Security

chris-mcnulty Skill

The markdown file schema for sales prospects in the [YOUR_FIRM] outbound harness. One file per lead at PROSPECT_DIR (OneDrive). Source of truth for state, dossier, drafts, conversation, and audit log. Read and written by Prospector, Composer, and Cadence skills. Use when researching a lead, drafting outbound, processing replies, or auditing a sales prospect's history.

jbdamask Bundle

Audit a codebase's test suite for tests that pass for no good reason — no assertions, tautologies, assertions on mocks only, swallowed exceptions, unawaited async assertions, permanently skipped tests, and other patterns that stay green no matter how broken the code is. Produces a red/yellow/green report. Use when the user says "bullshit tests", "find fake tests", "audit my test suite", "which tests are useless", "are these tests actually testing anything", "check test quality", "find tests that always pass", or asks whether green CI means anything.

shipshitdev Bundle

Comprehensive code review focusing on quality, security, performance, and testing. Use when user says 'review', 'code review', 'check my code', or before merging PRs.

i-onlabs Skill

Firebase patterns and troubleshooting for vibecoders. Use when user mentions Firebase, Firestore, Firebase Auth, Firebase hosting, security rules, or is working on projects using Firebase backend. Also use for errors like "permission denied", "missing index", or authentication issues in Firebase projects.

thiientv Skill

Reviews a GitHub pull request or focused branch diff for correctness, regressions, security, compatibility, test gaps, and maintainability. Use when an implementation needs an independent source-aware review before merge. Produces prioritized findings with evidence and actionable fixes. Not for architecture-only audits, formatting preferences, or processing existing review feedback.

thiientv Bundle

Coordinates an active production incident by establishing command, reducing blast radius, preserving evidence, communicating verified impact, restoring service, validating recovery, and creating owned follow-up actions. Use for outages, severe degradation, security or data-integrity events, failed releases, and urgent operational triage. Not for a normal local bug, routine alert tuning, or a postmortem after the incident is already closed.

thiientv Bundle

Threat-models and hardens an application, API, data flow, dependency, or deployment against authentication and authorization flaws, injection, secrets exposure, unsafe deserialization, SSRF, abuse, privacy loss, and supply-chain risk. Use for security review, threat modeling, hardening, or sensitive changes. Not for generic code style review or an unexplained bug without a security hypothesis.

vasuag09 Skill

Orchestrate the entire VERIFY phase — code review, security review, tests, run-the-app verification, and ship-prep. Use after /harness-implement. Sequences the Verify skills, runs reviewers in parallel when sensible, halts on Critical/High findings, and stops at the git boundary.

valorisa Bundle

Discipline de travail haut de gamme à tenir toute la session. Déclencher dès que l'on veut un travail soigné, vérifié, honnête : 'fabuleux', 'mode fabuleux', 'pense comme Fable', 'niveau Fable 5', 'qualité maximale', 'sois exigeant', 'relis vraiment'. ROUTE selon le type de tâche : ARTEFACT/AGENTIQUE (page, deck, code, doc, données) → produire + screenshot + vision + correction ; PROSE (email, post, article) → draft + passe de soustraction ; ANALYSE/CONSEIL → critères + vérification de chaque affirmation ; AUDIT → diagnostic honnête + correction + état final ; SIMPLE/ONE-SHOT → réponse directe, sans protocole.

valorisa Bundle

Use this skill when the user asks to "audit repo", "analyze repository", "find bugs", "find gaps", "review codebase", "check code quality", or wants to analyze a repository for bugs, missing features, test coverage gaps, security issues and create GitHub issues for findings. Performs a deep technical audit and optionally opens GitHub issues for high-priority problems.

shawnclybor Skill

Audit and rewrite content to remove AI writing patterns ("AI-isms") from deliverables, emails, and any written output. Use whenever generating client-facing or publish-grade content, drafting external emails longer than 3 sentences, writing proposals or reports, or when the user says "clean up the writing", "remove AI-isms", "make this sound less like AI", "audit the writing", "check for AI patterns", or "writing quality check". Also invoke automatically before any deliverable formatting step. If you just wrote or curated content that will go to a client or the public, run this skill on it before finalizing. Adapted from conorbronsdon/avoid-ai-writing v3.3.0 (MIT license).

shawnclybor Skill

Audit and rewrite content to remove AI writing patterns ("AI-isms") from deliverables, emails, and any written output. Use this skill whenever generating deliverable content (Phase 1 curation in any client deliverable skill), drafting client emails longer than 3 sentences, writing proposals or SOWs, creating reports, or when the user says "clean up the writing", "remove AI-isms", "make this sound less like AI", "audit the writing", "check for AI patterns", or "writing quality check". Also invoke automatically before any deliverable formatting step — do not skip. If you just wrote or curated content that will go to a client, run this skill on it before finalizing. Adapted from conorbronsdon/avoid-ai-writing v3.3.0 (MIT license).

dojogenesis Skill

Audits CLAUDE.md files for conflicts, stale rules, missing sections, and cross-file coherence. Produces a health report with auto-fix suggestions. Use when: 'check claude.md', 'audit CLAUDE.md', 'fix claude.md', 'claude md health'.

ferocknew Skill

网站安全扫描与加固。用于检查 HTTP 安全头、CORS 配置、CSP 策略、敏感文件暴露、前端代码 XSS 风险等安全问题，并提供 Nginx/FastAPI 修复模板。当用户要求安全检查、安全扫描、CORS 修复、CSP 配置时使用。

dtsong Bundle

Security audit checklist for web applications. Use when reviewing, auditing, or hardening a web app's security posture. Covers rate limiting, auth headers, IP blocking, CORS, security middleware, input validation, file upload limits, ORM usage, and password hashing. Triggers on requests like "review security", "harden this app", "security audit", "check for vulnerabilities", or when building/reviewing API endpoints.

jh941213 Skill

하네스(hooks, skills, agents, rules) 전체 건강도를 진단하고 점수 산출. Triggers on: harness audit, 하네스 진단, 설정 점검, 하네스 점검. NOT for: 코드 작성, 구현.

jh941213 Skill

에이전트 하네스 12원칙 기반 자가 진단 및 개선 제안. Triggers on: 하네스 진단, audit, 환경 점검, setup, maintenance, drift 확인. NOT for: 코드 구현, 버그 수정, 테스트 작성.

harrychuang Skill

Audit changed code for security sharp edges — dangerous defaults, type confusion, and silent failures

i-onlabs Skill

Decision-making framework for risky operations. Activates when PreToolUse hook triggers on potentially dangerous commands. Provides methodology for AUDIT → ASSESS → RESEARCH → THINK → DECIDE → ACT workflow.

aladicf Skill

Design security-conscious interfaces that protect users without frustrating them. Use when the user asks about MFA, password UX, breach notifications, trust indicators, secure forms, account recovery, or making security feel safe rather than scary.

jnzader Skill

This skill covers patterns for testing security using crafted content. Trigger: Load this skill when working with test_security scenarios.

nemagu Bundle

Сквозная проверка и доработка нормативной документации до готовности к реализации: инвентаризация области, динамический выбор профильных documentation-writing скилов, независимый аудит качества, исправление однозначных замечаний и повторение audit/fix цикла. Использовать, когда пользователь просит проверить и довести документ, комплект требований или документацию сервиса до согласованного состояния. Обязательно запрашивать у пользователя отсутствующие продуктовые и архитектурные решения и не угадывать их. Не использовать для проверки реализации, написания кода или только read-only аудита без исправлений.

harpreetsingh Skill

Cold-read audit of any artifact — code, plans, docs, research, or beads — for bugs, gaps, and problems

valorisa Bundle

ExploitGym-paper-to-security-skill

crozzbite Skill

OWASP ASVS Level 1 security controls for MVP applications. Trigger: When auditing authentication, sessions, validation, cryptography, or logging.

crozzbite Skill

Enterprise patterns for Use Cases (observability, security, resilience)

kao273183 Bundle

金流 / 付款測試專屬流程。覆蓋 App 內購（StoreKit 2 / Play Billing）、Stripe、Apple Pay / Google Pay、訂閱（續訂 / 過期 / 寬限期 / 退款 / 升降級 proration）。驗證購買成功/取消、restore purchases、server 端收據驗證、idempotency（不重複扣款）、價格/幣別/稅、促銷碼、付款中斷網（接 offline）、entitlement 同步。當使用者提到「金流測試 / 付款測試 / payment test / 內購 / IAP / StoreKit / Play Billing / Stripe / Apple Pay / Google Pay / 訂閱測試 / subscription / 退款 / 收據驗證 / 重複扣款」時觸發。配套：compliance-test（PCI-DSS）、offline-mode-test（付款中斷線）、security-scan（金流漏洞）、test-master（規劃金流 TC）、bug-report。

kao273183 Bundle

OAuth 2.0 / OIDC / SSO 登入流程測試專屬流程。覆蓋 authorization code + PKCE、token 刷新、access/refresh token 過期、refresh token 輪替、登出/撤銷、多 IdP（Google / Apple / Facebook / 企業 SSO）、deep link 重導、state/nonce CSRF 防護、scope/consent、silent renew、錯誤路徑（拒絕授權 / code 過期）。整合 iOS（ASWebAuthenticationSession）/ Android（Custom Tabs + AppAuth）/ Web（redirect + PKCE）/ BE（token 驗簽）。當使用者提到「OAuth / OIDC / SSO / 登入流程測試 / token 刷新 / refresh token / PKCE / 授權碼 / 第三方登入 / Google 登入 / Apple 登入 / single sign-on / token 過期 / 授權測試」時觸發。配套：security-scan（token 漏洞）、compliance-test（同意/個資）、test-automation（登入 UI test）、offline-mode-test（token 刷新斷線）、bug-report。

ryzhakar Skill

Audit every record one project holds against the index over them, then repair each mismatch found. "audit the records", "reconcile the index", "rebuild the map", the index and the records drifted apart, two records in force contradict each other, a record the index omits, a pointer whose target is gone, content carrying no recorded author, a recurring audit timer fires.

ryzhakar Skill

This skill should be used when the user asks to "fix a broken app", "app won't open", "Gatekeeper blocks app", "can't launch app", "app is damaged", "clear quarantine", "re-sign app", "fix code signing", or mentions macOS security preventing an app from launching.

catlog22 Skill

Intent-driven knowledge-store and Run knowledge lifecycle management — audit/prune, stage candidates (with signal recording), review/resolve/promote candidates, harvest artifacts, or manage wiki/domain knowledge. Arguments: [intent — e.g. '审计知识库' | 'harvest 这个 session' | 'wiki health' | '注册术语 MVP' | 'extractors']

zxremail Bundle

Use when reviewing another author's Feishu/Lark Docx or Wiki (技术方案、排查记录、实验记录、方案草稿、需求/设计文档), or when the user says 飞书文档review、评审意见、审一下这份飞书、帮我review这篇文档、文档评审, or pastes a feishu.cn / larksuite.com /docx/ or /wiki/ URL to review. Not for code PR/Bugbot/security review, dual-doc FAQ, or AI成果说明填报.

daboggieman Skill

Use when implementing, reviewing, debugging, or researching authentication, authorization, secrets, user data, APIs, dependencies, file handling, or other security-sensitive code.

daboggieman Skill

Use when reviewing changes, pull requests, diffs, implementations, or completed work for bugs, regressions, security problems, and maintainability issues.

impertio-studio Bundle

Use when reviewing a proposed MariaDB schema before it ships, auditing an existing schema for engine / indexing / naming / normalization problems, or validating a migration DDL. Prevents the common mistake of shipping a schema with MyISAM tables, UUID-text PKs, missing tenant indexes, utf8 charset, or composite indexes in the wrong column order. Covers a deterministic schema-review checklist : storage-engine choice, primary-key type, indexing strategy and column-order, charset / collation, normalization fitness, multi-tenant pattern detection, naming-convention adherence, with severity grading and cross-references to mariadb-core-storage-engines, mariadb-syntax-indexing, mariadb-impl-schema-design. Keywords: schema review, schema audit, review my schema, is this schema correct, schema checklist, design review, storage engine audit, index audit, primary key audit, normalization check, multi-tenant check, naming convention, DDL review, before I ship this schema, ENGINE=InnoDB, MyISAM, BIGINT AUTO_INCREMENT, UUI

impertio-studio Bundle

Use when defining triggers for BEFORE / AFTER INSERT / UPDATE / DELETE, scheduling recurring tasks via events, creating views including the materialized-view workaround, or controlling DEFINER vs INVOKER security context. Prevents the common mistake of overusing triggers for business logic, forgetting event_scheduler is OFF by default, expecting MariaDB to support materialized views (it does not), or choosing TEMPTABLE algorithm on huge views. Covers CREATE TRIGGER with FOLLOWS / PRECEDES, multi-trigger per event (10.2.3+), CREATE EVENT scheduler, ON COMPLETION PRESERVE / NOT PRESERVE, CREATE VIEW with ALGORITHM (UNDEFINED / MERGE / TEMPTABLE), DEFINER vs INVOKER, WITH CHECK OPTION LOCAL / CASCADED, materialized-view workaround via CREATE TABLE AS SELECT + EVENT. Keywords: CREATE TRIGGER, BEFORE INSERT, AFTER UPDATE, BEFORE DELETE, AFTER DELETE, FOR EACH ROW, FOLLOWS, PRECEDES, NEW.col, OLD.col, NEW pseudo-row, OLD pseudo-row, CREATE EVENT, ON SCHEDULE EVERY, ON SCHEDULE AT, event_scheduler, SET GLOBAL event_