Security

sergeyitaly Skill

Track and advance an AI-DLC (AI-Driven Development Life Cycle) workflow. Reports current phase/stage/status from aidlc-state.md, what's done vs. what's next, reminds about approval gates and audit logging, and updates the tracking docs as stages complete. Use when asked "what's next", "AIDLC status", "what's left", to resume/start a phase, or to record a stage approval.

wai0258 Bundle

Translates RPG Maker MV/MZ games by editing their text carriers directly: event-command dialogue and database fields in data/*.json, nested parameters in js/plugins.js, strings hardcoded in js/plugins/*.js, text baked into encrypted img/*.png_, and text stored in save/*.rmmzsave. This skill should be used when asked to translate, localize, or audit a RPG Maker MV/MZ game, when asked where a RPG Maker game's text lives or which files to edit, or when a patched game still shows untranslated text in its UI.

anizum1 Bundle

Audit an untrusted third-party repository for malware, backdoors, and misrepresentation BEFORE installing, building, or running it. Use this whenever the user pastes clone-and-install instructions and asks whether it is safe, asks you to "check this repo," "look for anything malicious," "see if there are bugs or backdoors," vet a dependency or a fork, or review code they found on GitHub/npm/PyPI and are about to run. Trigger even when the user frames it casually ("is this legit?", "should I install this?") or asks only about bugs — the install step is the risk, and it is worth checking before they run it. Do NOT use for reviewing the user's own code or diffs; that is code-review.

samraddhashrivastavatech Skill

CATLX — Security Architecture

samraddhashrivastavatech Skill

ROOT gateway for the CATLX Universal AI Operating System skill ecosystem. Load this first for any task about CATLX architecture, design, runtime, or deployment. It routes to the correct subsystem skill, drives automatic skill-to-skill delegation, and enforces progressive context loading. Use proactively when the user references CATLX, an AI OS, voice-first automation, hardware adaptation, memory architecture, workflow engine, security, or any of its subsystem capabilities.

ilog3 Skill

Use when applying AI to support qualitative education analysis, including initial coding suggestions, code clustering, theme naming, memo generation, negative-case search, evidence retrieval, contradiction checks, saturation support, and audit-trail creation. This second-layer execution skill complements human qualitative coding and must not treat AI outputs as final findings without researcher confirmation.

samraddhashrivastavatech Skill

Handles the CATLX Electron OS Shell: an OS-layer interface (not a normal app window), the multi-window window roles (main, HUD overlay, command palette, notification toasts, focus mode), the Ctrl+Space command palette with fuse.js fuzzy search, multi-window persistence, the always-on tray runtime, typed IPC security via contextBridge, and workspace persistence. Use when the user asks about the CATLX shell, windows, HUD, command palette, tray, IPC security, or workspace restoration.

samraddhashrivastavatech Skill

Applies secure-by-default engineering checks. Use before release, when handling auth/secrets, or after se_security_audit findings.

samelhagdev Bundle

Use when asked to run, perform, or conduct a network audit, network assessment, network scan, network security review, or security posture check on the current machine

tristan-hauber Bundle

Budget-aware code review for the current diff, a pull request, a branch, or a path. Prioritises concrete correctness defects, with bounded deeper checks at higher effort. Use for a focused review; use a dedicated security, architecture, or full code-review workflow when that is the primary request.

samelhagdev Bundle

Use when asked to run a code audit, code health check, code cleanup review, or a scan for improvements on the current repository

angelod1as Bundle

Use when setting up a repository in the bare + worktrees layout (.bare/ plus wt/<branch>/) and registering it in the Orca desktop app with an automatic worktree setup hook — covers both starting a new project and converting an existing normal repository, including the pre-conversion audit for work that exists only on this machine.

orcaqubits Skill

Implement AP2 dispute resolution and accountability — cryptographic evidence, liability allocation, chargeback handling, and audit trail construction. Use when building dispute handling, fraud investigation, or compliance systems for agentic payments.

rlawoals0529 Skill

Audits every unresolved review thread on a PR or a stack, giving each a verdict with a file:line proof, then adversarially refutes every "addressed" claim with a three-voter panel. Use when a PR comes back, to tell genuinely-handled threads from only-claimed-handled, before re-requesting review, or when a reviewer's summary looks shorter than the real thread count. Triggers on "the PR came back", "requested changes", "unresolved threads", "did we address everything", "ready for re-review".

cristianomafrajunior Skill

Scaffold a new Odoo module that follows OCA conventions, then bring it up to full OCA shape (manifest, readme fragments, security, tests) and pass standard OCA lint checks. Use when asked to create, add, or scaffold a new Odoo module/addon.

alpayc Skill

Runs dependency and framework upgrades in staged, independently verifiable commits with the breaking-change reading done up front. Use it for a framework major, a tool migration, a security advisory, or any bump large enough to break something.

grzmol Bundle

Writes and reviews production Salesforce Apex — classes, interfaces, inheritance, sharing keywords (with/without/inherited sharing), user mode versus system mode (as user, as system, WITH USER_MODE, AccessLevel), one-trigger-per-object handler frameworks, recursion guards, bulkification, collection and map idioms, Database.insert partial success and SaveResult handling, Savepoint and rollback, custom exceptions, Database.Stateful, JSON serialisation, Schema describe caching, custom settings and custom metadata access, Apex Enterprise Patterns (Selector, Domain, Service, Unit of Work), @AuraEnabled(cacheable=true) contracts for Lightning web components, and @RestResource services. Use this skill whenever work touches force-app/**/classes/*.cls or force-app/**/triggers/*.trigger, when an Apex class or trigger must be created, refactored, bulkified or security-hardened, when a reviewer asks why a class needs an explicit sharing declaration, when Apex must be exposed to LWC or REST, or before running vf-check ana

grzmol Bundle

Deep coverage of the fflib selector layer - extending fflib_SObjectSelector, getSObjectType/getSObjectFieldList/getOrderBy, the constructor flag and DataAccess.USER_MODE matrix, selectSObjectsById and queryLocatorById, the full fflib_QueryFactory fluent API (selectField, setCondition, addOrdering, setLimit, setOffset, subselectQuery, toSOQL, deepClone), parent field traversal and child subselects via configureQueryFactoryFields and addQueryFactorySubselect, FLS and CRUD enforcement old versus WITH USER_MODE, dynamic filters without SOQL injection using Database.queryWithBinds, QueryLocator selectors for Batch Apex, and selector anti-patterns. Use it when writing or reviewing any class extending fflib_SObjectSelector, when a selector query must add a filter, a child subselect, a field set, or a parent field, when fflib_QueryFactory.InvalidFieldException or NonReferenceFieldException or InvalidSubqueryRelationshipException appears, or when deciding how a selector enforces field-level security.

breroz Skill

Run a comprehensive application performance audit and produce a prioritized optimization report — then generate proposed code improvements. Use this skill whenever a user wants to improve app speed, reduce memory usage, fix slow queries, optimize rendering, improve scalability, reduce bundle size, or audit performance. Triggers include: "optimize my code", "why is my app slow", "performance audit", "memory leak", "slow queries", "N+1 problem", "reduce bundle size", "rendering performance", "scalability issues", "performance bottlenecks", "profile my app", "make this faster", "reduce memory", "improve response time", "optimize database queries", or any request to analyze or improve the speed, efficiency, or resource usage of an application — even if the user doesn't use these exact words. Always use this skill when the user shares code and asks why something is slow, heavy, or inefficient.

breroz Bundle

Operational support for application code dependency maintenance. Use when Codex needs to inspect project libraries or package managers, check for available dependency updates or security advisories, apply safe upgrades, update lockfiles, resolve breakages, run tests/builds/linters, iterate on fixes, summarize risk, and optionally commit or push verified dependency-maintenance changes.

samber Bundle

Audit a published API reference at the endpoint level against its spec surface - every operation, parameter, response code, and error documented, request/response examples present, per-language code snippets in parity, try-it affordances working - and install the source-of-truth gates that stop reference drift (spec-driven generation, OpenAPI lint, contract tests, snippet parity in CI). Use whenever the user mentions API reference docs, OpenAPI docs completeness, undocumented endpoints or error codes, stale or drifting docs, or docs CI gates - even if they never say "reference quality". Endpoint-level reference only. Do NOT use for portal IA and onboarding - use samber/developer-platform-skills@developer-portal-design instead.

uner4s Bundle

Use when protecting a Spring Boot endpoint or setting up JWT auth. Use when asked "protect this endpoint", "add security to route", "JWT in Spring Boot", "add @PreAuthorize", "secure this controller", "Spring Security setup".

samber Bundle

Design the API-key authentication surface a platform issues to its own API consumers - key format with prefix+checksum conventions, hashed (irretrievable) vs encrypted (retrievable) storage, zero-downtime rotation with dual-key overlap, least-privilege scoping, individual vs org vs service-account ownership, self-service key dashboard behavior, and SOC 2 / PCI-DSS 4.0 lifecycle governance. Use whenever the user mentions API keys, secret keys, key prefixes, key rotation, key scoping, or revoking keys after an employee departure - even if they never say "API key management". Provider side only, not consuming another vendor's API. Do NOT use for OAuth authorization-server design - use samber/developer-platform-skills@oauth2-provider-design instead.

samber Bundle

Audit an existing or proposed public REST API surface as a checklist-driven design review - resource and URI naming, HTTP method and status-code correctness, field-naming consistency, pagination pattern choice, filtering/sorting/field-selection conventions, one consistent error envelope, and Hyrum's-Law backward-compatibility risk - every finding bucketed Must-change or Improvement against a cited rule, plus the standing review program (audience, lifecycle triggers, reviewer authority, linting, federation). Use whenever the user mentions an API design review, REST API consistency, endpoint naming, pagination style, or API design governance - even if they never say "design review". Do NOT use for GraphQL schemas - use samber/developer-platform-skills@public-graphql-api-design instead.

samber Bundle

Defines the policy every code sample in developer documentation must meet and audits an existing sample corpus against it, returning a ranked fix queue. Use whenever the user mentions docs code samples, code snippets in documentation, runnable examples, examples that no longer compile, copy-paste failures, snippet drift after an API change, testing docs examples in CI, SDK snippet parity across languages, sample maintenance ownership, or asks why the examples in their docs do not work - even if they only say the docs are broken. Covers sample anatomy, copy-paste and security safety, execution tiers, single-sourcing from tested code, and language parity. Not for writing a quickstart page - use samber/developer-relations-skills@developer-quickstart-guide.

kranjata03 Skill

Use when analyzing UiPath workflows for bugs, anti-patterns, data validation issues, error handling gaps, and security vulnerabilities before deployment

samber Bundle

Designs an employer-brand strategy for attracting software engineers - the engineering EVP, the channel plan (engineering blog, OSS presence, referrals, conference talks, compensation-transparency artifacts), a verification-surface audit (employer-review sites, compensation databases, anonymous forums), and the measurement baseline. Use whenever someone raises "engineering employer brand", "why can't we attract engineers", "developer hiring content strategy", "should we publish salary bands", "tech recruiting brand", or engineering offer-acceptance dropping - even if they frame it as a recruiting problem. Covers early-stage through big-company stages, junior through staff-level targeting. Not DevRel program strategy - use samber/developer-relations-skills@devrel-strategy.

motherduckdb Bundle

Assess MotherDuck security, permissions, isolation, residency, and compliance requirements against documented controls.

curiositech Bundle

Generate context-aware code review checklists from PR diffs — tailored to language, codebase patterns, and team standards. Identifies what reviewers should focus on. NOT for automated code fixing, test generation, or security auditing.

robbyt Skill

Real-time web research using Gemini's Google Search. Trigger when user needs current information ("search with Gemini", "find current info about X", "what's the latest on Y"), library/API research, security vulnerability lookups, or comparisons requiring recent data.

rsmdt Bundle

Vulnerability review, threat modeling, OWASP patterns, and secure coding assessment. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations.

leoyeai-openclaw-master-skills Bundle

OpenClaw 多模式安全巡检工具：默认本地离线扫描，可选联网威胁情报上报。 功能范围：读取系统敏感信息（MAC 地址、主机名、系统日志、完整 Skill 清单）执行本地安全检测；在本机持久化保存扫描报告与安全基线；可选通过 --push 模式将摘要数据上传至 auth.ctct.cn 获取威胁情报评分（需用户显式同意）；可选通过 openclaw cron 设置定时任务（绑定 openclaw 基础设施，可跳过）。 运行依赖：Node.js v18+。本技能由 Changeway 团队（auth.ctct.cn 运营方）开发。 使用场景：用户说"安全巡检"、"安全检查"、"安全审计"、"巡检"、"security audit"、"检查安全"、"系统安全"等。 触发条件：任何与 OpenClaw 安全检测、审计、巡检相关的请求。

rewse Bundle

Recommend appropriate password strength and 1Password settings based on NIST SP 800-63B authentication assurance levels. Use when the user asks about password requirements, password strength recommendations, what type of password to use for different scenarios, or how to configure 1Password for specific use cases. Also trigger when the user mentions "how strong should my password be", "what password settings", "1Password configuration", "password generator settings", "secure password", "password for bank", "password for work", "PIN code length", or needs guidance on password security for any account type.

tiger3807861189 Bundle

Operate a selective workspace for complex reasoning, long tasks, repository engineering, coordinated agents, and authorized security analysis. Use when work requires durable state, evidence, cross-file consistency, or recovery; keep direct answers lightweight.

librefang Skill

Compliance expert for SOC 2, GDPR, HIPAA, PCI-DSS, and security frameworks

librefang Skill

Code review specialist focused on patterns, bugs, security, and performance