Security

fabioc-aloha Skill

Audit active brain artifacts for context cost, duplicated guidance, oversized routing files, and stale metadata. Use during brain audits, quarterly review, or when instructions feel heavy.

fabioc-aloha Skill

Render user-supplied markdown safely — marked.js → DOMPurify → Mermaid (order matters; skipping the sanitizer is XSS)

surya8991 Skill

Blunt, factual code review. No sugar coating. Finds bugs, security issues, performance problems, and architecture flaws. Use when user says /codereview or asks to review code.

dojogenesis Skill

Conduct a comprehensive 4-phase health audit on any software repository. Evaluates 5 dimensions (critical issues, security, testing, technical debt, documentation) with GREEN/YELLOW/RED classification, generates actionable engineering tasks with file paths and effort estimates, and produces a permanent dated audit artifact. Use when onboarding to a new codebase, after major releases, on a recurring schedule, or whenever a project feels at risk. Trigger words: health check, audit, code review, technical debt, security review, project health, sustainability, code quality.

surya8991 Skill

Security auditing skill for web applications and codebases. Scans for OWASP Top 10, dependency vulnerabilities, secrets exposure, XSS/CSRF/injection flaws, auth weaknesses, and misconfigurations. Use when task involves security scan, vulnerability assessment, pen test review, threat modeling, or hardening a codebase.

netalertx Skill

NetAlertX database architecture patterns. Use this when designing features that write to the Devices table, implementing audit/history logging, or choosing between trigger-based vs Python-hook approaches.

dojogenesis Skill

Systematic process for auditing project documentation to detect and correct drift -- the gap between what docs say and what the code actually does. Cross-references every document against the actual codebase to classify findings as Accurate, Drifted, Missing, or Orphaned. Use when documentation feels stale, after major releases, before onboarding new contributors, or on a recurring schedule. Trigger words: documentation drift, outdated docs, stale README, docs audit, missing documentation, broken links, doc review.

drmoisan Skill

Policy audit template usage and output requirements. Use when creating policy-audit.<timestamp>.md artifacts from the repo templates.

drmoisan Skill

Evidence storage and timestamp naming conventions for audits and remediation. Use when storing baseline/regression/QA evidence or naming audit artifacts with ISO-8601 timestamps.

drmoisan Skill

Reusable remediation trigger and atomic_planner handoff steps. Use when audits require remediation inputs and a delegated remediation plan.

dailybothq Bundle

Verify that a repository is DeepWorkPlan-conformant (AI-first) and that its plans are well-formed, producing an objective pass/fail report. Use when the developer asks to verify, audit, or check conformance of a repo or a plan.

octanejs Bundle

Audit one, several, or all existing Octane bindings; implement selected maintenance findings or remove redundant copied files with evidence matched to source ownership. Use for binding updates, lifecycle fixes, dependency or metadata maintenance, and convenience-import requests.

octanejs Skill

Audit or defend Octane performance. Use when a change can affect per-render, per-node, compiler-output, SSR, hydration, or bundle cost, or when asked whether something is fast enough.

webmaxru Bundle

Authors, reviews, installs, and debugs GitHub Agentic Workflows in repositories, including workflow markdown, frontmatter, gh aw compile and run flows, safe outputs, security guardrails, and operational patterns. Use when creating or maintaining GH-AW automation. Don't use for standard deterministic GitHub Actions YAML, generic CI pipelines, or non-GitHub automation systems.

dtsong Skill

Use when classifying data elements by sensitivity tier and defining per-tier handling requirements. Covers data inventory, sensitivity classification, PII flow mapping, encryption and masking specifications, and cross-boundary transfer documentation. Do not use for regulatory gap analysis (use compliance-review) or audit logging design (use audit-trail-design).

hack23 Skill

Security incident detection, analysis, containment, eradication, recovery, and lessons learned per NIST SP 800-61r2 and ISO 27035

hack23 Skill

Conduct comprehensive security code reviews using OWASP Top 10, SAST/DAST patterns, and Hack23 ISMS secure development policy

hack23 Skill

Threat modeling before coding, STRIDE methodology, defense in depth, security controls in SDLC

hack23 Skill

Secure SDLC phases, security requirements, secure coding practices, and security testing integration for the CIA platform

fabioc-aloha Bundle

Defense-in-depth, PII protection, secrets scanning, and secure packaging for distributed software

fabioc-aloha Bundle

Systematic documentation audit, drift detection, preflight validation, and multi-pass quality pipelines

rudironsoni Bundle

Review code for quality, correctness, and maintainability. Use this skill when reviewing pull requests, auditing existing code, refactoring for clarity, or enforcing coding standards. Covers DRY principles, SOLID design, error handling, performance, security, testing, and TypeScript/JavaScript best practices. For Obsidian plugin-specific API guidance, refer to the obsidian-plugin-development skill.

peterbamuhigire Skill

Use when producing any proposal or bid content to prevent generic, unverified, template-like writing in real time; use ai-slop-audit instead to grade an existing artefact after a major iteration.

peterbamuhigire Skill

Use when auditing an existing proposal artefact for AI slop after a major iteration or before submission; use anti-ai-slop instead as the live drafting guardrail.

fabioc-aloha Bundle

Systematic 5-dimension audit framework for VS Code extensions — debug hygiene, dead code, performance, menu validation, dependency cleanup

dyoshikawa Skill

Scan for malicious code in git diff between a tag/commit and HEAD

navikt Bundle

Assess a design or change for security and privacy risks. Use for sensitive data, identity, authorization, trust boundaries, privileged operations or a requested security review; use the full-context identity implementation workflow to implement an authentication mechanism and the full-context architecture assessment workflow for broader design trade-offs.

taracodlabs Bundle

Classify IP addresses as internet scanners (benign/malicious) or targeted attackers — filters noise from security alerts

taracodlabs Bundle

Audit HTTP security headers for any URL and receive a grade (A+ to F) with specific recommendations for missing headers

aaronjmars Skill

Recap of everything shipped since the last run - cross-repo PRs, security fixes, star deltas, and X traction, synthesized into a digest article and a ready-to-post shiplog in your voice.

fabioc-aloha Bundle

Comprehensive **project** consistency review across code, documentation, diagrams, and configuration

fusengine Bundle

Audit project dependencies for known vulnerabilities using ecosystem-specific tools (npm audit, composer audit, pip-audit, cargo audit, etc).

fusengine Bundle

Verify and configure HTTP security headers (CSP, HSTS, CORS, X-Frame-Options, etc). Checks current configuration and generates framework-specific fixes.

fusengine Bundle

Audit authentication and authorization patterns. Checks JWT, sessions, OAuth2, PKCE implementations for security best practices and common vulnerabilities.

fusengine Bundle

Research CVEs and security advisories for project dependencies. Uses Exa, NVD API, OSV.dev, and GitHub Advisory Database to find known vulnerabilities.

first-fluke Bundle

SCM (software configuration management) and Git: branching, merges, conflicts, worktrees, baselines, audit readiness, plus Conventional Commits and safe staging.