Security

blendsdk Bundle

Runs a rigorous multi-dimensional quality audit of a plan, requirements, or any artifact, grounded in the actual codebase. Use for "preflight", "quality audit", "review gate", "audit this plan", "audit these requirements", or "review my plan/requirements before I build it". An adversarial review gate that hunts for every ambiguity, contradiction, gap, and risk, verifies every claim against the real code, scores findings on a 13-dimension scan, and presents each one with options and a recommendation for the user to decide — it never fixes silently. Takes an artifact target (e.g. requirements, requirements RD-03, <feature-name>, <feature-name> 03-api-design, or a file/dir path) plus optional --continue to resume an interrupted session.

carthworks Skill

Provides a structured, thorough code review checklist covering correctness, security, performance, tests, and maintainability. Use this skill whenever asked to review a pull request, diff, or piece of code. Also activates when the user says "review this", "check my code", "is this PR ready", or "what did I miss". Apply to any language or framework.

devantler-tech Skill

The ADVANCE playbook for an autonomous AI engineer — how to move a product forward once it is healthy: product strategy and roadmap stewardship, issue triage and decomposition, oldest-actionable-first implementation, test coverage, benchmarking and performance, refactoring and code quality, documentation sync, and security posture — all shipped as evidence-backed draft PRs self-promoted on genuine readiness. Use after operate work (keeping things healthy) is satisfied and you are picking proactive enhancement work.

dstreefkerk Bundle

Enterprise PowerShell coding standards. Use when writing, reviewing, or generating any PowerShell code, creating PS1 scripts or functions, debugging PowerShell, or asked to help with PowerShell. Enforces best practices for structure, error handling, security, performance, and output patterns.

dstreefkerk Bundle

Generate structured PowerPoint speaker notes for technical presentations. Produces runbook-style bullet notes (not scripts) that add depth beyond the slide content, including anticipated Q&A, references, emphasis cues, transitions, and time markers. Use when the user asks to write, generate, create, or improve speaker notes, presentation notes, slide notes, or PowerPoint notes. Also triggers when users provide slide content and ask for notes to accompany it. Optimised for cyber security and technical audiences but applicable to any domain.

dstreefkerk Skill

Generates concise, CISO-level impact statements for security control failures. Use when the user asks for an impact statement, wants to explain the business consequences of a security control failure, needs to document risk for a risk register or audit finding, or wants to translate a technical vulnerability into executive language for a CISO or board.

dstreefkerk Bundle

Threat Modelling

grinchenkoedu Skill

Write or refresh this repository's CLAUDE.md — detected build, test and run commands plus the conventions and security rules for its family (Moodle plugin, PHP app, CMS, Python). Reads an existing file first and reports it as already fine rather than churning it; regenerating replaces only a marked block, so hand-written sections survive. Also leaves AGENTS.md as a stub pointing at CLAUDE.md.

grinchenkoedu Skill

Audit

grinchenkoedu Skill

Review your own changes before you push or open a pull request — a severity-rated list of what to fix, checked against the repository's own conventions, a lint pass over the changed files, its tests, a security pass over the well-known flaws (injection, escaping, login and permission checks, CSRF, secrets, files, outbound requests), and the failure modes that green tests miss. Ends by naming the next step. Review-only; never edits, commits or pushes.

levyflux Bundle

Audit a Flutter user flow across routes, screens, state owners, services, SDK callbacks, async boundaries, and lifecycle cleanup. Use for read-only diagnosis of cross-screen state bugs, stale UI, duplicated subscriptions, navigation races, reconnect behavior, or business-flow regressions; do not use static inspection alone as runtime proof.

levyflux Bundle

Audit EVM contracts that request, receive, and consume verifiable randomness. Use for VRF security reviews, raffle/game/NFT randomness state machines, request-to-business binding, callback and reroll analysis, randomness mapping, or VRF-focused Foundry tests. Do not use for ordinary VRF integration or setup unless security review is also requested.

levyflux Bundle

Apply a deterministic, fail-closed pre-trade gate to proposed automated new-token buys, snipes, swaps, and launchpad entries. Use before any bot or workflow may hand an exact EVM or Solana trade to a wallet; it gathers current security, simulation, liquidity, cluster, route, and policy evidence and returns PASS or BLOCK, but never signs or broadcasts.

searchfit Skill

Find and fix broken links on a website or in a codebase. Use when the user asks to "check broken links", "find dead links", "fix 404s", "link checker", "broken link audit", "find dead URLs", or wants to identify and repair links that lead to non-existent pages.

tavily-ai Skill

Enrich threat intelligence from CVEs, IOCs, malware names, threat actors, vendor advisories, security incidents, exploit reports, vulnerability disclosures, breach news, and mitigation guidance. Use when the user asks to investigate a CVE, enrich indicators, summarize vendor advisories, assess exploit status, collect mitigations, or produce a source-grounded security brief.

we-are-move Bundle

Builds a complete structured interview kit for a specific role — 4-6 mapped competencies, a stage-by-stage plan where each stage owns distinct competencies, a coverage grid, behavioural questions with probes and evidence standards, anchored 1-4 rating scales, and a work-sample exercise. Use when someone says they are "building the interview process for a specific role", "designing the loop for one req", "writing a scorecard", "need interview questions for a role", "our interviewers all ask the same three questions", "everyone just assesses culture fit", "we need to structure our interviews", "what should we ask a VP of Engineering", or is opening a new req and wants the assessment designed before the first candidate lands. Also use to fix an existing loop for one role. For diagnosing an entire hiring process across roles use interview-process-audit; for the hiring manager kick-off conversation that feeds this, use hiring-manager-intake.

we-are-move Bundle

Audits an existing onboarding programme against what actually drives time-to-productivity and early retention, and builds outcome-based 30/60/90 plans for a specific role or named hire — including pre-boarding, the manager's obligations as a separable brief, and the measurement set. Use when someone says "our onboarding is a mess", "we need a 30/60/90", "build a first 90 days plan", "we lost two people in their first three months", "new starters take forever to get productive", "onboarding is just an IT checklist", "audit our onboarding", "what should a new VP do in their first 90 days", "our new hire is drowning", "day one experience", "pre-boarding", "we have a candidate who accepted and starts in six weeks", "remote onboarding isn't working", "how do we measure time to productivity", or when early attrition, ramp time, or a buddy/mentor scheme comes up. Also use when a hiring manager asks for a plan for someone who has already started. For the kick-off conversation that defines the role before it is filled

get-convex Skill

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.

ractive Bundle

Perform critical Rust code reviews covering correctness, edition 2024 compliance, error handling, API design, async pitfalls, and dependency hygiene. ALWAYS use this skill when the user wants to review, audit, or critically evaluate Rust code — whether that's a PR diff, a specific crate or module, a cross-cutting concern like error handling, or the whole codebase. This includes requests to "review my changes", "check this code", "audit for best practices", "look for issues", "what's wrong with this", or "flag anything that could bite us". Use it even when the user doesn't say "review" explicitly but is asking you to find problems, inconsistencies, or anti-patterns in existing Rust code. Do NOT use for requests to write, fix, refactor, test, explain, or implement code — only for evaluating existing code.

ractive Bundle

REQUIRED skill for any security-related request. Use this skill whenever the user wants to find anything dangerous, sensitive, or risky in their code, files, or repository. This includes but is not limited to: scanning for secrets/keys/tokens/credentials, checking dependencies for vulnerabilities, auditing destructive commands for missing safeguards, reviewing files for PII or internal data before open-sourcing, checking .env files or git history for leaked credentials, or any request where the concern is "is this safe/secure/exposed?" This skill provides a structured audit methodology and checklist you MUST follow — do not attempt security reviews without it. Skip this skill ONLY for pure feature work, refactoring, bug fixes, or non-security code review.

ractive Bundle

Audit or tidy a Hyalo knowledgebase for broken links, orphan documents, stale content, and inconsistent metadata.

acedergren Bundle

Use when the user asks to "design an OCI landing zone", "plan compartments", "enable Security Zones", "build hub-spoke OCI", or "meet CIS OCI Foundations".

acedergren Bundle

Use when the user asks to "design OCI networking", "debug VCN connectivity", "configure Service Gateway", "choose NSG vs security list", or "plan FastConnect or VPN".

xialangji-debug Bundle

Audit local Skill registrations and routing, or report explicitly requested usage, trends, and feedback. Use for skill 整理, 触发不到, 索引同步, 失效/重复技能, frontmatter problems, or skill usage statistics. Registry maintenance does not require session-log scanning or telemetry setup.

norman-else Bundle

Securely send a Vault secret or dynamic database credential to a Slack user by private DM without exposing the secret content in chat. Supports sharing only a subset of a KV secret's keys. Use when Codex needs to share credentials from Vault with a teammate in Slack, especially for requests like "share secret X with Y", "share only DB_HOST and DB_PORT of X with Y", "DM the db creds to Alice", "send dev db to Norman", "process the latest DB credential request", "process the pending DB credential requests" (handles multiple unprocessed requests for different services/recipients, not just the newest), covering for a teammate who is away ("process the requests assigned to Hansen", "Hansen is on leave, handle his DB requests"), or terse slash-style input such as "vault-share ENV TYPE TARGET USER" and "vault-share PATH USER".

norman-else Bundle

Safely audit and clean macOS disk usage by identifying temporary files, caches, build artifacts, stale development environments, and other disposable data. Also explain macOS storage usage by analyzing data-volume usage, large directory groups, snapshots, and category mismatches with System Settings. Use when Codex needs to help free disk space on a Mac, clean up junk files, remove caches, inspect large stale files, explain why storage usage looks high, diagnose System Settings storage discrepancies, or respond to requests like "clean my mac", "free up disk space", "remove temp files", "disk cleanup", "why is my Mac storage so high", or "explain my storage". Always show a dry-run summary first and require explicit user confirmation before deleting anything.

jfmargar Bundle

Run near end-to-end Android simulator validation for this KMP app by combining connected tests, unit tests, app launch smoke, logcat crash scan, and docs-driven navigation/flow audit from docs/navigation.md and docs/flows.md.

jfmargar Bundle

Run near end-to-end Android simulator validation for this KMP app by combining connected tests, unit tests, app launch smoke, logcat crash scan, and docs-driven navigation/flow audit from docs/navigation.md and docs/flows.md.

ucsandman Bundle

Audit and fix the tells that software was vibe-coded / AI-generated, then give it a small distinctive identity, so it ships looking handcrafted and professional. Use whenever the user says "de-vibe", "does this look AI-generated / vibe coded?", "make this look shippable / handcrafted / professional", "remove the AI slop", "polish before launch", asks why their site "looks like every other AI site", or is about to ship/demo/hand off a project that was built largely with AI assistance — even if they don't use the word "vibe". Pairs naturally before /ship.

fradser Bundle

Detects and eliminates AI writing tropes that make text sound artificial or formulaic. Use as an explicit review/quality pass when asked to check writing style, eliminate AI cliches, audit documentation tone, or refine drafts. Do not trigger automatically for ordinary code generation or initial document creation. Supports four-tier JSON preferences (global/project x shared/local office.json) read via load-preferences.sh.

ruvnet Skill

Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns. Use for security-first v3 implementation.

modem-dev Skill

Review PyTorch pull requests for code quality, test coverage, security, and backward compatibility. Use when reviewing PRs, when asked to review code changes, or when the user mentions "review PR", "code review", or "check this PR".

jellydn Skill

Review code for quality, security, and best practices — read-only analysis

jellydn Skill

Audit code for security vulnerabilities — read-only analysis

managedcode Bundle

Scan C# source files for hard-to-test static dependencies — DateTime.Now/UtcNow, File.*, Directory.*, Environment.*, HttpClient, Console.*, Process.*, and other untestable statics. Produces a ranked report of static call sites by frequency. USE FOR: find untestable statics, scan for static dependencies, testability audit, identify hard-to-mock code, find DateTime.Now usage, detect static coupling, testability report, static analysis for testability. DO NOT USE FOR: generating wrappers (use generate-testability-wrappers), migrating code (use migrate-static-to-wrapper), general code review, or finding statics that are already behind abstractions.

meabo Skill

Domain authority, referring domains, and anchor-text profile — real link-graph data via the Semrush gateway