Security

norravarg Bundle

Audit content — a draft, a Jira ticket, a skill, a code comment, a message, a PR description, or a whole directory or guide read as one set — for unused, irrelevant, unnecessary, redundant, repeated, conflicting, misleading, wrong, unclear, or poorly worded material. Figures out what to audit from what is already in the session, or from the clipboard, a link, a file, a set of related files, a GitHub PR/issue, a Jira ticket, or a Confluence page, asking for confirmation when the target is ambiguous. Reports every finding, then fixes only what is confirmed. Invoke manually.

requinlabs Bundle

Architect, review, and optimize enterprise-grade NestJS backend services. Covers Clean Architecture/DDD, Prisma/TypeORM, dependency injection discipline, security guards, performance caching, Supertest E2E verification, TypeScript best practices, and foundational engineering principles. Triggers on "build NestJS API", "NestJS architecture", "NestJS performance", "Prisma NestJS", "TypeORM", "NestJS security", "NestJS microservice", "review backend code", "refactor NestJS".

xpressabhi Skill

Use when the user asks to "enhance", "polish", "improve", or "level up" a repository. Runs a full repository health check and improves the project across docs, configuration, code quality, security, testing, performance, UI/UX, and developer experience. Triggers on keywords like "enhance repo", "improve repo", "polish", "make this repo production-ready".

abhinand5 Bundle

Research-planning conversation that precedes an autoresearch loop. Interviews the user about the question, stress-tests the plan against a fixed checklist (decidability, cheapest kill, unwelcome result, confounds, evidence audit, budget, scope), proposes alternatives, fills knowledge gaps from the repo's prior loops, and ends with an in-chat plan brief shaped exactly for `autoresearch` init. Writes no files. Use when the user wants to plan a research loop, asks whether a loop is worth running, wants a research plan stress-tested or grilled, or is about to start autoresearch on a plan that has not been examined; also with --quick to stress-test an existing plan without the interview.

alexey1312 Bundle

End-to-end readiness workflow for iPhone Duo, Apple's foldable iPhone with an outer display and a regular-by-regular inner display. Use when a developer wants to prepare, audit, plan or test a SwiftUI or UIKit iOS app for iPhone Duo, the iOS 27 / 27.1 SDK resizable-app changes, foldable poses and the hinge, vertical bars, Device Hub pose simulation, or Apple's "Prepare your app for iPhone Duo" guidance. Runs a read-only scan and SDK check first, produces a tiered plan with session citations, changes code only after itemized approval by delegating to the iphone-duo specialist skills, and verifies against a pose matrix.

alexey1312 Bundle

Find and fix legacy screen, orientation, idiom and lifecycle code that breaks on iPhone Duo's inner display and in other iOS 27 resizable environments (iPhone Mirroring, iPhone apps on iPad, Split View). Use when a developer asks about UIScreen.main or mainScreen, screen bounds or scale, interfaceOrientation or UIDevice orientation checks, userInterfaceIdiom layout forks, keyWindow or connectedScenes.first, migrating from app lifecycle to UIScene lifecycle (required with the latest SDK), UIRequiresFullScreen, portrait-only apps, or hard-coded Face ID strings and symbols (iPhone Duo has Touch ID; branch on LAContext.biometryType). Covers SwiftUI and UIKit, ships a read-only scanner, and delegates bulk UIKit rewrites to Xcode's own modernization skill when available. Not for app features that merely touch UIScreen or orientation, such as screen brightness, deliberately locking a game to one orientation, or camera and sensor setup.

dfa1 Skill

Audit CHANGELOG.md's Unreleased section against the commits since the last tag: flags user-facing commits with no matching entry, entries that don't correspond to any real commit, and Keep-a-Changelog format violations. Read -only — reports findings, does not edit the file. Use before cutting a release, or whenever the user says "review the changelog", "check changelog", "audit changelog", or invokes `/review-changelog`.

jenkinsjamall Bundle

Set up and maintain a project memory that stays true over months — what to save, the four types, how notes link, the index that makes them findable, and a linter that catches drift. Use when starting a memory for a project, when deciding whether something is worth saving, when a memory turns out to be wrong, or when asked to tidy/audit/consolidate memory. Trigger on "set up my memory", "should I remember this", "audit my memory", "why didn't you remember", "clean up memory".

katla-app Bundle

Audits observable webpage behavior against GDPR, CCPA, and major APAC privacy requirements using browser automation. Use when the user mentions "GDPR compliance check," "CCPA compliance," "privacy compliance audit," "cookie compliance," "check my site for GDPR," "is my site GDPR compliant," "privacy regulation check," "cookie banner check," "consent compliance," "Do Not Sell check," "privacy policy check," or wants to verify cookie consent and privacy rights. Also covers APAC regimes — use when the user mentions "APPI," "Japan privacy," "Thailand PDPA," "Indonesia PDP Law," "UU PDP," "Singapore PDPA," "Taiwan PDPA," "Malaysia PDPA," "PDPO," "Hong Kong privacy," "Philippines Data Privacy Act," "RA 10173," "DPDP," "India privacy law," "APAC privacy compliance," or asks whether a site is compliant in a specific Asian market. Produces branded, printable compliance reports and shareable report links for DPOs and clients.

riseshinee Bundle

Use this skill to make a project safe for company use of Claude Code — keeping internal business logic, secrets, credentials, personal data (PII), and confidential material from ever being sent to Claude. Sets up blocking hooks and permission deny rules driven by a per-company policy file, audits a project for violations, and verifies the guard works. Triggers on "/sb-security-guard", "security guard setup", "apply the company security policy", "check this project before rolling out Claude", "prevent secrets from being sent to Claude", or questions about what data may be given to Claude in this project.

grimlink Skill

Review code changes, pull requests, or merge requests for bugs, code quality, security, and maintainability. Use when asked to review a PR, MR, diff, or set of changes. Also handles GitHub PRs and GitLab MRs.

mgoodness Bundle

Harden a GitHub repo so required checks and automated merges are actually safe: rulesets, merge settings, Dependabot with auto-merge, immutable releases, and Actions security practices (SHA pinning, `pull_request_target` hygiene, token scoping). Use when configuring or auditing a ruleset, merge settings, Dependabot, auto-merge, immutable releases, or when zizmor/actionlint flags a workflow. Defers CI content to a language skill (e.g. `go-ci`), release-please to `release-please`, and App-token mechanics to `github-app-token`.

yiweicreates Skill

把一个项目/skill 安全体面地开源到 GitHub。用户说"帮我开源这个/把X发到GitHub/做成公开仓库"时使用：开源版改写（路径通用化/剥内部引用/冷读审校）→发布前敏感审计（身份/路径/内部代号/密钥 grep 到零命中）→用户拍板仓库名与License→干净目录全新git历史+noreply身份发布→发布后从远端clone回来复扫→固定结构汇报。核心思想：push即永久公开，审计在发布前做足。English triggers - "open-source this", "publish this to GitHub", "make this a public repo". A push is permanent, audit before publishing.

yiweicreates Skill

Obsidian 知识库"大阅兵"——对整个 Vault 进行系统性审计和清理。扫描每个目录的结构健康度、文件内容质量、链接完整性、命名一致性，输出分级审计报告并逐项修复。 MANDATORY TRIGGERS: 知识库审计、大阅兵、vault audit、清理知识库、梳理知识库、检查知识库、知识库体检、vault cleanup、vault review、整理 Obsidian、Obsidian 大扫除。也适用于：用户说"帮我看看知识库有什么问题"、"知识库乱了"、"文档需要整理"、"检查一下文件结构"等任何涉及对 Obsidian vault 做系统性检查和修复的场景。即使用户只是说"帮我整理一下"但当前工作目录是一个 Obsidian vault，也应当触发本 skill。 English triggers - "audit my vault", "my knowledge base is a mess", "full vault checkup", "clean up my Obsidian".

sepand Bundle

A SkillScope Phase B test fixture - frontmatter denies network access, but a bundled script makes an HTTP call anyway. Demonstrates OWASP AST04's permission-understating example, which needs a directory/bundle view to detect.

jfkconstruct Bundle

Comprehensive UI/UX audit with hard ship gates, scoring framework, and actionable recommendations.

mariusfanu Bundle

Audit and enable security-oriented Xcode build settings. Progressively enables compiler warnings, static analyzer checkers, and Enhanced Security features. Use when: user wants to secure their Xcode project, audit security settings, enable hardening, review security posture of build configuration, set up security-focused static analysis, enable static analysis, improve warning coverage, harden diagnostics, or catch more bugs at compile time in C/C++/Objective-C/Swift. SKIP: network security (TLS/ATS), code signing, privacy APIs.

ryanwelcher Bundle

Audit or rewrite existing tutorials, recipes, workshop steps, or docs with Simplified Technical English (STE) in action zones (steps, prerequisites, warnings, UI paths), keeping Ryan's voice elsewhere. Findings first. Use for an STE pass, clearer steps, or readers whose first language isn't English.

ryanwelcher Skill

Internal forked helper for ste-pass. Maps zones in one file, runs ste-lint.py, and returns Simplified Technical English findings with proposed rewrites. Not for direct use.

ryanwelcher Bundle

Write or audit a YouTube video script in Ryan's voice (conversational, funny, developer-to-developer, not AI-sounding). Use to draft a video script or turn an outline into one, or to audit or rework an existing script so it sounds like him.

ryanwelcher Bundle

Scaffold a new WordPress workshop repo, reformat an existing repo to the canonical workshop shape (README, facilitator notes, slides outline, section files, code-reference snapshots, blueprint.json), or audit one read-only. Use when starting, retrofitting, or checking a workshop repo.

mypropper Bundle

Audit a DocuSign template or envelope export and report exactly what carries over, what changes shape, and what needs rebuilding — then import it. Use when someone has DocuSign template JSON, is evaluating a move off DocuSign, asks what their templates would look like elsewhere, or wants existing envelopes and tabs brought across.

roboco-io Skill

Perform thorough code reviews focusing on security, performance, maintainability, and best practices. Use this skill when users request code review, PR review, or ask for feedback on their code implementation.

ftrout Bundle

Extract, normalize, defang/refang, classify, and de-duplicate indicators of compromise (IPs, domains, URLs, hashes, emails, file paths, registry keys, CVEs, wallet addresses) from any unstructured text such as threat intel reports, vendor advisories, phishing emails, pasted logs, PDFs, or chat messages, then produce a clean, machine-readable indicator list with context and an enrichment plan. Use this whenever the user pastes or points at a report, advisory, email, or blob of text and wants the indicators out of it, asks to "pull the IOCs", "defang these", "make a blocklist", "turn this into a watchlist", "what should we block from this report", or needs indicators formatted for a SIEM, EDR, firewall, TIP, or STIX bundle. Also use it when someone asks whether a list of indicators is well-formed or contains noise.

pixee Skill

Detects and closes drift between the latest released Pixee CLI surface and the published `skills/pixee-*` skills on `origin/main`. Trigger after a new pixee release, on a `/audit-skills` request, or when the contributor asks 'are the skills up to date?', 'is there a missing pixee skill?', 'does the CLI match the skills?', 'check skill drift', or 'do we need to update the skills for vX.Y.Z?'. Always audits against `origin/main` (the source of truth for what users see), never the local working tree. Produces a structured drift report first, then closes the highest-severity gap in a pull request. Accepts `--headless` for unattended post-release runs.

roboco-io Bundle

Perform security code reviews based on OWASP Top 10 2025. Use this skill when users request security review, vulnerability assessment, or ask to check their code for security issues. Supports JavaScript/TypeScript, Python, Java, and Go.

ftrout Bundle

Map observed adversary behaviour to MITRE ATT&CK tactics, techniques and sub-techniques with evidence, rationale, and confidence, then produce a mapping table and an ATT&CK Navigator layer JSON. Use it whenever someone asks "what ATT&CK techniques is this", "map this to ATT&CK", "tag this with TTPs", "build a Navigator layer / heat map", "which techniques does our detection coverage miss", or pastes an incident timeline, threat report, sandbox report, Sigma rule set, or purple-team results and wants them expressed in ATT&CK terms. Also use it to check an existing mapping for over-mapping, wrong tactics, or stale technique IDs, and to diff a threat-profile layer against a detection-coverage layer.

ftrout Bundle

Design safe security automation playbooks for a SOAR platform (Microsoft Sentinel automation rules and Logic Apps, Splunk SOAR, Cortex XSOAR, Tines, Shuffle): triggers, enrichment, decision logic, containment behind human-approval gates, idempotency, rate limits, rollback, error handling, dry-run testing, and metrics, expressed in a vendor-agnostic JSON definition that a bundled linter checks. Use this whenever someone wants to "automate" an alert response, asks for a playbook, workflow, automation rule, Logic App, story, or runbook-as-code, wants to auto-block, auto-isolate, auto-disable, or auto-close anything, asks "is this automation safe", or wants an existing playbook reviewed or translated between platforms. Design and review only; it never executes actions.

jtydhr88 Skill

The pre-delivery AI-tell audit for lyrics (歌词 AI 味诊断). Run this on every draft before it ships. The eight enumerable symptoms that make AI-written lyrics recognisable in one listen, which are machine-countable and which need a person, the diagnostic path from symptom to owning skill, why a draft that passes every check can still be lifeless, and the remediation list. Use when a lyric draft is about to be delivered, when a draft reads fine but feels generic, when deciding whether to accept a version, or when a lyric passed LYR-LINT but still sounds machine-written. AI 味、歌词诊断、验收、太泛、像 AI 写的、交稿前检查。

mzvonar Skill

Audit a test suite for duration and quality in parallel subagent batches, bucket the findings with low-hanging fruit first, measure a machine-local baseline so deltas are attributable, then implement bucket-by-bucket via subagents — each bucket benchmarked and recorded in a markdown table. Use when asked to "audit the tests", "speed up the e2e/test suite", "find duplicate or broken tests", "why is CI slow", "run a test audit", or to continue a previous audit's next bucket. Self-configures on first run in a repo: discovers the sanctioned full-suite command, flake ledger and repo constraints, confirms them with the user, and writes .claude/claude-skills.json. Produces docs/test-audit-<date>.md plus one docs/test-benchmark-bucket<N>.md per implemented bucket.

mzvonar Bundle

Audit an implementation against its acceptance criteria, one criterion at a time, to find AC-misimplementations that code review misses. Use whenever the user wants to check, verify, or audit acceptance criteria — "does this actually satisfy the ACs", "check the ACs for this story", "did we really implement AC4", "audit this story before merge", "the review passed but I want a second opinion", or when reviewing a PR/MR against a spec or ticket. Also use when a story was marked done and the user suspects something slipped, or when they want to know which criteria a change fails. Combines a repeated fresh-context judge sweep with a deterministic existence check for criteria that name concrete artifacts.

stifleur390 Skill

Sécurité des applications Laravel 13. Auth, authorization, CSRF, injection, headers, rate limiting, audit. Utiliser quand on sécurise une app, on audit du code, on configure l'auth, ou on répond à une faille de sécurité.

drdustinedwards Skill

Audit, diagnose, or optimize website loading and interaction performance, Core Web Vitals, and Lighthouse performance scores.

drdustinedwards Bundle

Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security. Use for architecture and product selection, including when the user describes a need without naming a Cloudflare product; then find the relevant skill or documentation.

g-tavares14 Skill

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production auth, security-sensitive logic, a high-stakes migration, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

808enzo Bundle

Notice when something you launched has stopped working, and decide what to do about it. Use when a flow goes quiet, a send goes out twice or to the wrong list, an export stops refreshing, a promo pool runs dry, a metric sags with no obvious cause, or nobody can say which of your forty mechanics are still earning their place. Covers the duty roster and its slot, alerting, incident response, message recall and correction sends, and the periodic audit that decides what stays running. Not the design of a flow, not the definition of a metric, and not proof that a change caused a result.