Security

naodeng Bundle

Use this skill when you need to design security testing around OWASP risks, vulnerability scanning, and penetration scenarios; triggers include 安全测试 and security testing.

idwong Bundle

对**一次改动**做成文的代码评审：工作区 diff／分支／PR／指定路径都能评，产出带证据行（`file:line`）、 严重级与整改闭环的评审报告，落 `dev/reports/`。 能力：(1) 先圈定评审范围与规格真源，再按八个维度逐项过 (2) 每条意见必须指到实处并经一轮自我反驳 (3) 按交付模式分档（快速／标准／严格）(4) 整改后回填闭环状态，不留「已知问题」当交付物。 触发词：「代码评审」「review 一下这段代码」「帮我看看这个 PR」「合并前把关」「这次改动有没有问题」 「评审报告」「code review」「MR 评审」「提交前审一遍」「谁来把个关」， 或在 `dev-master` 阶段 10 之前需要人工／AI 把关时。 与内置 `/code-review` 的关系：Claude Code 内置命令适合**即时看 diff、不留档**； **本技能面向 Codex / Cursor（没有那个命令）以及需要成文报告、按维度全覆盖、要闭环追踪的场景**。 不适用：文档意图 vs 代码实现的差距审计（`pm-ai-ship-audit`）、具体故障定位（`systematic-debugging`）、 「说做完了是不是真做完」的终检（`verification-before-completion`）、测试用例设计（`pm-test-cases`）。

idwong Bundle

产出《发布与回滚预案》：变更面盘点 → 灰度批次与开关 → 监控指标与阈值 → 回滚触发条件与步骤 → 演练记录，落 `dev/release/`。回答的是「怎么发上去」和**「出事了怎么退回来」**这两个问题。 能力：(1) 把代码/配置/数据/契约/依赖五类变更分开定回滚方式 (2) 数据迁移按 expand-contract 拆成可逆步骤， 不可逆操作单列并要人工确认 (3) 每个监控指标带数据来源、观察窗口与回滚阈值 (4) 回滚步骤**必须演练过一次**才算完成。 触发词：「发布方案」「发布预案」「上线方案」「怎么发版」「灰度发布」「灰度放量」「放量节奏」「回滚方案」「回滚预案」 「出事了怎么退回去」「数据迁移能不能回滚」「发布检查单」「上线 checklist」「蓝绿」「金丝雀」「feature flag 怎么配」， 或 `dev-master` 阶段 12 要出上线材料时。 不适用：A/B 实验的分流与显著性判定（`pm-experiment-designer`——它的「灰度」指实验分组，本技能的灰度指**发布放量**）、 面向用户的版本更新文案（`pm-release-notes`）、分支合并与收尾（`finishing-branch`）、 任务分解、开发顺序与进度（`task-breakdown`）、上线前的代码与文档审计（`pm-ai-ship-audit`）。

leeyudok Skill

코드 변경사항 전체 리뷰. code-reviewer 에이전트 + security-audit 에이전트를 순차 실행하는 래퍼 스킬. PR/MR 생성 전 또는 리뷰 요청 시 사용.

leeyudok Skill

외부 보안팀 코드 검사 전 자체 사전점검. security-audit 에이전트(+ 설정돼 있으면 SonarQube 보안 핫스팟)를 돌려 P0/P1/P2로 정리하고, 발견사항을 이슈로 쪼개 병렬 서브에이전트로 고친다. "보안 검사", "보안 점검", "코드 감사" 언급 시 사용.

shoyann Bundle

Ethical, evidence-first OSINT planning, tool selection, verification, monitoring, reporting, and guarded official wanted/fugitive-person location intelligence using a structured catalog adapted from jivoi/awesome-osint. Use for public-source domain, company, username, image, geospatial, news, fact-checking, defensive threat-intelligence, and verified official wanted-person research. Do not use for doxxing, stalking, credential acquisition, access bypass, continuous real-time tracking, or abusive/invasive profiling.

brenordv Bundle

Single entry point for security AND penetration-testing work: auditing, SAST, dependency scanning, compliance, threat modeling, and penetration testing (planning, scoping, checklists, and command execution).

brenordv Skill

Review all changes in the current branch compared to main/master. Covers correctness, security, performance, maintainability, and testing. Language-agnostic: detects languages in the diff and applies relevant standards. Use after completing work or before merging.

simaomenezes Skill

Use when hardening JWT config, secrets, expiry, revocation, RS256/JWKS in NestJS.

diode663 Bundle

Lay out a KiCad PCB (.kicad_pcb) from Python — netlist-driven automatic placement using datasheet-derived recipes (regulator loops, decoupling, charger priority order, hub/codec/GNSS/M.2 rules), a reviewable floor plan with lock-and-rerun, module keep-outs (compute modules / SoMs on mezzanine connectors), double-sided boards, board outline, mounting holes and tidy silkscreen, decoupling rows for hand-written tables, BGA dog-bone fan-out, scripted and hybrid routing (critical nets from a script, Freerouting for the rest, ground pours, a reproducible result), and a JLCPCB placement (CPL) file with sourced rotation corrections — and prove it with a recipe audit and KiCad's own DRC. Use this whenever the user wants parts placed or arranged on a board ("come up with a sensible PCB layout", "place the components", "floorplan this board", "where should the regulator go", "make the board smaller", "score this placement"), wants placement copied from reference designs or datasheet layout guidance, asks to route a boar

rhenter Skill

Use when the user explicitly requests a security review, threat assessment, credential review, authorization review, or security-risk analysis.

djolaq Bundle

Conduct a non-destructive application security audit of a codebase against the official OWASP Application Security Verification Standard (ASVS) and produce a Markdown report, prioritized by severity, readable by product owners and security engineers. Use when the user asks to run an "owasp asvs audit", "security audit", "appsec review", "security code review", "ASVS compliance check", or wants findings classified by severity with remediation priorities. Triggers: asvs, audit, security, vuln, vulnerability, appsec, pentest report, compliance, securite.

padosoft Bundle

Use this skill when building or reviewing anything to do with who a user is and how long they stay that way — login, registration, password reset or change, email change, invitations, sessions, API tokens, second factor, logout, remember-me, a captcha on a form. Also when the user reports credential stuffing, an account enumeration finding, a session that never expires, a password change that did not log other devices out, a lockout that never fires, or asks what a new application needs before it opens to the public. It gives the control, the reason it is shaped that way, and the ways each one is commonly present but ineffective. Do not use it for authorisation and ownership (padosoft-tenant-isolation) or for the whole security posture (padosoft-security-baseline).

stbenjam Bundle

Review the current pull request diff and summarize risky changes before approval

padosoft Bundle

Use this skill to turn what other repositories have learned into skills — a periodic harvest of their lessons files, rule folders, internal skills, decision records and security docs, deciding for each finding whether it updates an existing skill, becomes a new one, or is deliberately left alone. Also when the user says "check the repos for new rules", "harvest the know-how", "what changed since last time", asks how to keep the catalogue current, wants to know whether something was already considered, or asks what to do with the local rules a skill now duplicates. It covers the work order, the judgement that turns a finding into a rule, the promotion criterion, and the ledger that stops the same material being mined twice. Do not use it to write a single skill from scratch (padosoft-skill-creator) or to audit an existing one.

padosoft Bundle

Use this skill when a pull request has comments from an automated reviewer — GitHub Copilot, Codex, CodeRabbit, Advanced Security — and the user wants them processed: "copilot review", "the bot comments on the PR", "address the review", "fix the Codex findings", or simply "there are 14 comments on PR 212, sort them out". It reads every bot comment, sorts them into must-fix / worth-fixing / negligible / bot-is-wrong, gets the categorisation approved before touching code, applies only the approved fixes, replies to each comment on GitHub, and proposes a new project rule when the bot found a real bug the project checks would have missed. Do not use it for a human reviewer's comments, for a single comment, or to write the code review itself.

padosoft Bundle

Use this skill when writing or reviewing a CI workflow or a gate that guards a merge — a GitHub Actions file, a required check, a validator script, a secret scan, a branch or tag ruleset — and whenever the user says a check went green without checking anything, a workflow did not start, a label does not trigger the run, CI minutes are being burned on every push, a required check cannot run before merge, or a rule can be bypassed. It covers what actually makes a gate a gate, the trigger and permission semantics that silently replace your defaults, and the cost tiering. Do not use it to design deployment pipelines, to pick a CI provider, or to debug a failing application test.

padosoft Bundle

Use this skill whenever a branch behaves differently depending on the environment — debug output, error detail, a profiler or diagnostic endpoint, a permissive security header, a seed, an auth mock, a provider in test mode, a destructive command guard, a feature flag keyed on the deployment. Also when the user reports that a development behaviour appeared on the live site, that stack traces or query dumps are visible to users, that a staging box behaves like a laptop, or that an environment check did not match. It replaces the two-valued check with the three answers that actually exist, and picks the default from what the branch does. Do not use it for CI workflow configuration, for secret management, or for choosing a deployment topology.

padosoft Bundle

Use this skill when something is being declared done, safe, covered or production-ready and you need to know what actually proves it: a release or compliance gate, a security or DR claim, a "CI is green so we can ship", a "the job succeeded", a "the tests pass so it works", a coverage or mutation number, a signed artifact, an integration verified against an emulator or a mock. It names the claim, names what would prove it, and finds the gap where a cheaper artifact was accepted in place of the expensive one. Do not use it to write tests (padosoft-test-integrity), to build a CI workflow (padosoft-ci-workflow-gates), or to debug a failing check — this is about whether a passing one means anything.

padosoft Bundle

Use this skill when adding something new to a Laravel application — an endpoint, a controller, a service, a CRUD backend, a queued job, a test — "make me the API for X", "add the CRUD for Y", "I need a service that does Z" — and whenever a piece added earlier is half-wired: a route that answers 404, a policy that is never called, a request class that validates nothing because the controller reads `all()`, a job that is dispatched but has no queue configured. It lists the files each piece touches, in order. Do not use it to review existing code (padosoft-laravel-conventions) or for the security review.

stbenjam Bundle

Use when reviewing a skillsaw PR. Dispatches 7 specialist reviewers (Architecture, Python Expert, Security & Supply Chain, QA Engineer, Technical Writer, Ecosystem, Slopinator) as parallel sub-agents by default, then synthesizes a single verdict. Use --serial for cheaper inline execution.

stbenjam Bundle

Audit skillsaw for release readiness — test new rules against real repositories, audit core architectural dimensions, independently verify proposed fixes, and ship improvements in clean, focused batches. Use before cutting a release.

padosoft Bundle

Use this skill when changing a shared OpenAPI contract that other projects consume — adding or editing a field, an endpoint or a response schema in a spec package, or bumping and publishing it — and whenever the user says the mock and the real API disagree, a client method is missing a new parameter, the generated document fails to build, or a consumer broke after a spec release: it walks the places that must stay in sync (schema, mocks and per-tenant overrides, endpoint, client, tests), the changeset and version bump, and the build-and-call verification loop. Do not use it to implement the endpoint in the API that serves it (padosoft-hono-api-conventions) nor for its security review.

stbenjam Skill

Review pull request diffs for correctness, security, and style. Use when assessing a code change.

stbenjam Skill

Draft release notes from merged pull requests since the last tag

stbenjam Skill

Query the ledger replica for transfers, balances, and audit rows. Use when debugging data issues in acme-api.

dioad Skill

Activate when the user asks for a comprehensive architecture review of the codebase, or wants to systematically address findings from a prior review. Reviews across eight lenses -- good engineering practices, correctness, operability, documentation, security, hexagonal architecture, low coupling/complexity, and beta-release readiness. Generates a ranked findings document (doc/claude-review-architecture.md) or works through existing findings one commit at a time.

killerwolf Bundle

Audit and upgrade a project's discoverability and credibility — README, badges, package/extension metadata, social preview card, CI, CHANGELOG/CONTRIBUTING, and the GitHub listing (description, homepage, topics). Adapts to whatever the project turns out to be: npm library, browser extension, CLI tool, Python/Rust/Go package, or a plain repo. Use this whenever the user wants to polish or launch a project, make a repo "look pro" or "more discoverable", rewrite a README, prep an npm or Chrome Web Store listing, add badges or an OG/social-preview image, or asks to apply to one repo what was done to another. Reach for it even when the ask sounds narrow ("add some badges", "write me a better README") — the audit is one command and it surfaces the rest of what's missing.

austin-jc Bundle

Two-phase review system for tickets that Claude implements — a Ticket Brief before any code is written (business context, before-and-after walkthrough, task list to approve) and a Change Report after (end-to-end flow, every endpoint, query, rule and screen change described in plain words, with a click path and a manual verification recipe). Use this whenever the user gives you a ticket, issue, story or Jira key to understand or start on, asks what a ticket is really about, asks you to explain, summarize or audit what was implemented on a branch or in a pull request, or says "brief", "change report", "what did we change", "walk me through this ticket", "review this before you start", or "what did you actually build". Also use it when a user who delegates implementation asks to understand a task in plain language. Do not skip it because the ticket looks small.

stbenjam Skill

Dependency audit across the service repositories.

zhengqiuyang Bundle

Validates a tool against real-world third-party inputs instead of self-made fixtures: official servers, real repositories, real PRs, real version drift, and cross-platform CI. Use when unit tests are green but you need evidence the tool works outside the lab — before publishing, after a major refactor, or whenever a security/precision claim needs to hold on data you did not invent. Catches the class of bugs fixtures structurally cannot contain.

hugobatista Skill

Review code changes on projects that start self-hosted and evolve into SaaS. Catches regressions, anti-patterns, and architecture violations before they reach production. Four specialized lenses — saas transition strategy, SaaS anti-pattern, security, and technical debt — plus full test suite execution. Works on pull requests (creates isolated worktree) or local git diffs. Triggered by: review PR, PR #, saas transition review, hybrid review, review pull request, review, review diff.

fe0437 Skill

Check and fix the WHOLE codebase against the project's API_GUIDELINES.md and ARCHITECTURE.md. First run distills the docs into cached checker/fixer scripts; later runs use only the cache (cheap). Use when asked to audit or enforce project guidelines/architecture compliance repo-wide.

sven-ericmolzahn Bundle

Adapt iOS apps (SwiftUI and UIKit) for iPhone Duo, Apple's folding iPhone: two displays, a hinge, toolbars and tab bars that move to the side, reserved regions, and the iOS 27.1 layout APIs (ArrangementView, UIArrangementViewController, reservedRegions, onHingeChange, axisBehavior, toolbarVerticalBehavior). Use this skill whenever the user mentions iPhone Duo, a foldable or folding iPhone, the hinge or fold, book or laptop pose, inner or outer display, Device Hub, vertical bars, or ArrangementView. Use it too when an iOS layout looks stretched, centred with dead space, squeezed or clipped on a wide or short screen, when toolbar items overflow or jump to the side, or when auditing an app for iOS 27 / Xcode 27 readiness, even if nobody says "Duo". Provides API spellings verified against the shipping SDK, measured device metrics, the traps that cost real debugging time, compile-checked samples, and scripts that audit a project and verify the SDK.

memseekai Skill

Audit why Memseek recalled a claim by opening its evidence and replaying the original session when needed.

liuyanghejerry Skill

扫描硬编码密钥与凭证