Security

dongzhigang13305312738-art Bundle

Submission cover-letter assistant for existing LaTeX manuscripts. Use to generate, optimize, align-check, preflight, and journal-fit-check cover letters against paper evidence, novelty claims, and target venue expectations. Also handles Chinese requests (写投稿信 / 致编辑信). Do not use for editing main.tex, full manuscript audit, bibliography search, or a job-application 求职信.

elder-plinius Skill

Triage and steward issues in BT6 research and support repositories, deciding whether to answer, reproduce, correct evidence, link work, design a feature, route security, implement, or close.

learnprompt Bundle

Repair synthetic MDX frontmatter when title, description, or sidebar.order drift from the frontmatter contract. Use for files that follow the same observable patterns proven in the receipts; do not use on private transcripts, secret-bearing material, or arbitrary YAML.

lyl1015 Skill

商业级视觉资产与网页(详情页/落地页)的审美与UX视觉审查：输出P0/P1/P2问题清单、可落地的样式tokens与改稿建议；可结合截图、URL与源码进行定位与修改。

mbackschat Skill

Produce a well-isolated bug-and-findings report for the dmtool CLI (a12-dmkits / A12 kernel) and save it to a folder the user picks. Use when a user hits an error, crash, internal error, or unexpected behaviour in dmtool, when they want to capture findings / DX friction / improvement notes, or when they ask to write or file a bug report against dmtool. Covers reading the result envelope (telling an internal tool error apart from a rejected input), shrinking to a minimal repro, an affected-vs-unaffected table, classifying genuine defects vs. your own input mistakes, a verbatim replay log, and a self-audit — then writing the report to a folder the user can upload or send however they like.

irahardianto Skill

Generates technical implementation plans and architectural strategies that enforce the Project Constitution. Use when designing new features, starting implementation tasks, refactoring code, or ensuring compliance with critical standards like Testability-First Architecture, security mandates, testing strategies, and error handling.

1mangesh1 Bundle

This skill should be used when the user asks to "scan for PHI", "detect PII", "HIPAA compliance check", "audit for protected health information", "find sensitive healthcare data", "generate HIPAA audit report", "check code for PHI leakage", "scan logs for PHI", "check authentication on PHI endpoints", "scan FHIR resources", "check HL7 messages", or mentions PHI detection, HIPAA compliance, healthcare data privacy, medical record security, logging PHI violations, authentication checks for health data, or healthcare data formats (FHIR, HL7, CDA).

1shot-api Bundle

Build an iframe-isolated, passkey-derived Ethereum wallet using the WebAuthn PRF extension. Use when the user wants to implement a passkey-based wallet, derive an EVM private key from a passkey without server custody, add a non-custodial wallet pattern to a web app, harden wallet key handling against XSS via an isolated iframe, or check whether a client platform supports the WebAuthn PRF extension. Covers PRF + HKDF → secp256k1 key derivation, LongBlob fallback for compatibility, cross-frame RPC via Postmate, and browser/OS platform support gating.

florianbruniaux Bundle

Audit Claude Code configuration to measure fixed-context token overhead and produce a prioritized action plan

moonweave-research Bundle

Prevents citation hallucination in academic writing. Invoke when: finding papers to support a specific claim; verifying/checking/auditing existing citations or DOIs; confirming whether a paper actually says what the user claims it says ('is that what the paper says?', 'did they actually show X?'); adding a citation by describing a paper ('add a citation for the paper where X'); running a pre-submission reference sweep. Do NOT invoke for: formatting references in APA/IEEE style, general topic explanations, citation style questions, or prose editing. Selects Quick Screen (seconds per paper) or Full Audit (source-depth claim check) automatically.

chaitin Bundle

Use when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability scanner (scan tasks, results, assets), CodeInsight (projects, repository configs, scan tasks, reports), CodeForce (projects, AI tasks, denoise, repositories), CloudWalker CWPP (events, vulnerabilities, assets), and T-Answer (semantic security operations for alarms, assets, policies, response actions, and Open API fallback).

codeacme17 Bundle

Audit, initialize, plan, and verify production launch readiness for an existing Web repository through the local LaunchRally CLI. Use when a builder asks whether a repo is ready to launch, wants a launch-readiness report, needs a read-only remediation plan or bounded Provider options, or wants to verify changes after remediation.

cosai-oasis Bundle

A CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.

dmlin7777777 Bundle

When a new idea arrives mid-development, classify it, assess destructiveness, audit consumers, and choose the lowest-impact integration path instead of rewriting.

jcdoll Skill

Reviews code for quality, security, and maintainability. Use after implementing features, completing significant work, or when user asks for code review.

aakash-dhar Skill

Scans code for security vulnerabilities including injection attacks, authentication flaws, exposed secrets, insecure dependencies, and data exposure. Use when the user says "security review", "is this secure?", "check for vulnerabilities", "audit this", or before deploying to production.

adewale Bundle

Create and improve README documents for GitHub projects. Use when the user wants to write a new README, improve an existing one, audit README quality, or asks about documentation best practices for their repository.

eooo-io Skill

Review code for correctness, maintainability, security, performance, and test quality.

google Bundle

Author, document, review, audit, or redesign unsafe Rust with proof-grade rigor. Use for unsafe blocks and functions, unsafe traits and impls, raw pointers, FFI, inline assembly, intrinsics, layout or validity reasoning, concurrency and atomics, SIMD and target features, allocators, invariant-bearing fields, safety comments or `# Safety` documentation, soundness reviews, TCB audits, generated unsafe code, changes to safety or behavioral contracts, and proof-oriented redesign of unsafe abstractions.

harumiweb Bundle

Unified ADR workflow for any repository. Use when Codex needs to determine whether a change needs an Architecture Decision Record, draft a new ADR or propose an update, lint or review an ADR draft, audit ADRs against docs/specs/tests/src for drift, or refresh ADR index artifacts in repositories that already define ADR indexing conventions. Trigger on requests about ADRs, architecture decisions, design rationale, issue/PR/diff policy changes, ADR review, ADR audits, or ADR index maintenance.

haydenbleasel Bundle

Keep a Blume docs site in sync with the product it documents. Audit recently merged pull requests, changelogs, config schemas, CLI help, and public APIs against the docs content, update only pages that are factually stale, verify the docs build, and open (or update) a maintenance pull request — or report a clean no-op. Use when asked to check docs for drift, refresh stale documentation, run a scheduled docs audit, or keep docs current after a release.

avdlee Skill

Review code for correctness, maintainability, and security risks. Use when preparing a PR or auditing a change set.

azizulhasan Bundle

Build WordPress plugins correctly and pass wp.org Plugin Directory review. Covers the full Plugin Developer Handbook (security, hooks, REST, shortcodes, blocks, CPTs/taxonomies, settings/meta, privacy/GDPR, users/roles, HTTP API, WP-Cron, JS/Ajax, i18n, readme/assets/SVN) and the 19 wp.org guidelines that cause closures (trialware, telemetry without opt-in, remote-loaded assets, missing source for minified files, wrong text-domain literal, missing REST permission_callback, vendored library collisions). Use when building a WordPress plugin or fixing a Plugins Team closure, preparing a submission, auditing compliance, responding to Plugin Check warnings, adding REST routes/shortcodes/blocks, registering CPTs/taxonomies/settings/meta, enqueuing scripts, wiring cron or activation hooks, translations, sanitizing/escaping, capability/nonce checks, or bundling PHP libs. Apply proactively on code under `wp-content/plugins/` or when you see `register_rest_route`, `add_shortcode`, `register_post_type`, `register_settin

b1rdmania Bundle

Tighten prose by stripping AI tics and applying Orwell/Gowers plain-English rules. Use when the user asks to rewrite, tighten, simplify, or detox writing — phrases like "plain English", "make this clearer", "cut the AI voice", "fix the writing", "rewrite plainly", "tighten this", "detox this". Also run as a self-audit pass before delivering long-form prose (essays, blog posts, articles, reports) so the output isn't recognisably AI-generated. Three modes: audit (flag + suggest), rewrite (deliver cleaned prose), edit (fix a named file in place). Technical documentation routes to the simple-english skill instead.

input-output-hk Skill

Writes and reviews GitHub Actions workflows with security hardening. Use when creating, modifying, or reviewing .github/workflows/*.yml or .github/actions/*/action.yml files. Covers shell injection prevention, trust gating for fork PRs, action pinning, and secrets hygiene.

jal-co Bundle

Decide whether an interface element should make a sound, which kind, how loud, and where the audio comes from (synthesis, recording, or generation). Also audits an existing UI: inventories every trigger, deletes the decorative ones, re-levels the rest, and finds the playback bugs. Use when adding sound to a UI, auditing or reviewing a UI that already has sound, deciding whether a silent UI needs any, choosing between synthesizing and sampling, levelling sounds against each other, or syncing audio to animation. Triggers on: ui sound, ux sound, sonic ux, audio feedback, micro feedback, earcon, auditory icon, notification sound, alert sound, hover sound, click sound, sound effect, sfx, should this have sound, audit sounds, sound audit, review the sound, too loud, sounds cheap, sound doesn't fire, sound plays twice, sound generation.

landco-llc Bundle

Audit software changes, pull requests, local diffs, or release candidates for target identity, scope, correctness, regression, security, evidence quality, and merge or release readiness. Use for independent audits, fixed-HEAD reviews, focused re-audits, docs-only audits, or verdicts such as PASS, CHANGES REQUESTED, BLOCKED, and NOT AUDITABLE. Do not use to implement fixes or perform a generic style-only review.

react-native-nitro-google-sign-in Skill

Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.

resciencelab Bundle

Audits and optimizes Convex application performance across hot-path reads, write contention, subscription cost, and function limits. Use this skill when a Convex feature is slow or expensive, npx convex insights shows high bytes or documents read, OCC conflict errors or mutation retries appear, subscriptions or UI updates are costly, functions hit execution or transaction limits, or the user mentions performance, latency, read amplification, or invalidation problems in a Convex app.

saeed-vayghan Bundle

Expertise in auditing and testing API endpoints. Use when the user asks to "check", "test", or "audit" a URL or API.

lirantal Bundle

Builds a Claude Code statusline from scratch or extends an existing one. A statusline is a live status bar that runs a shell script after every Claude response and displays data — security scans, git status, API quotas, build state — directly in the session. Use this skill when the user says "create a statusline", "make a statusline for X", "add X to my statusline", "show Y in the status bar", "build a statusline plugin", or "I want live data in my Claude session". Trigger even if the user just describes wanting live feedback during a Claude session without naming "statusline" explicitly. The skill drives from idea to a working, installed, tested statusline without requiring the user to direct every step.

liustack Skill

Audit product texts (skills, references, READMEs, rules) against the expression-style disciplines — unexplained coined terms, transliterated loan-words, semicolons, source-citation leaks. Use when asked to 黑话审计 / style audit / 审查表达风格 / check the writing style, or before shipping a batch of skill copy.

luka-zivkovic Bundle

Produce a read-only semantic contract-gap pass for an exact implemented change, optionally subtracting a frozen pull-request review. Use only when explicitly asked for an implementation-aware second pass or standalone deep contract audit, especially for persisted values, shared configuration, public contracts, migrations, state transitions, or multiple producers and consumers. Discover against code before reading any supplied review, then return only source-verified omissions. Do not use as the primary PR review, before implementation exists, for fixes or test implementation, for posting comments, or for wording-only changes.

tapauth Bundle

Use when you need delegated access from a user: OAuth tokens for Google Calendar, Gmail, GitHub, Slack, Linear, Notion, Vercel, Sentry, Asana, Discord, Apify, or Jira; or a user-entered password or fixed API key via the `secret` provider. Just run the bundled script and it handles grant creation, user approval, token/secret caching, and OAuth refresh when available. Do NOT use when you already have direct credentials.

veyralabsgroup Bundle

Audit any company website and generate a pitch-ready report for agencies. Extracts real problems, competitor comparison, quick wins, and a structured service proposal. No API keys required.

nativephp Bundle

Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.