Security

starforall Bundle

Use when auditing whether `docs/workflows/新项目开发工作流/` remains compatible under newer-version drift or an explicitly requested same-version full audit.

45ck Skill

secret-exposure-reviewer

45ck Skill

owasp-wstg-checklist-runner

tjboudreaux Skill

Apply proactive threat modeling, least-privilege design, and safety guardrails before delivering any code or infrastructure change.

45ck Skill

security-test-checklist-builder

minghou-lei Bundle

Heavy-ceremony orchestration for big work — research, planning, adversarial review, phased implementation, audit, delivery. Use when the user says "epic", "long task", "build this end to end", or wants a feature that runs all night.

coco-research Skill

Cross-phase audit of all outstanding UAT and verification items

conorluddy Bundle

Generate a paste-ready English (U.S.) App Store Optimization metadata file (ASO.md) for an iOS app by scanning its Swift/SwiftUI codebase. Produces App Name (30), Subtitle (30), Keywords (100), Promotional Text, Description, category recommendations, screenshot caption suggestions, IAP names, and a research-notes appendix grounded in the codebase. Use this skill whenever the user mentions ASO, App Store Optimization, App Store metadata, app store listing, app name, app subtitle, keywords field, App Store Connect copy, App Store keywords, app store description, promotional text, custom product pages, or wants help writing/auditing/improving the metadata for an iOS App Store submission — even if they don't say "ASO" explicitly. Also trigger when the user asks to prepare an app for submission, audit a listing for rejection risk, pick a category, or extract keywords from a codebase.

kalyvask Skill

Cuts opening sentences that recap what the recipient already knows about themselves, their company, or their own work. Implements Konrad's rule 2 ("begin with something they don't know — tell me a secret about the future") and Kramon's rule 4. Use when a draft opens with flattery, a summary of the reader's accomplishments, restating their stated thesis, or reciting biographical facts they already have. Triggers on "they already know," "rewrite the opener," "stop with the flattery," "first sentence is weak," "secret about the future," "tell them something new."

kong Skill

Use for Volcano server-side Functions and privileged or secret-bearing logic, including function invocation, generators such as QR codes or PDFs, outbound third-party APIs, orchestration, scheduled processing, and file or image processing.

linhanxin Bundle

DeepBlue Bastion (深蓝堡垒) team coordinator skill. Analyzes code quality, security, architecture, and coordinates expert agents (Atlas, Aegis, Ockham, BugHunter, Turbo, Pragmatic) dynamically using both sequential and parallel execution. Use when user needs code review, security audit, architecture assessment, code cleanup, performance optimization, feasibility evaluation, or legacy system maintenance requiring multi-expert collaboration, or any other code quality tasks.

jrittelmeyer Bundle

harness-audit

nanmicoder Bundle

Audit external compatibility between two DSH (DeepSeek Harness) versions and detect reverts, producing an upgrade-report directory; compares git tags with a source checkout, or published npm packages without one. Use whenever the user asks to check/compare/audit two DSH versions or whether upgrading is safe — e.g. "more changes or reverts in dsh-vX -> dsh-vY", "compare the breaking changes" — even with only two version numbers and no source location. Read-only outside the report directory; npm mode installs in isolation with --ignore-scripts.

nevenincs Skill

Record a new or changed costly decision after checking accepted decision coverage and sufficient Research, Reference, or Audit evidence.

nevenincs Bundle

Reconcile the ADR architecture corpus against the codebase and the feature lifecycle documents against the single-home-fact boundary. Use to audit ADR status and supersession, find ADR-vs-ADR, ADR-vs-code, and document-vs-document conflicts (restated grounding, displaced decisions, forked facts), and action them. Mechanical .vault/ hygiene is the CLI's job; this skill does the semantic reconciliation the CLI cannot.

nevenincs Skill

Audit planned work for safety, intent, and quality into a rolling audit record. Use at each point of the review cadence.

nishilbhave Bundle

Whole-codebase code quality audit system with 9 specialized sub-skills covering security, SOLID principles, architecture, error handling, performance, test quality, code smells, design patterns, and framework best practices. Produces a scored health dashboard (0-100 per category), severity-rated findings (P0-P3) with severity rationales, and copy-pasteable fix prompts; also does PR-style diff review vs a base branch. Strictly read-only — never modifies user code. Use when the user says "codeprobe", "audit", "full code review", "code health", "check my code", "security scan", "code smells", "SOLID check", or asks how healthy, risky, or maintainable a codebase is. (For reviewing just the working diff, the built-in /code-review may be more appropriate unless the user asks for codeprobe.)

nishilbhave Skill

Audits code for test quality and coverage issues — missing tests, test smells, poor test structure, mock abuse, coverage gaps, and fragile test data. Identifies weaknesses in the test suite and generates fix prompts. Trigger phrases: "test quality", "test audit", "test review", "coverage check", "missing tests", "test quality audit".

nishilbhave Skill

Scans code for security vulnerabilities — injection flaws, authentication gaps, XSS vectors, mass assignment, CSRF, insecure deserialization, sensitive data exposure, broken access control, and misconfigurations. Generates severity-scored findings with copy-pasteable fix prompts. Trigger phrases: "security scan", "security audit", "vulnerability check", "find security issues".

nishilbhave Skill

Scans code for error handling and resilience issues — swallowed exceptions, missing try/catch on external calls, unhandled promise rejections, missing transactions, validation gaps, retry/timeout omissions, and logging blind spots. Generates severity-scored findings with copy-pasteable fix prompts. Trigger phrases: "error handling check", "exception audit", "resilience check", "try/catch review", "error handling audit".

b-open-io Skill

This skill should be used when signing messages, authenticating HTTP requests, or doing counterparty cryptography with a BRC-100 wallet. Covers BSM (Bitcoin Signed Message) signing, BRC-77 auth tokens for signed HTTP requests, deriving a counterparty's Type-42 public key (ECDH friend key), and encrypting/decrypting data for a counterparty. Triggers on 'sign message', 'BSM', 'Bitcoin Signed Message', 'auth token', 'BRC-77', 'signed request', 'friend public key', 'Type-42', 'ECDH', 'encrypt for counterparty', 'decrypt from counterparty', or 'shared secret'. Uses @1sat/actions signing module.

maddhruv Bundle

Diátaxis-driven documentation for AI coding agents: write, improve, or audit tutorials, how-tos, reference, explanation, and developer docs (README, CONTRIBUTING, ADRs). Detects the docs stack; gates on the outline before writing prose; verifies every claim against the code before it ships. Triggers on "absolute docs", "write docs", "write a tutorial", "write a README", "document this", "improve this doc", "audit our docs".

maddhruv Bundle

Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "security audit", "are we vulnerable", "scan for CVEs", "check for secrets/injection", "harden this".

nwiizo Skill

Production readiness audit - checks unwrap elimination, error handling, clippy, docs, channel usage, and test count.

octanejs Bundle

Audit one, several, or all existing Octane bindings; implement selected maintenance findings or remove redundant copied files with evidence matched to source ownership. Use for binding updates, lifecycle fixes, dependency or metadata maintenance, and convenience-import requests.

octanejs Skill

Audit or defend Octane performance. Use when a change can affect per-render, per-node, compiler-output, SSR, hydration, or bundle cost, or when asked whether something is fast enough.

open-mercato Skill

Migrate downstream Open Mercato code from 0.6.7 to 0.7.0 with exact TanStack, settings-group, and removed-env edits; audit auth, search, workflow, facts, Redis, webhook, and security-header changes; validate the app; and report manual work. Use for "upgrade Open Mercato to 0.7.0", "migrate 0.6.7 to 0.7.0", "apply the 0.7.0 upgrade notes", or "zaktualizuj Open Mercato do 0.7.0".

pipixia-labs Bundle

Observe OpenTeamwork Node health with usage, automation status, audit facts, logs, and quick diagnostics.

pmndrs Bundle

Design, classify, write, audit, or restructure technical documentation with the Diátaxis framework. Use for tutorials, how-to guides, reference material, explanations, documentation maps, README routing, documentation audits, or requests to separate mixed-purpose docs. Do not apply it automatically to internal plans, ADRs, research logs, or specifications unless the user wants those artifacts organized as product documentation.

stark-ai-de Bundle

Audit, review, clean up, and prune Codex memories. Use when the user asks about ~/.codex/memories, stale or noisy memories, memory pollution, cross-repo rule leakage, sensitive memory contents, memory config tuning, cleanup plans, or whether entries belong in memory, AGENTS.md, repo docs, skills, config, or deletion. Do not use for ordinary repo docs cleanup.

stempeck Skill

Audits a documentation file line-by-line against the actual codebase, proving every factual claim with source file and line number citations. Produces a structured evidence table, applies corrections for inaccuracies, then verifies corrections are themselves accurate. Use when a user asks to review, audit, refresh, or update a documentation file, or says a doc is outdated.

superdesigndev Skill

Traps when running Google Ads through treg — the API requirements and cleanup semantics that cost round-trips or money. Use whenever asked to analyse ad performance, audit spend, create or change campaigns, adjust budgets or bids, or do media buying.

iabstergo1 Skill

Run QA / audit / coverage checks on the published knowledge base or pre-save candidates, producing a report and Review-Queue proposals. Use when the user says "run a KB QA / audit coverage / spot-check evidence / run the Q-chain / check for concept pollution". Semantic-health words (L4, contradiction, Q2 added value) belong to wiki-lint-semantic and must not be hijacked here.

nvidia-ai-iot Bundle

Measure Jetson DRAM/NvMap usage and verify before/after memory reclamation with live audit data.

academind Bundle

Comprehensive, read-only code review skill for analyzing entire codebases or explicitly mentioned files. Use when asked to review code for logic bugs, type errors, security issues, performance problems, regressions, maintainability risks, or other user-specified focus areas. Prioritize a thorough, evidence-based report with file references and never modify code while reviewing.

academind Skill

Enforce web security and avoid security vulnerabilities. Use when handling user input, managing authentication/sessions, or other security-related tasks.