Security

podo Bundle

Runs WCAG 2.2 audits combining automated testing, manual verification steps, and prioritised remediation guidance. Covers perceivability, operability, understandability, and robustness criteria across web interfaces.

podo Bundle

Designer Who Codes: visual audit followed by atomic commits fixing each issue. Garry Tan's design review skill — treats UI like code, identifies and fixes design debt systematically.

aws Bundle

Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400) or z/OS mainframe (ADB2GEN, Q Replication), choosing code page/collation (EBCDIC, CCSID), S3 backup/restore, Multi-AZ and cross-region standby replicas, RDSADMIN procedures, customer-managed KMS BYOK, self-managed Active Directory Kerberos, Db2 audit to S3, minimum IAM, or colocation.

bytedance Bundle

火山云通信隐私号 Skill. 管理 AXB / AXN / AXNE / AXG 等绑定关系生命周期, 不负责发起呼叫. 用户表达「绑定隐私号」「中间号」「号码保护」「解绑」「查绑定关系」时调用.

bytedance Bundle

Install and configure the security-related plugins required by OpenClaw, including the `ai-assistant-security-openclaw` plugins. Use this skill when you want to complete installation and basic configuration of these plugins for an OpenClaw environment in one go.

bytedance Bundle

Byted Security Llmscanner

posthog Bundle

Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.

rshankras Bundle

Senior developer-level release review for macOS/iOS apps. Identifies security, privacy, UX, and distribution issues with actionable fixes. Use when preparing an app for release, want a critical review, or before App Store submission.

rshankras Bundle

Guides you through comprehensive iOS/Swift app planning and analysis. Use for new apps (concept to architecture) or existing apps (audit current state, plan improvements, evaluate tech stack). Covers product planning, technical decisions, UI/UX design, and distribution strategy.

rshankras Bundle

Game feel ("juice") for Apple apps — celebration choreography, haptic vocabulary design, sound-effect layers, and the event×channel feedback audit. Use when big moments fall flat, when designing haptics or SFX, or when auditing whether every meaningful event actually reaches the user.

rshankras Skill

Audits skills in this repo for consistency, API drift, and structural gaps. Produces a prioritized report grouped by severity (Critical/High/Medium/Low). Use when asked to "audit skills", "check the skill repo for drift", or when planning bulk skill cleanup. Read-only — does not apply fixes.

rshankras Bundle

Generates GDPR/CCPA/DPDP privacy consent flows with granular category preferences, consent state persistence, audit logging, and ATT (App Tracking Transparency) integration. Use when user needs privacy consent UI, cookie/tracking consent, or compliance management.

rshankras Skill

Privacy manifest (PrivacyInfo.xcprivacy) implementation including required reason APIs, tracking domains, third-party SDK declarations, and App Tracking Transparency. Use when preparing apps for App Store privacy requirements.

secondsky-claude-skills Bundle

XSS attack prevention with input sanitization, output encoding, Content Security Policy. Use for user-generated content, rich text editors, web application security, or encountering stored XSS, reflected XSS, DOM manipulation, script injection errors.

secondsky-claude-skills Bundle

Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout. Use when upgrading deps, configuring security policies, or preventing supply chain attacks.

secondsky-claude-skills Bundle

REST API security hardening with authentication, rate limiting, input validation, security headers. Use for production APIs, security audits, defense-in-depth, or encountering vulnerabilities, injection attacks, CORS issues.

secondsky-claude-skills Bundle

Cloudflare Workers security with authentication, CORS, rate limiting, input validation. Use for securing APIs, JWT/API keys, or encountering auth failures, CORS errors, XSS/injection vulnerabilities.

connorads Bundle

Systematically audit, improve, and enforce test coverage, and gate test quality in CI - across any ecosystem (TypeScript, Python, Go, Rust). Use to raise coverage, set thresholds, audit gaps, manage exclusions, merge reports, wire coverage into CI/hooks, or add mutation testing and fuzzing as quality gates. Composes with the hk skill for pre-commit enforcement. For how to design and write good tests - property-based, snapshot/approval, differential, contract, flaky-test handling - use the testing skill.

connorads Bundle

Harden software supply chains across ecosystems (npm/pnpm/bun/yarn/aube, uv/pip, Cargo, GitHub Actions/aqua) by reasoning about what installing or importing a dependency actually executes, then choosing controls: release-age quarantine gates, install-script and load-time trigger removal, lockfile pinning and checksums, provenance/SLSA verification, and osv-scanner malware detection. Use when hardening a project or machine/global config (new or incremental); when converting age-gate settings/units between package managers; when a gate fires mid-task - a blocked install or build script, an age-gate or provenance refusal, a slopsquatted or unfamiliar package - and you must decide whether to allowlist; when adding a dependency you have not vetted; or when auditing a suspected compromised package. For linter rules, gitleaks, and zizmor use the mechanical-enforcement skill; for wiring checks into git hooks use the hk skill; for code-level vulnerability review of your own code use security-review.

connorads Bundle

Create, update, validate, and submit Homebrew Casks (macOS and Linux/AppImage). Use when the user mentions Homebrew cask/cask, Homebrew/homebrew-cask, adding a new cask, updating a cask, cask token naming, sha256, url verified:, livecheck, zap/uninstall, AppImage/app_image, on_linux/on_macos, cross-platform cask, or when asked to run brew style/audit for a cask.

connorads Bundle

Create, update, validate, and submit Homebrew formulae (homebrew-core, built from source). Use when the user mentions a Homebrew formula, Homebrew/homebrew-core, adding/updating a formula, brew create, building from source, a build system in a brew context (cargo/rust, go, cmake, meson, autotools/configure, make, python virtualenv, node/npm, ruby gem), resource blocks, depends_on/keg_only/uses_from_macos, the mandatory test do block, bottles, livecheck, brew bump-formula-pr, or when asked to run brew audit --new / brew test / brew style for a formula. For macOS GUI apps and prebuilt binaries use the homebrew-cask-authoring skill instead.

gracefullight Bundle

SCM (software configuration management) and Git: branching, merges, conflicts, worktrees, baselines, audit readiness, plus Conventional Commits and safe staging.

anthropics-knowledge-work-plugi Skill

Document a business process — flowcharts, RACI, and SOPs. Use when formalizing a process that lives in someone's head, building a RACI to clarify who owns what, writing an SOP for a handoff or audit, or capturing the exceptions and edge cases of how work actually gets done.

garrytan-gbrain Bundle

Everything In Its Right Place. The universal post-work organizer. After any significant work session, EIIRP runs a 7-phase audit: (1) inventory every output, (2) walk taxonomy to decide where each lands, (3) check schema-pack consistency against the brain's actual shape, (4) file enriched brain pages, (5) audit the skill graph for DRY+MECE, (6) verify resolvability, (7) report. Named after the Radiohead song. Nothing produced during significant work lives only in chat — knowledge becomes permanent, patterns become reusable. Also carries the always-on auto-fire gate: when >=500 words of structured analysis on a user-shared document is about to be delivered, file the brain page first, then deliver the analysis with the link in that same reply.

garrytan-gbrain Skill

Brain health checks: back-link enforcement, citation audit, filing validation, stale info detection, orphan pages, and benchmarks. Use when asked to check brain health, run maintenance, or audit quality.

garrytan-gbrain Bundle

Audit and fix citation formatting across brain pages. Ensures every fact has an inline [Source: ...] citation matching the standard format. Extended in v0.25.1: scans for broken tweet/post references that lack actual URLs and resolves them via the host's X / Twitter API integration.

garrytan-gbrain Bundle

Extract a sanitized shared team/company brain from a personal brain. Strips internal ratings, compensation, performance assessments, retention and political dynamics from pages, takes, and facts across the full scan scope (people, companies, meetings, dailies, cross-references — not just people/), verifies with grep + retrieval passes, and purges sensitive git history behind the data-loss-gate confirmation card. Also runs as a report-only re-audit on an existing shared brain.

josiahsiegel Bundle

This skill should be used when bootstrapping, auditing, or reviewing the community-health and repository-cornerstone files in a code repository: README, LICENSE, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, SUPPORT, issue / PR templates, CODEOWNERS, FUNDING, CITATION, and REUSE / SPDX metadata. PROACTIVELY activate on "set up new repo docs", "community health files", "what should my README contain", "do I need a code of conduct", "audit repo bootstrap docs", "repository documentation cornerstones", "pick a license", "CONTRIBUTING.md", "SECURITY.md", "vulnerability reporting", "SUPPORT.md", "CODEOWNERS", "issue templates", "PR templates", "CITATION.cff", "REUSE", "SPDX headers", "Standard Readme", "Contributor Covenant". Provides: four-question diagnostic per cornerstone, Standard Readme structure, license routing (no picking), CONTRIBUTING / CODE_OF_CONDUCT / SECURITY / SUPPORT canons, template files, and REUSE 3.3 / SPDX routing.

josiahsiegel Bundle

This skill should be used to retroactively record an architectural decision that was made in the past but never written up as an ADR — typically surfaced by a doc audit or by a user realising a long-ago shipped change should have been documented. PROACTIVELY activate on "backfill ADR", "retroactive ADR", "post-hoc ADR", "reconstruct an ADR from history", "write up a past decision", "we never documented this decision", "decision was made but no ADR exists", "we decided years ago", "back when", "before my time", or "the audit surfaced a backfill candidate." Tense rule: `adr-drafting` claims "we decided / we're deciding"; `adr-backfill` claims "we decided years ago / back when / before my time / never wrote it down." Refuses when reconstruction confidence is `low` -- routes to `open-questions.md`. Requires evidence in two independent locations and a verbatim honesty clause in the record. Provides: backfill ADR template, confidence rubric, evidence corroboration, honesty-clause boilerplate.

josiahsiegel Bundle

This skill should be used when deciding whether a doc should exist, where it belongs, whether something is really an ADR, or whether an architectural decision is missing from the record. PROACTIVELY activate on "should this be an ADR?", "where should I document X?", "is this architecturally significant?", "ADR vs RFC vs design doc vs runbook", "Diátaxis", "audit docs folder", "clean up the decision log", "doc drift", "doc governance", "ADR template selection", "Nygard vs MADR vs Y-statement", "missing ADR", "missing decision record", "undocumented architecture", "implicit decision", "historical documentation clutter", "inherited repo", "large legacy repo", "architecture archaeology", "code archaeology", "scan for decision records", "find decisions not captured in ADRs." Provides: doc placement diagnostic, alternatives catalog, ADR canon, folder audit procedure, and BACKFILL-ADR candidate detection.

josiahsiegel Skill

Unity game modding architecture and mod-loading systems. PROACTIVELY activate for: (1) adding modding support to a Unity game, (2) Asset Bundles for mods, (3) Addressables for mod content, (4) Lua scripting via MoonSharp, (5) Harmony patching for runtime IL injection, (6) Steam Workshop integration, (7) mod manager UI, (8) plugin architecture for user-generated content (UGC), (9) custom content loading at runtime, (10) sandboxing and security for untrusted mods. Provides: AssetBundle vs Addressables tradeoffs, MoonSharp setup, Harmony patch patterns, Steam Workshop SDK integration, mod manager templates, and security guidelines.

josiahsiegel Bundle

Git security best practices for 2025-2026 (signed commits, zero-trust, secret scanning). PROACTIVELY activate for: (1) configuring signed commits (GPG, SSH, S/MIME), (2) verifying commit signatures, (3) zero-trust Git workflows, (4) secret scanning (GitHub Advanced Security, gitleaks, trufflehog), (5) preventing secret leaks via pre-commit hooks, (6) protected branches and required reviewers, (7) CODEOWNERS for sensitive paths, (8) Sigstore-style attestations, (9) detecting and remediating leaked credentials, (10) supply-chain security (provenance, SBOM, SLSA). Provides: signed commit setup, secret-scanning integration, pre-commit hook templates, branch protection patterns, and incident-response checklist for credential exposure.

josiahsiegel Skill

Security-first bash scripting patterns for 2025 (mandatory validation, zero-trust). PROACTIVELY activate for: (1) reviewing or writing security-sensitive bash scripts, (2) preventing command injection via input validation, (3) safely handling untrusted input (URLs, filenames, env vars), (4) protecting HISTFILE and avoiding secret leakage, (5) safe temporary file creation (mktemp), (6) absolute paths and PATH hardening, (7) avoiding eval and dynamic command construction, (8) signal handling for cleanup, (9) ShellCheck SC2068 / SC2086 compliance. Provides: mandatory-validation patterns, secret-handling rules, mktemp recipes, signal-safe cleanup, and a security review checklist.

josiahsiegel Skill

Modern PowerShell security practices for 2025 — SecretManagement, JEA, WDAC, credential protection. PROACTIVELY activate for: (1) Microsoft.PowerShell.SecretManagement and SecretStore for credential storage, (2) Just Enough Administration (JEA) endpoints, (3) Windows Defender Application Control (WDAC) for PowerShell, (4) credential protection (PSCredential, SecureString, DPAPI), (5) module signing and Authenticode signatures, (6) ConstrainedLanguage mode, (7) audit logging (transcription, ScriptBlock logging, module logging), (8) AMSI integration, (9) AppLocker rules for PowerShell, (10) supply-chain security (PSGallery trust, package hash verification). Provides: SecretManagement setup, JEA configuration, WDAC policy templates, signing workflow, and audit-logging configuration.

josiahsiegel Bundle

This skill should be used when the user asks to run isolated or untrusted code on Modal.com. PROACTIVELY activate for: modal.Sandbox, safe user code execution, coding playgrounds, named sandboxes, PTY sessions, filesystem snapshots, timeout and resource limits, egress policies, sandbox lifecycle cleanup, terminate(), and security review for code execution. Provides: sandbox security checklist, lifecycle and cleanup patterns, egress/resource-limit recipes, and snapshot/PTY usage examples.

josiahsiegel Bundle

This skill should be used when the user asks about TUI widgets, forms, dialogs, tables, trees, charts, command palettes, split panes, scrollbars, validation, state management, Elm/MVU architecture, async message passing, configuration, packaging, distribution, terminal security, escape-sequence injection, paste sanitization, or production hardening. PROACTIVELY activate for: widget design, validation, virtual scrolling, config/keybinding files, XDG paths, packaging, secure terminal output, and release readiness. Provides: widget contracts, state patterns, config, security, and distribution checklists.