Security

thedixitjain Skill

FastAPI patterns for async APIs, dependency injection, Pydantic request and response models, OpenAPI docs, tests, security, and production readiness.

thedixitjain Bundle

Use this skill when you need to design security testing around OWASP risks, vulnerability scanning, and penetration scenarios; triggers include security testing and vulnerability testing.

hashgraph-online Bundle

>- Write a non-conformance report, NCR, reject a supplier, or document a defect with objective-evidence language and correct severity grading (Critical/Major/Minor). Covers disposition recommendations and segregation requirements for incoming inspection failures, in-process defects, customer returns, and audit findings.

jeremylongshore Skill

PR and community reconnaissance — audit current press coverage, social presence, community health, and competitor PR. Use when asked to "audit our PR", "what's our community state", "how do we compare in press", or before planning a launch or community initiative.

athola Bundle

Evaluate hook security, performance, and SDK compliance. Use for audits.

jeremylongshore Skill

Customer success reconnaissance — audit current onboarding completion, health signals, NRR, churn patterns, and CS motion. Use when asked to "audit our customer success", "why are customers churning", "what's our NRR", or before designing any CS playbook.

thedixitjain Skill

AI-powered Claude Code skill that performs deep code review using formal logic and reasoning frameworks to detect bugs, anti-patterns, and security risks beyond what linters catch.

jeremylongshore Bundle

Power management audit — analyze sleep modes, wake sources, power state machines, radio duty cycles, and battery life estimates. Use when asked to "audit power usage", "optimize battery life", "review power management", "why is my battery draining", "power budget analysis", or "sleep mode review".

thedixitjain Skill

'Manage api key manager operations. Auto-activating skill for Security Fundamentals. Triggers on: api key manager, api key manager Part of the Security Fundamentals skill category. Use when working with APIs or building integrations. Trigger with phrases like "api key manager", "api manager", "api". '

hashgraph-online Bundle

Use when reviewing uncommitted or staged git changes before commit. Trigger on: 帮我 commit, 我要 commit, commit 一下, 准备提交, pre-commit, 提交前检查, 看下这次修改, commit 前看一下, I want to commit, let''s commit, review my changes. Checks conventions, functional correctness, security/reliability/performance hotspots, wiring, comments, and dead code; emits a commit message only when READY. Does not mutate the working tree. Route to dev-commit-writer only when the user explicitly asks to skip review or wants only a commit message.

code-yeongyu Skill

Thorough, file-cited technical debt audit across 9 dimensions using AST-grep (tree-sitter), grep, language-native tooling, and optionally CodeGraph knowledge graph. Produces TECH_DEBT_AUDIT.md with severity, effort estimates, and prioritized fixes. Use when asked for codebase health check, tech debt audit, architecture review, code quality assessment, or cleanup planning. Triggers: 'tech debt', 'technical debt', 'debt audit', 'code health', 'technical debt audit', 'codebase health check', 'find tech debt', 'debt analysis', 'audit code quality'.

thedixitjain Bundle

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

hashgraph-online Skill

Use when tracking security investigations, bug bounty findings, CTF leads, audit evidence, exploit chains, dead ends, or reports in the Casefile ledger through Codex.

davepoon Skill

Analyze exploit intelligence for a vulnerability against the current repository

thedixitjain Bundle

Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.

thedixitjain Bundle

Use when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations. Covers MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting.

parcadei Skill

Security audit workflow - vulnerability scan → verification

nousresearch Skill

Find accounts for a username across 400+ platforms.

nousresearch Bundle

Autonomously remove your info from data-broker sites.

code-yeongyu Skill

Post-implementation review orchestrator. Launches 5 parallel background sub-agents: Oracle (goal/constraint verification), Oracle (code quality), Oracle (security), unspecified-high (hands-on QA execution), unspecified-high (context mining from GitHub/git/Slack/Notion). All must pass for review to pass. MUST USE before a PR handoff or when the user explicitly asks to review completed work. Triggers: 'review work', 'review my work', 'review changes', 'QA my work', 'verify implementation', 'check my work', 'validate changes', 'post-implementation review'.

jeremylongshore Bundle

Verify observability posture — audit monitoring coverage, find blind spots, prioritize gaps. Use when asked "is monitoring sufficient", "observability review", "are we covered", or "pre-launch monitoring check".

ruvnet Skill

AI-assisted pair programming with multiple modes (driver/navigator/switch), real-time verification, quality monitoring, and comprehensive testing. Supports TDD, debugging, refactoring, and learning sessions. Features automatic role switching, continuous code review, security scanning, and performance optimization with truth-score verification.

thedixitjain Skill

Use when the user asks to review pull requests, analyze code changes, check for security issues in PRs, or assess code quality of diffs.

data-goblin Bundle

Actionable feedback on the quality, usage, and effectiveness of Power BI reports. Automatically invoke when the user asks to "review a report", "audit a report", "report usage analysis", "report health check", "find unused reports", "check if a report is being used", "assess report performance", "evaluate report quality".

nousresearch Bundle

Set up op CLI, sign in, and read or inject secrets.

thedixitjain Bundle

Guidance and local audit tools for Python workflows that directly use GeoPandas GeoSeries, GeoDataFrame, spatial operations, or vector-data I/O.

thedixitjain Bundle

Use NeuroKit2 to build or audit reproducible research workflows for physiological time-series preprocessing, event/interval analysis, multimodal alignment, variability, and complexity. Trigger when code imports neurokit2 or needs its current APIs, schemas, and method-aware validation—not for diagnosis or device validation.

hashgraph-online Bundle

Provision, connect, and operate Sealos object storage through the sealos-cli s3 commands added in zjy365/sealos-cli#28. Use when the user needs S3-compatible storage for uploads, assets, backups, presigned URLs, bucket policy management, access credentials, quota checks, or wants to replace local MinIO/S3-compatible services with Sealos object storage in local development, Devbox, or app setup.

thedixitjain Bundle

Builds and queries multi-language source code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, and entry point enumeration. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, or building a code graph for audit prioritization. Prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.

hashgraph-online Skill

Systematic vulnerability scanner across injection, auth, data exposure, and dependencies. Use when scanning for vulnerabilities, reviewing security, or validating threat models.

thedixitjain Skill

Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.

thedixitjain Bundle

Writing, exploit — assemble raw material into a journey of beats, grounding each term before a beat leans on it.

thedixitjain Bundle

Writing, exploit — shape raw material into an article, paragraph by paragraph.

prompt-security Bundle

Security advisory feed package for OpenClaw-related threats and vulnerabilities. The upstream feed is updated daily; local automation is handled by clawsec-suite or the operator.

prompt-security Bundle

Harness-neutral community incident reporting for AI agents. Contribute to collective security by reporting threats.

jeremylongshore Bundle

Usability review — evaluate an existing flow or UI against usability heuristics, flag friction points, and recommend fixes. Use when asked to "review the UX", "usability audit", "what's wrong with this flow", "UX feedback", "critique this design", or "why are users dropping off here".