Security

nintendadev Bundle

Perform a code review on {{engine_name}} {{engine_code_language}} code. Checks for bugs, security issues, performance problems, and best practices against the project's coding rules, design principles, and framework-specific conventions. Supports four modes — staged changes, a pull request, a commit range, or individual files. Use when the user says "review code", "check my code", "code review", "review PR", "review staged changes", "review these commits", or "is this code okay". Optional +check flag validates findings via a fresh-context subagent.

camoa Skill

Use before committing code - validates code against SOLID, DRY, security, and purposeful-code principles (stack-neutral). Trigger: 'check code quality', 'pre-commit check', 'validate standards', 'review this'. Use proactively before any commit. The concrete stack linters are the code-quality-tools plugin's job; the framework-specific implementation rules come from the resolved implement recipe.

priivacy-ai Bundle

Review a fully merged Spec Kitty mission post-merge (all WPs done/approved) to verify spec→code fidelity, FR coverage, drift, risks, and security. Triggers: "review the merged mission", "post-merge mission review", "verify the completed mission", "audit the mission implementation", "mission-level acceptance review", "is this mission releasable", "final review before tagging", "cross-WP coverage audit". Does NOT handle: per-WP review during implementation (use spec-kitty-runtime-review), implement-review loop orchestration (use spec-kitty-implement-review), setup or repair (use spec-kitty-setup-doctor), or glossary maintenance (use spec-kitty-glossary-context).

camoa Skill

Runs honest fresh-context review of a Drupal contribution — dispatches isolated reviewer agents with no session narrative to check the work against scope, coding standards, security, and the AI policy. Use when the user runs /drupal-ai-contrib:review or asks for an honest review, a fresh-eyes review, or a pre-submission review of a Drupal contribution. A builder cannot objectively review its own work.

priivacy-ai Skill

Orchestrate a multi-repo, multi-mission Spec Kitty program end-to-end: run specify → plan → tasks → implement → review → merge → mission-review → post-merge fixes across several repositories in a defined dependency order, using background sub-agents for parallel work and a pulse-heartbeat safety net for long uninterrupted runs. Triggers: "ship this program across N repos", "orchestrate a cross-repo release", "run the full mission workflow on repos A/B/C in program order", "drive Decision Moment V1 across all repos", "multi-repo spec-kitty sprint". Does NOT handle: single-mission implement-review loop (use spec-kitty-implement-review), post-merge mission audit (use spec-kitty-mission-review), setup or repair (use spec-kitty-setup-doctor), per-WP review (use spec-kitty-runtime-review).

evanca Bundle

Use when asked to review a PR, MR, branch, or diff, audit changed files, or check code quality.

evanca Skill

Use when setting up Storage, uploading/downloading files, managing metadata, handling errors, or applying security rules.

evanca Skill

Use when syncing real-time data, structuring JSON trees, reading/writing, creating listeners, enabling offline persistence, managing presence, sharding, or writing security rules.

hiroro-work Bundle

Scan installed plugins and skills for security risks including malicious code AND malicious natural language instructions. Use /security-scanner to audit before installation.

markusstrasser Bundle

Use when: why/root-cause, confounder, regression, ACH, DAG adjustment, weakest-link. Lenses: null, causal, dag, hypotheses, audit, stop. NOT ideation (/brainstorm).

evanca Skill

Use when setting up Data Connect, writing GraphQL queries/mutations, configuring generated SDKs, handling offline, or applying security rules.

miroapp Bundle

Use when the user wants to create a visual code review on a Miro board from a pull/merge request (GitHub, GitLab, or any forge), local uncommitted changes, or a branch comparison — produces a file-changes table, summary/architecture/security docs, and architecture diagrams, then links them back from the PR/MR.

hypnguyen1209 Bundle

Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation

markusstrasser Bundle

Use when: /observe, session quality, what to fix next, biggest lever, codebase audit. Modes: sessions supervision drift retro failures blindspot harvest maintain lever audit conventions.

hypnguyen1209 Skill

Use when about to record, claim, rate the severity of, or report any security finding — before marking anything [CONFIRMED] or writing it into the report

hypnguyen1209 Bundle

Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation

hypnguyen1209 Bundle

Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox

hypnguyen1209 Bundle

Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI

hypnguyen1209 Bundle

Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains

hypnguyen1209 Skill

Use when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon, exploitation, or reporting)

silvainfm Bundle

Calculate Monaco payslips (bulletin de salaire) with social security contributions, taxes, and net salary. Use when user requests Monaco payslip calculations, salary breakdowns for Monaco employees, or needs to compute Monegasque employer/employee contributions.

sk-labs Bundle

Web application testing principles. E2E, Playwright, deep audit strategies.

bcastelino Skill

Audit rapidly generated or AI-produced code for structural flaws, fragility, and production risks. Use when evaluating prototype or AI-generated code for production readiness.

sk-labs Skill

Code review guidelines covering code quality, security, and best practices.

sk-labs Skill

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

sk-labs Bundle

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

pvillega Skill

CLAUDE.md + engram memory lifecycle management. Generates structured reflections, reviews and applies them to CLAUDE.md, consolidates CLAUDE.md health, and maintains engram memory hygiene. Triggers ONLY on: /reflect, /reflect review, /reflect consolidate, or explicit requests like "prune CLAUDE.md", "review my engram memories", "consolidate CLAUDE.md", "audit CLAUDE.md health", "write a session reflection for REFLECTION.md". DO NOT trigger on casual uses of "reflect on X", "let's reflect", or "what did we learn" outside the context of CLAUDE.md / REFLECTION.md / engram memory hygiene.

pvillega Skill

Deep GitHub Actions operational intuition — concurrency groups, OIDC federation, matrix semantics, composite vs reusable workflows, cache scope, expression injection, pull_request_target footguns, v4 artifact/cache breaking changes. Load for workflow gotchas, security hardening, OIDC setup, cache behavior, runner pinning, or reusable- vs-composite design. Skip for first-time CI workflow authoring. Triggers on: "pull_request_target", "pwn request", "expression injection", "OIDC trust", "reusable workflow", "actions/cache v4", "actions/upload-artifact v4", "GITHUB_TOKEN permissions", "id-token write", "fork PR secrets".

pvillega Skill

Detect the package ecosystem, run outdated/audit commands, propose a staged bump plan (patch → minor → major), regenerate the lockfile, run tests, and summarise breaking changes. Use when the user says "update dependencies", "bump deps", "what's outdated", "cargo update", "pip outdated", "go mod tidy", or "security update deps". Touches only project-local manifests and lockfiles. Never global installs, never commits — returns the diff for user review. Toolchain upgrades (Node/Python/Rust version) are out of scope.

pvillega Skill

Diagnose a failing GitHub Actions run. Fetch the failing job's step logs, correlate with recent commits, and produce a ranked top-3 root-cause hypothesis plus a minimal fix proposal. Use when the user says "CI is failing", "why did the build break", "triage this GHA failure", "workflow failed", "what broke CI", or pastes a `gh run` URL / run ID. Read-only — does NOT apply fixes, restart the run, or tail logs. For workflow-file security audits use gha-security-review; for local test failures use fix-loop.

pvillega Bundle

Use when the user mentions duplicated code, copy-paste, code clones, repeated code, similar code across files, overlapping implementations, code quality audit, code smells, technical debt involving duplication, or refactoring preparation. Also for cross-language duplication checks, CI duplication warnings, and codebase redundancy scans. DO NOT TRIGGER for implementing refactoring (use incremental-refactoring), fixing bugs, writing tests, adding features, or code review.

ancplua Skill

Root-authority, write-capable transformation of a repository you own — the Touch of God as one line. Full rewrite, public-API break, subsystem replacement, and deletion are pre-authorized; compatibility ceremony is skipped because the consumers are CI bots and your own framework. Keeps exactly two brakes: never leak a secret, never run a catastrophic unrecoverable command. Use when you want to transform your own framework end-to-end without permission friction. Invoked as /nihil:raze.

j0kz Skill

Universal security checklist based on OWASP Top 10 for ANY project type or language. Use before deploying to production, handling sensitive data, or processing user input.

ancplua Skill

Analyze, lint, and check a local Claude Code add-on or capability, explain the result, and rank the top fixes first. Use when the user says "audit this", "why did it score that way", "what should I fix first", "validate the manifest", "lint the hooks", or "benchmark the real token usage".

ancplua Skill

Analyze and check a local Claude Code SKILL.md folder: review frontmatter, size, broken links, trigger words, and token budget, then rank the top fixes. Use when the user says "audit this", "why did it score that way", "this is too big", "it is not triggering", or "measure the real token usage".

j0kz Bundle

Comprehensive security vulnerability scanning. Use when checking for OWASP vulnerabilities, scanning for secrets/API keys, auditing dependencies for CVEs, or running pre-commit security checks.