Security

iblai Skill

Connect an ibl.ai organization for API access. Gets the user signed in (ibl.ai/join if new, login.iblai.app/me if returning), captures their org key and username, mints a Platform API Token, and writes IBLAI_ORG / IBLAI_USERNAME / IBLAI_API_KEY to .env. If you already hold org credentials (key + secret), the secret works directly as the Api-Token — no browser needed. Run this first before any other iblai-* skill.

iblai Skill

Manage an organization's Platform API Tokens via the platform API — list, create (secret shown once), and delete Api-Tokens by name. Use when issuing or rotating the keys that authenticate ibl.ai API access.

uwayxt Bundle

Audit the product across all breakpoints before shipping. Use when responsive QA, cross-device testing, mobile audit, breakpoint check, or elements overflowing on mobile.

ariehmahoukou-web Skill

When the user wants to audit or optimize an App Store or Google Play listing. Also use when the user mentions 'ASO audit,' 'app store optimization,' 'optimize my app listing,' 'improv[...]

cookiemonsterdev Bundle

Use when users ask how to build, explain, configure, route, secure, debug, migrate, or troubleshoot Express.js web applications and APIs, including middleware, routing, error handling, request/response objects, the Router, static files, templates, proxies, performance, security, graceful shutdown, or Express 5 migration, especially when they need official Express documentation, exact links, or docs-grounded JavaScript guidance.

cookiemonsterdev Bundle

Use when users ask how to instrument, collect, process, export, or troubleshoot OpenTelemetry traces, metrics, and logs, including language SDKs, the OpenTelemetry Collector, zero-code instrumentation, semantic conventions, OTLP, platforms, security, compatibility, or reference architectures, especially when they need official OpenTelemetry documentation, exact links, or docs-grounded guidance.

griddynamics Bundle

To design and audit Solr schemas: field types, analyzers, docValues, solrconfig.

bejeweledme Bundle

Design, review, and evolve classical software and distributed service architecture: boundaries, data authority, capacity, consistency, caching, queues/streams, replication, sharding, recovery architecture, security, and safe migration. Use for architecture documents, production-readiness reviews, and system design interviews. Route HTTP/OpenAPI artifact and wire compatibility work to api-contract-engineering.

bejeweledme Bundle

Assess security claims for a scoped design, application change, release, repository, or OSS dependency. Use for abuse-path review, application-verification evidence, supplier posture, and security findings or release recommendations; ordinary maintainability review belongs to software-engineering.

bejeweledme Bundle

Use when designing, building, reviewing, validating, debugging, deploying, or operating Telegram Mini Apps and Telegram Web Apps. Trigger for Telegram bot + mini app architecture, launch modes, BotFather setup, initData authentication, backend validation, HMAC/Ed25519 checks, tma.js, Telegram WebApp API, native buttons, theme/viewport/safe area, CloudStorage/DeviceStorage/SecureStorage, biometrics, sensors, location, Telegram Stars/payments, WebView testing, mobile debugging, production readiness, security reviews, and long-term maintenance.

uwayxt Bundle

Audit and maintain route connections across the application. Use when adding pages or refactoring navigation.

uwayxt Bundle

Audit interface for auth boundaries, sensitive data exposure, and privacy compliance. Use when security review, privacy audit, data exposure, GDPR, or auth UX.

uwayxt Bundle

Audit layout for focal point, contrast, rhythm, and CTA hierarchy. Use when visual hierarchy, does this layout read well, check contrast and rhythm, what should the eye see first, or layout review.

uwayxt Bundle

Scan all interactive elements for missing handlers, broken links, and unconnected state changes. Use when buttons without actions, orphaned interactive elements, dead links, form without submit, or incomplete interactions.

uwayxt Bundle

Autonomous project health audit engine that computes a Token Adherence Index (TAI) score (0–100), maps quality gaps to specific Agentway skills, and generates a structured Health Report Card with a prioritized prescription queue. Use when: health check, diagnose project, TAI score, what skills do I need, agentway doctor, project quality audit, skill recommender.

uwayxt Bundle

Predict visual attention paths and audit cognitive friction using eye-tracking simulation, Fitts's Law motor effort, Hick-Hyman Decision Time, and Visual Saliency Ratio. Use when cognitive load, attention heatmap, eye tracking, visual friction, CTA hierarchy, decision overload, or first 500ms attention.

ashermahonin Bundle

Use for secret management, IAM and RBAC hardening, Vault, KMS, SOPS, Sealed Secrets, CI secrets, workload identity, supply chain security, scanning, SBOM, signing, policy gates, audit, access review, and rotation.

ashermahonin Bundle

Select and coordinate the smallest sufficient Agentic Skills route for broad software work. Use when a request spans product definition, architecture, implementation, validation, security, release, or several ownership areas. Do not activate for a familiar one-file change that already has clear acceptance criteria and validation.

ashermahonin Bundle

Review a web application, API, or mobile backend against the current OWASP Top 10. Use before release and after material changes to authentication, authorization, data flow, dependencies, integrations, cryptography, logging, or exception handling. Produce category status, concrete evidence, remediation ownership, residual risk, and a release recommendation.

ashermahonin Bundle

Review a native iOS or Android application against current OWASP MASVS and relevant platform controls. Use before release and after changes to authentication, local storage, networking, WebViews, deep links, permissions, signing, privacy, resilience, or SDKs. Review backend and API surfaces separately with the web security skill.

ashermahonin Bundle

Find the smallest useful reading set in an Obsidian-compatible project vault by following indexes, wikilinks, metadata, and task scope. Use before loading project notes for planning, architecture, security, implementation, or handoff. Do not read the whole vault when a focused path can answer the task.

oliver-kriska Bundle

Narrow bare rescue in Elixir so real errors like KeyError and typos propagate instead of being swallowed. Use to audit rescues and refactor error handling.

yangliu2060 Skill

AI 可读性审计：检查网站是否适合大模型抓取、理解和引用，并给出优化建议。

randommonicle Skill

Nothing enters a file without a present need. Code earns its place by a caller that exists, a comment by saying what the code cannot, flexibility by a stated requirement. Triggers on over-engineered, over-commented, YAGNI, speculative, gold-plating, "just in case", "future-proofing", "flexibility", and on "simplify" / "keep it simple" (both over-correction ditches are fenced); more generally when writing or refactoring code. Does not fire on recognising AI-written code (unslop-code owns the audit), failure-message wording (honest-failure-surfacing), or client-supplied data rules (server-side-authority).

randommonicle Skill

Nothing that can carry a secret value may reach a tool result, because the transcript is a synced file re-sent on every turn. Check an env var by presence and length only, list names not values, read a .env file by its keys, capture provider status output and API responses into a variable and print a named allowlist, and dry-run the output shape on a dummy value first. Triggers on any command, script or API call that names an env var, a .env file, a key, token, password or secret, or a credential-carrying header. Does not fire on whether a changed value is live (env-change-verification) or on comparing a secret (constant-time-secret-compare).

randommonicle Skill

Four server-side authority rules for any client-facing backend. Never trust a client-supplied storage path or object id — derive it server-side from the row the caller owns. An RLS self-update policy must scope columns, not just rows, or a user can promote their own role. Every exposed table gets RLS enabled or its grants revoked — a code comment is not a control. Escape all dynamic output in admin surfaces. Triggers when adding or reviewing a route that accepts client-supplied paths/ids, an RLS self-update policy, a new public-schema table, or an admin dashboard render. Does not fire on general security review (the security-review command) or client-side validation UX.

randommonicle Bundle

Turn a real repository into a project-specific skill library that preserves a senior engineer's operating knowledge, so juniors and smaller models can carry the project forward. Load when asked to build, refresh, or audit a skill library or engineering playbook for a codebase, to capture tribal knowledge before someone leaves, to onboard engineers, or to make a repo easier for AI agents to work on. This is project-agnostic and installed user-level, so it applies to every project on this machine; the PropOS repo's own propos-* family is the worked example it was derived from. Do not load it to write a single skill on a topic you already know (write that skill directly).

randommonicle Skill

Compare bearer tokens, API secrets, signatures, and password-equivalents with a constant-time comparison (hash both sides, then crypto.timingSafeEqual) — never == or short-circuiting string equality. Triggers when writing any code that checks a secret against a stored or expected value. Does not fire on comparing non-secret identifiers.

shoootyou Skill

Audit milestone completion against original intent before archiving

shoootyou Skill

Create phases to close all gaps identified by milestone audit

cklxx Bundle

When coding is done and changes need review → multi-dimensional code review (SOLID, security, quality, edge cases), outputs structured report.

cklxx Bundle

When multiple skills need coordinated activation → manage skill activation, conflict arbitration, strategy, and audit.

vinvcn Bundle

Writing, exploit——把原始素材塑造成文章，一段一段地推进。

cacr92 Skill

当用户要求安全审查、安全检查、漏洞扫描或提到安全时使用。

weirdgme Bundle

DevSecOps - Security Integration in Development

weirdgme Bundle

Build engineering covering build systems (Make, Gradle, Maven, Bazel), compilation optimization, dependency management, artifact repositories, build pipelines, reproducible builds, build caching, monorepo strategies, supply chain security, and performance optimization. Use when creating build processes, optimizing build times, managing dependencies, or implementing CI build pipelines. (project)