Security

shipshitdev Bundle

Audits a whole private repository once, at the decision to make it public. Runs four passes — license and attribution, secrets across the entire git history, private references (internal hostnames, employee emails, client and customer names, staging URLs), and publication readiness — then returns a publish or block verdict. Use when the user is preparing to open source a repository, asks whether a codebase is safe to publish, wants a pre-release audit before flipping a repo public, or needs to know what is still private in code that is about to ship publicly.

shipshitdev Skill

Audit the skills library for duplicates, stale content, spec violations, and structural issues. Run periodically or before releases.

shipshitdev Bundle

Keep a project's verification skill and feature map honest. Parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for maintain-verification-skill or audit the verify skill.

laurigates Bundle

Run all infrastructure standards checks and fixes. Use when onboarding a new project, doing a full compliance audit, or batch-fixing with --fix.

laurigates Bundle

Code review for quality, security, performance, and architecture. Use when reviewing code, auditing OWASP, checking SOLID, or finding perf bottlenecks and test gaps.

laurigates Bundle

Audit skill tree for overlap, split-pressure, and consolidation candidates. Use when finding confusing skill clusters or surfacing REFERENCE.md extraction candidates.

laurigates Bundle

Audit dependencies for security vulnerabilities, outdated packages, and license compliance. Use when checking supply chain security, preparing releases, or responding to CVEs.

laurigates Bundle

Audit skills, commands, and agents for agentic output compliance — optimization tables, bare CLI commands. Use when batch-checking skill documentation quality.

laurigates Skill

macOS EndpointSecurity/EDR high CPU & battery drain. Use when Kandji ESF / XProtect pegs a core; trace the exec storm via powermetrics + eslogger.

laurigates Bundle

Security scanning: dependency automation, SAST, secrets detection. Use when setting up Renovate/Dependabot, CodeQL, or TruffleHog in CI, or creating a SECURITY.md policy.

laurigates Bundle

Analyze a codebase for anti-patterns using ast-grep. Use when finding magic numbers, console.logs, var usage, excessive any, eval/innerHTML security issues, or deep nesting.

laurigates Skill

Dockerfile standards: Alpine/slim base, non-root user, multi-stage builds. Use when creating a Dockerfile, hardening security, or auditing image size.

laurigates Skill

Bun lockfile update (bun.lock): bun update, regeneration, security audits. Use when updating dependencies, resolving lockfile conflicts, or regenerating bun.lock.

laurigates Skill

Checklist for security, correctness, and performance review. Use when reviewing PRs, checking for secrets/injection, verifying error handling, or auditing N+1 queries.

laurigates Skill

Claude Code security settings: permission wildcards, shell operator protections, project-level allowlists. Use when auditing or hardening .claude/settings.json permissions.

laurigates Bundle

release-please workflow file, manifest, and config for a single-package repo — setup and compliance audit. Use when adding release-please or upgrading release-please-action.

laurigates Skill

Generate a .worktreeinclude so Claude Code copies gitignored env/secret/config files into new worktrees. Use when worktrees miss .env or local config.

laurigates Skill

Route to specialized agents (security, test, refactor, docs) based on codebase health attributes by severity. Use when the user has attribute data and wants automated remediation.

laurigates Bundle

Verify accumulated bug claims at upstream HEAD and dedup against trackers before filing issues. Use when filing upstream reports from backlogs, audit docs, or git-history findings.

thebushidocollective Skill

Use when implementing secure secrets management with Fnox. Covers encryption, key management, access control, and security hardening.

thebushidocollective Skill

Use when implementing SIP authentication, security mechanisms, and encryption. Use when securing SIP servers, clients, or proxies.

thebushidocollective Skill

Use when auditing GraphQL operations for complexity metrics, depth analysis, directive usage, or query performance concerns.

proffesor-for-testing Bundle

Use when working on security-sensitive code to catch secrets, eval(), innerHTML, and other dangerous patterns before they're written. Activate with /security-watch for real-time security scanning.

proffesor-for-testing Skill

AI-assisted pair programming with multiple modes (driver/navigator/switch), real-time verification, quality monitoring, and comprehensive testing. Supports TDD, debugging, refactoring, and learning sessions. Features automatic role switching, continuous code review, security scanning, and performance optimization with truth-score verification.

proffesor-for-testing Skill

Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices.

proffesor-for-testing Bundle

Review Agentic QE changes and issue an evidence-backed quality verdict. Use for code review, regression-risk assessment, release readiness, quality-gate evaluation, security/performance/testability review, or checking whether a change has sufficient verification. Do not use when the user primarily asks to implement a feature.

proffesor-for-testing Bundle

Credential exposure detection, OAuth flow validation, API key management testing, and data sanitization verification for n8n workflows. Use when validating n8n workflow security.

proffesor-for-testing Skill

Security auditing, vulnerability scanning, and compliance validation for OWASP, SOC2, GDPR, and other standards.

iii-hq Skill

WebSocket listener that SDK workers connect to. Use to expose the engine to trusted (internal) and untrusted (RBAC-protected) workers, gate function and trigger registration, and audit or transform every invocation through a middleware function. Mounts channel WebSocket endpoints on every listener.

bighardperson Bundle

Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to interact with external services. Security: The MATON_API_KEY authenticates with Maton.ai but grants NO access to third-party services by itself. Each service requires explicit OAuth authorization by the user through Maton's connect flow. Access is strictly scoped to connections the user has authorized. Provided by Maton (https://maton.ai).

bighardperson Bundle

Design, analyze, and optimize cold outbound email campaigns for Instantly. Handles end-to-end ICP definition, expert panel scoring (recursive to 90+), sequence copywriting, infrastructure audit, capacity planning, and implementation docs. Use when asked to build cold outbound sequences, optimize cold email, analyze outbound campaigns, build sales sequences, build Instantly sequences, create cold outbound strategies, or design email campaigns. Supports both "start from scratch" and "optimize existing" modes.

bighardperson Bundle

腾讯云鼎实验室出品，Skill安全审查工具。对用户指定的skill.md文件及其配套的文档、程序、脚本等进行全面安全审计，确保引用安全

aaaaqwq Bundle

Perform static architecture, dependency, license, and interface assessment of the pinned cv-cat/Spider_XHS repository and design a compliant replacement or integration boundary. Use only when the user explicitly names Spider_XHS, its PC/Creator/KOL/Qianfan APIs, or asks to audit that repository. Do not use to run its login, signing, scraping, proxy, fingerprint, anti-detection, invitation, upload, or publishing capabilities.

aaaaqwq Bundle

Audit, install in an isolated environment, or prepare the `sau` CLI for dreammis/social-auto-upload across Douyin, Kuaishou, Xiaohongshu, and Bilibili. Use only when the user explicitly names social-auto-upload, SAU, or asks for its login, cookie-check, video-upload, note-upload, or scheduled-publishing CLI. Do not trigger for drafting content, generic platform help, or publishing through official browser/API tools.

organvm-iv-taxis Bundle

Dry-run audit + targeted cleanup for shell command history. Currently wraps atuin (stats today, prune, dedup with dated preview artifacts); extensible to zsh/bash/mcfly backends. Always previews before applying — apply commands are echoed for the human to run, never auto-executed. Triggers on "/shell-history-hygiene", "audit atuin", "audit shell history", "clean shell history", "atuin prune", "atuin dedup", "shell history hygiene", "history cleanup". Replaces ad-hoc one-liners (e.g. `... | tee cmd > file.txt` which wrote two files, swallowed dedup output, and left a junk `cmd` file).

organvm-iv-taxis Bundle

Comprehensive quality verification system for code changes with build, type, lint, test, and security checks