Security

netvar1337 Skill

Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks, protected binaries, or debugging security-sensitive game components.

s-hiraoku Skill

Review a diff for concrete security risks across injection, authn/authz, secrets, supply chain, infrastructure, and business logic.

azzygoatcoder Skill

Guided security fix workflow. Use when the user wants to fix security audit findings, remediate vulnerabilities, apply security patches, or work through a security audit report. Triggers on "/security-fix", "fix security", "remediate", "apply audit fixes", "修安全漏洞", "修复审计问题", "安全修复", or when the user mentions a SECURITY_AUDIT.md file and wants to fix the findings.

azzygoatcoder Bundle

Use when the user wants to audit a codebase for security vulnerabilities, run a 代码审计 or 安全审查, do penetration testing, or verify that security fixes were applied. Triggers on "audit this repo", "security review", "find vulnerabilities", "安全审计", "代码审计", "安全扫描", "再审计", "检查修复", "确认修复", "re-audit", "verify fixes", "/audit", "/reaudit". Covers full audit (Phase 1-3) plus incremental re-audit and fix-state tracking (Phase 4). To APPLY fixes use security-fix-skill.

dzhuneyt Skill

Use when the user invokes /reflect or asks to reflect on, wrap up, or take stock of the current session. Re-reads the in-context conversation for anything that would die when the session closes — dropped action items, durable lessons with no home, stale docs, skillify opportunities, global/project CLAUDE.md and AGENTS.md and README gaps, and follow-ups worth an issue or a PR — surfaces them as one ranked shortlist, then acts on the ones the user selects. Not a git-history retro and not a full doc audit.

martintmk Skill

Review Rust changes for metrics, logs and spans that break OpenTelemetry semantic conventions, destabilize an existing dimension set, risk unbounded cardinality, allocate per emission, or duplicate instrumentation a library already provides. Use for a focused telemetry audit, or when review-lens routes changed telemetry here. Not for general logging style or for telemetry backend and exporter configuration review.

martintmk Bundle

Audit a Rust library's exported contract using cargo-public-api output only, then isolated rustdoc-based filtering of provisional claims. Use for a whole-crate or explicit output-only API audit, or review-lens's mandatory output-only pass; small PRs cover changed public items and their immediate family. Applies idiomatic Rust API practices and API-visible Pragmatic Rust Guidelines. Not for source-based findings, implementation correctness, docs quality/consistency, performance or posting.

martintmk Skill

Review Rust changes for recovery classification and retry, timeout, circuit-breaker, hedging, fallback or chaos behavior that should use approved middleware. In recoverable/seatbelt repositories, checks Recovery against the exact recoverable version's _documentation::recipes and audits seatbelt adoption. Use for a PR, branch, commit, working-tree diff, or focused crate audit. Not for a general code review or ordinary error changes with no recovery concern.

martintmk Skill

Review Rust changes for behavioral defects and prove each one before raising it: control-flow and version gates, boundary and representation limits, resource and free-list models, cancellation and drop safety, time arithmetic, and round-trip or invariant claims. Uses reproductions, Miri and bounded adversarial inputs under the shared verification discipline. Use for a focused defect audit, or when review-lens routes behavioral risk here. Not for API design, naming, or formatting.

godmode-team Skill

Red Team Security Audit

godmode-team Skill

World-class 6-phase onboarding that personalizes GodMode, discovers the user's world, connects tools, runs a GodMode Audit, and delivers a first win

c-kick Skill

Activates evidence-grounded behavioral constraints that minimize hallucination. Use this skill when the user invokes /factual-mode, or when they ask for "factual mode", "grounded mode", "no guessing", "only use what's in front of you", "don't hallucinate", "stick to the facts", "evidence-based only", or any variation requesting that the assistant restrict itself to verifiable claims. Also appropriate when the user is about to analyze documents, audit code, review contracts, or perform any task where accuracy matters more than creativity.

c-kick Skill

Senior Staff Engineer code review with SOLID principles, security analysis, and architecture critique. Use for significant changes, new systems, or when you want ruthless technical feedback.

sahilkhan30 Skill

Use when implementing Spring Security 6, JWT/Session authentication, RBAC, PII masking, and HMAC message integrity verification.

spardutti Bundle

MUST USE when writing or reviewing Express routes, middleware, or error handling. Express 5 — automatic async error forwarding, the four-argument error handler, named wildcards, validation at the boundary, thin routes, and the security baseline every production app needs. Bundle covers tRPC v11 on Express.

spardutti Skill

MUST USE when writing or reviewing code that handles user input, authentication, authorization, API endpoints, database queries, secrets, or any security-sensitive functionality. Enforces OWASP Top 10 prevention, secure defaults, and defense-in-depth patterns.

caomeiyouren Bundle

使用 GitHub CLI（gh）处理仓库、issue、pull request、workflow、project、release、codespace、gist、search、api、auth、config、alias、secret、variable、extension、ruleset 和 status 等命令行操作时使用。用户提到 gh、gh cli、GitHub CLI、gh auth、gh repo、gh issue、gh pr、gh workflow、gh project、gh release、gh api、gh search、gh codespace、gh secret、gh variable、gh alias 时都应触发。

caomeiyouren Skill

对鉴权、权限、输入处理、数据写入、依赖配置、密钥、日志和外部调用进行安全审计时使用。用户提到 security、auth、permission、vulnerability、secret、injection、审计登录逻辑、权限合规时都应触发。

epistemedeus Skill

Run a combined AI-search-readiness audit for a public company domain. Use when one report should join firmographics, technology, contact and DNS evidence, an AI-readiness score, structured-data gaps, a paste-ready JSON-LD fix list, and a combined grade. Do not present the grade as a search-ranking guarantee or invent missing business facts.

fiveonecode Bundle

Review pull requests, commits, or diffs for high-signal engineering issues and merge risk. Use when asked to review code, audit a patch, find bugs, or provide merge readiness feedback. Focus on defects introduced by the proposed changes (correctness, security, performance, reliability, and maintainability) and report actionable findings with severity, confidence, and precise code locations.

fiveonecode Bundle

Set up, audit, or diagnose iOS background (silent) notifications end to end: signed entitlements, APNs registration and environment, provider headers and payload, throttling, Simulator and device testing, and Apple delivery diagnostics. Use for content-available pushes or missing background delivery; not for visible alerts, Live Activities, PushKit, or provider-specific SDK setup.

fiveonecode Bundle

Check a Git repository's current candidate for high-confidence credential, private-key, and machine-home leaks, then perform a bounded public-release review. Use before publishing source or opening a public PR; do not use it to claim complete history or workflow-execution safety.

rosslevinsky Skill

Audit TSX files, identify non-UI logic, and extract it into custom hooks. Use when the user invokes /extract-hooks, or says "extract hooks", "move logic out of components", or "separate logic from layout".

sarveshtalele Bundle

Validate a set of engineering artifacts against governance rules and emit a deterministic pass/fail audit report with a compliance score. Trigger on: governance check, compliance audit, validate spec, gate, review compliance.

sentenz Bundle

Audit GitHub Actions workflow efficiency and recommend fixes to reduce CI minutes and costs.

aqwsde321 Bundle

Audit the active Codex skill catalog as a suite, then drill into specified or high-risk skills for trigger precision, information structure, guidance, pruning, and behavior-backed validation. Invoke only through $skill-quality-review; with no target audit the current active catalog, with a skill target perform a deep review, and with a directory target audit that suite. Do not scaffold a new skill.

jwiegley Bundle

Methodology for the user-triggered /wiggum command (do not self-invoke). An autonomous-continuation loop for long-running work -- run, checkpoint, and verify until a defined Definition of Done holds or a stop-and-escalate condition fires. Covers durable handoff state, baseline re-verification after context compaction, per-commit self-audit, work-unit commit and restack cadence, subagent fan-out limits, host-conditional anvil (live Emacs) tooling, and escalation.

jwiegley Bundle

Exhaustively verify code comments against the current state of a project. Use when asked to audit, fact-check, or validate comments/docstrings -- to confirm that every claim a comment makes is true, that any code shown in a comment actually works, and that everything a comment references still exists. Supports auditing an entire project or only the changes in a PR or stack of PRs. Triggers: "check the comments", "are these comments still accurate", "audit comments in this PR", "verify the docstrings".

lingwei-zheng Bundle

Audit and slim down skill folders by removing redundant instructions, shortening SKILL.md, and moving detail into references or scripts. Use when Codex needs to refactor a skill repo, simplify its layout, dedupe content, or validate that a skill follows the compact OpenAI skill structure.

lingwei-zheng Bundle

Use when evaluating a research proposal, rough idea, paper concept, manuscript, pre-submission package, or journal targeting strategy through an advisor-style assessment. Triggers include proposal review, idea evaluation, research supervision, manuscript pre-submission audit, journal targeting, 投稿建议, 研究想法评估, 论文投稿路线, and 投稿期刊选择. Produces one integrated Simplified Chinese report by combining good-question, good-story, academic-research, Zotero evidence, and web literature checks as appropriate to the task.

gurudevvv Bundle

Project organization audit in Quick (~5 min) and Full (~8 min) modes. Diagnoses CLAUDE.md quality, memory consistency, file structure, git hygiene, automations. Produces a severity-grouped actionable report. Use when: "аудит проекта", "проверь проект", "проверь структуру", "audit project", "check project health", "что не так с проектом", "почисти проект", "проверь CLAUDE.md", "memory audit", "аудит memory", "project health check", "навести порядок в проекте", "ревью проекта", "оцени состояние проекта", "clean up project", quick/full audit, new project assessment, pre-share cleanup. Do NOT use for: code review, PR review, debugging, runtime issues, or reviewing specs/designs (use multi-layer-review for those).

xiwan Bundle

审计 skill 的安全风险。扫描凭据泄露、危险命令、网络外传、文件越界等问题。用于：(1) 安装新 skill 前的安全检查 (2) 定期审计现有 skills (3) 发布 skill 前的自检。触发词：skill 安全、审计、security audit、检查 skill。

mxrsv Bundle

Review a change you just implemented — correctness against its callers, test quality, and code-level security — over a git range or the working tree. Run right after finishing a unit of implementation and before committing it. Not for reviewing a spec or a plan (use /review), not for whole-repo architecture, dependencies or docs drift (use /review-health), not for user flow in a browser (use /review-experience).

mxrsv Bundle

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

codyswanngt Skill

Set up OpenClaw as the chat-surface runtime for this project's staff. Verifies the openclaw CLI, ~/.openclaw/openclaw.json, a secret provider, and required gateway capabilities, then writes a lean `openclaw` section to .lisa.config.json. Run before connect-staff / connect-repo-topic.

bioconductor Skill

Analyze R package code coverage using covr, audit existing tests for tautological assertions, classify testing gaps, and proactively write test cases to improve coverage and result correctness.