Security

ryo-ebata Skill

Skill that manages configuration

techygarg Bundle

Apply clean code principles when generating or modifying implementation code. Enforces function focus, naming clarity, complexity management, error handling, and self-documenting style. Use when the user mentions 'clean code', 'code quality', 'coding guidelines', or 'implementation quality'. Loaded automatically by the code-generating molecules (code-forge, refactor-safely, bug-fix). This skill governs the craft of writing individual code units -- not architecture (see architecture), not security posture (see secure-coding), not test structure (see test-quality), and not refactoring workflows (see refactor-safely).

techygarg Skill

Generate implementation code from an approved design blueprint or verbal requirements. Composes context anchoring, architecture, clean code, DDD, security, and test quality into an inside-out implementation workflow. Use when moving from design to code, implementing approved contracts, or when the user says 'implement', 'code this', 'build it', 'forge the code', or 'generate the code'.

gabrielmoreira Skill

This skill should be used when establishing comprehensive QA testing processes for any software project. Use when creating test strategies, writing test cases following Google Testing Standards, executing test plans, tracking bugs with P0-P4 classification, calculating quality metrics, or generating progress reports. Includes autonomous execution capability via master prompts and complete documentation templates for third-party QA team handoffs. Implements OWASP security testing and achieves 90% coverage targets.

nowork-studio Skill

Meta Ads (Facebook + Instagram) account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my Meta ads", "audit my Facebook ads", "Meta ads audit", "set up my Meta ads", "onboard Meta", "Meta account overview", "how's my Meta account", "Meta health check", "what should I fix in my Facebook ads", or when the user is new to NotFair Meta and hasn't run an audit before.

openclaw Skill

Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.

gabrielmoreira Skill

Operates GitHub through gh CLI and the REST/GraphQL APIs with explicit target, authorization, impact preview, and independent readback. Use for pull requests, issues, Actions, repositories, collaborators, teams, organization member privileges, base permissions, 2FA enforcement, repository settings, API automation, parallel or superseded PR convergence, and public or enterprise GitHub. Also use when a GitHub write returned success but the requested state did not change, or when deciding whether a setting is writable through CLI, REST, GraphQL, or only the GitHub UI.

gabrielmoreira Skill

Hypothesis-driven, tool-grounded security review of coverage gaps

bgauryy Bundle

Use when code needs a blunt evidence-backed roast or memorable critique: smell inventory, debt ranking, hot-path autopsy, savage/diff review, security or performance sins, or practical redemption paths. Phrases like roast this, brutal review, top sins, cleanup debt. Polite evidence-first PR review → octocode-research.

denoland Skill

Review a Deno runtime pull request for correctness, tests, security, and conventions. Use when asked to review a PR or when a PR number/URL is provided for review.

first-fluke Bundle

SCM (software configuration management) and Git: branching, merges, conflicts, worktrees, baselines, audit readiness, plus Conventional Commits and safe staging.

matteocervelli Skill

Audit dependency freshness — scan outdated deps and CVEs, classify severity, record update/defer/skip decisions in Atrium, gate PASS/WARN/FAIL. Use when checking for outdated packages or deciding whether to upgrade. Trigger on "outdated dependencies", "dependency audit", "are my deps up to date", "should I upgrade".

nowork-studio Skill

Google Ads account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should I fix in my ads", or when the user is new to NotFair and hasn't run an audit before.

open-gsd Skill

Cross-phase audit of all outstanding UAT and verification items

open-gsd Skill

quality gates | code review debug audit security eval ui

openakita Bundle

Review code changes for correctness, security, and maintainability. Supports local git diffs (staged or working tree) and remote Pull Requests (by ID or URL). Use when the user asks to review code, check a PR, audit changes, or wants feedback on code quality before merging.

qwenlm Skill

End-to-end workflow for implementing a non-trivial qwen-code feature. Covers requirements investigation, design, E2E test planning, baseline dry-run, implementation, verification, self-audit, code review, and iteration.

rtk-ai Skill

Issue triage: audit open issues, categorize, detect duplicates, cross-ref PRs, risk assessment, post comments. Args: "all" for deep analysis of all, issue numbers to focus (e.g. "42 57"), "en"/"fr" for language, no arg = audit only in French.

ryo-ebata Skill

A skill with edge cases to test scanner boundary behavior

seedexr Bundle

Holistically audit a codebase, its dependencies, deployment, auth, and (with authorization) its running endpoints/hosts for security flaws — then fix, self-verify, and re-audit. Grounded in a local knowledge base covering established web-application, API, and network/host security techniques, an ASVS-derived control set, and current (2023–2026) research. Drives the cross-platform `linda` CLI, which uses best-in-class open-source scanners (semgrep, trivy, gitleaks, nuclei, ZAP, nmap) when present and degrades gracefully when not. Use whenever the user wants a security review, audit, pentest prep, hardening pass, vulnerability hunt, or 'make this secure'.

techygarg Bundle

Apply security-conscious thinking when generating or modifying code. Enforces trust boundary awareness, input validation, injection prevention, secrets management, and defense-in-depth authorization. Use when generating code that handles user input, authentication, authorization, database queries, external APIs, or file operations, or when the user mentions 'security review', 'secure this', 'check for vulnerabilities', 'trust boundary', 'input validation', or 'OWASP'. Loaded automatically by the code-generating molecules (code-forge, refactor-safely, bug-fix). This skill governs the security posture of generated code -- not architecture (see architecture) and not code craft (see clean-code).

ar9av Skill

Show the current state of the wiki — what's been ingested, what's pending, and the delta between sources and wiki content. Use this skill when the user asks "what's the status", "how much is ingested", "what's left to process", "show me the delta", "what changed since last ingest", "wiki dashboard", or wants an overview of their knowledge base health and completeness. Also use before deciding whether to append or rebuild. Includes an insights mode triggered by "wiki insights", "what's central", "show me the hubs", "central pages", "what's connected", "wiki structure" — analyzes the shape of the wiki itself to surface top hubs, cross-domain bridges, and orphan-adjacent pages. Also includes an equilibrium mode triggered by "is my vault at equilibrium", "wiki equilibrium", "is maintenance done", "is the vault converged", or "are my skills fighting" — runs every maintenance skill's audit-only pass and reports whether any of them still has a pending change.

lobehub Bundle

Audit a page / surface against the Designing Interfaces pattern language + the ux skill checklists, then land findings. Three layers — static (code), visual (screenshots), dynamic (automated user journey + perf). Use to run a repeatable, standards-based UX review of one screen.

madteacher Skill

Build, fix, audit, and migrate Drift persistence in Dart CLI, server-side, and non-Flutter desktop apps. Use when adding SQLite with package:drift/native.dart, configuring PostgreSQL with drift_postgres and package:postgres, writing type-safe tables, queries, writes, streams, and migrations, resolving build_runner or drift_dev failures, or validating Dart database code with code generation, analysis, tests, and migration checks.

gabrielmoreira Bundle

Architecture audit that maps module dependencies, checks layering integrity, and flags structural decay across a codebase, drawing on twelve classic engineering books. Triggers when: user asks to audit architecture, review folder/module structure, check for circular imports, understand how the codebase is organized, or asks "does this follow clean architecture?" or "why does everything depend on everything?". Also triggers for onboarding requests: "explain this codebase to a new developer" or "give me a codebase tour" (use onboarding mode). Do NOT trigger for: PR-level code review (use brooks-review) or line-level refactoring questions — this skill analyzes structural/module-level concerns, not individual functions.

mastra-ai Skill

Autonomous, report-only documentation review for Mastra docs. Use when auditing changed docs against source, validating contextual code examples or API coverage, checking canonical mastra-docs guidance, or running narrow deterministic checks.

nrwl Skill

Deep code review of the branch you are standing on, before it becomes a PR. Scope is merge-base..working-tree, so it covers commits, staged and unstaged changes together. Runs the same review lanes as review-pr — implementation, verification, approach, security — against the local checkout through the sandbox CLI, and saves a draft to ~/.nx-branch-reviews/<branch>.md. Use when asked to review "this branch", "my changes", or work that is not yet on GitHub.

rlaope Bundle

[omh] Hermes Code Review workflow: bug-first review with evidence. Use when the user says: code-review, review, audit, find bugs, release gate, claim audit, evidence audit, README claim.

techygarg Skill

Audit any Lattice SKILL.md for language compliance — removes rationale prose, converts soft language to imperatives, adds STOP: gates on hard rules, and cuts redundant repetition. Complements skill-review (which finds behavioral gaps) by fixing phrasing that causes agents to skip or underweight instructions at runtime. Use after writing or significantly changing any skill, or when the user says 'tighten this skill', 'clean up the language', 'make this more effective', 'reduce the bloat', 'tighten the language', or 'skill tighten'. Standalone — does not call other skills.

travisjneuman Skill

Detailed development workflow patterns, checklists, and standards. Auto-loads for complex tasks, planning, debugging, testing, or when explicit patterns are needed. Contains session protocols, git conventions, security checklists, testing strategy, and communication standards.

daymade Skill

Reviews or re-reviews one contributor pull request—including an explicitly named closed PR being reconsidered—or a bounded newest-to-oldest sweep of all open contributor PRs, for a GitHub repository maintainer against the current base branch. Handles base drift, history discontinuities, polluted branches, ownership, curation, supersession, and review-conditioned repair or landing using immutable Git snapshots, three-way merge results, isolated contribution projection, checks, tests, and findings-first reporting. Use for a PR URL or number, "main changed, review again", "review all open PRs newest to oldest", "apply our maintainer principles", "can we merge this and fix the rest ourselves?", or merge readiness. Do not use for general GitHub CRUD, repository-wide audits, CI-only diagnosis, security-only diff audits, unpushed local diffs, merely addressing existing review comments, or merging without a fresh review.

kayforkind Skill

Extracts Ruby and Rails backends into service and query objects, thin controllers, pinned Bundler manifests, and includes/preload/eager_load N+1 strategy. Use when fat models, fat controllers, Gemfile drift, or N+1 loops are the work. Never a RSpec/Minitest cookbook (rails-testing) or a Brakeman/OWASP deep chair (ruby-security).

lobehub Bundle

Audit .agents/skills SKILL.md files. Use for recurring checks of duplicate, overlapping, stale, inconsistent, or broken skills and merge/delete candidates.

open-gsd Skill

Retroactively audit and fill Nyquist validation gaps for a completed phase

openclaw Bundle

Audit or refresh OpenClaw maturity scorecard docs from root taxonomy, maturity scores, and QA evidence artifacts without using maintainer discrawl data or committed inventory reports.

openclaw Skill

Invoke whenever writing, changing, reviewing, or sweeping tests. Authoring gate for new tests plus audit workflow for low-value, implementation-coupled, or duplicative tests and the test-only production seams they demand.