Security

superman2003 Bundle

Use when asked to review a pull request, diff, or branch changes. Provides a methodical review checklist covering correctness, security, and maintainability.

vidit19sharma Skill

Opinionated system design for small-scale projects (1-10 engineers, <100K users, pre-Series A). Concrete defaults, not 'it depends'. Use when building MVPs, indie SaaS, small team projects, or any time you need to ship fast without over-engineering. Covers database, auth, deployment, caching, security, monitoring, and architecture — all tailored for simplicity and cost-efficiency.

yoichiojima-2 Bundle

Review code for quality, bugs, security issues, and best practices. Use this skill when the user asks for code review, code analysis, or wants feedback on their code.

abel3005 Bundle

사내 규정·지침·계약서 등 문서 묶음에서 서로 충돌하는 조항을 찾아내고, 어느 쪽이 우선하는지와 수정 문안까지 담은 점검 리포트를 만든다. 취업규칙·사규·운영지침·매뉴얼·계약서·정책 문서를 다루면서 "개정하면 어디를 같이 고쳐야 하는지", "규정끼리 안 맞는 것 같다", "예전 지침이 아직 살아 있는지", "문서 간 정합성/일관성 점검", "규정 충돌", "개정 영향 분석", "폐기 누락" 같은 말이 나오면 반드시 이 스킬을 사용한다. 사용자가 '충돌 점검'이라는 단어를 쓰지 않아도, 여러 문서를 놓고 서로 안 맞는 부분을 찾아 달라거나 한 문서를 고쳤을 때의 파급을 묻는 상황이면 사용한다. 문서 요약, 단일 문서 교정, 번역에는 사용하지 않는다.

google Bundle

Review a GitHub pull request and leave inline comments in a natural human reviewing voice, indistinguishable from comments typed by hand on the GitHub web UI. Deliberately bounded to defects a reader can settle by looking at the anchored line, rather than a deep audit, so every comment is cheap for the author to check. Scales to 2-20 comments by PR size, parallelises analysis across sub-agents, drafts for approval, then posts individually with human pacing. Use when the user says "review this PR", "review PR 123", pastes a github.com/.../pull/N link, or asks for comments on a pull request. Don't use for reviewing local uncommitted changes or a diff against a branch (use the `review` skill for that).

hainrixz Skill

Opt-in writer (the /claude-db:fix command). Applies the safe, reversible schema/migration changes from an audit — adding indexes, NOT NULL/CHECK/UNIQUE constraints, missing FKs, type corrections, default/generated columns — as expand-contract migrations. Dry-run preview by default; writes only after explicit per-change confirmation, and only via the migration-writer subagent. Runs only when the user invokes it — never auto-triggered.

hainrixz Skill

Recompute and display the two database scores (Design & Integrity + Performance & Scale) from a findings JSON, without re-auditing. Use to re-show or refresh the scores after an audit, to re-score with a different paradigm profile, or to score a saved findings file.

julianobarbosa Bundle

Complete Git version control workflow automation. USE WHEN user mentions commit, push, pull request, PR, branch, merge, rebase, stash, git status, staged files, unstaged changes, OR any version control operations. Handles conventional commits, security checks, and GitHub CLI integration.

man-git007 Bundle

Use this skill to write tests and implement code for a JavaScript/TypeScript feature, bug fix, or task from an already-approved implementation plan — writing tests first against the plan's test scenarios, then code against SOLID and OWASP standards, with an approval checkpoint before each phase, before branching and opening a PR. This skill expects an approved plan as input, ideally one produced by the js-feature-planner skill (a plans/*.md file or pasted plan content), rather than a raw user story or issue. If the user wants to jump straight to code without an approved plan, suggest running js-feature-planner first. Trigger on phrases like "implement this plan," "write the tests for this," "let's build this feature" when a plan is available, or "let's code this now."

cyl19970726 Bundle

Reconstruct a video's full content with an adaptive, evidence-backed two-round workflow. Use when Codex must understand, restore, analyze, convert to an article, document, or audit any video whose important information may live across speech, subtitles, on-screen text, interfaces, actions, parameters, before/after states, examples, claims, counterexamples, or visual transitions. First probe the viewer's intended cognitive change, information carriers, meaning changes, relationship structure, and omission risks; then derive and execute a video-specific capture protocol. Do not route by a closed content taxonomy.

rcarmo Skill

Design, audit, and redraw inline SVG architecture diagrams for rcarmo.github.io using the site’s established visual language and source-verification workflow.

steveclarke Skill

Audit all documentation for staleness after code changes. Checks README, CLAUDE.md, init presets, and release docs. Use after completing a feature, merging a PR, or when asked to check docs.

yibie Skill

Review code for security and correctness.

param302 Bundle

Plan, build, audit, migrate, and package source-grounded weekly mastery workbooks for IITM BS courses. Use only when explicitly invoked for a whole course or substantial workbook revision; use the project-lab skill for optional trend-driven projects.

block Skill

Senior engineer code review focused on catching issues before they become PR comments. Reviews only changed lines, categorizes issues by priority, and fixes them one by one. Use when the user says "code review", "review my code", "review this branch", or wants pre-PR feedback.

lm203688 Skill

Assess cross-border data transfer compliance under PIPL/网络安全法/数据安全法. 7-question risk assessment determines compliance pathway (安全评估/标准合同/认证). Covers personal information thresholds, important data identification, CIIO obligations. Use when: transferring data from China overseas, assessing if data export needs CAC security assessment, determining which compliance pathway applies, checking PIPL compliance for international business, evaluating data localization requirements.

schneidenbach Bundle

Use when reviewing code changes for bugs, security issues, and code quality using OpenAI Codex as an adversarial reviewer. Trigger when the user asks for a code review, wants to check code for bugs or security issues, asks to review a PR, branch, commit, or diff, or says things like "any issues with this?", "review before I push", "check my changes", "look at what I changed", or "review my PR". Tell it where to find the code.

schneidenbach Bundle

Use when reviewing code changes for bugs, security issues, and code quality using Claude Code as an adversarial reviewer. Trigger when the user (driving Codex) asks for a code review, wants to check code for bugs or security issues, asks to review a PR, branch, commit, or diff, or says things like "any issues with this?", "review before I push", "check my changes", "look at what I changed", or "review my PR". Tell it where to find the code.

get-convex Bundle

Audits and optimizes Convex application performance across hot-path reads, write contention, subscription cost, and function limits. Use this skill when a Convex feature is slow or expensive, npx convex insights shows high bytes or documents read, OCC conflict errors or mutation retries appear, subscriptions or UI updates are costly, functions hit execution or transaction limits, or the user mentions performance, latency, read amplification, or invalidation problems in a Convex app.

microsoft Skill

Framework code review checklist - correctness, performance, concurrency, design, and style.

aymericzip Bundle

Manages Intlayer dictionaries and configuration via the Command Line Interface. Use when the user asks to "audit translations", "build dictionaries", "sync content", or run "intlayer" commands.

vigolium Bundle

Draft a single-vulnerability report in GitHub advisory style from an audit finding, bug note, patch diff, PoC, or code review evidence. Use when Codex needs to turn one confirmed security issue into a clean disclosure-ready report with Summary, Details, Root Cause, Proof of Concept, Impact, embedded code snippets, explanatory prose that points to the vulnerable code, inline GitHub markdown links to source evidence, and clearly-scoped optional sections such as CWE, CVSS, references, attack preconditions, or patch metadata.

driangle Skill

Audit documentation coverage for a project: discover CLI commands, public APIs, configuration options, and features, then cross-reference against documentation to find gaps, stale content, and missing sections. Use when the user wants to check if docs are up to date, find undocumented features, or verify doc completeness.

xiaolai Skill

Audit value_invocations in run traces for EOUs with classification.judgment_authorized:true. Verifies invocations against the captured_workflow's declared priority (no F15), checks for drift over multiple runs (no F16), detects hallucinated value ids (no F17), catches silent decisions on contested cases (F14), and runs counterfactual-swap audit as the V1 anti-theater defense.

mufidhadi Bundle

Use when shipping or auditing a web app for production. Runs a 14-point security and data-lifecycle audit — per-user authorization (IDOR), password-reset expiry, input sanitization (SQLi/XSS), API exposure, rate limiting, safe error handling, DB indexes, logging and alerting, blue-green rollback — plus GDPR/PDP-safe account deletion via cryptographic erasure.

nettacker-codex-ai Bundle

Structured pull request review workflow that first verifies all PR commits are signed and all PULL_REQUEST_TEMPLATE.md checks are addressed, then evaluates correctness, security, tests, maintainability, documentation, and release risk, and gives a clear merge recommendation with justification. Use when asked to review a PR, assess whether a PR should be merged, write PR review comments, classify review findings, verify commit signing, verify PR template checklist completion, or provide merge/no-merge guidance.

payloadcms Bundle

Use when working with Payload projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.

ran4love Bundle

Prepare, audit, or debug hospital-facing reproducible code handoff packages for medical AI analyses. Use when packaging code for an external hospital or collaborator, especially AVLT, Cookie, Picnic, speech/cognition, or similar clinical AI projects that need README-first instructions, config templates, input templates, preflight checks, versioned run_all.py entrypoints, heartbeat/progress logging, de-identified returnable results, sensitive local sandboxes, do-not-return hospital-internal archives, reproducible experiment inventories, or hospital error triage. Also use for Chinese requests such as 医院代码交付, 医院交接代码, 医院交付包, 对外交付code, 对外交付代码, 医院可复现代码, or 医院运行报错排查.

shimo4228 Bundle

Audit and fix project documentation — detect role overlaps between context files (CLAUDE.md, CODEMAPS, ADR, README), migrate misplaced content, check freshness against code, and create missing docs. One command to keep all project context healthy.

shimo4228 Skill

Audit a project repo's non-code assets — tool configs, CI/GitHub workflows, runbooks, other docs — for assets whose consumer has vanished, and assign Keep/Update/Retire/Merge verdicts. Use when the user says "audit my repo assets", "which configs/workflows/runbooks are dead", "repo asset stocktake", 「非コード資産を棚卸しして」「使われてない設定/workflow/runbook を洗い出して」. NOT for — dead code → refactor-clean; doc-role overlap across CLAUDE.md/CODEMAPS/ADR/README → context-sync; ~/.claude config GC → config-gc; skills or rules → skill-stocktake / rules-stocktake.

lfnovo Bundle

Orchestrate a release of the current repository behind human gates, from changelog audit and version decision through a coverage table, validation on the real artifact, the cut, notes and credits, an explicit GO before the first action that can start distribution, verification from the registry and closure. Use when preparing, testing, cutting or publishing a release.

clay-good Skill

Run all quality checks — tests, lint, format, security scan.

viewway Bundle

Systematic code review patterns covering security, performance, maintainability, correctness, and testing

saturate Bundle

Performs comprehensive codebase audit checking architecture, tech debt, security vulnerabilities, test coverage, documentation, dependencies, and maintainability. Use when auditing a project, assessing codebase health, running security scans, checking for vulnerabilities, reviewing code quality, analyzing tech debt, or asked to audit/analyze the entire codebase.

vchirrav-eng Skill

Audit code for security vulnerabilities using OWASP Secure Coding rules from the local rules/ folder. Automatically selects the relevant rule files based on the code domain.

vchirrav-eng Skill

Generate secure code following OWASP Secure Coding rules from the local rules/ folder. Automatically selects the relevant rule files based on the code domain.