Security

x402agent Skill

Production-grade multi-threaded Rust vanity address generator for Solana — 100K+ keys/sec using Rayon parallel iterators with solana-sdk, Base58 pattern matching, prefix/suffix support, security-hardened file output, and Criterion benchmarks.

x402agent Skill

Production-quality Bash scripts for Solana vanity generation, keypair verification, batch operations, dependency auditing, and test orchestration — with security-hardened patterns including file permissions, input validation, and cleanup traps.

erp-core-dev Skill

Review PHP/Laravel code for PSR-12, PHP 8.3+ idioms, and security best practices

erp-core-dev Bundle

Review code for quality and security

erp-core-dev Skill

Review Ruby/Rails code for idioms, Rails conventions, and security best practices

erp-core-dev Skill

Run security vulnerability scan

yeshwanthyk Skill

Audit or repair a project-local verification skill against the real application.

natejswenson Bundle

Grade a real run of a skill against its own committed contract, then turn each confirmed failure into a permanent eval case. Use when the user says "evaluate this run", "grade this skill", "eval this run", "how good was that run", "did the skill follow its own rules", "audit this transcript", "write evals for my skill", "deepen the evals", or "my evals are decorative" — or wants a session transcript checked for results it claimed but never observed.

natejswenson Bundle

Interactively investigate this Mac’s network connections, listening services, and process security. Use for "netwatch", "analyze my network traffic", "investigate this process", unfamiliar destinations, changes over time, optional scoped packet capture, or stopping a network process the user selects. Default inspection reads local metadata; packet capture and process termination require specific user authorization.

natejswenson Bundle

Analyze a person's personal online brand from nothing but their name and generate a report on it. Use when the user says "brand report", "brandreport", "analyze my online brand", "what does the internet say about me", "search my name and tell me what you find", "audit my online presence", "what does my personal brand look like", "how do I come across online", or gives a name and asks what's out there about that person. The skill discovers sources itself — profiles, sites, posts, mentions — the user never supplies a list.

pvsundar Bundle

Compact Codex skill for report-only statistical audits of manuscripts against source data, extracted numerals, sample labels, figures, and cross-references.

pvsundar Bundle

Draft, revise, audit, and package academic response-to-reviewers letters, editor responses, revision memos, and R&R correspondence. Use when the user shares peer-review comments, decision letters, reviewer feedback, associate editor guidance, or asks for a response matrix, rebuttal, revision strategy, cover response, or journal-facing revision correspondence.

pvsundar Bundle

Compact Codex skill for APA citation checks, BibTeX consistency audits, Quarto citation audits, and user-triggered deep bibliography verification with source-cited results.

impertio-studio Bundle

Use when CesiumJS code has just been generated or reviewed and must be checked before it is called done, to catch deprecated APIs and common defects, or when auditing CesiumJS code from an older source. Detects the removed synchronous patterns (readyPromise, the url constructor option, ModelExperimental, defaultValue, new on a Cartesian factory), WebGPU assumptions, missing ion tokens, missing destroy() calls, and coordinate-type mistakes. Runs a deterministic checklist and routes each failure to the skill that fixes it. Keywords: validate CesiumJS code, review Cesium code, is this Cesium code correct, deprecated CesiumJS API, readyPromise, ModelExperimental, defaultValue removed, check before commit, CesiumJS code quality, lint Cesium, did I use the right API, audit Cesium scene, why might this code fail.

mardab96 Skill

Reviews Meta lead forms and ads for qualification strength and signal fit. Use when Meta lead forms deliver cheap volume that sales cannot use, or before turning on instant forms.

mardab96 Skill

Measures response time impact on qualification and conversion. Use when leads go cold between form fill and first contact, or when nobody knows how fast follow-up actually happens.

mardab96 Skill

Ranks lead sources by downstream stage, value and close rate. Use when two channels look equally good on cost per lead, or before moving budget between sources.

mardab96 Skill

Separates search intent quality from keyword bloat and match-type leaks. Use when Google Ads volume is fine and quality is not, or when the search terms report stops matching who you sell to.

ruicore Bundle

Test-driven development with vertical red-green-refactor cycles and behavior-preserving green-to-green refactor loops. Use when the user requests TDD, test-first feature or bug work, integration tests that drive implementation, or an internal restructure that must preserve observable behavior. Infer the contract from the request and repository evidence; ask only when unresolved material choices would change public or business behavior, data or security meaning, or scope.

ruicore Bundle

Review how a repository in any language actually uses its ecosystem technologies and their integration boundaries. Use for multi-language or polyglot library, framework, runtime, build, package, persistence, messaging, observability, testing, SDK, or platform integration reviews; infer languages automatically unless the user supplies them. Review-only by default; do not use for broad architecture, generic code style, security, performance, or every dependency.

ruicore Bundle

Read-only database access audit for batch operations, looped DB I/O, bulk writes, relation attach/detach, N+1, transactions, scope isolation, rowcount, concurrency, constraints, and indexes across any stack.

autonomous-ai Bundle

Guard mode for security monitoring. Two uses — (1) Toggle on/off when a friend says "guard mode", "watch the house", "I'm going out", or similar. (2) Handle any sensing event that carries a [guard-active] tag (e.g. [sensing:presence.enter][guard-active], [sensing:motion][guard-active]) with dramatic shock/curious emotion + Telegram broadcast. Do NOT fall back to normal sensing reactions while guard mode is on.

hugobowne Bundle

Audit try/except blocks for overly broad scope, by-catch risk, and catches of built-in exceptions that should be conditional checks. Tightens each block so the try covers only the operation that can actually fail.

tss-blue-ai-lab Skill

Automated code review for security, quality, and performance. Catches bugs, vulnerabilities, and anti-patterns before they ship. Use when: reviewing PRs, auditing code before release, or checking your own work.

tss-blue-ai-lab Skill

Run a portable, evidence-based review of the changes intended for merge. Use before merging a branch to inspect correctness, security, maintainability, tests, documentation, and review coverage without modifying the changes.

cryptopafi Skill

Vision-based design critique for banners, creatives, or any rendered visual. Use AFTER any banner production step and BEFORE showing the user. Reads the image through Codex vision and scores it on 5 axes (readability, hierarchy, depth, brand fit, professional polish), returns top 3 issues + 3 specific fixes + PASS/REVIEW/FAIL verdict. Use when user says '/banner-critique', 'critique this banner', 'rate this design', or as a self-check gate before delivery. ANTI-PATTERN: do not use for code review (use code-review), text review (use audit-pro), or non-visual outputs.

cryptopafi Bundle

Convert every proposed RUO Peptides/PeptraLabs Supabase mutation into a validated Hermes-main/default instruction set while keeping Codex read-only. Use after ruo-supabase-guardrails for data, schema/config/RLS/storage/RPC, dashboard sync, runtime access, or migration changes. ANTI-PATTERN: Never treat HANDOFF_READY as permission for Codex to execute a Supabase mutation.

cryptopafi Bundle

Control-gate RUO Peptides financial-audit updates so corrections propagate across source evidence, cash/treasury, customer credit, participant balances, inventory, owner investment, COA costs, and published outputs. Use for RUO accounting corrections, transaction reconciliation, inventory/account balance changes, or audit-summary updates. ANTI-PATTERN: Do not use for generic legal strategy, normal website copy edits, or one-off prose that does not change audit facts.

iopsystems Skill

Close an open **arc** — mark its narrative complete (`closed`) or explicitly set aside (`abandoned`), and audit that its closing conditions were actually met. Use this when the user says things like "close the X arc", "we're done with this arc", "abandon arc Y", "wrap up the arc". An arc cannot be `closed` while any of its inquiries are still `open` — this skill invokes `vault_check_transition` to enforce that and surfaces the blockers concretely. Arcs that trail off without explicit closure are the vault's biggest smell; spending two minutes on this skill is how that's avoided.

dailybothq Bundle

Verify that a repository is DeepWorkPlan-conformant (AI-first) and that its plans are well-formed, producing an objective pass/fail report. Use when the developer asks to verify, audit, or check conformance of a repo or a plan.

yafet-dev Bundle

Advanced denial-of-service testing methodology for bug bounty and application security work. Use when testing or reviewing application DoS, web cache poisoning DoS, algorithmic complexity, expensive GraphQL/API queries, large uploads, infinite loops, XMLRPC or brute-force amplification, account lockout abuse, resource exhaustion, cache-key poisoning, decompression or parser bombs, and workflows where small requests can create disproportionate CPU, memory, storage, cache, quota, or availability impact.

yafet-dev Bundle

Advanced remote code execution testing methodology for bug bounty and application security work. Use when testing or reviewing command execution, server-side code execution, upload-to-RCE, parser or renderer RCE, dependency confusion, package-install hooks, Git flag injection, VPN/appliance pre-auth RCE, desktop app RCE, admin-to-RCE, template or deserialization execution, CI/build worker execution, and workflows where attacker-controlled input reaches code, commands, interpreters, plugins, or privileged jobs.

yafet-dev Bundle

Advanced cross-site scripting testing methodology for bug bounty and application security work. Use when testing or reviewing reflected XSS, hidden-parameter and encoding-filtered XSS, stored XSS, DOM XSS, cache-poisoned XSS, OAuth/login-flow XSS, admin-context XSS, markdown/CMS/wiki XSS, chat/client XSS, SVG/file upload XSS, postMessage XSS, CSP bypass, mobile/WebView XSS, and workflows where attacker-controlled input executes JavaScript in another user's browser or a privileged admin context.

yafet-dev Bundle

Advanced XML External Entity (XXE) testing methodology for bug bounty and application security work. Use when testing or reviewing XML parsers, SOAP/SAML/SXMP processors, Office/PDF/image metadata parsers, XMP metadata in JPEGs, SVG/XML uploads, IVR or phone-to-XML workflows, document import/export, blind XXE, out-of-band XXE, local file disclosure, SSRF through XML entities, parser configuration mistakes, and workflows where attacker-controlled XML or metadata can resolve external entities.

yafet-dev Bundle

Advanced CSRF testing methodology for bug bounty and application security work. Use when testing or reviewing cross-site request forgery, missing or weak CSRF tokens, SameSite cookie gaps, JSON CSRF, OAuth or linked-account CSRF, deeplink CSRF, state-changing API endpoints, payment provider linking, account settings changes, admin console actions, and any workflow where a browser can be tricked into sending authenticated state-changing requests.

yafet-dev Bundle

Advanced IDOR/BOLA testing methodology for bug bounty and application security work. Use when testing or reviewing insecure direct object references, broken object-level authorization, cross-tenant access, account/member takeover through object IDs, payment/order/billing data exposure, destructive object mutations, GraphQL object authorization flaws, private file or export access, support/ticket/message/event authorization issues, or HTTP/API traffic with object identifiers in URL paths, query strings, JSON/form/multipart bodies, GraphQL variables, headers, cookies, mobile APIs, internal APIs, hidden features, and second-order workflows.