Security

navinspire-ia Skill

Audit data protection and privacy - PII/PHI handling, encryption at rest and in transit, retention, logging of sensitive data, tenant isolation, and GDPR/CCPA obligations. Use for /vault, privacy reviews, or compliance-driven data audits.

navinspire-ia Skill

Hunt for concrete, exploitable vulnerabilities - OWASP Top 10 patterns, hardcoded secrets, vulnerable dependencies and CVEs, SSRF, path traversal. Use for /probe, dependency audits, or "find the flaws" requests.

navinspire-ia Skill

Hunt for leaked credentials - hardcoded API keys, tokens, private keys, passwords and connection strings in code, config, logs and git history. Use for /unmask, pre-commit secret sweeps, or "did we leak a key?" questions.

nousresearch Bundle

Authorized web pentest: recon, proof-based exploits, report.

navinspire-ia Skill

Run a full application security audit - auth flows, input validation, secrets handling, injection surfaces, dependency risks, and hardening. Use for /fortify, pre-release security reviews, or "is this safe?" questions.

navinspire-ia Skill

Map the codebase and controls against security standards - OWASP ASVS, CIS Benchmarks, SOC 2, ISO 27001, PCI-DSS - producing a gap analysis with evidence and remediation. Use for /comply, audit prep, or "are we compliant with X?" questions.

navinspire-ia Skill

Build and use objection response playbooks - price, security, integration, competition, status quo. Use to prepare answers and battlecards for sales conversations.

navinspire-ia Skill

Choose the right depth of reasoning for the task - shallow for routine edits, deep for architecture, security, or ambiguous bugs. Use when work quality depends on thinking harder (or intentionally less).

jellydn Skill

Review code for quality, security, and best practices — read-only analysis

makinotes Bundle

EdgeLab 交易决策引导引擎。任何交易问题（解惑/探查/决策）都认真接住、往根因引导——结合用户明确表达的感受与交易记录，核对规则、证据和风险约束。梳不堵：结论你自己下，不替你给方向。两种模式：问诊（穿透一个具体问题）+ 体检（拆你整套打法）。 触发方式：/elab-diagnosis、/问诊、「我有个投资问题」「该不该清仓/割肉/加仓」「能不能买卖」「帮我体检我的打法」 EdgeLab trade-decision guidance engine: takes any trading question, checks evidence, stated feelings, decision rules and risk constraints. Never blocks; you draw the conclusion. Trigger: /elab-diagnosis, "should I cut/add/buy/sell", "diagnose my decision", "audit my approach"

makinotes Bundle

归档并审计富途（q.futunn.com）或老虎社区（laohu8.com）公开博主主页。用户给出主页 URL 或数字 UID，或要求先说明下一步、抓取、归档、复盘、比较富途/老虎博主时使用；即使用户说“先别执行”，也先加载本 skill 完成范围确认。数字 UID 默认富途；任何抓取前必须让用户明确选择时间范围。保存动态、专栏（仅富途）、原始证据和公开媒体（仅富途），结合发帖时点行情做证据有界研究。其他平台不适用。 Archive and audit public Futu or Tiger profiles from a profile URL or numeric UID. Invoke for planning-only requests too; a numeric UID defaults to Futu, and capture requires an explicit time window.

jellydn Skill

Audit code for security vulnerabilities — read-only analysis

ar9av Skill

Audit and maintain the health of the Obsidian wiki. Use this skill when the user wants to check their wiki for issues, find orphaned pages, detect contradictions, identify stale content, fix broken wikilinks, or perform general maintenance on their knowledge base. Also triggers on "clean up the wiki", "what needs fixing", "audit my notes", or "wiki health check". Add --consolidate to switch from report-only to act-and-report mode (the "dream cycle"): fixes broken links, adds missing cross-references for orphans, corrects lifecycle states, demotes stale peripheral pages, normalizes tag aliases, and adds contradiction callouts — all with a dry-run preview and explicit user confirmation before any writes.

inapp-inc Skill

Use when the spec affects system boundaries, data contracts, APIs, persistence, concurrency, security, performance, or cross-team behavior. Applies platform ADRs and governance; produces or updates OpenAPI specs and design decisions. Invoked by spec-driven-development for design and architectural alignment.

inapp-inc Skill

Use when a SEED Unit has security constraints (authn/authz, tenant isolation, input validation, secrets, OWASP). Invoked by spec-driven-development / seed-unit when security constraints apply.

firstp1ck Skill

Agents should invoke this skill for Linux server security reviews, SSH hardening, firewall/open-port audits, user/permission checks, exposed services, or host hardening requests. Produces severity-rated findings and practical remediation steps.

firstp1ck Skill

Audit and maintain fiction continuity, character knowledge, chronology, world rules, objects, foreshadowing, and series canon using evidence from saved manuscripts.

firstp1ck Skill

Agents should invoke this skill for code security reviews, leaked secret checks, dependency risk, unsafe shell/Python/TypeScript/Rust patterns, auth/input-validation flaws, SAST-style audits, or supply-chain concerns in repositories.

skillkeel Skill

Use when the user asks whether secrets were committed, before open-sourcing a repo, or after a leak scare. Scans the working tree and full git history for credentials, reports findings with commit and path, and gives a remediation plan (rotate first, then purge).

firstp1ck Bundle

Repair one focused, inspectable code behavior with a declared file boundary, actual validation, and a bounded retry count. Do not use for broad feature delivery, architecture decisions, security review, or documentation-only work.

skillkeel Skill

Use when the user asks to update, fix, or audit README.md, or when README commands look stale. Checks every command, path, and claim in the README against the actual repo and proposes a minimal diff; never rewrites the whole file unasked.

skillkeel Skill

Use when the user asks to check dependencies for vulnerabilities, outdated packages, or before a release. Runs the ecosystem's real audit tool, separates fixable from unfixable, and proposes minimal safe upgrades with lockfile changes reviewed, never bulk-upgrading blindly.

vibecodedapps-official Skill

Audit a change against the rules the repository states for itself in AGENTS.md, AGENTS.override.md, and configured fallbacks such as CLAUDE.md, resolved the way Codex resolves them and quoted exactly. Run by code-review, or alone when the user asks whether a change follows the project's conventions or instruction files.

vibecodedapps-official Bundle

The general review pass. Check every changed file for correctness, security, and performance defects with a per-file coverage checklist, confirm each finding in the code, and apply the do-not-report list. Run by code-review, or alone when the user asks for a bug hunt or a review of the logic in a change.

iwannabeblownaway Skill

Use this skill whenever the user wants to audit, review, inspect, or check a SKILL for logic consistency, content completeness, or quality issues. Triggers include: '审查这个SKILL'、'检查SKILL逻辑'、'审计技能'、'检查这个skill'、'review this skill'、'audit this skill'、'检查skill的完整性'。 Also use when the user pastes SKILL.md content and asks for review, or when the user says '帮我检查一下这个技能' or similar. This skill performs deep inspection of ALL files in the SKILL folder — every file type including SKILL.md, scripts (.py/.js/.ts), configurations (.json/.yaml), evals, assets, and any other present files. No file is excluded from audit by type.

qq13144946939-lab Skill

Route authorized reverse-engineering and security-analysis work to specialist skills when a task spans modules or its entrypoint is unclear. Use the dedicated browser or documentation skill directly for ordinary browsing and writing.

getedgehq Bundle

Audit a command-line tool for user-friendliness — clear situation / next-step / options in every output, colour-highlighted runnable commands, no raw jargon, no silent hangs. Invoke for "CLI UX audit", "review my CLI", "is this CLI intuitive", or before any CLI release.

heikkitoivonen Skill

Authors, expands, or reviews Python builtin and standard-library complexity pages, including API coverage, navigation, examples, translations, audit metadata, and verification. Use when adding a module/type page, materially expanding one, or reviewing an existing one for correctness - a review covers what the page omits as well as what it claims.

gabrielmoreira Bundle

Use when creating, triaging, or filing GitHub issues — writing bug reports, feature requests, or task tickets; classifying severity; using the gh CLI; or handling edge cases like regressions, flaky failures, security vulnerabilities, or cross-repo dependencies.

gabrielmoreira Bundle

Detects high-confidence security risks in code.

gabrielmoreira Skill

Automatic egress service for substantive work. Append a structured entry to .acm/audit-trail.md IN THE TARGET REPO ROOT — recording the interpretation, examination, decisions, actions, and reflection. Destination, Improve, Orient, and Probe apply Trail automatically; the operator should never need to invoke it separately. Direct use remains available for consequential work outside those workflows and independent-writer mode.

gabrielmoreira Skill

Health-check your meeting knowledge for contradictions, stale commitments, and decision conflicts. Use when the user asks "any conflicts in my meetings", "check for stale action items", "lint my meetings", "consistency check", "are there contradictions", or wants to audit their decision history.

gabrielmoreira Skill

Security analysis patterns for STRIDE threat modeling, compliance checks (SOC2, GDPR, HIPAA), vulnerability assessment, and secure coding. Use for security reviews at planning, implementation, and review phases.

naodeng Bundle

Use this skill when you need to design mobile test plans for iOS or Android covering functionality, compatibility, performance, network, and security; triggers include 移动端测试 and mobile testing.

gabrielmoreira Skill

Use after /controlflow-claude-code:controlflow-plan produces a plan, before implementation. Runs adversarial pre-execution verification inline in the main context (zero subagents): structural audit, assumption/mirage detection, and executability cold-start simulation. Emits APPROVED / NEEDS_REVISION / REJECTED with evidence.

gabrielmoreira Skill

Run a comprehensive security audit on a ClawdStrike policy