Security

agnik47 Bundle

A production-grade engineering quality gate that performs architecture review, security validation, performance analysis, testing verification, and release readiness checks before code is approved or merged.

mantasimb Bundle

Audit the current branch, unpushed commits, or working-tree diff against repository documentation and engineering guidance, then report misalignments before proposing or making changes. Use when a feature has been implemented and Codex should verify alignment with architecture docs, clean-code guidance, testing expectations, feature documentation, ADRs, READMEs, or other repository-defined standards before updating code or docs.

adelrioj Bundle

Use to run a whole-system adversarial audit of the current repo across three lenses at once — codebase (defects, incoherences, affordance gaps), docs (drift, structure, coverage), and process (end-to-end workflow dead ends). Dispatches three fresh Claude subagents in parallel, each writing a ranked findings report to docs/audits/, then offers an optional fix pass on CRITICAL findings. Triggers on: review codebase, audit codebase, audit this repo, adversarial audit, codebase audit, docs audit, process audit, fable audit, three reviews, full audit, whole-system review, find everything wrong.

acquia Skill

Use when user asks about fixing security vulnerabilities, composer audit failures, vulnerable Drupal packages, or CVE advisories in a Drupal codebase.

stackloklabs Bundle

Identify security vulnerabilities and recommend fixes based on OWASP guidelines

avisheku Bundle

Repeat audit then 2080 review; reuses models config. Manual invoke only.

avisheku Bundle

Search ledger and emit audit report with error-map cross-ref.

danmaps Bundle

Audit ArcGIS Pro projects for broken layers, schema issues, and performance risks

danmaps Skill

Turn outputs from schema-smells, project-audit, and spatial-index into a plain-language risk summary with a ranked “will bite you later” list and remediation order.

escoffier-labs Skill

Use when asked to simplify, clean up, tidy, or refactor code for clarity without changing what it does, or when the user says "simplify this", "clean this up", "make it readable", "reduce the complexity", or "tidy this". Behavior-preserving only; not a bug or security audit (use bug-hunt or security-sweep for those).

nagisanzenin Skill

[production-grade internal] Audits code for security vulnerabilities — OWASP top 10, auth flaws, injection, data exposure, dependency risks. Routed via the production-grade orchestrator.

cwijayasundara Skill

Run code review and security review on implemented code. Checks architecture compliance, quality principles, test coverage, and security vulnerabilities.

hyqibot Skill

使用可视浏览器自动完成 CoPaw 的钉钉频道接入。适用于用户提到钉钉、DingTalk、开发者后台、Client ID、Client Secret、机器人、Stream 模式、绑定或配置 channel 的场景；支持遇到登录页时暂停，等待用户登录后继续。

sailingnaturali Skill

Use when publishing or maintaining a SignalK plugin and you want to know its registry score. Fetches the actual published score from the registry, previews the criteria you can fix locally (screenshots, changelog, audit, plugin-CI) with what each gap costs, and triggers an on-demand re-score via the registry's rescore issue template instead of waiting for the nightly run.

janeeyre3007 Bundle

瑞数/Ruishu/Rivers Security 专项逆向。Use ONLY with clear Ruishu evidence: $_ts.nsd/cd/l__, r2mKa, meta[r=m], Cookie S/T/P, basearr, hasDebug, 瑞数 412/403, Cookie T/P 纯算, or 瑞数 URL suffix/动态防护参数。Also use for Ruishu-specific sdenv, JsRpc, browser-rpc, and runtime XHR suffix work. Do not use for ordinary sign/token tracing, generic sdenv/JsRpc/browser RPC, generic browser hooks, generic Node.js env patching, or AST deobfuscation without Ruishu evidence.

peterbamuhigire Skill

Use when producing or revising any research artefact to prevent generic, unsupported, repetitive, or mechanically styled output in real time; use ai-slop-audit to grade a concrete completed iteration independently.

peterbamuhigire Skill

Use when auditing a concrete artefact for AI slop after a major iteration or before release, with evidence-backed findings, fixes, genericness score, and A/B/C/F verdict; use anti-ai-slop during production rather than for retrospective grading.

peterbamuhigire Bundle

Use when creating or upgrading skills in this repository. Covers repository-specific frontmatter rules, progressive disclosure, reference-file strategy, validation, and the quality bar required for production-grade engineering skills.

peterbamuhigire Skill

Use when performing a read-only safety review of a new or changed skill for credential harvesting, unsafe installers, hidden mutation, excessive permissions, unknown tools, or instruction conflicts; use skill-writing for structural quality and source-verification for factual claims.

bbrysonelite-max Skill

Maintain Brent's INSTALLED skill library — audit ~/.codex/skills for integrity (name↔folder mismatches, missing SKILL.md, stray files, dead symlinks, inactive-profile leaks), reconcile it against the Git-backed codex-skills/SKILLS-INDEX.md (what's new vs stale), and regenerate that index preserving his categories. Read-only audit by default; fixes are per-item approved; it QUARANTINES cruft to the dump, never deletes. The maintenance complement to skill-miner (miner finds new skills; librarian keeps the shelf clean). Use when Brent says "skills librarian", "clean up my skills", "skills are a mess", "dedupe my skills", "update the skills index", "what skills do I have", or after building/installing skills.

bbrysonelite-max Bundle

Use when a proposal, plan, or design needs its assumptions challenged against available evidence before implementation begins.

bbrysonelite-max Bundle

Use when an implemented AI feature needs its planned evaluation dimensions, guardrails, and evaluation infrastructure checked before deployment.

bbrysonelite-max Bundle

Use when requirements or acceptance criteria need traceability to tests and executable proof before work is declared complete.

clickpulsecommerce Bundle

Detects and removes WordPress malware, backdoors, and security vulnerabilities. Scans files for malicious code patterns, obfuscated scripts, suspicious functions, and unauthorized modifications. Fixes compromised files and documents all changes. Use when working with WordPress sites, detecting hacks, security audits, malware removal, or when suspicious files are found.

openai Bundle

Internal prototype QA helper. Use only after a Product Design prototype, URL-to-code build, or image-to-code build has a source visual target and a rendered implementation to compare before handoff. Do not use for broad UX critique, design critique, product audits, or flow reviews; route those user-facing requests to audit.

chillicream Bundle

GraphQL schema design and review. Use when designing new GraphQL schema changes (types, mutations, queries, connections, enums, errors), reviewing schema diffs, planning schema evolution, or auditing nullability and naming. Triggers on 'graphql schema design', 'design a mutation', 'design a query', 'design a type', 'new type', 'new mutation', 'review schema', 'review schema diff', 'schema review', 'schema evolution', 'audit the schema', '/graphql-schema-design'.

moussaoui-ghiles Bundle

Audit an existing B2B offer from the perspective of a cold buyer with no transferred trust. Use when reviewing a website, proposal, call transcript, case study, offer note, pricing or terms, or user-supplied answers to determine what is clear, supported, coherent, and safe to test; expose contradictions, claim-to-proof gaps, risk, effort, time-to-value, and first-commitment weaknesses without claiming market validation or likely conversion. Do not use to invent, redesign, or build an offer; route an explicitly requested post-audit rebuild to offer-creation.

moussaoui-ghiles Bundle

Legacy content framework. Use only when the user explicitly invokes $audience-content-os. Do not auto-trigger for ordinary content, LinkedIn, newsletter, hook, headline, audit, or source-transformation requests.

tariux Skill

Produces a rigorous, forward-looking technical audit with severity ratings and improvement directions.

hoangnguyen0403 Skill

Verify feature, bug, UI, API, mobile, security, or deployment work against acceptance criteria.

promisingcoder Skill

Inspect, patch, validate, publish, or confirm MarketingClaw GHSA security advisories and private-fork state.

promisingcoder Bundle

Triage, redact, clean up, and resolve MarketingClaw GitHub Secret Scanning alerts in issues or PRs.

ssrjkk Bundle

Implements OAuth 2.0 authentication and JWT-based authorization with refresh tokens. Use for secure API access.

claude-dev-suite Skill

PHP code quality: static analysis, coding standards and best-practice enforcement for PHP codebases. USE WHEN: working with PHP codebases requiring code quality analysis, static analysis, or best practices enforcement DO NOT USE FOR: security-specific issues (use `php-security`), runtime debugging, or deployment

claude-dev-suite Skill

API security across REST, GraphQL and gRPC, organised around the OWASP API Security Top 10:2023. USE WHEN: designing, implementing, or auditing REST, GraphQL, or gRPC APIs for security vulnerabilities DO NOT USE FOR: general API design patterns (use the `rest-api` / `graphql` skills), authentication setup (use the `jwt` / `oauth2` skills)

claude-dev-suite Skill

PHP application security: vulnerability review and secure implementation patterns. USE WHEN: securing PHP applications, reviewing code for vulnerabilities, or implementing security best practices DO NOT USE FOR: code quality issues (use `php-quality`), general PHP development patterns