Security

encod3d-sec Skill

Fast PARALLEL wiki lookup engine over wiki/techniques + wiki/payloads + wiki/tools + wiki/cheatsheets for a surface/service/vuln-class. Two modes - quick (one qmd search, cheap, fire constantly) and deep (4 parallel subagents, one per area, merged ready-to-use arsenal card, cached). This is the fast path arsenal that `arsenal` delegates to; the hunt-* skills each inline their own qmd_query and can hand off here for a parallel lookup. Use for "what do I use against <surface>", "arsenal for <X>", "deep/full arsenal", "tool + payload + technique + cheatsheet for <X>", "fast wiki lookup", "parallel wiki search", any "how do I attack/exploit <service|vuln-class>" where you want the documented tooling + payloads before hand-rolling.

cyz26 Bundle

Prepare or review a PixiJS project for future WeChat or Douyin mini-game adaptation without implementing runtime adapters yet. Use when Codex needs to audit browser-only coupling, define platform boundaries, set mini-game-safe rules before implementation, or produce a readiness gap checklist before mini-game migration.

cyz26 Skill

Use when auditing context-heavy skills/plugins or project tool cleanup.

buildpad-ai Skill

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

marvin-lijunzan Bundle

Organize, execute, audit, and package computational research projects from literature and data intake through reproducible experiments, figures, manuscripts, and submission-ready delivery.

marvin-lijunzan Bundle

Complete author guidelines, submission checklist, automated LaTeX/Word formatting rules, and technical screening compliance audit for Cement and Concrete Composites (Elsevier, ISSN 0958-9465). Use when formatting, auditing, checking compliance, or editing manuscripts for submission to CCC, including LaTeX elsarticle 5p/3p layout, continuous line numbers, Highlights (3-5 bullets, <=85 chars), figure/table citation monotonicity, bijective bibliography verification, Elsevier Numbered reference style (Initials. Surname, LTWA abbreviations, full HTTPS DOIs), CRediT authorship statement, Funding/Crossref declarations, and Data availability statements.

marvin-lijunzan Bundle

Reference audit and integrity checker: verifies bijective cross-referencing between in-text citations and bibliography lists, checks citation style compliance (GB/T 7714, APA, IEEE, Elsevier), and detects broken reference chains.

marvin-lijunzan Bundle

Evaluates a preliminary research idea against a five-dimension framework (Higher, Faster, Stronger, Cheaper, Broader) plus idea-lifecycle and student-capability matching, paradigm-shift probing, and a fatal-flaws audit. Returns a reviewer-style verdict. Use when the user has a draft research idea and asks whether it is worth pursuing, asks to 'evaluate this idea', 'score this idea', 'assess feasibility', 'novelty check', 'is this a good research direction', or before committing to a paper scope.

marvin-lijunzan Bundle

Runs a pre-submission review of a technical paper across five dimensions: macro logic, writing details, English grammar, LaTeX formatting, and figure quality. Uses a reviewer-style severity taxonomy (CRITICAL / MAJOR / MINOR) and flags banned AI-tone vocabulary and em-dash misuse. Use when the user asks to 'review this paper', 'audit before submission', 'check the draft', 'find issues', 'proofread', or within one week of a submission deadline.

marvin-lijunzan Bundle

Use for PaperSpine paper and report writing workflows including intake, research, rewrite, build from materials, LaTeX output, translation, and audit.

marvin-lijunzan Bundle

Audits PaperSpine outputs for missing artifacts, shallow revisions, logic transfer, unsupported claims, and translation coverage.

dragoon0x Skill

Audit and fix ARIA attributes. Ensures proper aria-label, aria-hidden, aria-live, and role usage throughout the interface.

dragoon0x Skill

Comprehensive design quality audit with severity ratings, specific line references, and actionable fix instructions. Deeper than /score — examines every declaration.

dragoon0x Skill

Audit visual density and whitespace balance. Checks that sections alternate between sparse and dense, avoiding uniform monotony.

ferroxlabs Skill

Generate a cease-and-desist letter - trademark, copyright, IP misuse, defamation, breach of contract, or debt - with appropriate tone (professional / firm / litigation-threat), supporting evidence section, demand, and deadline. Templates only - not legal advice. High-stakes versions warrant attorney review before sending.

ferroxlabs Skill

Security vulnerability assessment expertise covering OWASP Top 10 deep dive, code review for security, dependency vulnerability scanning, SAST/DAST tools, security headers audit, authentication and authorization audit, and security assessment report writing for identifying and documenting application security weaknesses. Use when the user asks about security auditor, security auditor best practices, or needs guidance on security auditor implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

openaccountant Skill

Analyzes recurring charges to find subscriptions, calculates total monthly/annual cost, flags services with no recent usage, and recommends cancellations. Trigger when user asks about subscriptions, recurring charges, "what am I paying for monthly", or wants to cut expenses.

johnqtcg Bundle

Create evidence-backed pull requests to the GitHub main branch with strict preflight, quality, and security gates. Use when users ask to create/submit/open/update a PR to main (including private repos), decide draft vs ready state, and provide reviewer-ready context for team review.

johnqtcg Bundle

Orchestrate a comprehensive Go code review by triaging code changes, dispatching vertical review skills (security, concurrency, error, logic, performance, quality, test, observability) as parallel agents, then consolidating results into a unified report. Use for full Go PR review or comprehensive code review. Replaces the monolithic go-code-reviewer with focused parallel analysis.

johnqtcg Bundle

Exploitability-first standalone security review of code changes, diffs, PRs, or services. Use when asked for a security review, security audit, vulnerability assessment, or pre-merge security check (安全审查/安全评审/漏洞排查) — covers auth, input, secrets, API, data, concurrency, container, third-party, and dependency risk across Go, Node.js/TypeScript, Java, and Python, with mandatory evidence, false-positive suppression, scope-based depth (Lite/Standard/Deep), and CWE/OWASP-mapped machine-readable output. NOT for general-purpose Go code review — use go-review-lead for that (it dispatches go-security-review as its security dimension); this skill is the deeper security-only process with mandatory gates and audit-grade output.

johnqtcg Bundle

Go dependency audit specialist for CVE scanning (govulncheck), license risk triage, outdated dependency detection, upgrade impact analysis, and supply chain security. ALWAYS use when auditing go.mod dependencies, running govulncheck, checking license compatibility, planning dependency upgrades, or investigating supply chain risks in Go projects. Read-only by default — emits a remediation plan instead of mutating go.mod/go.sum. Complements security-review (code-level) with module-level supply chain analysis.

dauquangthanh Bundle

Audits third-party dependencies: lists direct + transitive deps, cross-references against CVE databases (via WebSearch/WebFetch), surfaces licence conflicts and abandonware. Records audit as a dated file so subsequent runs show drift. Use when checking for security vulnerabilities in dependencies, performing a licence audit, or reviewing third-party packages for risk.

fbakiyev Skill

Проверить код или конфигурацию приложения на конкретные нарушения безопасности на границах доверия и проверить предложенные исправления. Использовать для оценки безопасности или существенного изменения, влияющего на неё, а не для каждой обычной правки кода.

fbakiyev Skill

Разобрать сценарии злоупотребления и требования безопасности для предлагаемой системы или существенного архитектурного изменения. Использовать до фиксации проектных решений, а не вместо проверки кода или расследования инцидента.

fbakiyev Skill

Установить применимость и приоритет находок сканера или уведомлений об уязвимостях с учётом фактического артефакта и среды развёртывания. Использовать для решений о применимости и исправлении уязвимостей, а не активной эксплуатации или общего аудита безопасности.

fbakiyev Skill

Расследовать деградацию, недоступность сервисов или сбои обработки данных и координировать восстановление. При подозрении на компрометацию, требующую сдерживания инцидента безопасности, использовать security-incident-response.

fbakiyev Skill

Оценить ситуацию и координировать сдерживание или восстановление при подозрении на компрометацию учётных данных, проникновение, вредоносное ПО или раскрытие данных. Использовать для события безопасности, а не обычного разбора уязвимостей или сбоя сервиса без признаков компрометации.

nexadevapp Skill

Reviews code changes for quality, correctness, security, and maintainability with an independent perspective. Use when the user asks to "review the code", "check my changes", "review the implementation", or mentions code review, PR review, or quality check.

nexadevapp Skill

Builds the Go net/http middleware chain with authentication, authorization (RBAC), CSRF protection, security headers, structured slog logging, and panic recovery. Run before implementing use cases so that feature code can rely on cross-cutting infrastructure. Use when the user asks to "set up middleware", "add auth middleware", "build the middleware layer", "add security headers", "protect my routes", "add login redirect", "set up route guards", or mentions middleware, authentication guard, route protection, CSRF, or RBAC middleware.

skyosev Skill

Audit Go code for missing documentation where the "why" is not obvious — obscure calculations, non-trivial business rules, surprising behavior, implicit constraints, workarounds, and missing godoc on exported symbols. Finds where a comment would save the next reader significant time. Use when: reviewing Go code for long-term maintainability, onboarding new team members, auditing undocumented business logic, or preparing code for handoff.

skyosev Skill

Audit Python code for missing or misleading inline documentation where the "why" is not obvious — obscure calculations, non-trivial business rules, surprising behavior, implicit constraints, workarounds, and stale comments that contradict the current code. Finds where a comment would save the next reader significant time, or where an existing comment actively misleads. Use when: reviewing Python code for long-term maintainability, onboarding new team members, auditing undocumented business logic, or preparing code for handoff. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit TypeScript code for missing inline documentation where the "why" is not obvious — obscure calculations, non-trivial business rules, surprising behavior, implicit constraints, and workarounds. Finds where a comment would save the next reader significant time. Use when: reviewing TypeScript code for long-term maintainability, onboarding new team members, auditing undocumented business logic, or preparing code for handoff.

skyosev Skill

Audit Go code for AI-generated noise — redundant comments, verbose documentation, style drift from project conventions and gofmt, trivially dead code, and unnecessary error wrapping. Surface-level hygiene pass; defaults to branch diff but supports any scope. Use when: reviewing AI-assisted Go code before merge, cleaning up generated code, enforcing project style on new contributions, or reducing review noise.

skyosev Skill

Audit Go test code for quality gaps — missing coverage on critical paths, brittle tests coupled to implementation, over-mocking, assertion-free tests, missing edge cases, table-driven test misuse, and race condition blindness. Focuses on test effectiveness. Use when: reviewing Go test suites for reliability, reducing false-positive test failures, improving coverage of critical business logic, or cleaning up test debt.

skyosev Skill

Audit Python code for performance antipatterns and resource management issues — blocking I/O in async contexts, sequential awaits, N+1 queries, unclosed resources, unbounded caches, eager materialization, missing connection pooling, and expensive operations in hot paths. Use when: reviewing async correctness, auditing resource lifecycle, hunting N+1 query patterns, checking connection pool configuration, or profiling structurally inefficient code. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit Python code for AI-generated noise — redundant comments, verbose documentation, style drift from project conventions, and trivially dead code. Surface-level hygiene pass; defaults to branch diff but supports any scope. Use when: reviewing AI-assisted Python code before merge, cleaning up generated code, enforcing project style on new contributions, or reducing review noise. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".