Security

aibot88 Bundle

Senior developer-level release review for macOS/iOS apps. Identifies security, privacy, UX, and distribution issues with actionable fixes. Use when preparing an app for release, want a critical review, or before App Store submission.

aibot88 Bundle

Assess an AI feature or product for ethical risks, bias, safety issues, fairness gaps, and regulatory compliance. Use when reviewing an AI feature before launch, conducting a responsible AI audit, or responding to a bias or safety concern.

aibot88 Bundle

Code review covering security, quality, tests, implementation, documentation, and architecture / module-depth. Use when the user asks to review code, check changes, audit a PR or diff, find refactoring opportunities, or look for shallow modules and over-abstraction. NOT for fixing the issues found (use fixing-code) or applying refactors (use refactoring-code).

aibot88 Bundle

Incremental security scan for changed files only — optimized for PR and commit-level reviews

aibot88 Bundle

Detect accidentally committed secrets, credentials, and sensitive information in code.

aibot88 Bundle

Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform a penetration test on a codebase.

aibot88 Bundle

Sempre considera vetores OWASP top-10 ao escrever/revisar código

aibot88 Bundle

Monitor social platforms for security threats, vulnerability discussions, and breach intelligence using Xpoz. Use when asked to "find CVE discussions", "security threat monitoring", "OSINT social media", "vulnerability intelligence", "breach mentions", or "threat intel from Twitter/Reddit".

aibot88 Bundle

Run composable security analysis across binaries, prompts, traces, and policies.

aibot88 Bundle

Scan codebase for security vulnerabilities, hardcoded secrets, injection flaws, misconfigurations, and attack surfaces. Use when user wants a security audit, vulnerability scan, or to find security issues.

aibot88 Bundle

Security-focused PR review for snarkVM codebase. WHEN: User says "review PR", "audit PR", "security review", "check PR changes", or wants thorough analysis of PR changes for bugs/vulnerabilities. WHEN NOT: Fixing review feedback (use snarkvm-fix pr), fetching context only (use snarkvm-github), or fixing issues (use snarkvm-fix).

aibot88 Bundle

Solidity development standards and security auditing. TRIGGER when: working with .sol files, foundry.toml, hardhat.config.*, smart contract auditing, security review, or vulnerability analysis. Covers Foundry-first development patterns, vulnerability taxonomies, and audit methodology. DO NOT TRIGGER when: general Ethereum tooling/ecosystem questions (use ethskills skill), or Noir/ZK circuits (use noir skill).

aibot88 Bundle

Post-cycle second-pass review of the last `/sst-dev-cycle` commit on any project. Reads what shipped (code + tests + spec + TODO + docs), evaluates it against the spec item it closed along several axes (spec parity, correctness, coverage, discoverability, production verification, security, style, performance), and appends concrete follow-up items to the project's spec AND the handoff TODO's "Next up" if critical, blocking, or medium-to-major gaps are found. If nothing substantive turns up, leaves both unchanged and reports "clean." Does NOT fix issues — only names them and schedules them as spec work for the next `/sst-dev-cycle`. Pair with `/sst-dev-cycle` (chained via `bin/skill-chain.py sst-dev-cycle sst-dev-review`).

aibot88 Bundle

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

aibot88 Bundle

Instrukce pro návrh pytest testů pro Python kód. MUSÍ být použity při analýze testovacího pokrytí — happy path, edge cases, error cases, security regrese, fixtures.

aibot88 Bundle

Generate threat models using STRIDE, PASTA, or VAST methodologies

aibot88 Bundle

Python audit tooling: ruff (linting), mypy (types), bandit (SAST), pip-audit (CVEs), radon (complexity), vulture (dead code), mutmut (mutations). Use during audit phases for Python projects.

aibot88 Bundle

Use when authoring or editing pages under /knowledge/ on the lab website (paper pages, topic pages, repo pages). Covers required frontmatter fields, slug rules, the h1-must-match-title invariant, finding anchors, git commit conventions, the wiki_janitor audit, and the preservation rule for category and papers_supporting fields.

aibot88 Bundle

Prévenir les attaques XSS. Utiliser quand on affiche du contenu dynamique ou sanitize des entrées utilisateur.

aibot88 Bundle

Write and test YARA rules for malware detection and threat hunting. Use when creating YARA signatures, detecting malware families, scanning files or memory for indicators of compromise, or building detection rules for threat intelligence.

aibot88 Bundle

Rebuild a feature as if the correct product architecture existed from day one — remove compatibility cruft, dead abstractions, and historical compromises instead of preserving them. Use when the operator says "refactor properly," "clean up," "rewrite," "modernize," "remove legacy," "simplify," "rethink," "pay down tech debt," or signals frustration with accumulated complexity. Do NOT use for hotfixes, bug repros, surgical patches, or security backports — blast-radius minimization wins there. Trigger with "/zero-tech-debt", "do it right this time", "the way it should have been built", "refactor toward intent".

aibot88 Bundle

Code review: IoC, RESTful, Contracts, Security (OWASP), Clean Architecture, SOLID.

aibot88 Bundle

Debate multi-agente: 2-4 perspectivas (PM, Arquiteto, QA, Security) debatem decisao tecnica. Output: decisao + rationale + dissenting opinions → ADR. Inspirado no Party Mode do BMAD-METHOD.

aibot88 Bundle

Network protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering packets for forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4) Investigating network anomalies and attack patterns, (5) Validating encryption and security controls, (6) Performing protocol analysis for vulnerability research.

aibot88 Bundle

OWASP Top 10, secure code review, SAST/DAST gating.

aibot88 Bundle

Audits the current project against the development standards defined in ~/.claude/CLAUDE.md. Documents non-compliant findings as GitHub issues and writes a prioritised fix plan to the project CLAUDE.md. Use when the user says audit against settings, audit standards, check standards compliance, or audit this project.

aibot88 Bundle

Use when configuring environment variables for Bknd projects. Covers .env files, secrets management, env injection in config, platform-specific variables, and production security.

aibot88 Bundle

Use when initializing or configuring the Bknd authentication system. Covers enabling auth, configuring password strategy, setting up JWT and cookie options, defining roles, and production security settings.

aibot88 Bundle

Assesses Non-Functional Requirements (security, performance, reliability, maintainability, observability) with evidence-based codebase analysis. Scans actual code for patterns, scores each aspect, and produces a structured assessment saved as a tracker document. Supports epic-level (specific project) or system-level (whole codebase) scope. Use when 'nfr assess', 'nfr assessment', 'non functional', 'évaluation nfr', 'exigences non fonctionnelles', 'testarch nfr', 'testability assessment', 'test engineering nfr' is mentioned.

aibot88 Bundle

Fact-check scientifique BYAN (Demonstrable, Quantifiable, Reproductible). Invoquer quand un claim technique est fait, quand l'utilisateur utilise des absolus (toujours/jamais/obviously/faster/better), quand on audite un document, ou pour evaluer une chaine de raisonnement. Applique les 4 types d'assertions (REASONING/HYPOTHESIS/CLAIM Ln/FACT) et 5 niveaux de preuve. Domaines stricts (security/performance/compliance) = LEVEL-2 minimum.

aibot88 Bundle

On-chain analysis and transaction forensics for blockchain security investigations. Provides capabilities for tracing fund flows, identifying suspicious patterns, MEV analysis, and generating forensic reports for incident response.

aibot88 Bundle

Professional skill creation with research-driven workflow and automated validation. USE WHEN: Creating new skills, validating existing skills, deciding between Skills vs Subagents, migrating documents to skills, or running individual validation tools. PRIMARY TRIGGERS: "create skill" = Full creation (12 steps with research + execution planning) "validate skill" = Validation workflow (steps 3-8) "Skills vs Subagents" = Decision workflow (step 0) "convert doc to skill" = Migration workflow "estimate tokens" = Token optimization "security scan" = Security audit WORKFLOW COMPLIANCE: Structured workflows with validation checkpoints. Research phase (Step 1c-1d) ensures skills based on proven approaches. DIFFERENTIATOR: Research-driven creation. Web search (3-5 queries) before building. Multi-proposal generation. 9 automation scripts. Quality 9.0+/10. REUSED: Anthropic's init_skill.py and package_skill.py (production-tested).

aibot88 Bundle

Comprehensive code review covering security vulnerabilities, performance bottlenecks, best practices, and refactoring opportunities. Use when user requests code review, security audit, or performance analysis.

aibot88 Bundle

Activate regulatory compliance specialist mode. Expert in SOX, GDPR, HIPAA, and PCI-DSS requirements. Use when reviewing code for compliance, implementing audit trails, data protection, or regulatory controls.

aibot88 Bundle

This skill should be used when the user says "configure hooks", "set up quality gates", "add PostToolUse hook", "set up permission hooks", "create hook configuration", "add typecheck hook", "set up secret-scan hook", or wants to configure event-driven hooks for their Claude Code project. Validates against the documented Claude Code event list — catches fictional event names before they end up in settings.json.

aibot88 Bundle

Router skill for classifying Contabo tasks and delegating to the narrowest specialist for cost analysis, capacity planning, security hardening, VPS/VDS lifecycle operations, or Object Storage management. Use when the user asks a Contabo question that spans multiple domains or needs triage before specialist engagement.