Security

linuxfoundation Skill

Senior code-review method for lfx-v2-meeting-service pull requests. Use when the task is to review a PR for correctness, design, and security on this repo.

irahardianto Skill

Pre-flight checklist and post-implementation self-review protocol. Use before generating any code (pre-flight) and after writing code but before verification (self-review) to catch issues early.

rodri-oliveira-dev Skill

Use this skill to audit DotNetRepoInspector tests for weak assertions, flakiness, over-mocking, implementation coupling, order dependence, sleeps, magic data, and artificial coverage. Do not use it merely to write a new test from scratch.

wazuh Skill

Resolve a dependency CVE in the Wazuh Dashboard plugins — confirm the vulnerable package is actually present and reachable, apply the least-invasive remediation (direct bump, lockfile dedupe, or scoped resolution), verify build/tests/audit, and hand off a prepared PR. Use when the user asks to fix or resolve a CVE / dependency vulnerability, or provides a CVE id or CVE issue URL.

tavily-ai Skill

Enrich threat intelligence from CVEs, IOCs, malware names, threat actors, vendor advisories, security incidents, exploit reports, vulnerability disclosures, breach news, and mitigation guidance. Use when the user asks to investigate a CVE, enrich indicators, summarize vendor advisories, assess exploit status, collect mitigations, or produce a source-grounded security brief.

av Skill

Scan the codebase and classify every fact by lifecycle stage — tag @draft, @spec, or @implemented based on what the code actually shows. Add missing facts, fix inaccurate ones, remove obsolete ones. Use when asked to discover facts, bootstrap or update a fact sheet, scan the codebase for truths, sync facts to match the code, or audit the fact sheet for accuracy.

vinilana Skill

Use when checking auth, secrets, permissions and security-sensitive code.

dotnet Bundle

Review dotnet/android PRs against established rules. Trigger on "review this PR", a GitHub PR URL, or code review requests. Checks MSBuild, nullable, async, security, error handling, formatting, performance, native code, JNI interop, generator codegen, and trimmer/AOT compatibility.

0xlayerghost Skill

[AUTO-INVOKE] MUST be invoked BEFORE deploying DeFi contracts (DEX, lending, staking, LP, token). Covers anti-whale, anti-MEV, flash loan protection, launch checklists, and emergency response. Trigger: any deployment or security review of DeFi-related contracts.

0xlayerghost Skill

Security audit and code review checklist. Covers 30+ vulnerability types with real-world exploit cases (2021-2026) and EVMbench Code4rena patterns. Use when conducting security audits, code reviews, or pre-deployment security assessments.

0xlayerghost Skill

[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers private key handling, access control, reentrancy prevention, gas safety, and pre-audit checklists. Trigger: any task involving creating, editing, or reviewing .sol source files.

block Skill

Senior engineer code review focused on catching issues before they become PR comments. Reviews only changed lines, categorizes issues by priority, and fixes them one by one. Use when the user says "code review", "review my code", "review this branch", or wants pre-PR feedback.

electric-sql Skill

Set up a server-side proxy to forward Electric shape requests securely. Covers ELECTRIC_PROTOCOL_QUERY_PARAMS forwarding, server-side shape definition (table, where, params), content-encoding/content-length header cleanup, CORS configuration for electric-offset/electric-handle/ electric-schema/electric-cursor headers, auth token injection, Bun fetch concurrency cap (BUN_CONFIG_MAX_HTTP_REQUESTS default 256), ELECTRIC_SECRET/SOURCE_SECRET server-side only, tenant isolation via WHERE positional params, onError 401 token refresh, and subset security (AND semantics). Load when creating proxy routes, adding auth, or configuring CORS for Electric.

caomeiyouren Skill

专注于代码安全性审计、漏洞识别与权限合规检查。用于登录鉴权、权限边界、注入、密钥泄露、依赖供应链、外部技能引入等安全审查；当用户提到 security、auth、permission、vulnerability、secret、injection、供应链、审计登录逻辑、权限合规、安全扫描时触发。

dyoshikawa Skill

Review a pull request in parallel for code quality and security, integrate findings with severity levels, and report CI status. Use when asked to review a PR or assess whether it is ready to merge.

ipea Skill

Read-only R code review protocol for `.R` scripts. Checks code quality, reproducibility, domain correctness, tidyverse idioms, and professional standards; produces a report without editing. Use when user says "review this R script", "check the R code", "audit the analysis code", "code review on the R", or when an R file is touched as part of a paper submission. NOT for running the code — pair with `/audit-reproducibility` for numeric verification.

ipea Skill

Deep consistency audit of the entire repository infrastructure. Launches 4 parallel specialist agents to find factual errors, code bugs, count mismatches, and cross-document inconsistencies. Then fixes all issues and loops until clean. Use when: after making broad changes, before releases, or when user says "audit", "find inconsistencies", "check everything".

dansnow Skill

Audit changed code for security sharp edges — dangerous defaults, type confusion, and silent failures

compozy Bundle

Analyzes codebases to identify refactoring opportunities based on Martin Fowler's catalog of code smells and refactoring techniques. Detects duplicated code, high coupling, complex conditionals, primitive obsession, long functions, and other structural issues. Produces a structured refactoring report with prioritized findings saved to docs/_refacs/. Use when auditing code quality, preparing for a refactoring sprint, or reviewing architectural health. Don't use for style/formatting issues, performance optimization, or security audits.

greenpau Bundle

go-authcrunch repository coding standards and implementation directives for Go library, CLI, authentication, authorization, identity store/provider, SSO, KMS, registry, messaging, translation, embedded UI, and test code. Use when creating, modifying, or reviewing repository code; designing configuration and its required dedicated parser package; choosing package boundaries, constructors, validation, errors, logging, serialization tags, security handling, or tests; or deciding how a feature fits existing AuthCrunch packages.

greenpau Bundle

go-authcrunch source code management and commit message rules. Use when creating, reviewing, or updating commit messages, especially when the user asks to create a commit message for a change in this repository.

devantler-tech Skill

The ADVANCE playbook for the Agentic Engineer (the products' primary engineer) — how to move a devantler-tech product forward once it's healthy: product strategy & roadmaps, issue triage & decomposition, planning & implementing issues, test coverage, benchmarking & performance, refactoring & code quality, and security hardening that never taxes developer experience. Use after the operate ladder is satisfied and you're picking proactive enhancement work.

nodnarbnitram Bundle

Manage Linear tickets, projects, milestones, and documents. Use for coordinating work across skills (orca-security, multi-repo) or tracking remediation progress.

srstomp Bundle

Use when starting AI development sessions, resuming interrupted work, managing multi-session projects, or orchestrating work with human checkpoint control (supervised, semi-auto, auto, or unattended modes).

duck4nh Skill

Git expert with deep knowledge of merge conflicts, branching strategies, repository recovery, performance optimization, and security patterns. Use PROACTIVELY for any Git workflow issues including complex merge conflicts, history rewriting, collaboration patterns, and repository management. If a specialized expert is a better fit, I will recommend switching and stop.

google Skill

Performs a strict evaluation of a video asset using Google's official 'ABCD' framework (Attract, Brand, Connect, Direct) based on transcript and metadata.

google Skill

Provides an executive dashboard comparing Creator vs Audience verdicts for a recent client product launch.

dmitryprg-ai Bundle

Review code for quality, security, and maintainability. Use when reviewing pull requests, examining code changes, doing code review, QA checks, or architecture review for COMPLEX tasks. Includes QA checklist and CTO review template.

dyoshikawa Skill

Review a PR for code quality and security issues, then post review comments on it. Runs review-pr followed by post-review-comments sequentially.

metinduraktr-44 Bundle

Security QA gates for ASSESS/IMPLEMENT modes.

metinduraktr-44 Skill

Use when closing a phase — archiving completed outputs and snapshotting state for audit.

dmitryprg-ai Bundle

Find gaps, stubs, broken workflows, and incomplete features in code. Use before implementing features (to find implicit requirements) or for code audits (to find TODO, FIXME, empty handlers, broken workflows). Keywords - gap analysis, audit, find stubs, incomplete, broken workflow.

dmitryprg-ai Bundle

Scan codebase for technical debt and fix safely with TDD. Use to find oversized files, duplicated code, code smells, and refactor safely. Workflow - SCAN, TEST CASES, REFACTOR, VERIFY. Keywords - techdebt, tech debt, duplicates, code quality audit.

metinduraktr-44 Bundle

Secret scanning, vault patterns, redact-only handling.

metinduraktr-44 Bundle

STRIDE/LINDDUN-style threat modeling — defend/detect focus.

metinduraktr-44 Bundle

Map controls to NIST/ISO/CIS/OWASP — draft needs review.