Security

majiayu000 Bundle

> MANDATORY READING PROTOCOL: Before implementing ANY encryption, read references/advanced-patterns.md for key derivation and references/security-examples.md for implementation patterns.

majiayu000 Bundle

Audits Claude Code hooks for correctness, safety, and performance. Use when reviewing, validating, or debugging hooks, checking exit codes, error handling, or learning hook best practices.

majiayu000 Bundle

Steve Jobs Design Thinking Audit. Auto-activates on: "simplify", "too complex", "UX review", "design audit", "user experience", "feature bloat", "streamline", "make it simpler", "overwhelmed users", "confusing interface"

majiayu000 Bundle

Comprehensive reference for Kali Linux tools. Use this skill to find, understand, and use security tools in Kali Linux. It provides a categorized index of all available tools.

majiayu000 Bundle

Use this skill when developing Go applications with the Prefab server framework. This includes creating servers, adding gRPC/HTTP handlers, configuring authentication and authorization, setting up SSE streams, managing configuration, creating custom plugins, and following Prefab error handling and security patterns.

majiayu000 Bundle

Helps with Prowler repository CI and PR gates (GitHub Actions workflows). Trigger: When investigating CI checks failing on a PR, PR title validation, changelog gate/no-changelog label, conflict marker checks, secret scanning, CODEOWNERS/labeler automation, or anything under .github/workflows.

majiayu000 Bundle

Optimize quiz funnel questions by analyzing flow, checking first question for curiosity hook, evaluating pacing, and identifying dropout points. Use when quiz conversion is low, optimizing existing quizzes, or building new quiz funnels.

majiayu000 Bundle

Comprehensive pre-production repository audit for preparing repos for public release. Use when the user wants to perform a "final sweep", "production check", "pre-release audit", or prepare a repository to be made public. Audits metadata files across all project types (Fabric mods, Node/npm, Go, Python, etc.) for correct username/organization, checks README links, and identifies leftover development artifacts like planning docs, test scripts, and temporary files. Interactive cleanup with user confirmation.

majiayu000 Bundle

Comprehensive code analysis, quality assessment, and issue diagnosis. Use when analyzing code quality, security vulnerabilities, performance bottlenecks, architecture reviews, or troubleshooting bugs and build failures.

majiayu000 Bundle

This skill should be used when the user asks to 'check spec alignment', 'verify requirements coverage', 'detect drift', 'spec audit', or automatically at wave gates. Verifies implementation aligns with specification - different from code review which checks quality.

majiayu000 Bundle

Brutal Vibe Audit for engineering quality. Auto-activates on: "code review", "technical audit", "engineering quality", "is this production ready", "vibe check", "slop check", "AI-generated code", "technical due diligence", "can we ship this", "quality assessment"

majiayu000 Bundle

Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells. Use for security research and detection system testing.

majiayu000 Bundle

Google Ads account audit and business context setup. Run this first — it gathers business information, analyzes account health, and saves context that all other ads skills reuse. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should I fix in my ads", or when the user is new to NotFair and hasn't run an audit before. Also trigger proactively when other ads skills detect that business-context.json is missing.

majiayu000 Bundle

Audit AI search visibility. Use when: checking brand presence in ChatGPT, Perplexity, AI Overviews, Gemini.

majiayu000 Bundle

Audit or design generative AI interfaces against three diagnostic pillars (deterministic-stochastic balance, interaction density, visual cohesion). Treats taste as a measurable control system, not subjective preference. Use when: 'taste audit', 'score this UI', 'design quality', 'interaction density', 'visual cohesion', 'refiner layer', 'correction cost', 'why does this feel off', 'polish this', 'design review', or building any user-facing AI product.

majiayu000 Bundle

Populate the PM knowledge system from existing project documentation — STATUS.md, KNOWN_ISSUES.md, PROJECT_STATE_REVIEW, security audit reports. The first-sprint bootstrap. Use once when the vault is new and existing project knowledge needs to be captured. Triggers on "/pm-seed", "seed from docs", "bootstrap vault", "import existing knowledge".

majiayu000 Bundle

USE FOR: Static analysis of .NET assemblies including code metrics, dependency graphs, architecture validation rules, technical debt estimation, and CQLinq queries for code quality gates. DO NOT USE FOR: Runtime profiling (use dotTrace or PerfView), Roslyn-based live code analysis (use Roslyn analyzers), or security vulnerability scanning (use Semgrep or Snyk).

majiayu000 Bundle

Evaluate and benchmark Salesforce skill quality. Compares AI-generated code with vs without skill context, scores against a Salesforce-specific rubric (security, governor limits, bulkification, patterns, completeness), and produces a comparison report. Use to run benchmarks, verify skill value, or check Apex code quality. Activate on mentions of "evaluate skills", "benchmark", "skill quality", "run eval", or "compare with/without skills".

majiayu000 Bundle

Application security - OWASP, validation, secrets. Use when securing the app.

majiayu000 Bundle

Red vs Blue team security competition orchestrator. Runs long-running overnight battles with 1000s of interactions, scoring, and insight generation.

majiayu000 Bundle

Regulatory compliance intelligence for international trade. Covers PGA requirements (FDA, EPA, USDA, CPSC), denied party screening, sanctions, export controls, and import documentation. Use when someone asks about regulations, permits, licenses, "can I import this?", compliance requirements, FDA approval, sanctions, or restricted parties.

majiayu000 Bundle

Django framework best practices including project structure, ORM, and security.

majiayu000 Bundle

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route selection, CE marking, SBOM requirements, vulnerability and incident reporting to ENISA/CSIRTs, support period obligations, and manufacturer/importer/distributor duties. Trigger for EU CRA, Cyber Resilience Act, PDE compliance, Annex I requirements, SBOM EU, CE marking cybersecurity, or connected product security EU.

majiayu000 Bundle

Apply production security hardening to the codebase (Janet Moore's workflow)

majiayu000 Bundle

Plutonium resource policies - authorization, attribute permissions, and scoping

majiayu000 Bundle

Web application security testing - OWASP Top 10, API security

majiayu000 Bundle

Generate comprehensive REST API documentation using SpringDoc OpenAPI 3.0 and Swagger UI in Spring Boot 3.x applications. Use when setting up API documentation, configuring Swagger UI, adding OpenAPI annotations, implementing security documentation, or enhancing REST endpoints with examples and schemas.

majiayu000 Bundle

Automatically applies when securing AI/LLM applications. Ensures prompt injection detection, PII redaction for AI contexts, output filtering, content moderation, and secure prompt handling.

majiayu000 Bundle

Invoke the Cursor CLI for security-focused plan validation and code review.

majiayu000 Bundle

Log all chat messages to a SQLite database for searchable history and audit. Use when: (1) Building chat history, (2) Auditing conversations, (3) Searching past messages, or (4) User asks to log chats.

majiayu000 Bundle

Analyze codebase health - large files, test coverage gaps, duplicate code, dead/legacy code, and documentation issues. Use when asked to scan, audit, or assess code quality, find refactoring targets, or identify technical debt.

majiayu000 Bundle

Use Codex CLI for sandboxed auditing, debugging, and autonomous prototyping

majiayu000 Bundle

Extract and track builder commitments from critique exegesis. Use /commitments to audit promises made in prose, verify implementation status, and identify unfulfilled obligations.

majiayu000 Bundle

Security review of configuration files and infrastructure as code.

majiayu000 Bundle

Audit documentation against fractary-docs standards and generate actionable remediation specification

majiayu000 Bundle

This skill should be used when users want to migrate from .env files to fnox with 1Password (or another secret provider). It covers installing fnox, creating 1Password items, configuring fnox.toml, and integrating with mise. Use when users mention ".env migration", "fnox setup", "1password secrets", or want to improve their secret management workflow.