ritual — audit today's patterns against accumulated memory, propose promotions, refresh MEMORY.md, and write the session handoff. Use when the user says "/memory-kit:close-session", "закрой сессию", "закрываем", "we're done for today", "wrap up".

nasa-pds Skill

Analyze SonarCloud security issues and suggest triage decisions (SAFE/FIXED/wontfix/falsepositive) with explanations. Use when the user needs help reviewing security issues, making triage decisions, or understanding whether security hotspots/vulnerabilities are true positives.

sjunepark Bundle

Integrate Git branches deliberately: plan or dry-run merges, transplant work, resolve conflicts, or audit completed or in-progress merges.

vstorm-co Bundle

Review Python code for quality, security, and best practices

vstorm-co Skill

Systematic code review for bugs, security, style, and performance

jclfocused Skill

Audit and improve SwiftUI runtime performance. Use for requests to diagnose slow rendering, janky scrolling, high CPU/memory usage, excessive view updates, or layout thrash in SwiftUI apps.

morzecrew Bundle

Use when a branch, fix series, or document set of your own is finished and about to be merged or handed off, or when the user says "self-audit", "audit your work", or "check your own changes". Not for reviewing someone else's code, and not mid-flight.

nangongwentian-fe Bundle

Use after completing a non-trivial implementation and before final handoff, especially for public API/schema compatibility, database or migration work, authentication/security, deployment/configuration, concurrency or data integrity, algorithmic or control-flow complexity, cross-module refactors, runtime lifecycle, and rendered UI behavior. Make sure to invoke this skill even when the user asks only to implement or fix something and does not explicitly request review. Risk-classify the completed change, use a new isolated read-only subagent for review-triggering changes when delegation is allowed, otherwise perform and disclose a local fallback, verify findings, fix authorized in-scope defects, rerun relevant checks, and report residual risks. Do not use for planning, answer-only or diagnosis-only tasks, trivial text edits, mechanical formatting, or tasks with no implementation-artifact change.