Security

tools-only Bundle

Express (Node.js) Web Security Spec (Express 5.x / 4.19.2+, Node.js LTS)

tools-only Bundle

Express (Node.js) Web Security Spec (Express 5.x / 4.19.2+, Node.js LTS)

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.2 (20260204a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

tools-only Bundle

<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

adobe Bundle

Use when validating an App Builder app before submitting to Adobe Exchange, or when the user mentions Adobe Commerce app compliance, extension review, marketplace submission, or Adobe Exchange listing. Checks security requirements, project structure, documentation completeness, and dependency health; reports MUST-have blockers and NICE-to-have recommendations and walks through each finding interactively.

sandbaseai Skill

Reviews a supplied code path or diff for correctness, security, maintainability, and style without executing or modifying it

redpanda-data Bundle

Manage schemas, subjects, compatibility levels, modes, and contexts in the Redpanda Schema Registry via the `rpk registry` CLI (alias `rpk sr`). Use when registering or fetching Avro/Protobuf/JSON schemas, listing or deleting subjects and schema versions, setting BACKWARD/FORWARD/FULL/NONE compatibility levels, changing registry mode (READONLY/READWRITE/IMPORT), or working with schema contexts for namespace isolation. Also covers Enterprise-licensed registry features: Schema Registry Authorization and server-side Schema ID Validation. For granting ACLs or RBAC on registry resources, see /redpanda:rpk-security; for producing or consuming records with schema encoding/decoding, see /redpanda:rpk-topic.

theexperiencecompany Skill

Optimize web performance for faster loading and better user experience. Use when asked to "speed up my site", "optimize performance", "reduce load time", "fix slow loading", "improve page speed", or "performance audit".

theexperiencecompany Skill

GAIA's wide-event logging - how to instrument code with log.set/set_ns/audit, wide_task boundaries, and the traps that silently lose context

theexperiencecompany Skill

Intelligently clean Gmail inbox - audit labels, identify patterns, batch categorize, archive old messages, present cleanup summary

karthick-ramachandran Skill

Turn approved requirements into an implementation plan with tasks and a test plan. Use when planning a substantial feature from approved requirements before any implementation begins. Skip for small local changes (implement directly with focused tests), security reviews, and convention checks.

karthick-ramachandran Skill

Check a change against the repository's naming conventions and canonical vocabulary instead of reinventing patterns. Use when reviewing a finished change, or before finishing one, to verify it reuses what CONVENTIONS.md names. Skip for planning work, security reviews, and writing new tests.

erikdarlingdata Skill

Quarterly maintenance pass (every 1-3 months) — dependency/security audit, build health, and repo hygiene for PerformanceMonitor and PerformanceStudio

getlago Bundle

Triage a CVE / Dependabot alert in a JS/TS project and recommend the least-invasive fix. Walks the dependency chain, identifies the parent that blocks the patch, flags unmaintained packages, and only suggests a package-manager override as a last resort with explicit user confirmation. TRIGGER when the user asks to "fix a CVE", references a Dependabot alert URL (github.com/*/security/dependabot/*), mentions a CVE-YYYY-NNNN or GHSA-* identifier, or asks how to resolve a vulnerable transitive dependency.

priyothana Bundle

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

jesse-merhi Skill

Plan and audit test portfolios before creating, changing, or removing tests or test infrastructure; challenge missing, duplicate, brittle, wrongly placed, ownerless, and dangerous coverage.

jesse-merhi Skill

Audit PR diffs for unrelated artifacts, noisy comments, deletions, generated drift, and stray refactors.

thecolliery Bundle

Performance complexity and resource allocation canary — checks for O(N^2) loops, database N+1 query patterns, memory leaks (unbounded collections), and blocking calls in main event loop. Triggers on keywords: "/scale-canary", "scale-canary", "performance audit", "scale audit". Use when writing loops over growing data, DB queries, caches, or async/event-loop code.

thecolliery Bundle

World-class completeness audit — score a project's rules/standards/features against best-in-class exemplars, name the gaps, fill missing rules, adopt as binding, then offer to conform existing code. Triggers on keywords: "/gold-standard", "gold-standard", "audit rules", "are we world-class", "fill gaps", "complete our rules", "conform old code".

thecolliery Bundle

Failure-mode audit (FMEA for software) — for each way the system can fail (network, storage, partial completion, crash, concurrency, bad input), check whether code DETECTS, HANDLES, RECOVERS, and COMMUNICATES it. Triggers on: "/resilience-audit", "resilience-audit", "FMEA audit". Use when touching network, storage, async, retry, or rollback paths. Flags data loss, silent-success-on-failure, missing rollback/retry/idempotency. Reports; does not fix unless asked.

thecolliery Bundle

Observability and structured logging canary — checks for structured logs (JSON), OpenTelemetry metrics/traces, proper error stack traces, and flags empty catches or silent log swallowing. Triggers on keywords: "/telemetry-canary", "telemetry-canary", "observability audit", "structured logging". Use when adding or changing logging, metrics, tracing, or error-handling code.

thecolliery Bundle

Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

thecolliery Bundle

Testability and design decoupling canary — checks for tight coupling, lack of Dependency Injection (DI), hardcoded constructors, Single Responsibility Principle (SRP) violations, and mockability gaps. Triggers on keywords: "/testability-canary", "testability-canary", "testability audit", "decoupling". Use when refactoring coupling, introducing DI, or making code unit-testable.

64x-lunicorn Bundle

Designs or changes an HTTP API contract against fixed REST guidelines, covering resources, methods, status codes, problem details, pagination, concurrency, security and versioning, and keeps its OpenAPI document, Swagger UI and Bruno collection in the same change. Use when endpoints or routes are designed, added, changed or removed, when an OpenAPI document or Bruno collection is written, when an API change is reviewed, or when a feature needs a backend endpoint even though nobody says "API".

64x-lunicorn Bundle

Writes a project's community files from fixed templates on GitHub, GitLab, Forgejo or without a forge, the pull or merge request template, CODEOWNERS, SECURITY.md, CONTRIBUTING.md and LICENSE, keeps the project's own sections on re-runs and reports drift. Use when a project gets its community files for the first time, when they drifted from the house templates, or when the license, the code owners or the CI checks changed.

kerpopule Skill

Use when Jev is not working yet, a Jev tool reports no_key or auth_failed, or the person asks to connect or fix Jev. Gets their TypeSafe or OpenRouter key into the secret store, unseen by you.

gremelinn0 Skill

Manage your Claude Code skills via a self-hosted visual hub. Regenerate the skills/CLAUDE.md indexes, serve the marketplace page locally or on Vercel, consume the exported decisions JSON to apply move/duplicate/archive/store/note actions across your repos. Triggers — "/skill-hub", "ouvre mon hub de skills", "ménage skills", "trier mes skills", "audit skills perso".

microsoft Bundle

Run autonomous experimentation while the user is AFK. Uses 6 investigation categories (investigation, bug hunting, feature design, refactoring, optimization, security audit) to systematically discover non-obvious behaviors. Every task is an experiment — implement in worktrees, commit to persistent dream branches, and push to the configured remote. Dreams compound across sessions: future experiments branch from prior dream branches, building a tree of progressively deeper work. Invoke when the user is AFK or asks for a dream run.

nudgebee Bundle

Console / Performance Audit