Security

gabrielmoreira Bundle

Create backend test plans for APIs, services, databases, auth, integrations, and background jobs. Use when Codex is asked to define unit, integration, contract, migration, security, performance, or regression tests for backend changes.

gabrielmoreira Skill

Score product remarkability 1-10 to decide if it's worth promoting. Seth Godin's Purple Cow test. Triggers on: "is this product worth promoting", "should I promote", "product audit", "purple cow", "remarkable product", "is it remarkable", "rate this product", "product quality check", "worth my reputation", "product evaluation", "would I recommend without commission", "product remarkability score", "evaluate this affiliate product", "quality gate for promotion".

gabrielmoreira Bundle

Expert Australian Information Security Manual (ISM) advisor for government entities and their supply chains. Use for ISM control selection, gap analysis, system authorisation, IRAP assessment preparation, security documentation, and ASD compliance. Triggers on: ISM controls, ASD compliance, IRAP assessment, PROTECTED system scoping, Essential Eight vs ISM, system authorisation, NC/OS/ PROTECTED/SECRET/TOP SECRET classification markings, security objectives, ISM guidelines or chapters, control applicability markings, cybersecurity documentation for Australian government, and any question about the ASD Information Security Manual framework or Australian government cybersecurity obligations.

gabrielmoreira Skill

Verify compliance with OWASP Top 10 2021 security standards. Use when performing OWASP compliance checks and security certification.

gabrielmoreira Skill

Diagnoses GitHub Dependabot / security alerts in the Medusa monorepo and finds the least-invasive fix. Use when investigating a Dependabot alert, security advisory (GHSA/CVE), vulnerable dependency, "npm audit" finding, or a security update PR. Traces the vulnerable package to the exact affected workspace package(s) under packages/, assesses real impact, and prefers a fix scoped to the affected package over a root package.json / yarn.lock resolutions override (which is a last resort).

gabrielmoreira Bundle

Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI

gabrielmoreira Skill

Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle.

gabrielmoreira Bundle

40-item CITE domain audit: citation, impact, trust, entity scoring with veto checks. 域名权威/网站可信度

gabrielmoreira Skill

Map an organisation's risks against its insurance policy portfolio to find what's uncovered, underinsured, or double-covered. Use when asked to run a coverage gap analysis, review an insurance programme against a risk register, check what risks aren't insured, or audit a policy portfolio. Produces a risk-by-coverage matrix, flagged gaps and overlaps, a deductible stack review, and recommendations ranked by expected-loss severity.

gabrielmoreira Skill

Audit your desk setup and fix what's hurting your neck, back, wrists, or eyes — with specific, mostly-free adjustments before you buy anything. Use when asked to check my desk setup, ergonomics help, my [wrists/neck/back] hurt from my desk, or how to set up my workstation. Produces a point-by-point setup check (chair, screen, keyboard, mouse, lighting), the specific fixes ranked free-first, cheap upgrades only if needed, and micro-break habits — with a 'see a professional for persistent pain/numbness' flag.

gabrielmoreira Skill

Review a product/codebase for internationalization readiness before you localize. Use when asked if a product is ready to localize, to review i18n readiness, find hard-coded strings/locale bugs, or prep for going multilingual. Produces a readiness audit — externalized strings, locale-aware formatting, layout/expansion, encoding/RTL, and a prioritised list of i18n fixes to make before translation starts.

gabrielmoreira Skill

Evaluate a new tool before it joins the stack — the problem-first framing (tools answer needs, not demos), the trial designed with success criteria upfront, the stack-fit check (integration, overlap, the tool-sprawl tax), and the security/data review sized to the stakes. Use when asked should we buy this tool, evaluate this software for the team, we have three tools that do this already, or run a proper trial before committing. Produces the need statement, the trial design with pre-set criteria, the stack-fit audit, and the adopt/decline verdict with its reasoning.

gabrielmoreira Skill

The improvement skill. Understand the ask, examine the target, challenge the first read, decide on one change (or argue for redesign, or declare silence), honor the operator's supervision or delegation boundary, act, reflect, record, and report the result clearly. USE WHEN: improve, audit, review, fix, refactor, redesign, evaluate, what would make this better, am I missing something.

gabrielmoreira Skill

Independent power-user audit of a big new-feature PR. Research the feature domain from external sources before reading any implementation code, design the ideal test suite from a power-user's perspective, then gap-compare it against the PR to produce evidence-backed, precedent-linked review items. Use when a large feature PR (new provider API surface, new modality, new subsystem) needs an unbiased second opinion grounded in what the underlying APIs and real integrators require. Not a diff review.

gabrielmoreira Bundle

Dependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

gabrielmoreira Bundle

Perform a full codebase review, categorize findings by severity, file GitHub issues, then fix each issue in an isolated git worktree and submit PRs. Use this skill when the user asks to audit the codebase, do a comprehensive code review, find and fix security/quality/reliability issues, or run a proactive health check across the entire repository.

gabrielmoreira Skill

Exhaustive security assessment with maximum coverage, depth, and vulnerability chaining

gabrielmoreira Skill

Audit and remediate an open GitHub PR's review feedback: verify Copilot and Codex actually reviewed, drive every unresolved thread to a fix-or-justify reply, correct PR title/description drift against the real diff, and run a one-time self-review pass. Trigger on "have all PR comments been addressed", "did copilot and codex review this", "reply to the PR comments", "address the PR feedback", "is this PR ready to merge", "clean up this PR before merging", "make sure nothing got missed on this PR" — and on generic "review comments" mentions, on single-bot mentions, and when prepping a new PR for review before comments exist. Not a fresh review of an unpushed working diff; that's `/code-review`.

gabrielmoreira Skill

Manage DefenseClaw enterprise security - scan components, manage tool permissions, view alerts, configure guardrails

gabrielmoreira Skill

Prevent secret leakage across git history, package artifacts, logs, and docs. Use when editing workflows, packaging configuration, environment files, or release automation.

gabrielmoreira Skill

Validate skill files for structural compliance and behavioral correctness. Three modes: static (linter), spec (behavioral), audit (coverage report).

gabrielmoreira Bundle

Use this skill when users need to get, create, edit, delete, or manage Salesforce Sharing Rules metadata. TRIGGER when: users mention sharing rules, record sharing, criteria-based sharing, role-based sharing, guest user sharing, sharingRules, sharingCriteriaRules, sharingGuestRules, sharingOwnerRules, .sharingRules-meta.xml files, or ask to share records with specific roles or groups. Also trigger when users want to retrieve or view existing sharing rules from an org, modify or remove existing sharing rules, or update sharing rule criteria or access levels. DO NOT TRIGGER when user needs permission sets or profiles (use platform-permission-set-generate), or needs object-level security rather than record-level sharing (use platform-permission-set-generate).

gabrielmoreira Skill

Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.

gabrielmoreira Bundle

Use when you need to design, review, or improve REST APIs with Quarkus REST (Jakarta REST) — including resource classes, HTTP methods, status codes, request/response DTOs, Bean Validation, exception mappers, optional runtime OpenAPI exposure (SmallRye), contract-first generation from OpenAPI, content negotiation, pagination, sorting and filtering, API versioning, idempotency (Idempotency-Key), optimistic concurrency (ETag / If-Match), HTTP caching (Cache-Control), API deprecation (Sunset / Deprecation headers), RFC 7807 Problem Details, ISO-8601 for time in contracts, and security-aware boundaries. This should trigger for requests such as Review or improve JAX-RS resources in a Quarkus project; Design HTTP APIs with validation and error handling on Quarkus; Add API versioning, idempotency, ETag concurrency, or deprecation headers; Implement pagination, sorting, or RFC 7807 Problem Details error responses; Improve Quarkus REST resources and exception mappers. Part of Plinth Toolkit

gabrielmoreira Bundle

Use when reviewing Java enterprise evidence for MiFID II investment services, investment activities, client classification, suitability, appropriateness, order-handling evidence, best-execution evidence, algorithmic-trading governance evidence, market-access governance evidence, transaction evidence, record keeping, monitoring, or compliance-owner handoff. This should trigger for requests such as Review a Java investment-service platform for MiFID II evidence; Assess suitability, appropriateness, order-handling evidence, or best-execution evidence; Document audit, monitoring, or clock-synchronisation gaps for algorithmic-trading governance; Assess investment-service engineering evidence before production release. Part of Plinth Toolkit

gabrielmoreira Bundle

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

gabrielmoreira Bundle

Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like "we need to get audited", "a customer asked for our security report", "writing an information security policy", or "preparing for an audit". Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams.

gabrielmoreira Skill

Dung khi da co ket qua audit va can lap plan content ky sau TU DATA chu khong doan — ty le 70 giu winner, 20 toi uu bien the, 10 thu nghiem moi, toi da 2 gia thuyet moi mot ky. Kich hoat khi user nhac 'next content plan', 'plan thang toi', 'content ky sau lam gi', 'dua vao data lap ke hoach', 'thang sau viet gi'. Khong dung cho — audit de biet cai gi work thi chay skill 39-content-audit truoc; xep lich dang theo ngay thi dung skill 01-lich-noi-dung.

gabrielmoreira Skill

Audit whether the organisation's AI spend actually paid — measured against baselines, not vendor math or vibes. Use when a CFO asks what the AI tools returned, when renewing AI contracts, when consolidating overlapping AI subscriptions, or to build the measurement plan before the next spend. Produces an ROI audit with per-tool verdicts (keep/consolidate/cut), the honest-measurement method behind each number, and a baseline plan for whatever can't be scored yet. To forecast ROI before an investment use roi-estimator; this skill measures what already happened.

gabrielmoreira Skill

Run a self-audit of a food establishment before the health inspector arrives, focused on the violations that actually close kitchens. Use when asked to prep for a health inspection, do a food-safety self-audit, avoid critical violations, or get ready for the health department. Produces a prioritized checklist organized by risk (critical/priority vs. non-critical), the temperature and hygiene fundamentals, a fix list with owners, and how to handle the inspector on the day.

gabrielmoreira Skill

Audit driver hours records for the violations that actually get cited — the falsification patterns, the edit trails, and the scheduling that makes compliance impossible — and fix the causes rather than the logs. Use when asked to audit hours of service, review driver logs, check tachograph or ELD records, prepare for an hours compliance review, or reduce hours violations. Produces the violation summary by type and severity, the falsification-pattern review, the scheduling root-cause analysis, the driver-level and systemic actions, and the audit trail. Rules and limits are jurisdiction-specific and must be verified against current regulation.

gabrielmoreira Skill

Set up a sane password and two-factor-authentication baseline that's genuinely secure and actually sustainable — a password manager, unique passwords where it counts, and 2FA on what matters. Use when asked to improve my password security, set up a password manager, how do I use 2FA, or make my accounts more secure. Produces a prioritized rollout (secure the crown-jewel accounts first), a password-manager setup, a 2FA plan by method strength, backup-code and recovery safeguards, and a realistic order so it gets done, not abandoned.

gabrielmoreira Skill

Audit the recurring meetings a team has accreted — each standing slot tested against its original purpose, current attendance reality, and outcomes, with keep/shrink/merge/kill verdicts and the two-week cancellation experiment that settles arguments. Use when asked audit our recurring meetings, our calendar is all standing syncs, which meetings should die, or reset the team's meeting load. Produces the inventory with per-meeting verdicts, the experiment protocol, the merge map, and the re-accretion guard.

gabrielmoreira Bundle

Run a third-party / vendor security review and assign a risk tier with required controls. Use when asked to assess a vendor's security, run a third-party risk assessment, complete a security questionnaire about a vendor, or decide what due diligence a new tool needs. Produces a vendor risk assessment — a data/access-driven risk tier, the questionnaire focus, required evidence (SOC 2, pen test, DPA), residual risk, and an approve/conditional/reject recommendation.

gabrielmoreira Skill

Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks "what endpoints can I clean up?", "are any of my endpoints broken?", "which materialised versions are still being called?", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.

gabrielmoreira Bundle

Audit a design-award submission package against the current official rules for a specific award cycle. Check required materials and technical constraints, cross-material facts and claims, rights and disclosure risks, and final submission readiness. Use when a user asks for a pre-submission check, compliance review, missing-material audit, consistency check, or final go/no-go decision. Do not use this skill to choose an award, retrieve winners, judge the design itself, rewrite the whole entry, or give a legal clearance opinion.