Security

hairyf-skills Bundle

Cross-loader Minecraft Java mod development workflow — audit project context, mine vanilla implementations, follow the standard implementation checklist, and debug/fix defects. Use before or during any Minecraft mod feature work (Fabric, NeoForge, or Forge); pairs with the `fabric` skill for loader APIs and the `geckolib` skill for animation APIs.

hairyf-skills Bundle

OpenAPI (Swagger) 2.0 specification for describing REST APIs. Use when writing, validating, or interpreting Swagger 2.0 specs, generating clients/docs, or working with path/operation/parameter/response/schema/security definitions.

hairyf-skills Bundle

OpenAPI Specification 3.2 — write and interpret OpenAPI descriptions (OAD), paths, operations, parameters, request/response, schema (JSON Schema 2020-12), security, and extensions. Use when authoring or validating OpenAPI 3.2 documents.

cacr92 Bundle

Install Claude skills from GitHub repositories with automated security scanning. Triggers when users want to install skills from a GitHub URL, need to browse available skills in a repository, or want to safely add new skills to their Claude environment.

joellewis Bundle

Guide the design and maintenance of recordkeeping programs under SEC Rules 17a-3, 17a-4, and 204-2. Use when the user asks about document retention schedules, how long to keep trade records or customer complaints, WORM storage requirements, email or text message archiving, social media capture, BYOD compliance policies, or electronic storage audit trails. Also trigger when users mention 'we got an exam request for records', 'migrating to a new archiving vendor', 'blotter retention', 'order ticket requirements', 'off-channel communications', 'WhatsApp archiving', or ask how long specific records must be kept.

joellewis Skill

Design and manage reference data systems — security master, client master, account master, identifier mapping, pricing data sources, golden source designation, and governance. Use when building or evaluating a security master database, mapping identifiers across systems (CUSIP to ISIN, SEDOL to FIGI), designing client master models for onboarding or KYC, defining account master attributes across custodians, designating golden sources and MDM patterns across systems, establishing a pricing vendor hierarchy with fallback order, establishing reference data governance and stewardship, handling identifier changes from corporate actions, or troubleshooting issues traced to missing or changed identifiers. Trigger on: security master, CUSIP, ISIN, SEDOL, FIGI, client master, account master, pricing data, reference data, golden source, MDM, master data, identifier mapping, data governance, vendor hierarchy.

joellewis Skill

Guide BSA/AML compliance program design, ongoing transaction monitoring, and FinCEN reporting for broker-dealers, banks, and investment advisers. Use when the user asks about suspicious activity reports, currency transaction reports, OFAC screening, structuring detection, ongoing risk-rating reviews and escalation, or FinCEN requirements. Also trigger when users mention 'large cash deposit', 'sanctions check', 'money laundering red flags', 'unusual transaction patterns', 'wire to a foreign country', 'SDN list', 'tipping off a client about a SAR', 'AML audit', 'correspondent account due diligence', or ask whether a transaction needs to be reported. (For onboarding identity verification, CIP/CDD, beneficial ownership, and initial customer risk rating, use know-your-customer.)

joellewis Bundle

Prepare for and respond to SEC and FINRA regulatory examinations across the full exam lifecycle. Use when the user asks about exam notification letters, document request lists, deficiency letter responses, mock examination programs, annual compliance reviews under Rule 206(4)-7, or SEC/FINRA examination priorities. Also trigger when users mention 'we just got an exam letter', 'preparing for our first SEC exam', 'how to respond to a deficiency finding', 'staff interview preparation', 'what does OCIE look for', 'examination readiness checklist', 'sweep exam on off-channel comms', or ask what to expect during a regulatory audit.

joellewis Bundle

Guide the design and implementation of order lifecycle management in trading systems. Owns FIX application-layer message flows (NewOrderSingle, ExecutionReport, cancel/replace) and order state. Use when building an order state machine for an OMS or EMS, handling cancel/replace race conditions, defining pre-submission validation rules (buying power, position limits, restricted lists), selecting order types and time-in-force instructions, designing multi-leg or OCO or bracket orders, building CAT-compliant audit trails, troubleshooting order rejections or unexpected state transitions, hardening an OMS against edge cases, or implementing order persistence and recovery for failover. Also covers execution-report handling, ClOrdID chaining, and partial fill aggregation. For FIX session management (logon, sequence gaps, disconnects) see exchange-connectivity.

joellewis Skill

Execute a complete tax-loss harvesting workflow from candidate identification through post-harvest monitoring. Use when the user asks about finding TLH candidates, gain/loss budgeting, replacement security selection, wash-sale compliance, or harvest execution planning. Also trigger when users mention 'unrealized losses in my portfolio', 'swap ETFs for tax purposes', 'harvest losses before year-end', 'substantially identical security', 'wash-sale window', 'NIIT offset', 'loss carryforward', or ask how much tax they can save by harvesting.

joellewis Bundle

Guide the design and implementation of automated pre-trade compliance systems that validate orders before execution. Use when building a compliance rule engine for an RIA or broker-dealer, configuring hard blocks and soft blocks, maintaining restricted and watch lists including MNPI-driven restrictions, setting concentration limits at security/sector/issuer level, implementing position limits or short selling controls, enforcing wash sale detection or free-riding prevention or pattern day trader identification, applying client-specific ESG screens or legal constraints, designing compliance override workflows with authorization and documentation, backtesting compliance rules, or evaluating compliance check latency impact on execution quality.

joellewis Bundle

Turn a retirement portfolio into sustainable lifetime income: sequence-of-returns risk, the 4% rule and its assumptions, Guyton-Klinger-style guardrails, RMD calculation from the Uniform Lifetime Table, Social Security claiming math (early reduction, delayed credits, breakeven age, survivor benefits), gap-year bracket-filling with Roth conversions, bucket strategies vs total-return, and SPIA annuitization as longevity insurance. Use when the user asks about a 'safe withdrawal rate', 'when should I claim Social Security', a 'guardrails strategy', 'sequence of returns risk', or 'how much can I spend in retirement'. Also trigger on RMD amounts or missed-RMD penalties, Social Security breakeven analysis, '4% rule', 'bucket strategy', retirement paycheck design, drawdown or decumulation planning, and whether to buy an annuity. For accumulation-side savings math, see savings-goals; for asset location and tax mechanics, see tax-efficiency.

joelhooks-joelclaw Skill

Operate Joel's Obsidian Vault through the joelclaw CLI. Use when reading ADRs/projects, searching notes, listing PARA sections, or auditing ADR hygiene with `vault adr` commands. Triggers on: 'check the vault', 'read ADR', 'find this note', 'vault search', 'ADR collisions', 'ADR audit', 'decision inventory', or any Vault command task.

joelhooks-joelclaw Skill

Audit and maintain the joelclaw skill inventory. Use when checking skill health, fixing broken symlinks, finding stale skills, or running the skill garden. Triggers: 'skill audit', 'check skills', 'stale skills', 'skill health', 'skill garden', 'broken skill', 'skill review', 'fix skills', 'garden skills', or any task involving skill inventory maintenance.

eachlabs Bundle

Reduce noise and grain from videos using each::sense AI. Denoise low light footage, remove high ISO grain, enhance security camera video, restore old footage, and improve webcam quality.

glebis Skill

Audit the Claude Code ecosystem — skill health and staleness, project activity pulse, CLAUDE.md instruction drift, Mac Mini service status. Use this skill whenever the user asks about ecosystem health, stale skills, abandoned projects, system status, infrastructure check, "what's broken", "what's stale", "how's my setup", or any request to review the state of their Claude Code environment. Also triggers on "/ecosystem", "audit my ecosystem", "ecosystem health", "ecosystem audit".

glebis Bundle

Interactively prepare a code repository for publication — LICENSE, NOTICE, AUTHORSHIP, README sections, package metadata, .gitignore, community docs (CONTRIBUTING/CODE_OF_CONDUCT/SECURITY/CHANGELOG), .github templates (issues/PR/CI/dependabot), a promo "more from the author" block, and conditional EU/Germany legal compliance (CRA, AI Act, GDPR, Impressum, product liability). Includes a dedicated authorship wizard that documents human decisions, judgment, direction, and art direction with jurisdiction-aware legal framing. Use when setting up a new repo for release, adding missing legal/meta/community files, writing an AUTHORSHIP record for AI-assisted work, or asking "prepare this repo for GitHub / open-sourcing".

glebis Skill

Pre-consultation diagnostic questionnaire for clients building websites with AI tools (Claude, Codex, Cursor, Bolt, v0, etc.) who have concerns about quality, design, or maintainability. Collects structured answers about their project, tools, pain points, and goals, then generates a consultation brief. Use when preparing for a website review consultation, when a client asks for a site audit, or when someone says their AI-built site has problems. Supports Russian and English — asks the client to choose language first.

glebis Bundle

Run a corpus-scale, STATS-ONLY PII audit over a folder of session transcripts LOCALLY and produce an aggregate report — counts by type and by layer, the per-session redaction-rate distribution, document lengths, and a coarse residual proxy. Use when the user says "audit my sessions", "scan folder for PII", "how much PII across these transcripts", "PII stats for my corpus", "is my redaction holding at scale", or points at a directory of transcripts and asks how much personal data it contains. Fully local — raw text never leaves the machine; the report carries ZERO PII values, transcript substrings, or filenames (only anonymized own-NN ids and counts), so the aggregates are safe to surface. Run it on a RED (raw) corpus to size the PII, or on a GREEN (already-redacted) corpus to check residual leakage.

glebis Bundle

This skill should be used for elimination-style research where the user wants to choose from a shortlist of products, tools, services, vendors, or other options using explicit criteria, numeric evidence, tournament-style comparison, source/domain classification, image-supported consumer reports, raw data tables, and ownership-cost estimates for replaceable parts. Use this skill whenever the user asks to compare options, buy something, shortlist candidates, rank alternatives, generate a "don't make me think" report, or produce a full audit report with raw numeric data.

julianobarbosa Bundle

Master advanced Git workflows including rebasing, cherry-picking, bisect, worktrees, and reflog to maintain clean history and recover from any situation. Use when managing complex Git histories, collaborating on feature branches, or troubleshooting repository issues.

julianobarbosa Bundle

Run a premortem on any plan, launch, product, hire, pricing change, strategy, or high-stakes decision. Uses Gary Klein's prospective-hindsight method — assume it already failed at a future date and work backward to surface every plan-specific cause, then produce a revised plan, mitigations, early-warning signals, and a pre-launch checklist. USE WHEN premortem this, run a premortem, what could kill this, future-proof this, stress test this plan, what am I missing here, find the blind spots, what could go wrong, am I missing anything, poke holes in this, where will this break, before I commit to this. NOT FOR adversarial attack on an arbitrary idea or argument (use RedTeam), current-state multi-perspective debate (use Council), network/system vulnerability testing (use Security), or simple feedback/factual questions. DO trigger when someone has a concrete plan or commitment where the cost of being wrong is high and the decision is still changeable.

julianobarbosa Skill

Get code review from Codex AI for implementation quality, bug detection, and best practices. Use when asked to review code, check for bugs, find security issues, or get feedback on implementation patterns.

nickcrew Skill

Review test quality and audit test coverage for any module. This skill should be used when reviewing existing tests, auditing test gaps, writing new tests, or when asked to assess test health. It pipelines testing standards into the audit workflow to produce a prioritized gap report. The output is a report, not code — do not write test implementations until the report is reviewed.

nickcrew Skill

Meta-skill for auditing and validating skill quality. Use when reviewing skills for consistency, completeness, accuracy, and adherence to standards. Provides structured rubrics, scoring frameworks, and actionable recommendations.

nickcrew Bundle

Systematic documentation audit and maintenance. This skill should be used when documentation may be stale, missing, or misorganized — after feature work, refactors, dependency upgrades, or as a periodic health check. It prescribes folder structure for docs/ and manual/, dispatches haiku subagents for codebase/doc scanning, and routes doc creation to specialized agents (reference-builder, technical-writer, learning-guide) with docs-architect as quality gate.

nickcrew Bundle

Regulatory compliance auditing across GDPR, HIPAA, PCI DSS, SOC 2, and ISO frameworks with automated evidence collection and gap analysis. Use when conducting compliance assessments, preparing for certifications, or implementing regulatory controls.

nickcrew Skill

Orchestrate a full documentation health audit across five dimensions: structural health, semantic accuracy, topic completeness, prose quality, and information architecture. Runs each phase in dependency order with phase gating. This skill should be used for pre-release audits, periodic health checks, or comprehensive documentation assessments.

nickcrew Bundle

CQRS and Event Sourcing patterns for scalable, auditable systems with separated read/write models. Use when building audit-required systems, implementing temporal queries, or designing high-scale applications with complex domain logic.

nickcrew Bundle

Audit documentation completeness by mapping what a doc set should cover against what it actually covers. Produces a prioritized gap report by topic, not just by file. This skill should be used after shipping features, before releases, or when users report missing documentation.

nickcrew Bundle

Secure coding practices and defensive programming patterns for building security-first applications. Use when implementing authentication, handling user input, managing sensitive data, or conducting secure code reviews.

nickcrew Bundle

Security testing patterns including SAST, DAST, penetration testing, and vulnerability assessment techniques. Use when implementing security testing pipelines, conducting security audits, or validating application security controls.

nickcrew Bundle

Threat modeling methodologies using STRIDE, attack trees, and risk assessment for proactive security analysis. Use when designing secure systems, conducting security reviews, or identifying potential attack vectors in applications.

podo Bundle

Identify, categorize, and prioritize accumulated design inconsistencies and structural problems. Debt taxonomy, audit process, Severity×Frequency/Effort scoring, debt register.

podo Bundle

Audits codebases and product copy for deceptive dark patterns inferable from local source code and text — no runtime inspection or screenshots needed. Produces a structured narrative report with confidence grading, source locations, concise reasoning, and official pattern reference links for each detected pattern. Covers pricing, subscriptions, consent, modals, preselected controls, misleading CTAs, and more.

podo Bundle

Audit Core Web Vitals and render-blocking resources. Official Cloudflare skill for identifying and fixing LCP, INP, CLS, TTFB issues with Cloudflare-specific optimization strategies.