Security

skyosev Skill

Audit Python test code for quality gaps — missing coverage on critical paths, brittle tests coupled to implementation, over-mocking, assertion-free tests, missing edge cases, and duplicated test setup. Focuses on test effectiveness, not production code structure. Use when: reviewing Python test suites for reliability, reducing false-positive test failures, improving coverage of critical business logic, or cleaning up test debt. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit Python code for weak type design — primitive obsession, stringly-typed APIs, broad unions, structural vs nominal confusion, type aliases hiding intent, and models that fail to make illegal states unrepresentable. Use when: reviewing type annotations for expressiveness, tightening domain models, reducing runtime checks via the type system, or preparing for stricter mypy/pyright configuration. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit TypeScript/Node.js code for performance antipatterns and resource management issues — event loop blocking, sequential awaits, N+1 queries, unclosed resources, unbounded caches, eager materialization, missing connection pooling, and expensive operations in hot paths. Use when: reviewing async correctness, auditing resource lifecycle, hunting N+1 query patterns, checking connection pool configuration, or profiling structurally inefficient code.

skyosev Skill

Audit TypeScript code for AI-generated noise — redundant comments, verbose documentation, style drift from project conventions, and trivially dead code. Surface-level hygiene pass; defaults to branch diff but supports any scope. Use when: reviewing AI-assisted TypeScript code before merge, cleaning up generated code, enforcing project style on new contributions, or reducing review noise.

skyosev Skill

Audit TypeScript test code for quality gaps — missing coverage on critical paths, brittle tests coupled to implementation, over-mocking, assertion-free tests, missing edge cases, and duplicated test setup. Focuses on test effectiveness, not production code structure. Use when: reviewing TypeScript test suites for reliability, reducing false-positive test failures, improving coverage of critical business logic, or cleaning up test debt.

skyosev Skill

Run all 10 Go code quality hunters in parallel as subagents and write each report to a timestamped reports folder. Covers boundary, doc, invariant, security, simplicity, slop, smell, solid, test, and type hunters. Use when: running a full Go codebase audit, scanning all quality dimensions at once, preparing for a code review, or generating a comprehensive findings report.

skyosev Skill

Audit Go code for classic code smells — feature envy, data clumps, shotgun surgery, primitive obsession, temporal coupling, comments as deodorant, temporary fields, init() abuse, package-level mutable state, and stuttering names. Use when: reviewing Go code for structural design problems, preparing for a refactor, auditing code after rapid feature development, or hunting for misplaced responsibilities.

skyosev Skill

Audit Python code for error handling design quality — missing exception hierarchies, lost exception chains, return-None antipatterns, over-broad try/except, silent suppression, poor exception context, framework handler gaps, and missing error boundaries. Use when: reviewing error handling strategy, tightening exception design before deployment, auditing error propagation paths, standardizing API error responses, or establishing error handling conventions after rapid feature development. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Run all 12 Python code quality hunters in parallel as subagents and write each report to a timestamped reports folder. Covers boundary, doc, error, invariant, perf, security, simplicity, slop, smell, solid, test, and type hunters. Use when: running a full Python codebase audit, scanning all quality dimensions at once, preparing for a code review, or generating a comprehensive findings report. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit Python code for classic code smells — feature envy, data clumps, shotgun surgery, temporal coupling, comments as deodorant, temporary fields, god modules, mutable default arguments, and class abuse. Use when: reviewing Python code for structural design problems, preparing for a refactor, auditing code after rapid feature development, or hunting for misplaced responsibilities. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit Python class and interface design for SOLID violations — god classes, rigid extension points, broken substitutability, fat ABCs/Protocols, and concrete dependency chains. Focuses on responsibility assignment and abstraction fitness. Use when: reviewing class hierarchies, preparing for extension with new variants, reducing coupling between services, or improving testability of class-heavy code. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit TypeScript code for error handling design quality — missing Error hierarchies, lost Error.cause chains, return-undefined antipatterns, over-broad try/catch, silent suppression, poor error context, framework handler gaps, Result type opportunities, and missing error boundaries. Use when: reviewing error handling strategy, tightening exception design before deployment, auditing error propagation paths, standardizing API error responses, or establishing error handling conventions after rapid feature development.

skyosev Skill

Run all 12 TypeScript code quality hunters in parallel as subagents and write each report to a timestamped reports folder. Covers boundary, doc, error, invariant, perf, security, simplicity, slop, smell, solid, test, and type hunters. Use when: running a full TypeScript codebase audit, scanning all quality dimensions at once, preparing for a code review, or generating a comprehensive findings report.

skyosev Skill

Audit TypeScript code for classic code smells — feature envy, data clumps, shotgun surgery, primitive obsession, temporal coupling, comments as deodorant, temporary fields, and class abuse. Use when: reviewing TypeScript code for structural design problems, preparing for a refactor, auditing code after rapid feature development, or hunting for misplaced responsibilities.

skyosev Skill

Audit TypeScript class and interface design for SOLID violations — god classes, rigid extension points, broken substitutability, fat interfaces, and concrete dependency chains. Focuses on responsibility assignment and abstraction fitness. Use when: reviewing class hierarchies, preparing for extension with new variants, reducing coupling between services, or improving testability of class-heavy code.

skyosev Skill

Audit Go packages for boundary violations — leaked internals via exports, coupling through shared types, import cycles, missing internal/ packages, over-exported APIs, and dependency direction violations. Use when: reviewing package structure, shrinking public API surface, enforcing encapsulation, preparing packages for replacement, or untangling tight coupling between layers.

skyosev Skill

Audit Python packages and modules for black-box boundary violations — leaked internals via exports, coupling through shared types, Law of Demeter chains, missing abstraction layers around externals, and over-exported APIs. Use when: reviewing package structure, shrinking public API surface, enforcing encapsulation, preparing modules for replacement, or untangling tight coupling between layers. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit Python code for security vulnerabilities — hardcoded secrets, injection risks, missing input validation at trust boundaries, insecure defaults, auth gaps, sensitive data exposure, and unsafe patterns like eval, pickle, or shell injection. Use when: reviewing Python code before deployment, auditing trust boundaries, preparing for a security review, onboarding third-party integrations, or hardening an application. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Bundle

Audit TypeScript modules for black-box boundary violations — leaked internals via exports, coupling through shared types, Law of Demeter chains, missing abstraction layers around externals, and over-exported APIs. Use when: reviewing module structure, shrinking public API surface, enforcing encapsulation, preparing modules for replacement, or untangling tight coupling between layers.

skyosev Skill

Audit TypeScript code for security vulnerabilities — hardcoded secrets, injection risks, missing input validation at trust boundaries, insecure defaults, auth gaps, sensitive data exposure, and unsafe patterns like eval or innerHTML. Use when: reviewing TypeScript code before deployment, auditing trust boundaries, preparing for a security review, onboarding third-party integrations, or hardening an application.

skyosev Skill

Audit Go code for weak invariants — unchecked errors, nil pointer risks, ignored context cancellation, unsafe type assertions, zero-value traps, panic/recover misuse, and missing validation at construction boundaries. Use when: tightening domain models, reducing panic risks, increasing error handling discipline, or establishing a safety baseline before refactoring.

skyosev Skill

Audit Python code for weak invariants — unnecessary casts, loose optionality, defensive None-checks masking missing guarantees, leaky tagged unions, error suppression, and runtime checks that the type system or construction boundaries should enforce. Use when: tightening post-construction guarantees, reducing type: ignore and cast() usage, reviewing dataclass/TypedDict optionality, auditing error-handling hygiene, or establishing a type-safety baseline before refactoring. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit TypeScript types for weak invariants — unnecessary casts, loose optionality, defensive `?.`/`??` masking missing guarantees, leaky discriminated unions, and runtime checks the type system should enforce. Use when: tightening domain models, reducing type assertions, increasing type coverage, reviewing discriminated unions, or establishing a type-safety baseline before refactoring.

skyosev Skill

Audit Go code for unnecessary structural complexity — duplication, reinvented primitives, avoidable abstractions, dead logic paths, over-parameterized APIs, deep nesting, interface pollution, channel misuse, mixed concerns, and coexisting abstraction generations left behind by unfinished migrations. Recommends the simplest shape that preserves intended behavior. Use when: reviewing Go code for over-engineering, reducing complexity after prototyping, enforcing reuse over addition, simplifying before a refactor, or auditing a codebase after a library or framework migration.

skyosev Skill

Audit Python code for unnecessary structural complexity — duplication, reinvented primitives, avoidable abstractions, dead logic paths, flag-heavy APIs, deep nesting, mixed concerns, and coexisting abstraction generations left behind by unfinished migrations. Recommends the simplest shape that preserves intended behavior. Use when: reviewing Python code for over-engineering, reducing complexity after prototyping, enforcing reuse over addition, simplifying before a refactor, or auditing a codebase after a framework or library migration. Reports omit empty sections — no placeholder headings, empty tables, or negative statements like "no issues found".

skyosev Skill

Audit TypeScript code for unnecessary structural complexity — duplication, reinvented primitives, avoidable abstractions, dead logic paths, flag-heavy APIs, deep nesting, mixed concerns, and coexisting abstraction generations left behind by unfinished migrations. Recommends the simplest shape that preserves intended behavior. Use when: reviewing TypeScript code for over-engineering, reducing complexity after prototyping, enforcing reuse over addition, simplifying before a refactor, or auditing a codebase after a framework or library migration.

creatorland Skill

Adversarially stress-test a creator shortlist you already have — re-run the brief under an alternate phrasing for missed talent, audit each pick for audience-geo mismatch, screen for competitor conflicts via affiliations, and write a risks-and-caveats appendix. Use when the user says "second pass", "poke holes in this shortlist", "stress-test this slate", "red-team this casting", or wants a critical review before sending. The anti-yes-man pass; produces a critique appendix.

ulpi-io Skill

Answer Engine Optimization (AEO) audit and SERP analysis for AI-generated answers. Analyzes pages for AEO readiness (structured data, FAQ patterns, heading hierarchy, meta quality) and checks how queries appear in AI-powered search results (Google AI Overviews, Perplexity, ChatGPT Search). Uses the browse CLI for all page interaction.

ulpi-io Skill

Use when the user asks to find bugs, review changes, security audit, or check code quality on the current branch. Analyzes full diffs against the default branch, maps attack surfaces, runs a security checklist against every changed file, verifies findings against context, and reports prioritized issues. Invoke via /find-bugs or when user says "find bugs", "review my changes", "security review", "audit this code".

hack23 Skill

Implement CIS Controls v8 critical security controls for effective cyber defense in CIA platform

hack23 Skill

Conduct systematic threat modeling using STRIDE framework, attack trees, and security architecture analysis for CIA platform

hack23 Skill

Verify implementation of ISO 27001:2022 information security controls across CIA platform development and operations

hack23 Skill

Hack23 ISMS organization-wide compliance requirements, policy enforcement, audit preparation

hack23 Skill

Maintain comprehensive security documentation including SECURITY_ARCHITECTURE.md, THREAT_MODEL.md per Hack23 ISMS standards

davie521 Skill

Trace every user-facing button/touchpoint through its full state change sequence to find bugs where functions individually work but cancel each other out, produce wrong final state, or leave the UI in an inconsistent state. Use when: systematic debugging found no bugs but users report broken buttons, or after any major refactor touching shared state stores.

davie521 Bundle

Security review checklist reference — not the built-in /security-review command. Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.