Security

tinyc0der Skill

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production auth, security-sensitive logic, a high-stakes migration, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

0xebby Skill

The baseline mindset and antipattern catalogue for smart-contract security — minimalism, reuse, input validation, and the common vulnerability classes with their fixes. Use at the start of any contract work and as a pre-audit self-review.

alexgreensh Skill

Audit your OpenClaw setup for token waste, context bloat, and cost optimization opportunities

scdenney Skill

Designs and formats publication-quality tables for social-science manuscripts — column order, row grouping and panels, decimal precision, standard-error versus confidence-interval conventions, self-contained titles and notes, and code-generated output. Use when the user is building or revising a regression table, balance table, descriptive-statistics table, summary table, or robustness table, mentions stargazer, modelsummary, gt, huxtable, kable, pystout, esttab, or booktabs, or asks whether a result belongs in a table or a figure. Hand the finished table set to figure-table-audit for end-stage QA.

scdenney Skill

Designs and formats publication-quality figures for social-science manuscripts — chart type, scales, color, legend order, self-contained captions, and script-based reproducibility. Use when the user is making, revising, or critiquing a figure for a paper — a coefficient plot, small multiples, a distribution or trend plot, a map, a network — or asks about axis labels, a colorblind-safe palette, legend ordering, direct labeling, or figure captions. Prefer this over general data-visualization guidance whenever the destination is a manuscript, working paper, or journal submission. Hand the finished figure set to figure-table-audit for end-stage QA.

scdenney Skill

Operate or audit a live Qualtrics survey via the v3 APIs without breaking fielding — publish gating, quotas, flow routing, embedded data, panel-vendor redirects, read-back verification, and a read-only pre-fielding audit. Use when publishing or patching a fielding instrument, when a quota counts but never blocks, when wiring panel-vendor redirects or flow gates, or when auditing a survey before launch (consent-before-anything gates, force-response completeness, quota and redirect checks, anti-bot instrumentation, and language-arm symmetry).

scdenney Skill

Audits the citation layer of a manuscript — in-text and reference-list parity, fabricated or nonexistent sources, DOIs that resolve to a different work, style and completeness against APA 7 or a named journal style, and whether each cited work actually supports the claim attached to it. Verifies against Crossref, OpenAlex, DataCite, and Semantic Scholar, drives LaTeX audits off the keys actually cited, and marks anything it cannot check as NOT CHECKED rather than guessing. Use when the user asks to check citations or references, suspects an AI-invented source, wants a .bib checked against the text, or asks whether the DOIs are right. Figures and tables go to figure-table-audit.

scdenney Skill

Drafts a referee report on someone else's manuscript for a journal editor — a recommendation, a summary of the claim and design, three to six major concerns that drive the decision, additional concerns, and a coherent revision plan, produced by five parallel adversarial finders (Breaker, Butcher, Shredder, Void, Situator), a Blue Team error filter, a Chief Reviewer synthesis, and a Tone Guard legal pass, with an optional confidential note to the editor. Use when the user has been asked to referee a manuscript for a journal. Self-audit of the user's own draft goes to paper-review-lite or presubmit, and writing an author-side response to reviewers goes to referee-response.

scdenney Bundle

Pre-submission audit of a manuscript — argument, numerical consistency, references and DOIs, writing, figures, CONSORT flow, pre-registration, replication archive. Use before submitting a paper, or whenever a draft needs an adversarial, quote-grounded review with a journal-readiness checklist. Add `--codex` to run the same specification independently on Claude and on Codex (GPT-6 Astra) and cross-check the two sets of findings.

scdenney Bundle

Drafts or audits the introduction and framing of a scientific paper — the motivating real-world "why", the evidence audit, the funnel from theory to a falsifiable if-then with a named estimand, bridges between multiple experiments, and a contribution list that matches what the design can deliver. Use when the user asks to write, restructure, or critique an introduction, motivate or frame a paper, fix a gap-in-the-literature opening, sharpen or calibrate a contribution claim, or connect several experiments into one argument. For sentence-level flow and wording, use prose-revision instead.

scdenney Skill

Scaffold or audit a social-science replication package, and audit the manuscript and its archived research objects against the FAIR principles. Scaffold mode writes the folder structure, README, master.R, figure/table crosswalk, codebook template, LICENSE placeholder, .gitignore, and pre-release checklist. Audit mode grades an existing package against that checklist and runs the FAIR block over data, code, materials, prompts, preregistrations, DOIs, metadata, licenses, access restrictions, and availability statements. Use when setting up or repairing a replication package, checking one before submission, auditing research objects against FAIR (Findable, Accessible, Interoperable, Reusable), or drafting and verifying data-, code-, and materials-availability statements. Adapted from Yusaku Horiuchi's replication-package-guide; platform-neutral (Harvard Dataverse, OSF, Zenodo, GitHub releases, institutional archives).

athola Bundle

Applies NIST/CWE security hardening to Python and Rust code. Use when auditing code for vulnerabilities or proposing concrete security remediations.

athola Bundle

Orchestrates multi-domain review (code, arch, tests, security) in a single pass. Use when thorough pre-release review is needed.

athola Bundle

Evaluate hook security, performance, and SDK compliance. Use for audits.

athola Bundle

Guide creating Claude Code hooks with security-first design. Use for validation and enforcement.

athola Skill

Applies CQRS and Event Sourcing for read/write separation and audit trails. Use when designing systems with complex domain logic or full state-change history.

athola Bundle

Runs a three-tier codebase audit (git history, targeted scans, full review) with gating. Use when auditing a codebase before release or after incidents.

chinthakat Skill

Record an issue you found but are not fixing now, so that it is still actionable months later, and close one with evidence. Use whenever an audit, review or unrelated task surfaces a problem that is out of scope, and whenever marking a tracked item done.

chinthakat Skill

Measure a system that keeps its data in more than one place — source files, staging, production, an archive — without letting a number cross between them. Use before writing any audit, inventory, gap analysis, "what's missing" report or coverage claim, and whenever a finding says something does not exist.

chinthakat Skill

Add or audit an authorization gate — tenant scoping, role or group checks, share links, admin-only routes — and prove that it denies. Use whenever a new endpoint, resolver, query, page or link exposes data that belongs to someone, and whenever a review asks whether a gate actually works.

athola Bundle

Audit Skill() refs; detect hubs, isolates, and dangling targets. Use when auditing skills.

al-janef Bundle

Deprecated compatibility alias for /janef from janefskills 1.x. Forwards to the forge entry point; /janef <task> behaves like /forge <task> and /janef full security pass behaves like /forge security pass. Do not use for new work.

al-janef Bundle

Tactics for large repositories, noisy tool output, long sessions, and token pressure: search before reading, read ranges not files, keep logs and generated output out of context, never reread unchanged files or rerun unchanged passing checks, prefer deterministic scripts. Use when context volume materially affects execution quality; never reduces necessary reasoning, security, or verification.

al-janef Bundle

Independent review of a diff, PR, or file that hunts concrete defects introduced by the change: correctness, security, data loss, authorization or tenant escape, production failure, broken contracts, performance regressions, missing critical tests. Severity-ordered findings citing a real code path; no style inflation; "no qualifying defect" is valid. Use for code review and as the independent gate at high risk.

al-janef Bundle

After any vulnerability or bug is confirmed, sweep the entire codebase for every other instance of the same pattern with ripgrep and custom Semgrep rules so the whole class is fixed, not one case. Use right after finding or fixing a security issue, when checking a fix is complete, or to prove a past pattern is eradicated. Defensive only.

al-janef Bundle

Keep secrets out of code, git history, logs, and client bundles: detect hardcoded API keys, credentials, tokens, and connection strings; move them to the environment or a secret manager; catch client-exposed prefixes; set up gitignore and pre-commit scanning; run the rotate-first response when a secret has leaked. Use for any credential, .env, or "where do I put my key?" question.

al-janef Bundle

Review, harden, and design authentication and session management: login, logout, session lifecycle, password storage, JWT and cookie handling, refresh tokens, brute-force and enumeration resistance, MFA/OTP, password reset, roles and permissions. Use whenever a task touches sign-in, sessions, tokens, or authorization, even casually. Defensive only.

al-janef Bundle

Audit-grade multi-layer security pass: Semgrep SAST, Gitleaks secret scanning, and dependency audit as deterministic ground truth, then specialist review, variant analysis, fix verification, timing review, and an honest coverage verdict naming what was and was not covered. Use for "full security pass", security audit, pre-launch review, or any serious security assessment. Defensive only.

al-janef Bundle

Design and review security audit logging and detection: record who did what and when for auth events, data changes, and admin actions; never log passwords, tokens, or PII; keep logs tamper-evident; add a few high-value alerts such as failed-login thresholds. Use for audit trails, log redaction, monitoring, or incident investigation.

northraystudio Skill

Parses reports generated by the software-evaluation or vulnerability-scan skills and interactively registers selected tasks as GitHub Issues using the `gh` CLI. Use when the user wants to convert an evaluation report (docs/evaluation/*.md) or security audit report (docs/security-audit/*.md) into GitHub Issues. Triggers on requests like "create issues from report", "register tasks to GitHub", "convert report to issues", or when pointing at a specific report file.

gl0di Bundle

Appends every action this skill takes to a durable local audit log.

tdebooij Skill

Tim's personal PR review workflow. Checks a pull request against the 9to5-web-dev skill's conventions plus general correctness, security, and overengineering concerns, then walks Tim through issues one at a time in severity order with fix options. Use when Tim asks to review a PR, says '/tim-pr-review', or asks to check a branch/PR against 9to5-web-dev standards.

maiconsouza89 Skill

Reviews a pull request or a local diff for correctness bugs, missing tests and unsafe changes, and reports findings with file and line. Use when "review this PR", "review my changes" or "look for bugs in this diff". Do NOT use for writing the PR description (use mass-pr-description) or for a security-only audit of a skill (use mass-security-checklist).

rogerchappel Bundle

skill-portability-audit

maiconsouza89 Bundle

Creates and maintains Architecture Decision Records (MADR minimal) through their whole lifecycle, bootstrapping the archive, writing new records, moving them through proposed/accepted/rejected/superseded/deprecated and auditing numbering and supersede chains, in any folder and language (default docs/adr/, English). Use whenever the user mentions ADRs or decision records, or asks to "write an ADR", "record this decision", "document why we chose X", "supersede ADR 0003", "deprecate that decision", "audit our ADRs" or "set up ADRs", and also when an expensive-to-reverse architecture choice is being made in the conversation with no record of it. Do NOT use for how-to guides, READMEs or changelogs.

jo-bity Skill

Check a capability's documentation against the current codebase and report every statement that no longer holds — stale claims, decisions silently reverted in code, and documented behaviour that was never built. Reports and routes findings; never edits the notes itself. Use when the user asks whether a capability note or ADR is still accurate, wants to audit documentation against code, or suspects a note has gone stale.