Security

mohitagw15856 Skill

Simulate enterprise procurement and security review of your product before your first big deal meets it for real — the questionnaire, the gaps, the deal-slowing findings. Use when asked to prep for enterprise procurement, simulate a security review, why do enterprise deals stall, or get ready for vendor assessment. Produces the reviewer's findings memo (security, legal, compliance, vendor-risk), the stall-risk ranking, and a debrief with the artifacts to prepare before the real gauntlet.

mohitagw15856 Skill

Set up a sane password and two-factor-authentication baseline that's genuinely secure and actually sustainable — a password manager, unique passwords where it counts, and 2FA on what matters. Use when asked to improve my password security, set up a password manager, how do I use 2FA, or make my accounts more secure. Produces a prioritized rollout (secure the crown-jewel accounts first), a password-manager setup, a 2FA plan by method strength, backup-code and recovery safeguards, and a realistic order so it gets done, not abandoned.

mohitagw15856 Skill

Audit the recurring meetings a team has accreted — each standing slot tested against its original purpose, current attendance reality, and outcomes, with keep/shrink/merge/kill verdicts and the two-week cancellation experiment that settles arguments. Use when asked audit our recurring meetings, our calendar is all standing syncs, which meetings should die, or reset the team's meeting load. Produces the inventory with per-meeting verdicts, the experiment protocol, the merge map, and the re-accretion guard.

mohitagw15856 Skill

Get your security deposit back — the move-out documentation that wins disputes before they start, the itemized-deduction challenge, the demand-letter ladder, and the small-claims decision point. Use when asked how do I get my deposit back, my landlord is keeping my deposit, dispute these deposit deductions, or write a deposit demand letter. Produces the move-out evidence protocol, the deduction-by-deduction challenge with the wear-and-tear line drawn, the escalation ladder with letters, and the small-claims prep sheet.

mohitagw15856 Skill

Review a vendor/SaaS contract against a practical checklist before you sign. Use when asked to review a vendor contract, check a SaaS/MSA/subscription agreement, flag risky terms, or prepare negotiation points before signing. Produces a structured review — key terms extracted, a risk-flagged checklist (commercial, legal, security, exit), questions to ask, and prioritised negotiation points. Not legal advice.

mohitagw15856 Skill

Write a single clear, honest public statement about an incident. Use when asked to draft a public statement, a press statement, or an official response to a security breach, outage, data incident, recall, or public controversy. Produces a ready-to-publish statement — acknowledgement, what happened, impact, what you're doing, what affected people should do, and a commitment to update — plus a short and a long version.

mohitagw15856 Skill

Run a third-party / vendor security review and assign a risk tier with required controls. Use when asked to assess a vendor's security, run a third-party risk assessment, complete a security questionnaire about a vendor, or decide what due diligence a new tool needs. Produces a vendor risk assessment — a data/access-driven risk tier, the questionnaire focus, required evidence (SOC 2, pen test, DPA), residual risk, and an approve/conditional/reject recommendation.

mohitagw15856 Skill

Reconcile controlled-substance records and prepare for an inspection — the count against the register, the discrepancy investigation, the documentation an inspector asks for, and the reporting obligations a shortfall triggers. Use when asked to reconcile controlled drugs, prepare for a DEA or controlled-drug inspection, investigate a discrepancy or suspected diversion, or audit the CD register. Produces the reconciliation, the discrepancy investigation record, the inspection-readiness checklist, and the escalation and reporting decision tree. A process framework only; reporting thresholds, timelines and obligations are set by law in your jurisdiction and must be verified there.

mohitagw15856 Skill

Run or document a security incident response — contain, eradicate, recover, and learn. Use when responding to a breach/compromise/security incident, writing an IR plan or runbook, or producing a post-incident report. Produces a phase-by-phase response (triage, contain, eradicate, recover, post-incident) with the immediate actions, comms, evidence-handling, and a blameless review. For incidents on systems you own or defend.

mohitagw15856 Skill

Prepare a transport operation for a regulatory audit — the records an auditor asks for in order, the findings your own file will produce, and the gaps closed before the visit rather than during it. Use when asked to prepare for a DOT or FMCSA audit, a traffic commissioner or operator licence review, a fleet compliance inspection, or to run an internal transport compliance audit. Produces the records inventory, the self-audit findings by severity, the gap-closure plan, the audit-day logistics, and the evidence pack. Requirements are jurisdiction-specific and must be verified against the current regulation and your licence conditions.

mohitagw15856 Skill

Find out how a dashboard, KPI report, or metrics slide is lying to you — before you repeat its story in a bigger room. Use when numbers feel too tidy, a narrative rests on one chart, or you inherited metrics you didn't define. Produces a deception audit: every metric graded for the eleven classic distortions (denominator games, survivorship, y-axis crimes, cherry-picked windows…), the story the data would tell under honest framing, and the three questions to ask the metric's owner.

mohitagw15856 Skill

Respond to a brand or executive impersonation incident — deepfaked executives, cloned support lines, fake apps, spoofed domains, or AI-generated scam content wearing your name. Use when a deepfake of a leader is circulating, customers report a fake version of your product or support channel, or to prepare the impersonation playbook before it happens. Produces an incident response: verification protocol, takedown sequencing by platform, customer and public communications, and the hardening plan. For general crisis comms use press-release/pm-crisis skills; for security incidents inside your systems use security-incident-response.

mohitagw15856 Skill

Document a pharmacist's clinical intervention — the interaction or error spotted, what was done, what the prescriber decided, and the outcome — so the record shows the catch and the care that followed. Use when asked to document a clinical intervention, record a prescriber call about an interaction, log a near-miss, or build an intervention record for audit or remuneration. Produces the intervention record with severity and evidence, the prescriber-call script, the outcome and follow-up, and the aggregate reporting fields. A documentation framework for a licensed pharmacist; every interaction and severity judgement must be verified against current references.

nvidia Bundle

Run one NemoClaw daytime maintainer pass. Prioritize items for the release version. Select a merge, salvage, security, test, conflict, or sequencing workflow and report progress. Use during the workday to land PRs and close issues. Designed for /loop, for example /loop 10m /nemoclaw-maintainer-day. Trigger keywords - maintainer day, work on PRs, land PRs, make progress, what's next, keep going, maintainer loop.

mohitagw15856 Skill

Decode a home renovation or repair quote — allowances that aren't prices, exclusions that become change orders, payment schedules that shift risk, and what a comparable-bids check should cover. Use when someone asks 'is this contractor quote fair', 'decode this renovation bid', 'what should be in a contractor contract', or 'why do these three bids differ so much'. Produces a section-by-section decode, the allowance and exclusion audit, payment-schedule risk analysis, and the questions that make bids comparable.

mohitagw15856 Skill

Draft answers to a vendor security questionnaire (SIG, CAIQ, or a custom sheet) from your real controls — fast, consistent, and honest about gaps. Use when asked to fill out a security questionnaire, answer a SIG/CAIQ, respond to a customer's security review, or complete a vendor risk assessment. Produces drafted answers grounded in your stated controls, a gap list of questions you can't truthfully answer yet, and reusable answer snippets for next time — never fabricated compliance.

oliver-kriska Bundle

Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after phx-deps-audit findings or to initialize hex_vet.exs.

oliver-kriska Bundle

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

tinyhumansai Skill

Review a change for what it lets an attacker do, and file what it finds on the security-findings ledger.

oliver-kriska Bundle

Narrow bare rescue in Elixir so real errors like KeyError and typos propagate instead of being swallowed. Use to audit rescues and refactor error handling.

tinyhumansai Skill

Assemble what an auditor will ask for, and find what they will find before they do.

theboscoclub Bundle

Autonomous 20-phase project audit with testing, security scanning, code quality, GitHub auditing, and auto-fixing

jamie-bitflight Skill

Use when reviewing test suites for coverage, isolation, mock usage, naming conventions, or completeness. Activates on "review test coverage", "audit test quality", or "check tests for completeness" requests. Performs thorough checklist-driven review covering test isolation, mock correctness, AAA pattern adherence, and naming standards.

oliver-kriska Bundle

Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.

jmix-framework Skill

Create or update Jmix unit, integration, UI integration, or end-to-end tests for services, entity listeners, security behavior, views, fragments, and persistence workflows.

jmix-framework Skill

Configure or audit Jmix fetch plans in XML views, fragments, DataManager loads, repositories, and entity events when loading references, avoiding N+1 queries, fixing unfetched attribute errors, or tuning data loading.

stanfish06 Skill

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

stanfish06 Bundle

Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.

stanfish06 Bundle

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

stanfish06 Bundle

Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.

stanfish06 Bundle

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

stanfish06 Bundle

从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调"CTF 本地通 → 真实远程稳定打通"的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。

stanfish06 Bundle

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

stanfish06 Bundle

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

stanfish06 Bundle

Data Room Gap Analysis skill for Datasite deal rooms. Use this skill whenever a sell-side deal team wants to audit what is missing, sparse, or incomplete in their data room before going live to buyers. Triggers include: "run a gap analysis", "what's missing from the data room", "check the data room coverage", "flag empty folders", "what haven't we uploaded yet", "data room readiness check", "find gaps before we go live", "are all the contracts in there", "check we have everything", or any request to assess completeness of the data room by section. Use whenever a deal team is preparing to launch a data room and wants to know what still needs to be uploaded or organised. Do not use for document quality issues such as PII or redaction (use document-quality-check), or for drafting Q&A responses (use bulk-qa-answers).

stanfish06 Bundle

Use for a standard, single-pass security audit of an entire repository or a scoped path, package folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR/commit/branch/working-tree diffs, or for deep, multi-pass, or variance-reducing scans.