Security

tegnike Skill

ELYTH生活heartbeatのlive行動を判断・実行し、world guard/auditを通して読みやすいDiscordレポートを返す。

tegnike Skill

ELYTH/からくり発話やmemory proposalのsecret・cross-surface混入を検査する。

tegnike Skill

ELYTHとからくりワールド向けのworld行動判断・memory proposal・guard/auditを扱うHermes profile-local skill。

vigolium Bundle

Use when performing repository security analysis that combines application/attack-surface modeling and, depending on mode, advisory intelligence, static analysis, manual exploit-path review, false-positive elimination, PoC construction, and reporting. Applies to knowledge-base, lite, balanced, deep, revisit, and focused audit roles; the active command definition and engine remain the orchestration authority.

vigolium Bundle

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.

nvidia Bundle

Use when generating a Warp pre-release or release-candidate audit report from Towncrier fragments and release history.

nvidia Bundle

Use when auditing and recovering Warp changelog fragments, finalizing a release changelog, or synchronizing a tagged release back to main.

pproenca Skill

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".

purpleailab Bundle

Generates and validates Foundry PoC tests from attack scenario documents. Use when: (1) Audit Phase 3 invokes Skill(vigilo:poc) for each High/Medium finding, (2) A finding at .vigilo/findings/ needs PoC validation, (3) Converting attack scenarios into executable Foundry tests. Outputs: test/poc/{finding-id}.t.sol, .vigilo/poc/ validation logs.

purpleailab Bundle

Generates submission-ready audit reports from validated findings. Use when: (1) Audit Phase 4 invokes Skill(vigilo:report) after PoC validation completes, (2) Findings need to be formatted for Code4rena, Cantina, Sherlock, or Immunefi submission, (3) Generating executive summary or individual submission reports. Default format: Code4rena. Reads from .vigilo/findings/ and poc/.

zhizhunbao Skill

腾讯云鼎实验室出品，Skill安全审查工具。对用户指定的skill.md文件及其配套的文档、程序、脚本等进行全面安全审计，确保引用安全

soham407 Bundle

Thorough, user-invoked tech debt and architecture audit of the current codebase. Produces TECH_DEBT_AUDIT.md with file-cited findings, severity, effort estimates, and a required "looks bad but is actually fine" section. Use when the user asks for a debt audit, codebase health check, architecture review, or code quality assessment of an entire repo. Does not auto-invoke.

tommybez Bundle

When the user wants to research, profile, or analyze competitors from their URLs. Also use when the user mentions 'competitor profile,' 'competitor research,' 'competitor analysis,' 'profile this competitor,' 'analyze competitor,' 'competitive intelligence,' 'competitor deep dive,' 'who are my competitors,' 'competitor landscape,' 'competitor dossier,' 'competitive audit,' or 'research these competitors.' Input is a list of competitor URLs. Output is structured competitor profile markdown files. For creating comparison/alternative pages from profiles, see competitors. For sales-specific battle cards, see sales-enablement.

dmnote-app Skill

This skill should be used when the user asks about "dead code", "find dead code", "detect dead code", "show dead code", "dead code analysis", "unused functions", "find unused functions", "unreachable code", "identify high fan-out functions", "find complex functions", "code quality audit", "find functions nobody calls", "reduce codebase size", "refactor candidates", "cleanup candidates", or needs code quality analysis.

eszxcvfd Skill

Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.

fayazara Skill

Adding a new Cloudflare binding (KV, R2, D1, Durable Object, Queue, secret, or environment variable) to this TanStack Start + Cloudflare Workers project. Use this skill whenever the user asks to add a binding, connect a new Cloudflare service, wire up KV/R2/D1/Queues, add a secret, or set an environment variable. Also trigger when the user says things like "I need caching" (KV), "add file storage" (R2), "set up a queue", "add a secret for my API key", "I need a new D1 database", or "add an env var". This skill covers the exact wrangler.jsonc configuration for each binding type, the cf-typegen step to get TypeScript types, and the usage patterns for accessing bindings via `import { env } from "cloudflare:workers"`.

garden-co Skill

Use this skill when designing data schemas, implementing sharing workflows, or auditing access control in Jazz applications. It covers the hierarchy of Groups, Accounts, and CoValues, ensuring data is private by default and shared securely through cascading permissions and invitations.

ghosttypes Bundle

Production-ready Python DOs and DON'Ts for engineers. Covers code quality, type hints, error handling, async patterns, testing, security, performance, logging, and data validation. Use when writing Python code that needs to be production-ready, reviewing Python code, refactoring legacy Python, or answering questions about Python best practices. Targets Python 3.12+.

hoangnb24 Bundle

Convert accepted repository rules into the smallest repository-native mechanical validation with positive and negative proof and precise enforcement-level reporting. Use for requests to enforce architecture, reliability, security, or quality boundaries; prevent a documented violation from recurring; add structural guards; or turn accepted rules into validation. Do not use to infer or invent policy from conventions, code patterns, tests, defaults, or undocumented preferences.

hoangnb24 Bundle

Independently audit a brownfield onboarding transcript, operational map, or exact proposed documentation patch before application. Use when a fresh reviewer must verify an $onboard-repository first pass, distinguish environment-caused Unknowns from reasoning defects, score its safety and evidence gates, or run a narrow patch-admissibility decision for specific capsule-backed hunks. This audit is read-only and must not edit files, install tools, start services, create state, or trust the producer's self-score.

huzengyun3268 Bundle

Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to interact with external services. Security: The MATON_API_KEY authenticates with Maton.ai but grants NO access to third-party services by itself. Each service requires explicit OAuth authorization by the user through Maton's connect flow. Access is strictly scoped to connections the user has authorized. Provided by Maton (https://maton.ai).

iggmasterdev Skill

Map a feature, story, release, or system to the four Agile Testing Quadrants and produce a concrete test-coverage plan — what to test, who owns it, automated vs manual, when, and with which modern tools — that deliberately surfaces the test types teams forget (Quadrant 3 exploratory/UAT/usability and Quadrant 4 performance/security/reliability). Use this whenever someone asks what tests a feature needs, plans test coverage or a test strategy for a story or release, asks "am I missing any kinds of testing", wonders how to balance unit vs functional vs exploratory, or mentions the testing quadrants. Trigger even when the user only describes a feature and asks "how should I test this" — the quadrants are the right lens for a complete answer.

shenjingnan Bundle

安全审计技能，用于检查和修复依赖安全问题

snyk Skill

Deep verification of code changes before committing. Traces code paths, detects semantic changes, identifies code smells and security issues. Reads GitHub PR reviews to propose implementation decisions. Use before commits, after implementation, or when asked to verify/review changes.

spatie Bundle

Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.

vechain Bundle

Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks. Use when creating, scaffolding, editing, or reviewing `.github/workflows/*.yml`, reusable workflows, `action.yml`, or Dependabot config for GitHub Actions. Also use for full repository security audits ("audit my workflows", "harden this repo", "security scan", "pin actions to SHA"), secrets scanning with gitleaks and trufflehog, and pre-public-release security reviews. Enforce full 40-character commit SHA pinning, avoid `pull_request_target` on untrusted code, pass GitHub context into `run:` steps via `env:`, and set least-privilege permissions.

webmaxru Bundle

Authors, reviews, installs, and debugs GitHub Agentic Workflows in repositories, including workflow markdown, frontmatter, gh aw compile and run flows, safe outputs, security guardrails, and operational patterns. Use when creating or maintaining GH-AW automation. Don't use for standard deterministic GitHub Actions YAML, generic CI pipelines, or non-GitHub automation systems.

xllm-ai Bundle

Review code changes for quality, security, performance, and correctness following project-specific standards. Use when reviewing pull requests, examining git diffs, or when the user asks for a code review. This skill should be used proactively — when the user asks for a review without specifying commits, automatically detect the current branch and diff against the main branch.

yang985-cmd Bundle

Assemble and preflight evidence-backed mathematical-modeling competition papers in official Word, LaTeX, or PDF formats. Use when the primary request is template-compliant manuscript delivery, native equation handling, frozen-result insertion, format audit, or final page-by-page visual inspection.

yang985-cmd Bundle

Build and audit traceable quantitative plots and code-native modeling diagrams from existing modeling results. Use when the primary deliverable is a figure, diagram, figure bundle, or final-size visual QA rather than a complete modeling solution.

yang985-cmd Bundle

Audit existing mathematical-modeling data, backend ownership, experiments, innovation claims, results, constraints, reproducibility, and claim-to-evidence links. Use when the primary request is to check or validate an existing modeling project rather than solve a complete new problem.

yaniv-golan Bundle

Compile ordinary formulas (exp(x+y), x**y, ln(x*y), sin(x)+cos(x), sqrt(x*y), x/y, asin(x), atan(x), log10(x)) into EML trees, look up calculator-primitive witnesses (exp, ln, add, mult, sub, pow, neg, inv, div, pi, i, sin, cos, tan, sqrt, asin, acos, atan, log10), inspect arbitrary EML trees, or run one-shot compile-render to emit tree + diagram + audit + summary from a sympy expression. Use when a user wants to lower a sympy-parseable expression into the EML IR, ask "how many tokens does the mult witness take?", visualize a tree as Graphviz/Mermaid, convert between nested / RPN / JSON forms, read shape stats (K, depth, leaf histogram), or produce a shareable artifact bundle in one command. Every named elementary primitive has a stored tree; the only `needs_tree` entry is `apex` (the closure proof itself, not a callable primitive).

yaniv-golan Bundle

Verify whether a claimed EML tree really computes a stated elementary function. Use when a user presents an EML expression (nested eml(...) form or RPN) and asks "does this really equal sin(x)?" / "is this a valid witness for log10?", when auditing proof-engine witness trees, when checking a compiler's output against a reference formula, or when someone needs a branch-cut / removable-singularity audit with an interior-domain sampler. Produces a structured audit report (audit.json, audit.md, audit.blog.md) covering leaf set, shape stats, numerical agreement, branch-cut flags, and removable-singularity caveats. The `--format blog` option emits a self-contained README/blog-friendly markdown artifact with embedded Mermaid, K-context table, witness provenance, and a probe table. Handles complex arithmetic via principal-branch cmath.

kernel8901 Bundle

Standard Operating Procedures: Security Analysis Guidelines

lirantal Skill

A handful of commands available for code security, dependency security and other security audits using Snyk

lovstudio Bundle

Review and improve an existing BP outline, PPTX, PDF, or rendered slide set across investment logic, evidence, copy, charts, and visual quality. Produces a scored report, page-level revisions, and targeted regeneration instructions while keeping facts separate from assumptions. Trigger on "润色 BP", "审稿商业计划书", "PPT 不专业", "逐页检查", "改图表", "BP review", "polish pitch deck", or "audit investor deck".