Security

fission-ai Bundle

Use this skill when releasing OpenSpec: audit merged work and changeset coverage, decide whether a catch-up changeset PR is needed, prepare or resume the Changesets Version Packages PR, cut a beta or stable release, verify publishing, and polish GitHub release notes. Also use when asked whether an open release PR is complete, what the next release step is, or to continue a release paused for human approval.

galaxy-dawn Bundle

This skill should be used when the user asks to "review paper quality", "check paper completeness", "validate paper structure", "self-review before submission", "audit claims", "check overclaiming", "verify whether results support claims", or mentions systematic paper quality checking. Provides comprehensive quality assurance checklist for academic papers.

ghostsecurity Skill

Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.sum, or Gemfile.lock.

internlm Bundle

Audit a ClawHub skill for security risks BEFORE installation.

kurone-kito Skill

Repo-local, dogfood-only semantic audit of the IDD instruction corpus for leaked session context, cross-file contradictions, fresh-memory completability gaps, automation blockers, and restatement-discipline drift. Use only in the kurone-kito/idd-skill source repository, on request, to audit .github/instructions, skills/issue-authoring, CLAUDE.md, or .github/copilot-instructions.md. Read-only — never edits files or mutates issues.

maxritter Skill

Audit and update Pilot Shell upstream dependencies in installer/upstreams.yaml. Checks npm, PyPI, brew, and curl-pipe entries for newer stable versions, known security advisories, and sha256 drift. Verifies each update installs successfully before committing. Use when: "check upstreams", "update dependencies", "audit upstreams.yaml", "are our dependencies up to date", "supply chain check".

microsoft Skill

Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping

gabrielmoreira Skill

Optimize an article for Answer Engine Optimization (AEO) so AI engines like ChatGPT, Perplexity, and Claude can extract, quote, and cite it. Use when asked to AEO-optimize, make content AI-readable, improve AI citation chances, or adapt an article for answer engines. Produces an AEO-optimised rewrite with question headings, 50–80 word answer capsules, a paragraph-length audit, and flagged trust signals.

gabrielmoreira Skill

Build and maintain a project or product risk register. Use when asked to create a risk register, identify project risks, build a risk matrix, or document risks and mitigations for a programme. Produces a complete risk register with likelihood/impact scoring, RAG status, ownership, and prioritised mitigations.

gabrielmoreira Skill

Walk a space — home, office, commute, classroom — and find the sensory landmines quietly draining or overloading you, with fixes ranked by cost and impact. Use when someone says 'my office wrecks me and I don't know why', 'I'm overstimulated all the time', 'make my home autism/ADHD-friendly', or lives with SPD, autism, migraine, or misophonia. Produces a room-by-room sensory map, a ranked fix list (free → cheap → invest), and a portable kit for spaces you can't change. A self-help audit, not a clinical assessment.

penpot Skill

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

rlaope Skill

[omh] Failure Signal Audit workflow: find swallowed errors, unsafe fallbacks, hidden UI/runtime failures, and missing propagation before they become false green status. Use when the user says: failure-signal-audit, failure signal audit, silent failure, silent failures, silent failure hunter, swallowed error, swallowed errors, empty catch.

shuvonsec Bundle

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.

gabrielmoreira Skill

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

travisjneuman Skill

SOC2, HIPAA, GDPR, PCI-DSS, FedRAMP compliance implementation in code. Audit logging, data encryption, access controls, privacy by design, and regulatory requirement mapping. Use when implementing compliance controls, preparing for audits, or building privacy-compliant systems.

zebbern Skill

This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.

automateyournetwork Skill

Search the National Vulnerability Database for CVEs - find vulnerabilities by keyword or ID, get CVSS scores, weaknesses, affected configurations, and remediation references. Use when looking up a CVE, scanning for vulnerabilities, running a security audit, or checking if a software version has known exploits.

breaking-brake Skill

Run one unattended IMPLEMENTATION iteration of the autonomous value-creation loop — steward any in-flight PR, fix interrupts (red CI / security / human bugs), or else build ONE queued `idea` issue on a branch off auto-dev and open a PR that squash-merges on green CI. Ideation lives in the next-idea skill; this skill consumes its queue. Use when the user says "次のタスク", "next task", "続きをやって", or wants autonomous progress without specifying what to do.

dynatrace Bundle

Hunt threat-intelligence indicators of compromise (IoCs) across Dynatrace logs and spans and produce a 0-100 threat-exposure score. Extracts and normalizes IoCs — IPs, Domains (hostnames included), URLs, Emails, CVEs, File hashes (md5/sha1/sha256), MITRE TTPs — from unstructured reports, advisories, advisory URLs, pasted text, or STIX, then hunts them in fetch logs and fetch spans. Trigger: hunt these IoCs, am I exposed to this threat, check these indicators in my logs and traces, threat exposure report, extract IoCs from this advisory URL, search these hashes/domains/IPs in my environment. Routes CVE-to-vulnerability, IP/Domain/URL/MITRE-to-detection legs to dt-sec-insights. Do NOT use for: querying security.events directly (vulnerabilities, detections, compliance, THREAT_REPORT — use dt-sec-insights); general log queries not tied to an IoC hunt (use dt-obs-logs); general span/trace analysis (use dt-obs-tracing); explaining DQL syntax (use dt-dql-essentials).

epicpast Skill

Create, debug, and optimize GitHub Actions workflows with security best practices. USE THIS SKILL when user says "create workflow", "fix workflow", "workflow fails", "add CI", "reusable workflow", or needs help with GitHub Actions.

gabrielmoreira Skill

Review agentic workflow changes for correctness, security posture, and optimization opportunities with compile, validation, and audit evidence.

gabrielmoreira Skill

Never read .env files or write secrets to .squad/ committed files

matteocervelli Skill

Forensic scan for npm/PyPI supply-chain compromise (Shai-Hulud/TeamPCP campaigns) — checks persistence, hook injection, compromised packages, IOC strings, C2, dead-man switches. Use when auditing a machine or repo for malicious dependencies. Trigger on "supply chain audit", "check for compromised packages", "Shai-Hulud", "scan for malicious deps".

gabrielmoreira Skill

Treat neurodivergent masking as a daily energy budget — audit what passing as neurotypical actually costs you, where the spend is worth it, where you can safely drop the mask, and how to plan a heavy-masking day so you don't crash after. Use when someone says 'I'm exhausted from masking', 'work drains me and I don't know why', 'how do I unmask safely', or is autistic/AuDHD/ADHD and burning out socially. Produces a mask-cost audit, a spend/drop map, and a recovery plan. A self-knowledge tool, not a diagnosis or therapy.

gabrielmoreira Skill

Write a clear penetration-test report from findings of an authorized engagement. Use when documenting a pentest, security assessment, or authorized red-team engagement — turning findings into a report clients act on. Produces an executive summary, scope & methodology, findings with severity/evidence/reproduction/remediation, and a risk-ranked remediation plan. For authorized testing only.

gabrielmoreira Skill

Draft an internal policy people can actually follow — the rule stated plainly with its reason, the bright lines separated from the judgment zones, the edge cases resolved by principle, and the enforcement reality stated honestly. Use when asked write our expense/remote-work/AI-use/security policy, turn this incident into a policy, our policy doc is unreadable, or people keep asking what's allowed. Produces the policy with rules-plus-reasons, the bright-line/judgment split, the worked edge cases, and the honest enforcement section.

gabrielmoreira Bundle

Audit any document against its own sources — every factual claim extracted and graded as evidenced, partially evidenced, unsupported, or contradicted, with the exact source line that supports or fails it. Use when asked to fact-check a document against its sources, check whether a report's claims are backed up, verify a deck against the data, or ask 'does this doc have receipts?'. Produces a claim ledger, unsupported claims ranked by load-bearingness, a fix-or-drop call per claim, and an honesty score with stated method.

gabrielmoreira Skill

Harden a vibe-coded app before strangers use it — the audit for prototypes built fast with AI: exposed secrets, missing auth checks, unvalidated input, data with no deletion path, and the five embarrassing holes every weekend build has. Use when someone says 'Claude built my app, is it safe to launch', 'harden my prototype', 'vibe check my project', or before putting real users on a hackathon build. Produces a ranked findings list with fixes, a launch-blocker line, and a 'what I'd break first' attacker's tour. Defensive review of YOUR OWN app.

gabrielmoreira Bundle

Build a wedding budget that survives to the wedding — allocation by real shares, the per-guest lever made explicit, the routinely-forgotten line items priced in from day one, and a contingency that isn't decorative. Use when asked make a wedding budget, how do people split X across a wedding, we have N dollars and M guests, or why is our wedding over budget. Produces the allocation table from the script, the guest-count math, the forgotten-items audit, and the track-against-actuals discipline.

gabrielmoreira Skill

Run an honest personal year-in-review and set next year's direction — wins, misses, an energy audit, and one theme, not a resolution list that dies in February. Use when asked for a personal year in review, a yearly reflection, to reflect on the past year, or plan next year. Produces the structured retrospective (what worked, what didn't, what you learned), an energy audit of what gave vs. drained you, the honest misses, and a single theme with a few concrete commitments. Personal, not corporate.

openai Bundle

Audit or update English SDK documentation against the requested implementation scope.

openclaw Bundle

Run, watch, debug, and summarize OpenClaw full release CI, release checks, live provider gates, install/update proofs, and release-secret preflights.

qwenlm Skill

Audit the repository's docs/ content against the current codebase, find missing, incorrect, or stale documentation, and refresh the affected pages. Use when the user asks to review docs coverage, find outdated docs, compare docs with the current repo, or fix documentation drift across features, settings, tools, or integrations.

tiger3807861189 Skill

Use this skill to establish and operate the model's inner workspace — the J-space — for any task that needs more than fluent output: multi-step or chained reasoning, planning, long-horizon and agentic work, competition-level problems, complex debugging, keeping many parts of a deliverable globally consistent, holding a goal or constraint through a long mechanical task, auditing what the model believes but has not said, calibrated confidence and error detection, suspicious or manipulative input, recovering from degenerating reasoning, and any moment the user asks the model to think harder, faster, deeper, or longer. Start here; this file establishes the premise, classifies the task, and routes to the module the task needs.

wu-yc Skill

Detects common wet-lab procedural and safety errors from XR or fixed-camera lab video. Identifies pipette volume deviations, forgotten reagent additions, uncapped tubes, contamination risks, sample mix-ups, and other observable hazards. Outputs structured JSON with error type, timestamp, severity, and corrective action suggestions for real-time alerts or post-hoc audit.

xuzhougeng Bundle

Build, audit, authorize, recover, or finalize dynamic Zotero citations and bibliographies in Microsoft Word DOCX files with a protected-source, digest-bound workflow. Use for Word–Zotero citation conversion, static OOXML citation audits, mocked/offline validation, Refresh authorization/report review, UI-evidence contracts, run recovery, or rollback proposals; never perform live Word/Zotero integration without separate explicit authorization.