Security

majiayu000 Bundle

Scaffold or audit an entire research project repository organized around its source library. Use whenever the user is starting, structuring, organizing, or reviewing a whole project — "set up a research repo", "how should I structure/organize this project", "initialize my sources folder", "new paper or literature-review project", "audit my repo structure", "is my sources folder set up right", "check my project layout". Builds the full tree from the sources spine outward — sources/{og,md,unprocessed}, references.bib, a PDF→Markdown convert script (OpenDataLoader PDF), a process-source intake command, CLAUDE.md/AGENTS.md, .gitignore, .venv — plus the analysis, manuscript, and review folders; or audits an existing repo and reports what is present, partial, or missing. NOT for intaking or converting a single PDF (use process-source) or building a publication replication package (use replication-package).

majiayu000 Bundle

Audit Claude Code session logs (~/.claude/projects) for token waste and produce a ranked, attributed efficiency report (habit / skill_file / config). Use when the user asks to audit session efficiency, analyze token waste or cost blowups, review Claude Code usage cost, or asks "where are my tokens going".

majiayu000 Bundle

· Create/review skills: frontmatter, triggers, overlaps, collection consistency, retrospective updates. Triggers: 'skill creator', 'new skill', 'skill audit', 'skill review', 'update skill library'.

majiayu000 Bundle

Extract structured decisions from source material — sprint outputs, team reports, issue investigations, security audits. Comprehensive extraction is the default. Every architectural decision, tech fact, enforcement lesson, and sprint outcome that serves PM coordination gets documented. Triggers on "/pm-document", "/pm-document [file]", "extract decisions", "document this sprint", "process this report".

majiayu000 Bundle

Phase 2: Run mechanical checks and Gemini formatted audit

majiayu000 Bundle

Validate vault graph consistency and structural integrity

majiayu000 Bundle

Review Dojo code for best practices, common mistakes, security issues, and optimization opportunities. Use when auditing models, systems, tests, or preparing for deployment.

majiayu000 Bundle

Spec verification phase - tests, execution, rules audit, code review

majiayu000 Bundle

Check dependencies for vulnerabilities. Use when user asks to "audit dependencies", "/audit-deps", "check for vulnerabilities", or wants to check dependency health.

majiayu000 Bundle

Burp Suite Professional is an HTTP interception proxy with numerous security testing features. Use when testing web applications for security vulnerabilities.

majiayu000 Bundle

Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.

majiayu000 Bundle

Clerk Organizations for B2B SaaS - create multi-tenant apps with org switching, role-based access, verified domains, and enterprise SSO. Use for team workspaces, RBAC, org-based routing, member management.

majiayu000 Bundle

Perform comprehensive code audits on repositories or directories. Use when asked to audit code, review a codebase, analyze code quality, find bugs, check for security issues, review architecture, check SOLID/DRY compliance, or generate a code audit report. Produces well-formatted markdown reports with prioritized recommendations.

majiayu000 Bundle

Detect, classify, and mark Controlled Unclassified Information (CUI) per 32 CFR Part 2002. Scans documents and ArangoDB collections for CUI indicators, applies proper markings, and tracks CUI flow through the system.

majiayu000 Bundle

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

majiayu000 Bundle

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

majiayu000 Bundle

Specializes in JSON Web Tokens (JWT) implementation, security, and optimization. Handles token creation, validation, and best practices for JWT usage.

majiayu000 Bundle

· Administer Kali: apt, branches, metapackages, images, live USB persistence, NetHunter, wireless/GPU. Triggers: 'kali', 'kali rolling', 'kali snapshot', 'kali-tweaks', 'nethunter'.

majiayu000 Bundle

Use when a PinMe project (Worker TypeScript) needs to integrate user authentication — creating email/password users, verifying id_tokens, querying user info, or listing users via Identity Platform auth proxy APIs.

majiayu000 Bundle

Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets. Triggered when users ask about Git analysis, code hotspots, who owns what code, secret scanning, security audits of commit history, or optimizing code review assignments.

majiayu000 Bundle

Set up SOPS + age encryption for sharing .env files securely across machines. Detects existing state, installs tools, generates age keys, creates .sops.yaml, and encrypts .env files as YAML (avoids SOPS dotenv bug #1435). Use when user mentions "sops setup", "encrypt env", "share secrets", "secure env files", "sops age setup", "env encryption", "setup sops", "share env across machines".

majiayu000 Bundle

This is the root skill. It routes requests to the right sub-skill and enforces a few global rules.

majiayu000 Bundle

Drafts EPA Toxic Release Inventory (Form R) reports under EPCRA Section 313 and 40 CFR Part 372. Covers facility identification, chemical threshold determinations, release quantification, off-site transfers, source reduction, and certification. Use when preparing TRI filings, Form R reports, toxic chemical release disclosures, or annual EPCRA Section 313 submissions.

majiayu000 Bundle

Scan containers and dependencies for vulnerabilities with Trivy

majiayu000 Bundle

View and modify VCP configuration. Add or remove ignore entries, toggle scopes, manage compliance frameworks, change severity threshold, and manage exclude patterns. Supports both project config (.vcp/config.json) and global config (~/.vcp/config.json).

majiayu000 Bundle

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

majiayu000 Bundle

Audit the test suite for useless tests, consolidation opportunities, over-mocking, weak assertions, placement/organization issues, xdist safety violations, and other test quality issues. Use when user says "audit tests", "audit test suite", "review tests", or "test quality check". Generates an improvement plan in temp/ with explanations for each proposed change.

majiayu000 Bundle

Comprehensive project audit — health, architecture, phase retrospective, and codebase quality. Produces a scannable report with actionable recommendations.

majiayu000 Bundle

Use when determining which repositories or files a task affects. Distinguishes between target repos (where changes happen) and reference repos (for learning patterns). Supports both standard mode returning { targets, references } and audit mode detecting specific config files to audit. Returns structured scope object.

majiayu000 Bundle

Audit Lightning Network integration. Checks node health, channel balances, peer connectivity, invoice handling, and routing. Use when: reviewing Lightning setup, diagnosing payment failures, or capacity planning. Keywords: lightning, lnd, cln, channels, invoices, bolt11.

majiayu000 Bundle

Browser automation via Puppeteer CLI scripts (JSON output). Capabilities: screenshots, PDF generation, web scraping, form automation, network monitoring, performance profiling, JavaScript debugging, headless browsing. Actions: screenshot, scrape, automate, test, profile, monitor, debug browser. Keywords: Puppeteer, headless Chrome, screenshot, PDF, web scraping, form fill, click, navigate, network traffic, performance audit, Lighthouse, console logs, DOM manipulation, element selector, wait, scroll, automation script. Use when: taking screenshots, generating PDFs from web, scraping websites, automating form submissions, monitoring network requests, profiling page performance, debugging JavaScript, testing web UIs.

majiayu000 Bundle

Inspect commerce events, manage the event audit trail, and handle idempotency keys. Use when debugging event history, reviewing the outbox, or ensuring operation idempotency.

majiayu000 Bundle

Neovim configuration audit knowledge base. Use when: reviewing config files for issues, checking deprecated APIs, optimizing settings, or performing health checks. Provides checklists, best practices, and version-specific deprecated API detection patterns.

majiayu000 Bundle

This skill focuses on identifying security vulnerabilities, outdated packages, and license compliance issues in project dependencies. It covers multiple package ecosystems (JavaScript/Node.js, Python,

majiayu000 Bundle

Month-end and year-end close workflow covering journal entries, reconciliations, close procedures, and audit preparation. Delivers accurate, timely close with full audit trail.

majiayu000 Bundle

Simulate a first-time user experience by following only the documentation. Generates UX audit reports with friction points and recommendations. Use to test documentation quality and create improvement loops.