Security

0xlayerghost Skill

[AUTO-INVOKE] MUST be invoked when designing or reviewing ERC20 token contracts that need flash loan protection. Covers token-level defense design patterns: cost tracking, same-block cooldown, progressive sell tax, minimum balance retention, EIP-7702 aware address checks, front-run protection, and referral binding. Trigger: any ERC20 token with anti-flash-loan, anti-bot, or tokenomics security design requirements.

0xlayerghost Skill

[AUTO-INVOKE] MUST be invoked BEFORE any on-chain operation (cast send, forge script --broadcast). Systematic 6-layer verification checklist: permissions, dependencies, parameters, security, testing, and knowledge capture. Trigger: any task involving sending transactions, deploying contracts, or interacting with on-chain state.

suda777 Bundle

Audit one or all of the user's personally maintained Codex Skills, including fully self-created Skills and third-party Skills customized with the user's own rules, using evidence from accessible Codex conversations and the latest verified Suda777/codex-skills repository state. Propose concrete changes and apply only changes the user explicitly approves. Use when the user asks to update, maintain, revise, optimize, consolidate, or review their personal Skills, or when an automation invokes a whole-collection Skill governance review. Do not use for system Skills, plugin-provided Skills, unchanged third-party Skills, ordinary installation or Git synchronization, or creating an unrelated new Skill from scratch.

typefox Bundle

Publish a VS Code extension to the VS Code Marketplace and/or Open VSX Registry. Use when the user wants to publish, ship, or release a VS Code extension; audit or improve manifest, listing, or release setup; build or upload a `.vsix`; set up `vsce` or `ovsx`; create a marketplace publisher or Open VSX namespace; configure CI for extension releases; bump versions; or troubleshoot publishing errors. Covers both registries — invoke even if the user names only one.

algorand-devrel Bundle

Guide for writing Python code with AlgoKit Utils (`algokit-utils`). Use this skill whenever the user is building on Algorand with Python — client setup, account management, payments, ASA operations, atomic transaction groups, smart contract deployment and interaction (AppFactory, AppClient, ARC-56/ARC-32 specs), raw app calls, TEAL compilation, key registration, network management, error handling, and the low-level crypto primitives in `algokit_crypto` (Ed25519 keygen/signing/verification, Peikert xHD BIP44 wallets, wrapped-secret patterns) and `algokit_common` (`sha512_256`). Trigger on imports from `algokit_utils` or `algokit_crypto`, references to `AlgorandClient`, `AppFactory`, `AppClient`, `AlgoAmount`, `ed25519_generator`, `peikert_hd_wallet_generator`, `sha512_256`, `WrappedEd25519Seed`, or `RawEd25519Signer`, or any Python code that builds on Algorand.

algorand-devrel Bundle

Guide for writing TypeScript code with AlgoKit Utils (`@algorandfoundation/algokit-utils`). Use this skill whenever the user is building on Algorand with TypeScript — client setup, account management, payments, asset operations, atomic transaction groups, smart contract deployment and interaction (AppFactory, AppClient, ARC-56/ARC-32 specs), raw app calls, key registration, network management, testing with algorandFixture, error handling, and the low-level crypto primitives under `@algorandfoundation/algokit-utils/crypto` (Ed25519 keygen/signing/verification, SHA-512/256 `hash`, Peikert xHD BIP44 wallets, wrapped-secret patterns). Trigger on imports from `@algorandfoundation/algokit-utils` (incl. `/crypto`, `/testing`, `/transact` subpaths), references to `AlgorandClient`, `AppFactory`, `AppClient`, `AlgoAmount`, `algorandFixture`, `ed25519Generator`, `peikertXHdWalletGenerator`, `hash`, `WrappedEd25519Seed`, or `RawEd25519Signer`. Also on any TypeScript or JavaScript code that builds on Algorand.

mgiovannibh Skill

Comprehensive master review orchestrating security, performance, SOLID, clean code, java patterns, and logging. Provides a lean, action-oriented report focusing only on necessary changes.

roadofriot Skill

Perform structured application security audits and document evidence-based findings.

roadofriot Skill

Analyze software performance, resource usage, latency and optimization opportunities.

practical-office Skill

Pre-merge release checklist covering tests, docs, rollback, security, and breaking changes. Use before merging to main, cutting a release, or when the user asks if a branch is ready to ship.

practical-office Skill

Scans staged changes and diffs for leaked secrets, API keys, tokens, and credentials before commit or PR. Use when preparing commits, opening pull requests, reviewing diffs, or when the user mentions secrets, tokens, .env files, or credential leaks.

sylphai-inc Skill

Security checklist to run before merging any change that touches auth, secrets, or user data

danieleteti Bundle

Use when writing any server-side feature with DelphiMVCFramework (DMVC) — controllers, routes, REST endpoints, entities, middleware, validation, dependency injection, JWT, SSE, or the server bootstrap. The core skill; the Minimal API, web-app, UI, security and testing skills build on it. Triggers on "DMVCFramework", "DelphiMVCFramework", "create a controller", "add a route", "REST endpoint in Delphi", "TMVCActiveRecord", "ActiveRecord entity", "add middleware", "configure JWT", "MVCRequired", "add validation", "service container", "MVCInject".

danieleteti Bundle

Use when reviewing existing Delphi / Object Pascal code for defects, hunting a memory leak or an access violation, or hardening new code against the classic mistakes. Covers compiler warnings and hints that indicate a real bug, warnings-as-errors, leak detection and how to make a leak fail a build, third-party static analysis, and a catalogue of smells each with a way to find it. Triggers on "code smell", "code review", "review this unit", "refactor this unit", "memory leak", "leak", "leaking", "double free", "access violation", "AV", "static analysis", "lint", "compiler warning", "W1035", "$WARN", "warnings as errors", "FastMM", "ReportMemoryLeaksOnShutdown", "audit this code".

dengyie Bundle

Use when reviewing pull requests, diffs, architecture-sensitive changes, reliability risks, production readiness, merge readiness, or requests to review like a senior engineer. Focuses on correctness, robustness, maintainability, observability, tests, security, and production risk rather than style-only review.

fengmo11 Bundle

Use when auditing manuscript claims, citations, references, DOI/BibTeX metadata, citation support strength, unsupported claims, fabricated references, or claim-evidence-boundary maps.

fengmo11 Bundle

Use before manuscript submission to audit final package completeness, venue format, title page, abstract, figures, tables, references, data/code availability, author declarations, cover letter, supplementary files, and export readiness.

slicervm Skill

Filter, audit, and inject secrets into HTTP(S) egress from Slicer microVMs with Slicer Proxy — default-deny allow rules, credential injection (Bearer, Basic, OAuth for Claude/Codex/Copilot/xAI), audit and passthrough modes — on Linux and macOS.

vinilana Skill

Security review checklist for code and infrastructure

ilonatommy Bundle

Performs comprehensive code reviews for GitHub pull requests. Use when reviewing PRs, checking if a PR fixes an issue, analyzing code changes, or when given a GitHub PR URL (github.com/.../pull/...). Evaluates problem alignment, code quality, security threats, alternative approaches, edge cases, and identifies duplicate/existing implementations.

m1nga Skill

资深产品体验官 — experience a product-in-development as a zero-experience first-time user, then report to the PM with prioritized findings, fix recommendations, and follow-ups. Covers product experience, design, visual, interaction, copy, emotion — everything a cold stranger would feel. Two modes — analyze screenshots the user provides, or run/drive the product live (web via browser tools, CLI/TUI via terminal, native via computer-use). Use whenever Ming shares screenshots of a product he's building and wants reactions, or says anything like 体验一下 / 用户视角 / 从0经验的角度 / 体验官 / 帮我试试这个产品 / walkthrough / first-time user experience / UX audit / 看看新用户会怎么想 / 这个流程顺不顺 — even if he doesn't say the skill name. Trigger for any "experience my product and give feedback" request, screenshots included or not.

mattmireles Skill

Audit a Gemma Tuner plan phase against its acceptance criteria, tests, artifacts, leakage controls, hardware claims, and stop conditions.

mattmireles Skill

Carry a Gemma Tuner plan through implementation, empirical verification, adversarial audit, and honest closeout. Use only when explicitly invoked. A preregistered KILL is a valid completed result.

nikhil8bph Bundle

Design, review, and scaffold enterprise Spring Boot backends with layered architecture, JPA, security, auditing, multi-tenancy, RBAC, standardized APIs, and optional microservice infrastructure. Use for backend implementation only.

colbytimm Bundle

Write, update, or audit project documentation (docs/ folders, guides, tutorials, how-tos, API references, architecture docs) that matches the quality of the best open source documentation and reads like a maintainer wrote it, not an AI. Use this skill whenever the user asks to document a project, write docs, create a getting-started guide or tutorial, document an API, explain how something works, fix stale docs, or check documentation quality - even if they just say "this needs docs" or "the docs are out of date". For the repo front page specifically, use the readme-writer skill; this skill covers everything past the front door.

colbytimm Bundle

Create or update README.md files that match the quality of the best open source projects and read like a maintainer wrote them, not an AI. Use this skill whenever the user asks to write, generate, improve, rewrite, review, or update a README, project documentation landing page, or repo front page - even if they just say "document this project", "make this repo presentable", or "my README sucks". Also use it to audit an existing README for AI-sounding writing.

jinjie0703 Bundle

代码审查、敏感密钥泄露拦截与标准化 Git PR 提交生成技能。自动提取 git diff 变更，扫描 Secret 泄露与代码异味，生成符合 Conventional Commits 规范的精准提交信息与大厂级 PR 审查报告。在需要审查代码变更、生成 Git Commit 提交信息、或编写 PR 描述时使用。

jfcrenshaw Skill

Best-practices guide for designing and auditing Claude Code skills and global configuration. Covers CLAUDE.md length and content fitness, skill naming and description quality, SKILL.md structure and progressive disclosure, trigger condition robustness, settings.json permissions, and directory hygiene. Use whenever asked to write, update, audit, or improve a SKILL.md file; evaluate trigger condition quality; review or suggest improvements to a CLAUDE.md or settings.json; create a new skill from scratch; improve an existing skill; or assess whether skills in a set cross-reference each other correctly.

jonny-1812 Skill

Manage the AI knowledge base by listing sources, checking indexing status, adding new URLs, searching indexed content, and auditing for coverage gaps. Use when the user asks about their knowledge base, wants to add training data, search KB content, check what the AI knows, or audit documentation coverage.

lyupro Skill

Audit code or design against Apple Human Interface Guidelines.

lyupro Bundle

Run `npm audit --json` against the target project and summarise high/critical vulnerabilities.

poudatmorteza Skill

Apply Arnaud Lauret's The Design of Web APIs principles when designing, reviewing, or documenting REST/OpenAPI APIs. Use for resources, HTTP methods, error models, versioning, security, consumer-first API design, or when the user mentions REST API, OpenAPI, API design, or Lauret.

benjaminshoemaker Bundle

Detect split data source anti-patterns and scattered business rule duplication where the same logic is reimplemented across multiple files and languages. Catches semantic duplication that syntactic tools like jscpd miss. Use at phase checkpoints or when investigating data consistency issues.

marcelinero Bundle

Auditar sistemas de gestión ambiental conforme a ISO 14001, verificación de inventarios de gases de efecto invernadero conforme a ISO 14064 y GHG Protocol, y cumplimiento ambiental aplicable. Activar siempre que se hable de auditoría ambiental, environmental audit, ISO 14001, ISO 14064, GHG Protocol, sistema de gestión ambiental, SGA, aspectos ambientales, impactos ambientales, residuos peligrosos, vertimientos, emisiones, permisos ambientales, licencia ambiental, EIA, evaluación de impacto, ciclo de vida, LCA, biodiversidad, agua, energía.

marcelinero Bundle

Evaluar la adherencia de la organización a leyes, regulaciones, normativas internas y compromisos contractuales aplicables, así como la efectividad del programa de cumplimiento. Activar siempre que se hable de auditoría de cumplimiento, compliance audit, regulatory audit, programa de cumplimiento, ISO 37301, ISO 37001, antisoborno, anticorrupción, FCPA, UK Bribery Act, SAGRILAFT, SARLAFT, AML/CFT, lavado de activos, política de cumplimiento, código de ética, conflicto de interés, regaliación, sanciones, due diligence de terceros, oficial de cumplimiento.

marcelinero Bundle

Evaluar la postura de ciberseguridad de la organización aplicando NIST CSF 2.0, ISO 27001/27002 y CIS Controls — gobernanza de seguridad, identificación, protección, detección, respuesta y recuperación. Activar siempre que se hable de ciberseguridad, cybersecurity audit, NIST CSF, ISO 27001, ISO 27002, CIS Controls, MITRE ATT&CK, SIEM, SOC, EDR, DLP, IAM, MFA, gestión de vulnerabilidades, pentest, red team, ransomware, phishing, NIS 2, zero trust, gestión de identidades, respuesta a incidentes, IR, threat hunting, breach.