Security

dangxingyu Bundle

Plan, draft, revise, simplify, or audit machine-learning and mathematical research papers. Use for paper stories and outlines, redundant prose, titles, abstracts, introductions, methods, experiments, theorem and proof exposition, figure captions, LaTeX prose, and submission checks; do not use for ordinary nontechnical or creative prose.

dangxingyu Bundle

Audit experiment code, launch configurations, logs, metrics, and figures; then write a rigorous, reproducible technical report that defines each algorithm and loss, maps algorithms to executed experiments, records settings such as chunk size, learning rate, data, and evaluation, separates measured results from plans, and renders a page-checked PDF. Use for ML or systems experiment reports, internal research readouts, result summaries that need traceability, and Markdown-to-PDF research deliverables.

marwan562 Skill

Use this skill when reviewing code for correctness, security, maintainability, performance, testing, and clean code. Triggers on requests to review, audit, critique, or assess code, PRs, or diffs.

yorrick Bundle

Multi-provider interactive PR code review. Runs Claude Code, Gemini CLI, and Codex CLI in parallel to review a pull request, merges and deduplicates findings by severity, then walks through each issue interactively so you can vet, discuss, and selectively post comments. Use this skill when the user wants to review a PR, asks for code review on a pull request, says 'review PR #123', 'code review this PR', 'check this PR for issues', or mentions reviewing changes before merging. Also triggers on 'multi-provider review', 'cross-AI review', or 'security review PR'.

yorrick Bundle

Access control for Supabase projects where a browser talks straight to PostgREST with no API middle layer. Load this skill BEFORE writing or reviewing anything that decides who can read or write data: RLS policies, GRANT/REVOKE statements, SECURITY DEFINER functions, RPCs, views, triggers used as authorization, migrations that touch permissions, custom JWT claims, or code that handles an anon/publishable key or a service_role/secret key. Also load it when diagnosing 'permission denied for table', a 403 or empty result that should have returned rows, when a user can see or change data belonging to another tenant, or when asked to audit a Supabase project for privilege escalation. Bundles Supabase's own Splinter linter and adds four checks it lacks. Triggers on: RLS, row level security, Supabase policy, anon key, service_role, privilege escalation, multi-tenant isolation, column level security, PostgREST, Splinter, Security Advisor.

rashadansari Skill

Enforce thorough research before answering or implementing anything non-trivial, including always looking up the latest stable version of any library or dependency. Activate when working on unfamiliar APIs, systems, protocols, security topics, dependency versions, or any concept where guessing would be harmful.

trailofbits Bundle

Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures. Use after a patch exists and before accepting, merging, or reporting it as fixed; also use when an AI-generated patch, remediation commit, pull request, or proposed upstream fix needs adversarial post-patch validation across any language.

compozy Bundle

Deep architectural audit focused on finding dead code, duplicated functionality, architectural anti-patterns, type confusion, and code smells. Use when user asks for architectural analysis, find dead code, identify duplication, or assess codebase health. Don't use for style/formatting issues, performance profiling, security audits, or feature-level code review.

handsomefox Skill

Audit a bounded scope for correctness risk, complexity, dead code, inconsistency, and measured performance problems, then report before changing anything. Use when the user asks to simplify, refactor, clean up, or speed up a specific package, directory, or diff. Do not use for feature work, bug fixes, or whole-repository sweeps.

devantler-tech Skill

Repository maintenance for devantler-tech/reusable-workflows — triage, action/workflow version hygiene, backward-compatible workflow health, and consistency across the shared CI/CD building blocks. Use when performing autonomous or on-request maintenance of this repo.

kall Bundle

OpenAI/Codex 인증 없이 Claude Code 구독만으로 저장소 전체를 1회 보안 감사하고 봉인된 계약 산출물(scan-manifest.json / findings.json / coverage.json + report.md + SARIF)을 생성한다. codex-security 번들 플러그인의 표준 스캔 워크플로를 Claude가 직접 수행한다. PR/커밋/브랜치/working-tree diff 스캔이나 deep 다중패스 스캔에는 사용하지 않는다(그 스킬들은 아직 없음).

kall Skill

보안 이슈를 수정한다. 이슈 서술을 입력받아 codex-security 플러그인 fix-finding 스킬 규약대로 최소 수정을 만들고 outcome(fixed/no_change/blocked)을 보고한다. 저장소 변경과 저장소 정의 스크립트(테스트/게이트) 실행을 각각 별도 승인받는 2단 승인 구조. OpenAI/Codex 인증 없이 Claude Code 구독만으로 동작.

kall Skill

보안 finding의 진위를 판정한다. 스캔이 남긴 candidate_ledger.jsonl 또는 단일 finding 서술(텍스트/파일)을 입력받아, codex-security 플러그인 validation 스킬의 compact 모드 규약대로 disposition(reportable/suppressed/not_applicable/deferred)과 근거를 판정한다. OpenAI/Codex 인증 없이 Claude Code 구독만으로 동작. 전체 저장소 스캔은 codex-security-scan, 변경분 스캔은 codex-security-diff-scan을 쓴다.

kall Skill

다중 패스 심층 보안 스캔의 실용적 축소판(deep-lite). 랭킹·샤딩은 플러그인 스크립트로, 후보 발굴 팬아웃은 Claude 서브에이전트로, 수렴은 고정 2패스로 대체한다. 공식 deep 스캔과 동등하지 않음(고지 필수). OpenAI/Codex 인증 없이 Claude Code 구독만으로 동작. 표준 단일 패스 스캔은 codex-security-scan을 쓴다.

kall Skill

변경분(diff)만 보안 스캔한다. --diff BASE [--head HEAD](커밋/브랜치 refs) 또는 --working-tree [--base REF](스테이지+미스테이지 로컬 패치)를 대상으로, 위협 모델은 저장소 전체 범위에서, 리뷰는 diff 범위에서 수행하고 봉인된 계약 산출물을 만든다. OpenAI/Codex 인증 없이 Claude Code 구독만으로 동작. 전체 저장소 스캔은 codex-security-scan을 쓴다.

kall Bundle

같은 저장소의 완료된 보안 스캔 2개 사이에서 "같은 근본 원인의 finding"을 의미 기반으로 매칭해 이력을 연결한다(공식 scans match 대체). 제목·CWE·fingerprint·위치가 달라도 동일 근본 원인·동일 수정으로 해결되는 finding을 그룹화. 매칭 판정은 도구 없는 격리 서브에이전트가 수행한다. OpenAI/Codex 인증 없이 Claude Code 구독만으로 동작.

kall Skill

이미 적용된 보안 수정이 원래 취약점을 실제로 제거했는지 저장소를 **변경하지 않고** 판정한다. finding별로 fixed/still_vulnerable/inconclusive 와 근거를 반환한다. codex-security 플러그인 verify-fix 스킬 규약을 따른다. OpenAI/Codex 인증 없이 Claude Code 구독만으로 동작. 수정 자체는 codex-security-patch, 후보 finding의 진위 판정은 codex-security-validate, 전체 스캔은 codex-security-scan을 쓴다.

whatifwedigdeeper Skill

Security Audit and Fix: $ARGUMENTS

phantom Skill

Skill: audit

phantom Skill

Skill: fix-audit

rshankras Bundle

Security category index for Apple platforms. Routes to the privacy-manifests skill. General secure-storage/biometrics/ATS guidance was retired in the 2026 blind-test audit — current models cover it natively.

aliyun Bundle

管理 Dataphin 数据分级、数据分类目录、数据分类和字段级安全识别结果。 当用户要把手机号、身份证号、姓名、薪资等字段标记为 C1/C2/C3/C4 或 L1/L2/L3/L4，创建或调整分类分级体系，查询字段当前分类分级标签，或批量启停/删除识别结果时进入。 触发词：数据分级分类、分类分级、数据分类、数据分级、安全等级、敏感数据标签、识别结果、identify result、security classify、security level、C1、C2、C3、C4、L1、L2、L3、L4。 关键限制：公共 OpenAPI 管理的是分级、分类、识别结果三层对象；字段打标用 create-security-identify-result；批量覆盖需确认 conflict-strategy；写操作需 HITL 确认。

askaret Skill

Use to review changes before committing/PR. Focus on correctness, security, performance, and maintainability. Provide actionable diffs or TODOs.

jhostalek Bundle

Run an explicitly selected code or UX audit, or a full fourteen-dimension sweep.

getaxonflow-axonflow-cursor-plugin Skill

Search AxonFlow audit trail for recent tool executions, policy decisions, and compliance evidence

amattas Skill

Binary analysis tools and techniques

amattas Bundle

Scan code for security vulnerabilities. Use after implementation changes.

nintendadev Bundle

Verify a completed implementation against the feature plan in .unikit/code/plans/. Confirms every planned task was fully implemented and nothing was forgotten, the code compiles, the tests pass, and {{engine_name}}-specific conventions are followed (per ENGINE_RULES.md). Run this after /unikit-implement finishes, or whenever the user wants to confirm the work is complete and correct against the plan, e.g. "verify", "verify the implementation", "check the work", "did we miss anything", "did we implement everything", "is the plan fully done", "make sure nothing was forgotten", "does it build and pass tests". This checks plan completeness and build/test health — for code-quality, bug, and security review use the review skill instead.

mhylle Skill

Codebase Audit

wolverin0 Skill

Skill: Audit Loop

wolverin0 Skill

Skill: Audit Blind Spots Walk

wolverin0 Skill

Skill: Audit Tambon Hunt

ilude Bundle

Security-First-Design Skill

florianbruniaux-claude-code-ultimate-guide Skill

Delegate threat-intelligence research and updates to AgentSec, then validate the guide and landing mirrors.

sitaggart Bundle

Run a rigorous multi-pass technical code review of recent changes. Use when the user asks for ce-technical-review, a technical review, a deep code review, or a strict pre-commit audit.

rldyourmnd Skill

security-review