Security

drnabeelkhan Skill

Compliance Officer

drnabeelkhan Skill

Incident Responder

drnabeelkhan Skill

Penetration Tester

drnabeelkhan Skill

Security Architect

bytesagain Bundle

HOTP (RFC 4226) HMAC-based one-time password reference. Counter- based OTP for hardware tokens. Covers algorithm step-by-step, Python implementation from scratch, pyotp/otpauth libraries, counter synchronization, resync protocol, look-ahead window, and security considerations vs TOTP.

bytesagain Bundle

TOTP (RFC 6238) time-based one-time password reference. Covers algorithm internals, Python pyotp/Node.js otpauth/Go implementation, otpauth:// URI format, QR code generation, backup codes, rate limiting, security best practices, and database schema.

bytesagain Bundle

Supabase open-source Firebase alternative reference. PostgreSQL backend with Auth, Storage, Realtime, and Edge Functions. Covers JS client queries, filters, RPC functions, Row Level Security, OAuth/magic link auth, file storage, realtime subscriptions, presence tracking, and Deno edge functions.

kensaurus Skill

Plan-only authenticity / AI-slop audit across prose, UI, code, and IA. Use when "looks like AI slop", "reads like ChatGPT", or "authenticity burndown". One-page UX apply → enhance-web-ux. Visual polish → enhance-web-ui.

kensaurus Skill

Read-only audit of custom lint/ratchet doctrine — is each rule right on the merits, not merely enforced. Use when "is this lint rule wrong", "the ratchet banned a legitimate pattern", "audit our guardrail doctrine". Enforcement → audit-gate-logic. Consolidation → housekeep-gates.

kensaurus Bundle

Enhance an existing README with a theme-aware hero, feature tour, screenshots/GIF, accurate badges, and synced content. Use when "enhance README", "make README prettier", "add screenshots", or "showcase the app". Content-only docs → docs-writer. Drift audit/plan → plan-docs-sync.

kensaurus Bundle

Polish an existing page's hierarchy, spacing, type, and visual personality. Use when "make this page polished/premium", "less crowded", or "better visual hierarchy". Understood / CPL → enhance-readability. Flow/IA → enhance-web-ux. Breakpoints → audit-responsive.

kensaurus Bundle

NN/g-grounded enhancement of an existing page's flows — not a repo-wide slop audit. Use when "fix UX of /xxx" or "improve information density". Repo-wide authenticity plan → plan-antislop. Composition/type → enhance-web-ui. Dense prose / CPL / reading level → enhance-readability. Heuristics-only → audit-ux.

kensaurus Skill

Read-only full-stack conformance audit against RealWorld ("Conduit"): formal API spec, shared E2E suite, and closest-stack reference. Use when "audit against RealWorld", "Conduit conformance", or "is my full-stack app complete?". General user journeys → audit-ux-journeys.

kensaurus Bundle

Plan-only performance audit across web/mobile/backend/data; measures first and emits a burndown, no fixes. Use when "performance audit plan", "perf burndown", "measure before optimize", or "N+1 audit plan". Apply runtime fixes → audit-performance. JS bundle-only → audit-bundle-size.

kensaurus Skill

Read-only audit of CI gate logic — silent bypass, ratchet gaming, required-but-not, duplicate gates. Use when "can CI be bypassed" or "why did a regression pass CI". Cost → audit-cicd. Consolidation → housekeep-gates. Rule content → audit-doctrine.

kensaurus Skill

Read-only production-resilience audit: timeouts, bounded retries, circuit breakers, idempotency, rate limits, graceful degradation, PII. Use when "resilience audit", "will this survive real traffic?", or "audit retries/timeouts/idempotency". Feature parity → audit-realworld.

kensaurus Skill

Analyse and shrink JavaScript bundle size for any web app. Use when asked to "reduce bundle size", "analyse bundle", "tree shaking", "lazy loading", "code splitting", "slow initial load", "large JS", "chunk size", "build performance", "LCP caused by JS", "why is the bundle so big", or "first load JS too large".

kensaurus Bundle

Audit runtime performance (CWV, load priority). Use when "slow page", "LCP/INP/CLS", "fetchpriority", "early hints", "speculation rules", "bfcache", or "long tasks". JS payload → audit-bundle-size. Instant nav implement → enhance-web-instant-nav. Breaking point → test-load.

kensaurus Skill

Scoped behavior-preserving refactor: map dependencies, change structure, run affected tests. Use when "refactor this", "reduce duplication", "improve readability". Dead code → plan-dead-code. Repo-wide anti-patterns → audit-code-quality. Bulk transform → burndown-full / audit-codemod-safety.

kensaurus Skill

Detect and fix repo-wide anti-patterns and consistency drift (naming, organisation, repeated smells). Use when "code smell", "anti-pattern", "technical debt", or "standardize the codebase". This PR/diff review → audit-code-review.

kensaurus Skill

Design mobile-first UIs: touch targets, safe areas, gestures, then enhance up. Use when building for small screens, touch, swipe, PWA, or tablet. Linearized desktop / responsive audit → audit-responsive.

kensaurus Skill

Audit and fix how easily content is UNDERSTOOD: CPL/reading level, Gestalt grouping, deadspace, icons or a table that cuts verbosity. Use when "hard to read", "too dense", "reading level", "cognitive load", or "turn this prose into a table". Looks-good → enhance-web-ui. Breakpoints → audit-responsive.

kensaurus Skill

Audit silent failures and observability gaps (Sentry/Langfuse), then a phased plan — no implementation. Use when "errors aren't showing in Sentry", "things fail silently", or "empty catch blocks". Apply patterns → backend-error-handling.

kensaurus Skill

Drive an entire repository to a fully green baseline — typecheck, lint, tests, and build all passing from a clean checkout — when the user has explicitly authorized fixing. Use when "make the repo green", "get CI passing", "fix all the failing tests". Ratchet integrity → audit-gate-logic.

kensaurus Bundle

Read-only audit for payment/money-movement systems, scope-gated so a Stripe-Checkout site and an in-house ledger each see only relevant findings. Use when "audit payment system", "double charge / idempotency", "ledger / reconciliation", "webhook / 3DS / PCI". Mobile IAP → audit-monetization-iap.

kensaurus Skill

Implement correlated errors, traces, and structured logs with PII redaction. Use when "add logging", "instrument this", "correlate error to trace", or wiring Sentry/Langfuse. Plan-only observability audit → plan-error-handling. Investigate Sentry issues → debug-sentry-monitor.

kensaurus Skill

Plan-only trust-boundary audit for missing validation, injection, XSS, and forged requests across forms/APIs/webhooks. Use when "validate my inputs", "is my app injection-safe?", "check my forms", or "can someone forge requests?". Apply fixes only after plan approval.

kensaurus Bundle

Non-destructive UI/UX and design-system audit that emits a unification burndown — no code until each phase is approved. Use when "audit UI without fixing", "UI burndown", or "IA audit before redesign". Apply-now token cleanup → housekeep-design. Per-page heuristics → audit-ux.

kensaurus Skill

Pre-release quality gate: test-red-team, audit-security, audit-bundle-size, audit-performance, test-unit. Use when "is this ready to ship?", "quality gate", "pre-release checklist". Gate soundness → audit-gate-logic. Working tree to a PR → workflow-release-prep.

kensaurus Skill

Read-only audit of mobile IAP and subscriptions — StoreKit 2, Play Billing, or RevenueCat — for server receipt validation, restore, lifecycle sync, grace periods, and entitlements. Use when "audit our IAP", "restore purchases broken", or before a paid app. Web Stripe/ledgers → audit-payment-system.

kensaurus Skill

Optimize slow queries, indexes, and N+1s. Use when "slow query", "database performance", "add an index", or "N+1". Schema consistency → audit-db-schema. RLS access control → plan-rls-audit.

kensaurus Bundle

Implement error-handling patterns (boundaries, toasts, API error shape). Use when "error boundary", "error toast", or "standardize API errors". Plan-only observability audit → plan-error-handling. Live Sentry triage → debug-sentry-monitor.

kensaurus Skill

Set up Playwright screenshot baselines and CI diffing so UI changes fail pixel-by-pixel instead of by eye. Use when "add visual regression tests", "catch UI regressions", or after audit-responsive / audit-ui-states. Functional clicks stay on test-playwright.

kensaurus Skill

Install mechanically-enforced architecture boundaries (dependency-cruiser / eslint-boundaries) so layer direction, feature isolation, and forbidden imports fail CI. Use when "enforce module boundaries" or "stop spaghetti imports". Advisory audit → audit-backend-architecture. Rule content → audit-doctrine.

kensaurus Bundle

Instant in-site nav: Speculation Rules, View Transitions, bfcache, 103 Early Hints. Use when "instant navigation", "prerender", "early hints", "back button reloads", or "second page is slow". First-load CWV → audit-performance. JS weight → audit-bundle-size. SPA → framework prefetch.

kensaurus Skill

Plan-only Capacitor/Ionic native-layer security audit: WebView, token storage, deep links/OAuth, cleartext traffic, exported activities. Use when "is my Capacitor app secure?", "harden my hybrid app", or pre-store hardening. Store readiness → plan-mobile-readiness.