Security

fworks-tech Skill

Deprecated alias for the-auditor. Do not select directly; load skills/the-auditor/SKILL.md instead.

2428424081cn Bundle

OWASP Top 10 安全审计助手。静态检测 XSS、未过滤 eval、明文认证传输与 CORS 宽泛配置。

2428424081cn Bundle

开源供应链安全与依赖漏洞审计。执行 npm audit / pip audit 检查 CVE 漏洞与投毒包。

dragoon0x Skill

Audit all font-family, font-size, font-weight, line-height, and letter-spacing declarations across the codebase. Find inconsistencies, banned fonts, and missing hierarchy.

dragoon0x Skill

Map all colors in the codebase. Find duplicates, near-duplicates, one-off values, and colors not in the token system.

dragoon0x Skill

Map all layout patterns. Identify grid/flexbox usage, spacing patterns, nesting depth, and responsive breakpoints across the codebase.

cleanexpo Skill

Audit Trail

cleanexpo Skill

Secret Management

cleanexpo Bundle

Architecture drift detection, silent failure scanning, hallucination prevention, and feature completeness auditing. Activates at phase boundaries, before merges, or on explicit audit requests.

cleanexpo Bundle

Pre-execution governance with dynamic validation gates, risk/confidence scoring, and structured error format. Activates before destructive, multi-layer, or security-impacting operations to assess safety.

smirnovalex-qa Skill

Independent QA/tech-lead audit of a bugfix — verifies against the facts of the code and tests whether the bug is actually fixed, whether a regression was introduced, whether adjacent functionality got broken, and whether the implementation meets enterprise/prod-ready standards. Use when asked to check/audit a bugfix, review a fix, confirm a bug is really fixed before merge/release, or check whether fixing the bug caused a regression.

smirnovalex-qa Skill

Независимый QA/tech-lead аудит багфикса — проверяет по фактам кода и тестов, действительно ли баг исправлен, нет ли регрессии, не сломан ли смежный функционал, и соответствует ли реализация enterprise/prod-ready стандартам. Используй когда просят проверить/заодитить фикс бага, ревьюнуть исправление, убедиться что баг реально пофикшен перед мержем/релизом, или проверить нет ли регрессии от исправления бага.

smirnovalex-qa Skill

Focused performance and resource-cost audit of ONE specific feature/change in the-platform (not the whole codebase) — scope taken from a directory/branch/diff, a requirements document, or a YouTrack issue; the same measurement discipline as the full audit (EXPLAIN ANALYZE, py-spy, bundle size, k6), a "before/after" comparison if the feature replaces existing functionality, an explicit production-readiness verdict. Use when asked to check the performance/resource consumption of a specific feature, branch, PR, or YouTrack task before merge/release, to assess whether a new implementation degraded existing functionality in speed/resources, or to give the resource-cost green light for that specific change — even without the word "audit", e.g. "will this feature take down the database", "how much will this eat at real volumes", "is this branch ready performance-wise".

smirnovalex-qa Skill

Точечный аудит производительности и ресурсоёмкости ОДНОЙ конкретной фичи/изменения в the-platform (не всей кодовой базы) — периметр из директории/ветки/diff, документа требований или YouTrack issue; та же дисциплина измерений, что и у полного аудита (EXPLAIN ANALYZE, py-spy, размер бандла, k6), сравнение "до/после" если фича заменяет существующий функционал, явный вердикт готовности к продакшену. Используй когда просят проверить производительность/расход ресурсов конкретной фичи, ветки, PR или YouTrack-задачи перед мержем/релизом, оценить не деградировала ли новая реализация существующий функционал по скорости/ресурсам, или дать зелёный свет по ресурсоёмкости именно для этого изменения — даже без явного слова "аудит", например "не положит ли эта фича базу", "сколько это будет жрать на реальных объёмах", "готова ли эта ветка по производительности".

ingvarconsulting Skill

Безопасная аутентификация и криптография 1С. Используй когда нужно спроектировать или диагностировать OpenID, сертификаты, CryptoPro, TLS, роли, секреты и auth для интеграций.

lhh666-6 Bundle

Use when you need to compile a LaTeX document — includes autonomous error resolution, citation audit, and quality scoring.

lhh666-6 Bundle

Use when you need to run parallel audits across skills, hooks, agents, rules, and conventions.

lhh666-6 Bundle

Use when you need to design or audit an identification strategy for an observational study.

lhh666-6 Bundle

Use when you need to scaffold a NEW educational companion book for a LaTeX paper. Reads the paper, drafts 8 substantive chapters into the vault at ~/Research-Vault/books/{slug}/, copies bib + figures, registers the book, and verifies atlas serves it. Source-of-truth is the paper PDF/tex; the book is a reading companion, never a re-statement of new claims. For syncing an existing book to a paper revision, use /audit-paper-book.

lhh666-6 Bundle

Use when you need to detect drift between an existing paper-book companion and a revised version of its source paper, then sync the mechanical pieces (new bib entries, new/changed figures) and report the substantive drift (renamed sections, changed numbers, new theorems, new contributions) for the user to triage. Counterpart to /init-paper-book. Read-only by default; --apply flag opts in to mechanical fixes.

lhh666-6 Bundle

Audit and curate a Zotero library — find duplicate DOIs, orphan items missing required tags, propose collection rebinds, identify bloated or under-used collections, generate tag hygiene reports, emit preview-only cleanup plans. Use when the user asks to "audit Zotero", "find duplicates", "tag hygiene report", "which collections are bloated or under-used", or "propose a Zotero cleanup plan". Defers all CRUD operations to the standalone `zotero-skills` skill or `research-hub zotero` CLI. Includes a backup-first reminder before any apply/CRUD handoff suggestion.

h4vzz Skill

Perform a comprehensive security audit of applications and infrastructure to identify vulnerabilities, assess risk, and recommend mitigations aligned with industry standards.

h4vzz Skill

Scan project dependencies for known vulnerabilities, generate software bills of materials, and enforce license compliance across the software supply chain.

h4vzz Skill

Perform thorough code reviews on files or pull requests, checking for bugs, security vulnerabilities, performance issues, and style violations.

h4vzz Skill

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines.

yogsoth-ai Skill

SOP for auditing wikilink coverage — scans all edges and reports which source pages are missing [[dir/slug]] wikilinks to their targets.

encod3d-sec Skill

Vulnerability-research loop toward a novel CVE. Target triage -> attack-surface map -> ranked hypotheses -> investigate (RE / fuzz / audit) -> a finding deepens the loop, a dead-end pivots to a new approach. Uses the full wiki + hunt skillset. Scaffolds and persists state under raw/research/<project>/. Triggers - "research", "find a cve", "analyze this binary/library", "audit this code for vulns".

encod3d-sec Skill

API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse. OWASP API Top 10. Wiki-first, FIND schema output.

encod3d-sec Skill

Enterprise SSL VPN attack - vendor fingerprinting, CVE matrix (Cisco, Fortinet, Citrix, Palo Alto, Pulse/Ivanti), default credentials, pre-auth exploit commands. Wiki-first, FIND schema output.

encod3d-sec Skill

XSS hunting - reflected, stored, DOM-based. Marker discipline to avoid false positives. Blind-XSS beacons for stored contexts. SVG/markdown/redirect vectors. Wiki-first, FIND schema output.

encod3d-sec Skill

File upload attack hunting - extension/content-type/magic-byte bypass to web-shell RCE, path traversal in filename, SVG/XML XSS, zip slip, and pixel-flood DoS. Wiki-first, FIND schema output.

encod3d-sec Bundle

OFFLINE FALLBACK for the claude-md-management plugin - prefer that plugin when it is installed. Audit and improve CLAUDE.md files - scan for CLAUDE.md files, evaluate quality against templates, output a report, then make targeted updates. Invoke explicitly (/claude-md-improver) when the plugin is unavailable.

buildpad-ai Bundle

Set up complete role-based access control for DaaS applications including roles, policies, permissions, access entries, and dynamic filters. Supports patterns like own_items, role_hierarchy, and public_read. For multi-tenancy, use /manage-scope which handles scope-aware role assignment natively. Use when the user needs roles, permissions, access control, or security configuration.

buildpad-ai Bundle

Generate comprehensive Playwright E2E and Vitest unit tests for DaaS features, API routes, pages, components, security (RLS), permissions, and load tests. Creates test files with proper setup, cleanup, and coverage. Use when the user needs tests, testing, E2E tests, API tests, security tests, load tests, or wants to test a feature.

buildpad-ai Bundle

Generate a Supabase PostgreSQL database migration with proper schema, RLS policies, indexes, triggers, and grants. Follows DaaS naming conventions and includes standard audit columns. Use when the user needs a database migration, table creation, schema change, or wants to add columns to a collection.

encod3d-sec Skill

Drive msfconsole across the workflow - DB-backed recon (db_nmap, auxiliary scanners), version->exploit search/check/run, multi/handler reverse shells (meterpreter-first, plain shell_reverse_tcp backup for Windows/EDR), sessions + local_exploit_suggester + post modules, and autoroute/portfwd/socks pivoting. Points to the metasploit cheatsheet for syntax. Use for "metasploit", "msfconsole", "msfvenom", "meterpreter", "multi/handler", or driving an exploit/reverse-shell through msf.