Security

majiayu000 Bundle

WHEN: Rust project review, ownership/borrowing, error handling, unsafe code, performance WHAT: Ownership patterns + Lifetime analysis + Error handling (Result/Option) + Unsafe audit + Idiomatic Rust WHEN NOT: Rust API → rust-api-reviewer, Go → go-reviewer

majiayu000 Bundle

Incorporating security at every step of software development – writing code that defends against vulnerabilities and protects user data.

majiayu000 Bundle

Classifies inbound Telegram messages for telclaude as ALLOW/WARN/BLOCK with brief rationale.

majiayu000 Bundle

Apply security awareness during code review and implementation. Catches common vulnerabilities without requiring full security audit.

majiayu000 Bundle

Proactive security scanning. Triggers when modifying auth, API endpoints, user data, or sensitive operations.

majiayu000 Bundle

Review Vite security audit patterns for SPA and dev server security. Use for auditing VITE_* exposure, build-time secrets, and proxy configs. Use proactively when reviewing Vite apps (vite.config.ts present). Examples: - user: "Audit Vite env vars" → check for secrets with VITE_ prefix - user: "Check Vite build config" → verify define block and source maps - user: "Review Vite dev server" → check host binding and proxy security - user: "Scan Vite bundles" → search dist/ for leaked API keys or secrets - user: "Audit Vite SPA auth" → verify server-side auth vs client route guards

majiayu000 Bundle

Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking, and security automation. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or ensuring compliance requirements.

majiayu000 Bundle

Audit website sitemaps for AEO optimization opportunities. Use when analyzing site structure, checking indexed URLs, planning content migrations, or when user mentions "sitemap", "site structure", "URL audit", "page inventory", or "content migration".

majiayu000 Bundle

Aggregate security content from Telegram public channels and X/Twitter accounts, forward to Discord webhooks, and persist to graph-memory. Uses Telethon (MTProto) for Telegram, surf browser automation for X, and Discord webhooks for delivery.

majiayu000 Bundle

Comprehensive stress testing skill for FlowState. Runs reliability, backup, container, security, and performance tests. Use before releases, after major refactoring, or when reliability is questioned.

majiayu000 Bundle

Quick reference for all Supabase security audit skills with usage examples and command overview.

majiayu000 Bundle

Create and harden systemd service unit files following modern best practices. Use when writing new systemd units for web applications, background workers, or daemons, or when hardening existing services with security sandboxing and isolation features. Covers service types, dependencies, restart policies, security options, and filesystem restrictions.

majiayu000 Bundle

Activate when the user needs help conducting proactive threat hunting, investigating suspicious activity, or building hypothesis-driven hunts in LimaCharlie.

majiayu000 Bundle

Consult this skill when implementing usage logging and audit trails.

majiayu000 Bundle

Deep architectural context building for security audits. Use when conducting security reviews, building codebase understanding, mapping trust boundaries, or preparing for vulnerability analysis. Inspired by Trail of Bits methodology.

majiayu000 Bundle

Guides you through comprehensive iOS/Swift app planning and analysis. Use for new apps (concept to architecture) or existing apps (audit current state, plan improvements, evaluate tech stack). Covers product planning, technical decisions, UI/UX design, and distribution strategy.

majiayu000 Bundle

Release candidate preparation. Final checks before merge - QA, security, review, changelog. The last gate before shipping.

majiayu000 Bundle

Parse, modify, encode, decode, and deduplicate URLs from the command line. Use when the user needs to extract URL components, manipulate URLs, encode/decode URL strings, or deduplicate URL lists for security testing or web automation.

majiayu000 Bundle

Audit whether the organisation's AI spend actually paid — measured against baselines, not vendor math or vibes. Use when a CFO asks what the AI tools returned, when renewing AI contracts, when consolidating overlapping AI subscriptions, or to build the measurement plan before the next spend. Produces an ROI audit with per-tool verdicts (keep/consolidate/cut), the honest-measurement method behind each number, and a baseline plan for whatever can't be scored yet. To forecast ROI before an investment use roi-estimator; this skill measures what already happened.

majiayu000 Bundle

Audit Microsoft Word (.docx) documents for heading hierarchy, comments, tracked changes, broken cross-references, and style consistency. Use when reviewing a contract draft, preparing a document for handoff, or enforcing a style guide.

majiayu000 Bundle

Audit PowerPoint (.pptx) decks for slide count, text density, embedded images and fonts, hidden slides, speaker notes, and animation density. Use when reviewing a board deck, sales deck, or conference talk before sending.

majiayu000 Bundle

Adversarial visual-layout audit of a Quarto `.qmd` or Beamer `.tex` deck. Flags overflow, font inconsistency, box fatigue, spacing, and alignment issues. Use when user says "visual audit", "check the layout", "does this overflow?", "look for visual issues", "audit the slides", or after reworking a deck's appearance. Does NOT check writing or pedagogy — pair with `/proofread` or `/pedagogy-review`.

majiayu000 Bundle

Conducting project scoping and estimation using logical chunking and metric analysis. Use when the user wants to estimate audit effort, scope a codebase for review, calculate hours for a security engagement, or assess the size of a diff or full repository.

majiayu000 Bundle

Use when preparing a release: aggregated GO/NO-GO gate checking coverage, security, tests, lint, and dependency vulnerabilities against manifest thresholds.

majiayu000 Bundle

Perform code review on staged changes or a pull request. Checks for bugs, security issues, performance problems, and best practices. Use when user says "review code", "check my code", "review PR", or "is this code okay".

majiayu000 Bundle

Audit codebase for adherence to architectural standards, practices, and rules. Use when user says "audit arch", "audit architecture", "check architecture", or "architectural review". Spawns parallel subagents to examine multiple architectural aspects and generates a structured report.

majiayu000 Bundle

Audit project documentation for drift against actual code structure

majiayu000 Bundle

Full audit — launches all 6 audit skills in parallel, produces unified report

majiayu000 Bundle

Comprehensive PR analysis with security review, code quality assessment, and automatic improvements. Use when reviewing PRs for security issues, performance optimizations, or best practices violations. Provides multi-dimensional analysis with safe auto-apply options.

majiayu000 Bundle

(ePost) Use when preparing a release, running pre-init checks, auditing kit health, or when asked to "verify", "audit kit", "pre-release check"

majiayu000 Bundle

Pre-commit self-validation for code quality and security

majiayu000 Bundle

Auditer les policies RLS d'une table ou du projet. TRIGGERS : audit-rls, vérifier RLS, sécurité DB, check policies, audit sécurité

majiayu000 Bundle

Use the AWF (Agentic Workflow Firewall) to run commands with network isolation and domain whitelisting. Provides L7 HTTP/HTTPS egress control for AI agents.

majiayu000 Bundle

Review a diff with the reviewer fleet, funneled to one triaged verdict. Targets the current working diff, a path, or an inbound GitHub PR.

majiayu000 Bundle

Autonomous sprint — one interactive spec gate, then plan-to-PR execution with every auto-decision SMARTS-scored and logged. Hard gates remain true stops.

majiayu000 Bundle

Audit project dependencies for known vulnerabilities (CVEs). Supports npm, pip, Cargo, and Go. Zero API keys required. Safe-by-default: report-only mode, fix commands require confirmation.