Security

bioconductor Skill

Perform comprehensive security audit of R/Bioconductor packages

mine-fnl Skill

Use when designing or hardening a Content-Security-Policy header for an HTTP application. Applies when the user asks for "CSP", "Content Security Policy", "nonce-based CSP", "strict-dynamic", or "XSS hardening headers". Do not use for non-web platforms (native, mobile), for CORS configuration (use a CORS skill), or for setting CSP via a managed WAF without owning the header value.

mine-fnl Skill

Use when an incident has been resolved and the team needs to write up what happened, why, and what changes. Triggers: "write the postmortem", "incident review", "what happened during the outage", "let's schedule the postmortem". Do not use during an active incident (use an incident-response skill instead), for near-miss reviews that did not cause user impact, or for security-incident write-ups (those have different disclosure requirements).

mine-fnl Skill

Use when reviewing a code change for security implications — pull requests touching auth, secrets, crypto, input handling, deserialization, network calls, file system access, or any user-controlled data flow. Triggered by "security review", "is this safe to ship", "any vulns here", or "audit this change". Do not use for general code review (use code-review-checklist), threat modelling new systems (use a dedicated threat-modelling skill), or compliance audits.

notharshhaa Bundle

Perform a broad infrastructure and DevOps audit as a senior platform engineer, across reliability, security, cost, observability, and operability, then produce a prioritized, evidence-based findings table and self-contained remediation plans for other agents to execute. Strictly read-only — never applies changes. Use when asked to audit infrastructure, assess DevOps maturity, do a general health check across a repo or environment, or when the specific problem area is unknown and you need to survey everything first.

notharshhaa Bundle

Write or audit operational runbooks as a senior SRE — one document per failure mode, with detection signal, triage decision tree, verified read-only diagnostics, mitigation with rollback, escalation path, and verification — grounded in the real repo, alerts, and dashboards rather than generic advice. Strictly read-only on systems — it drafts documents under runbooks/ and never executes a mitigation itself. Use when asked to write a runbook or on-call playbook, document a failure mode or recovery procedure, close a "no runbook for this alert" gap, or review existing runbooks for staleness and accuracy.

rtfm-it-services-llc Skill

Use this skill for anything about how your MSP runs day-to-day support: setting or questioning a ticket's priority, response and resolution targets, "the client says everything is down", escalation, after-hours or emergency requests, security incident intake, triage order, your PSA (ticketing) system workflow, time entries, or ticket categories. Also trigger when drafting anything that describes support levels or response times to a client, and when training new hires on the service desk workflow (client onboarding is msp-onboarding). Apply alongside msp-client-comms (the messages clients receive during incidents), msp-legal (the SLA schedule lives in each client's Order; security incidents have contract implications), msp-pricing (after-hours billing multipliers), msp-maintenance (alerts that escalate into tickets, and the on-call rotation behind the after-hours line), and msp-metrics (ticket data feeds every business number).

rtfm-it-services-llc Skill

Use this skill whenever writing an operational message to an existing client of your MSP: outage or incident notices and updates, planned or emergency maintenance announcements, post-incident summaries, security advisories ("warn our clients about this phishing wave"), price change letters, new-user-ready or user-offboarded confirmations, and ticket closing notices. Trigger on "draft an email to the client about", "let them know", "notify clients", "tell the client", or any in-service client notification. Sales outreach to prospects belongs to msp-sales; this skill owns messages to clients already under agreement. Apply alongside msp-brand (voice and signature), msp-helpdesk (priorities set the cadence), msp-legal (anything touching breach, liability, or contract mechanics), and msp-pricing (any number).

geekfujiwara Bundle

パーソナルスキルの新規作成・更新に加え、公開前の品質ゲート (汎用化・秘匿化・ コンプライアンス・業務コンテキスト・SKILL.md 簡潔化・参照整合・階層化) を実施する。 Use when user asks to "スキルを作って", "スキルを更新", "スキルをブラッシュアップ", "スキルを公開したい", "スキルをチェックして", "create/update/audit a skill". Do NOT use for 検証・採点・削除のみ — 利用環境のスキル管理機能に委譲。

mardab96 Skill

Google Ads Conversion Tracking Audit

mmiani Bundle

Use when reviewing implemented Kotlin Multiplatform / Compose Multiplatform code for architecture consistency, business-logic placement, state correctness, concurrency, Compose quality, design-system usage, security, performance, resilience, and maintainability.

ferroxlabs Skill

Generate a cross-platform AI audit (Trident) on a diff, brief, or artifact. Trigger: 'cross audit', 'Trident', 'second opinion', 'check with other AIs', 'cross-check this', 'get another perspective', /cross-audit

leeyudok Bundle

에이전트 영속 메모리를 실제 근거(코드·DB·이슈 트래커·파일시스템)와 대조해 낡은 기억을 교정하고 죽은 기억을 아카이브 후보로 보고하는 감사 스킬. 메모리가 ~30개 파일을 넘었을 때, 큰 스택/인프라 변경(라이브러리 교체, 버전 업그레이드, 서버 이전, 스키마 삭제) 직후, 두 메모리가 서로 모순돼 보일 때, 또는 "메모리 정리해줘 / 감사해줘"(clean up / audit my memory) 요청에 사용한다.

multiatlas Skill

Las escrituras de un endpoint admin en Supabase con RLS (INSERT/UPDATE/DELETE) DEBEN usar el cliente service_role tras verificar que quien llama es admin, NUNCA la clave anon. Con anon, RLS bloquea la escritura, afecta 0 filas SIN lanzar error y el endpoint responde success:true — el admin ve "guardado" y en la base de datos no hay nada. Invocar al crear o auditar cualquier endpoint admin de escritura en un proyecto Supabase con Row Level Security.

traderalice Skill

Audit and coordinate the active OpenAlice Workspace floor without turning the manager into another business desk.

yipxiyi Skill

Use when a user asks to use OpenArc generally, initialize governance, improve repository continuity, audit governance drift, migrate an existing workspace, or choose which OpenArc skill should handle a request.

amatray Skill

Use when the user asks to audit, review, or check Stata dofiles for macro definitions, undefined paths, internal consistency, or unused variables. Triggers on "audit code", "audit dofiles", "check my Stata code", "audit my Stata project", or "/audit-code".

amatray Skill

Use when the user wants to verify whether the citations in a LaTeX or markdown manuscript actually support the claims they're attached to, or wants a citation audit against their .bib. Triggers on "check my citations", "verify references", "citation audit", "do my citations actually support what I wrote", "audit bibliography against claims", or "/lit-review-verify". Not for producing a literature review or finding related papers (use /lit-review), and not for cleaning bib metadata (use /clean-bib).

fhgomes Bundle

Privacy and data-exposure specialist for code — a PRE-PUBLICATION audit of repositories that are about to go public (or already are). Hunts leaked secrets and sensitive data: API keys, tokens, passwords, connection strings, private keys, certificates, database credentials, CI secrets, service accounts, internal IPs and hostnames, private endpoints, and personal data — PII (Brazilian CPF/RG/CNPJ IDs, e-mail, phone, address, customer names), PCI (credit card numbers, CVV), PHI (health data) — in the working tree AND in GIT HISTORY, where a leak survives even after the file is deleted. Teaches remediation: move to an environment variable, .env, application.properties, parameter, or secret manager; create .env.example; fix .gitignore; rewrite history; and rotate the exposed credential. ALWAYS use when the user says: "I'm making this repo public", "can I publish this?", "is there a secret in the code?", "did a password leak?", "check whether a key was committed", "audit before publishing", "is this repo safe to op

armelhbobdad Bundle

Drift detection between skill and current source code. Use when the user requests to "audit a skill" or "audit skill" for drift.

mrilikecoding Skill

Map and audit the logical structure of an academic paper's argument. Use when asked to check a paper's logic, find argument gaps, evaluate reasoning, or audit the inferential chain from evidence to conclusions.

mrilikecoding Skill

Comprehensive audit of a paper's citations. Verifies every reference exists, checks claim-source alignment, identifies missing seminal works, and analyzes citation patterns for bias. Use when asked to check references, verify citations, or audit a bibliography.

mrilikecoding Bundle

Comprehensive multi-lens codebase architectural analysis with pedagogical stewardship framing. Evaluates architecture, patterns, code health, test quality, documentation accuracy, and system invariants. Use when approaching a new or poorly-understood codebase, or when you need to understand a codebase's actual architecture vs. its intended architecture.

surya8991 Skill

Blunt, factual code review. No sugar coating. Finds bugs, security issues, performance problems, and architecture flaws. Use when user says /codereview or asks to review code.

surya8991 Skill

Security auditing skill for web applications and codebases. Scans for OWASP Top 10, dependency vulnerabilities, secrets exposure, XSS/CSRF/injection flaws, auth weaknesses, and misconfigurations. Use when task involves security scan, vulnerability assessment, pen test review, threat modeling, or hardening a codebase.

fabioc-aloha Skill

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. OWASP-aware, language-agnostic principles with TypeScript examples — applies to any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

amaledtuning Bundle

File-first memory sandbox for Codex. Stores compact durable task-state snapshots, ingests docs, and compiles deterministic knowledge pages, with query and lint/audit support.

johnsonbuilds Skill

Use when users ask to analyze skills, audit skills, check skill health, generate skill reports, inspect installed skills, review skill packages, find duplicate skills, identify unused skills, evaluate skill quality, or run Skill Inspector.

krishyaid-coder Bundle

Reviews staged Python diffs for security issues. Use when the user says 'review my changes' or wants a security pass before commit.

krishyaid-coder Skill

Reviews staged Python diffs for security issues. Use when the user says 'review my changes' or runs git diff before committing.

meshmakers Bundle

One-time, safe setup of the Loki / monitoring-Grafana credentials that the /octo-logs skill relies on. Stores LOKI_USERNAME / LOKI_PASSWORD in the gitignored private PowerShell profile that the octo-tools profile dot-sources — sourced from Keeper or Vault, with the password piped straight from the secret store into a writer that never prints it or takes it as a CLI argument. Supports per-cluster credentials. Run this when /octo-logs reports credentials are missing. Trigger on: set up Loki credentials, configure log access, LOKI_USERNAME, LOKI_PASSWORD, monitoring Grafana password, store Grafana credentials, logcli auth, log credentials missing, octo-logs setup, Keeper Grafana monitoring, Vault grafana admin_password, private profile credentials.

prashantdivate Bundle

Yocto security hardening and OTA/update skill for AI coding agents. Use for CVE checks, package/license review, firewall policy, SSH hardening, systemd security, read-only rootfs, dm-verity, secure boot, measured boot, signed artifacts, SBOM, SPDX, vulnerability triage, SWUpdate, RAUC, Mender, OSTree, A/B updates, rollback strategy, and production image hardening.

prashantdivate Bundle

Official-doc-first Yocto security, CVE, license, and SBOM compliance support for AI coding agents. Use when investigating cve-check results, vulnerable packages, security patch backports, LICENSE and LIC_FILES_CHKSUM issues, license manifests, SPDX or SBOM output, source provenance, reproducibility concerns, package audit findings, or compliance-sensitive Yocto/OpenEmbedded image and recipe changes.

tommasobbianchi Skill

Vigilanza pre-consegna. Invocala SEMPRE prima di "fatto", "done", "ok prova", "ho consegnato X", prima di commit+push, prima di chiudere un'azione che ha effetto fuori dalla conversazione. Use BEFORE telling the user the task is done — runs efficacy + cleanup + confidence calibration. Triggers anche su "perfetto", "pronto", "tutto a posto", "puoi provare ora".

tommasobbianchi Skill

Orchestratore dei sottosistemi cognitivi (goal-stack, inhibit, self-monitor, outcome-eval, error-check, cleanup-check, calibrate, handoff-audit). Invocala a session start, dopo un compact/clear, prima di affrontare un task non triviale, o quando vuoi un "reset disciplinato" del proprio modo di lavorare. Use to set up which cognitive sub-skill fires at which moment of the task lifecycle — prevents skipping critical checks under time pressure.

agnik47 Skill

Performs senior-level code reviews covering security, maintainability, architecture, performance, and production readiness before code is merged.