Security

sergeyklay Skill

Prove a passing check was capable of failing before recording it as evidence. Use when a test, CI job, build-and-diff, smoke test or rehearsal comes back green and that green is about to be treated as proof - especially when the check depends on a setup mutation (a sed/awk rewrite, an env var, a secret, a fixture file, a branch or working-copy state), when a job passes under continue-on-error, `|| true`, `set +e` or warning-only output, when an event-driven workflow is hand-run while nothing has changed, when simulating a future input such as the next release, or when a flaky or racy fix is about to be called verified. Covers asserting the precondition actually took effect, confirming the subject rather than the receiver was exercised, stripping failure suppressors, and running a negative control, which a race needs forced, not reverted. Do NOT use for zero-hit searches or absence claims (that is research-it), or for authoring unit tests in a specific language (that is test-go or test-ts).

varnan-tech Bundle

Audit how often LLMs recommend your brand vs competitors and generate a GEO action plan.

vinta Skill

Triage open PRs — screen from the diff, delegate the admission judgment to audit-the-list, then merge or close on GitHub. Fire when the maintainer asks to review PRs, process the PR queue, or judge whether a specific PR should be merged.

codeaholicguy Bundle

AI DevKit · Review and improve documentation for novice users. Use when users ask to review docs, improve documentation, audit README files, evaluate API docs, review guides, or improve technical writing.

drayline Skill

Generates a structured Project Brief — a comprehensive markdown document that extracts goals, architecture, knowledge file inventory, Custom Instructions summary, Memory contents, current state, ecosystem position, and key decisions from a Claude Project. Briefs serve as uploadable context documents: add one to any other Project for immediate deep awareness of the source Project's purpose, architecture, and progress. Use when user says "create a brief," "brief this project," "extract project context," "generate a project summary for another project," "I need to share this project's context," "prepare this project for cross-project reference," or "document this project." Also use when the user is preparing to work across Projects and needs portable context. Do NOT use for session handoffs, project audits, or Memory optimization (use rootnode-session-handoff, rootnode-project-audit, or rootnode-memory-optimization respectively, if available).

elementalsouls Skill

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

ghostsecurity Skill

Starts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers. Capabilities include starting/stopping the proxy scoped to specific domains, viewing captured request/response logs, searching traffic by method/path/status/host, and inspecting full raw HTTP entries for security analysis. Use when the user asks to "start the proxy", "capture traffic", "intercept requests", "inspect HTTP traffic", "search captured requests", or "view request/response".

kayforkind Skill

Migrates Spring Security 5 on Boot 2 to Spring Security 6 on Boot 3: drop WebSecurityConfigurerAdapter, switch to EnableMethodSecurity, requestMatchers, lambda DSL, and javax-to-jakarta servlet. Use when converting an existing SS5 configuration. Not for greenfield Security 6 apps, versions before 5, or remaining on Boot 2/javax.

khendzel Skill

Find new skills on GitHub or check a specific skill before installing. Use when the user wants to search for skills, evaluate a skill URL, check overlap and security risk before installing, or compare a local skill against alternatives. Trigger with '/janitor-discover'.

koala73 Skill

Retrieve the current AI-generated strategic intelligence brief for a country, keyed by ISO 3166-1 alpha-2 code. Use when the user asks for a summary of the current geopolitical, economic, or security situation in a specific country.

netdata Bundle

Triage SonarCloud findings (issues, hotspots, code smells, vulnerabilities) for this project — search what's open, mark False Positive / Won't Fix / Confirm / Safe / Acknowledged / Fixed, batch-mark whole rule families. Use when the user asks to "review Sonar findings", "triage SonarCloud", "mark False Positive on Sonar", or anything mentioning sonarqube/sonarcloud, S2259, S5008, code smells, security hotspots, or sonarcloud.io.

nexu-io Skill

Capture full-page screenshots of web pages via Chrome DevTools Protocol with zero dependencies. Useful for portfolios, case studies, and audit reports.

openclaw Skill

Audit and optimize an existing Convex app: security, scale, upgrades, observability.

openclaw Skill

Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.

posthog Skill

Audit PostHog survey SDK features and version requirements

sergeyklay Bundle

Run a Snyk SAST + SCA security audit on the repository, remediate findings that pass the project's verification gates, and write a prioritized report to .audit/. Optional scope argument: all (default), code, deps, or changed.

simstudioai Skill

Add a runtime feature flag (AppConfig-backed on prod, secret fallback off-prod), global by default or optionally gated by workspace id, org id, user id, or platform admin

travisjneuman Bundle

This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation.

zebbern Skill

This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.

gabrielmoreira Bundle

Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.

ajhcs Bundle

Healthcare Agents plugin router for healthcare administration work. Use when the user says to use the Healthcare Agents plugin, asks for a healthcare administration workup, names a department or area such as revenue cycle, quality, compliance, clinical administration, payer, health IT, population health, pharmacy, operations, strategy, or emergency preparedness, or asks for a workplan, audit checklist, template, or specialist routing.

alibaba Skill

Performs AI-powered code review on Git changes using the `ocr` CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply fixes when requested. With appropriate review rules, can detect various types of issues including bugs, security vulnerabilities, performance problems, and code quality concerns.

butterbase-ai Skill

Use when users report access denied errors, see wrong data, RLS policies are not working, or when troubleshooting Row-Level Security issues in Butterbase

bytedance Bundle

Reviews DeerFlow skill packages for readiness, triggers, safety boundaries, resources, and evidence. Invoke when users ask to audit, grade, or production-check an existing skill.

clawbio Bundle

Classify germline variants from VCF/BCF files according to the ACMG/AMP 2015 28-criteria evidence framework and generate clinical-grade interpretation reports with per-variant evidence audit trails and ACMG SF v3.2 secondary findings screening.

drmhse Skill

Use AuthOS compliance and audit surfaces for privacy, SIEM, audit logs, risk events, MFA metrics, GDPR export, and anonymization. Use when implementing SAR export, right-to-be-forgotten flows, tenant SIEM streaming, audit review, or compliance evidence collection.

ghostsecurity Skill

Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability summary, full security audit, or combined scan results.

kayforkind Skill

Reviews Django and DRF code for validated ORM issues: N+1 queries, unbounded querysets, missing indexes, and write loops, reporting only proven hot-path findings. Use when asked to review Django performance, find N+1s, or audit queryset and database problems. Not for general Django feature work, test/admin/migration files, or speculative micro-optimizations. Do not use as a substitute for EXPLAIN ANALYZE on production.

n8n-io Skill

Reviews a GitHub pull request like a thoughtful human reviewer and writes the feedback to a markdown file. Prioritizes context, architecture fit, solution complexity, bugs, security edge cases, and missing tests. Use when given a PR URL to review, or when the user says /human-like-code-review.

nyldn Bundle

Trace codepaths in diffs, map against tests, auto-generate missing coverage — use before shipping PRs

rlaope Skill

[omh] Hermes Verification Gate workflow: define and record build, lint, typecheck, test, security, docs, generated-output, and CI evidence before completion or merge. Use when the user says: verification-gate, verification gate, quality gate, release gate, test gate, build lint test, lint typecheck tests, verify before merge.

rlaope Skill

[omh] Hermes workflow learning workflow: classify and review self-improvement store routes as an auxiliary review lane before durable writes, then record workflow attempts as metadata-only traces, evals, review queues, patch proposals, regression cases, audits, indexes, and exports. Use when the user says: workflow-learning, workflow learning, route-signal, self-improvement store routing, store route review, memory skill wiki routing, learning trace, learning audit.

ryo-ebata Skill

Skill with dangerous system commands

sergeyklay Bundle

Measure a candidate library's real maintenance state and its behavior against the protocol, schema, or API version the project has already pinned, before taking it as a dependency. Covers any ecosystem (Go, npm, PyPI, Cargo, Maven) and any forge (GitHub, GitLab, Gitea). Use when deciding whether to adopt, replace, or drop a library, when asked which of two or more packages that do the same job to use ('should we use X or Y'), when an architecture decision turns on whether a package is still maintained, or when a package looks healthy by stars and release count and the real question is whether it can reach the project's pin. Answers with a measured verdict on named candidates, from the unmerged pull request queue and a runtime probe against the published artifact rather than the README. Do NOT use for a vulnerability in a dependency already adopted (scan-security), a weighted-criteria comparison document for publication (compare-it), or a library question with no adoption decision attached (research-it).

shuvonsec Skill

GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.

simstudioai Bundle

Audit a Sim dynamic selector across its declaration, browser-safe manifest, server attachment, provider primitive, and selectors.execute security boundary. Use when reviewing selector correctness, secret handling, scope authorization, or migration completeness.