Security

liuyanghejerry Skill

大规模扫描硬编码凭证，忽略占位符

the-exodus Skill

House rules for a project's lexicon — the domain's ubiquitous language — and the procedure for pruning, consolidating and correcting one that has sprawled. Load before admitting, amending or retiring a lexicon or glossary entry in any repo; when asked to review, audit, prune, consolidate, clean up or correct a lexicon or glossary; and when a lexicon has grown past about thirty entries or its entries describe code rather than meaning. design-interview loads it for the admission tests. NOT for API reference documentation, code doc comments, or user manuals.

dprakash2101 Skill

Review .NET changes for concrete correctness, regression, security, contract, concurrency, and test risks. Use for review requests, pull requests, or diffs; do not modify code unless separately requested.

khe618 Skill

Use when writing, reviewing, or verifying Supabase Postgres migrations, RLS policies, SECURITY DEFINER functions/RPCs, grants, or storage-path code. Also when debugging: a policy that silently matches nothing, "infinite recursion detected in policy" (42P17), "column reference is ambiguous" (42702) from an RPC, "could not choose the best candidate function", anon able to call a function that should be authenticated-only, rows visible/invisible only for some users, a nested embed coming back null, or storage objects that 404 after a move. Covers how to actually test RLS (role impersonation, pglite) — service-role probes prove nothing.

managelm Skill

Manage Linux and Windows servers via ManageLM — run tasks, search infrastructure, audit security, and control your fleet with natural language

agentic-lineage Skill

Use when changing Lineage package manifests, validation, export/import, archives, setup prompts, file materialization, secret scanning, path handling, or receiver activation. Apply general security-review practice first, then enforce these Lineage package-safety rules.

danthamanvoiss Skill

Check nearby skills for overlap, ambiguity, or confused ownership so the suite stays easy to route.

megabadcoder Skill

Use after verify passes for the future maintainer's audit — sit in the chair of the person who'll touch this code in 3-6 months and ask "what will bite us later?" at the decision level. Surfaces wrong abstractions, load-bearing-but-unobvious shapes, next-change traps, drift from surrounding code; raises a Scope flag if the whole change looks like the wrong call. Delegates an independent, critical review and fills the task file's `## Conclusion`.

mine-fnl Skill

Use when designing or reviewing a backend REST API for correctness, security, and maintainability. Do not use when the work concerns UI design, database administration, or non-API engineering tasks.

w3wide Skill

Accurately migrate, audit, and convert Android XML layouts (activities, fragments, dialogs, bottom sheets, item views, custom views) into idiomatic Jetpack Compose code with plan-first workflows, documented roadmaps, and optional subagent execution.

andersonlimahw Bundle

When the user wants to audit or optimize an App Store or Google Play listing. Also use when the user mentions 'ASO audit,' 'app store optimization,' 'optimize my app listing,' 'improve app visibility,' 'app store ranking,' 'audit my listing,' 'why aren't people downloading my app,' 'improve my app conversion,' 'keyword optimization for app,' or 'compare my app to competitors.' Use when the user shares an App Store or Google Play URL and wants to improve it.

mark-c-827 Bundle

Writes the on-site PDP master copy - a benefit-led, scannable product detail page in the brand's voice - from a raw spec sheet or feature list. Use when you have a spec list, feature bullets, or a bare template description for one product and need conversion copy for its own product detail page. Produces a paste-ready block (hook, intro, benefit bullets, objection handling, CTA, Details block) plus a self-audit. Do NOT use for Amazon or marketplace listings - use amazon-listing-optimizer instead. Do NOT use to spin one master into many size/color variants - use variant-copy-scaler instead. Do NOT use for ad creative, email, or social copy.

andersonlimahw Bundle

Wraps any external CLI so the AI harness can invoke it without context bloat. Captures --help output, documents every subcommand/flag in a compact digest, saves token metrics (raw vs wrapped), and exposes a standardized interface (invoke, explain, audit). Use before calling an unfamiliar CLI or when the harness needs to interact with a CLI repeatedly.

andersonlimahw Bundle

agentic-value-loops plugin. Routes to its sub-skills: ai-tuning-loop, documentation-sync-loop, feature-development-loop, loop-invariants, maintenance-security-loop. Use when the task matches any of the capabilities listed below.

andersonlimahw Bundle

Executes a continuous validation loop for backend REST APIs using CURL commands. Records findings (REST standards, path, HTTP verbs, inputs, outputs, documentation, security gaps, performance) and applies minimal surgical fixes in routers, controllers, validation schemas, or middleware.

andersonlimahw Skill

Manage GitHub Secrets for repos, orgs, and environments via gh CLI.

andersonlimahw Bundle

JavaScript/TypeScript bundle size analysis, tree-shaking audit, and code splitting recommendations. Identifies heavy dependencies, duplicate packages, unused imports, and suggests dynamic imports and lazy loading. Use when bundle is too large, Lighthouse score is low, or user wants to optimize web app loading performance.

andersonlimahw Bundle

Recursive error-fix loop. Use when a bash command fails with a build/test/typecheck error, when the same class of error appears more than once, or when the harness itself needs a persistent rule so the error does not come back. Detect → root-cause → minimal fix → test → lint/typecheck → persist rule (SKILL.md / AGENTS.md / docs/rules) → audit with evidence. Cross-harness (Claude Code, OpenCode, Codex, Gemini, Agy).

andersonlimahw Skill

Secure coding patterns and DevSecOps best practices. Use for threat modeling, secret management, secure authentication, OWASP Top 10 prevention, and security compliance.

andersonlimahw Skill

Launch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for code-review-expert, double thermo review, or combined bug/security and code-quality branch audits.

andersonlimahw Skill

Adversarial code review and security audit. Use for thorough code review with a devil's advocate perspective, security vulnerability scanning, architecture review, and quality gates.

andersonlimahw Bundle

Run both thermo-nuclear review (security/correctness) and thermo-nuclear-code-quality-review (maintainability/structure) subagents in parallel, then synthesize findings. Use for full-spectrum branch audits combining bug/security and code-quality passes. The plugin also includes `code-review-adversary` for interactive, mentor-style senior-vs-junior PR reviews.

andersonlimahw Skill

Ready-to-paste prompts for engineering quality — PR review with semantic commits, async-pattern audits, database indexing, security threat modeling, resilience/load testing, and i18n sync.

andersonlimahw Skill

Maintenance & Security Loop. Goal: keep dependencies current and the app free of known vulnerabilities — one safe batch per iteration.

veekunth217 Skill

Application and server security — OWASP Top 10, WordPress hardening, server hardening (UFW/fail2ban), SSL/TLS, secrets management, WAF

cmevietnam Bundle

Reach a project's secrets in 1Password through `opgate`, behind a Touch ID gate on every use. Use when you need an API key / DB URL / token to run something, when an app fails for a missing environment variable, when setting up secrets for a new project, or when you find a plaintext secret in a repo.

xiaogege6697 Bundle

Create, audit, refresh, or resume from a repository-local maintenance capsule: a goal-oriented standard project kernel that preserves identity, boundaries, acceptance evidence, stable baseline, and current handoff state across windows, models, people, and environments. Use when the user says 基因胶囊, 维护胶囊, 项目胶囊, 保存项目, 保存项目上下文, 保存当前项目状态, 固定项目, 固定项目风格, 固定当前项目状态, 项目封存, 项目交接, 换窗口继续, 接着做, 以后方便维护, 稳定风格, 维护升级, or asks to create or refine GOAL.md, optional repository AGENTS.md or HANDOFF.md, reduce bloated project rules, preserve a project for later continuation, or quickly recover where work stopped. Treat save, preserve, stabilize, handoff, and cross-window continuation requests as capsule requests by default; do not trigger on 固定 alone, ordinary code maintenance, a bug fix, or a one-off task with no continuity need.

googlesandy Bundle

Use when writing or running Google Security Operations (SecOps/Chronicle) SIEM queries or investigations — UDM filter queries, stats/aggregation, event-event joins, raw log search, reference list lookups, entity investigations (users, hosts, IPs, files, domains), enriched data queries (geolocation, VirusTotal), entity context search (graph.*), or understanding data availability timing. Use when a user asks to search, investigate, hunt, query, or find data in SecOps SIEM.

shichengf Bundle

Skill for crafting and revising rebuttals to peer-review feedback in ML/AI research contexts. Trigger this skill whenever the user asks to write, revise, or audit a rebuttal, author response, reviewer reply, meta-review response, or any formal response to peer-review comments. Covers strategy by reviewer type, cross-rebuttal consistency, character budget discipline, and common credibility pitfalls. Use alongside the academic-writing skill, which provides baseline formatting, notation discipline, and prose conventions; rebuttal-craft layers rebuttal-specific strategy on top of those rules.

shichengf Bundle

Design and write survey, review, state-of-the-art, and systematization-of-knowledge papers in ML, AI, and adjacent technical fields. Use for taxonomy design, literature synthesis, comparative analysis, open problems, survey introductions, thematic related work, and full survey manuscripts. Trigger on survey paper, review paper, literature review, SoK, position paper with broad literature synthesis, or 综述. Use academic-writing for general prose conventions and academic-self-check for the final audit.

shichengf Bundle

Create structural outlines for conference papers, workshop papers, research proposals, grants, and thesis chapters without drafting the final prose. Use when the user asks for an outline, paper structure, section plan, paragraph map, argument flow, page allocation, or a compressed overview of an academic manuscript. Use academic-writing after the structure is approved and academic-self-check for the final manuscript audit.

shichengf Bundle

Audit a completed or near-complete academic manuscript for unsupported claims, numerical drift, terminology and notation inconsistencies, citation problems, figure and table defects, LaTeX layout issues, anonymity risks, and submission readiness. Use when a major revision warrants a broad audit, before submission, or when the user asks for a full-paper review, final check, consistency audit, or reviewer-style inspection. This skill diagnoses first and edits only when the user authorizes edits.

ckodex-labs Bundle

Reads and transforms structured data files

keeveeg Skill

Audit all agreed game content against specifications, consumers, production tasks, and acceptance, including procedural families and gaps hidden by shared specifications.

keeveeg Skill

Independently audit game architecture documentation for requirement coverage, ambiguous system contracts, conflicting decisions, and unsupported technical assumptions.

laginho Skill

Whole-repo code audit that ends in a verdict (Approved / Approved with cleanup / Not approved) and a written report in docs/audits/. Use when the user invokes /audit, optionally with a path to restrict scope.