Security

reflexioai Skill

Rigorous code review of all uncommitted changes. Analyzes architecture, code quality, security, and engineering best practices. Embeds questions and assumptions inline, then summarizes all proposed changes as a plan for user approval before any edits are made.

trevors Bundle

Sync this Claude Code config against the shipped product — find config features added since the pinned baseline that this config should adopt, and audit silently-validating surfaces (themes, settings) for keys that are missing, dropped, or invalid. Use when Claude Code has been updated, when the user asks what's new / what changed / whether to adopt new settings or hooks, after a version bump, when checking config currency, or when a custom theme or settings block looks stale or isn't taking effect. Reports adoptable settings/hooks/env-vars/permissions plus schema drift as a risk-tiered proposal, then bumps the baseline. Do NOT use for judging whether config is well-shaped, debugging hooks, or organizing rules — that is `maintaining-claude-code`.

trevors Bundle

Audit and improve Claude Code hooks, rules, and settings.json. Use when adding/debugging a hook, organizing rules, auditing settings.json (permissions, env vars, stale flags), or deciding between hook vs skill vs rule vs CLAUDE.md. For SKILL.md authoring use the skill-creator plugin; for CLAUDE.md audits use the claude-md-improver plugin.

inselfcontroll Skill

Expert for codebase-wide code reviews. Use when auditing Pull Requests, refactoring complex logic, or enforcing architectural and security standards across the ecosystem.

inselfcontroll Skill

Acts as a Code Quality Enforcer to audit and refactor code, enforcing guard clauses and reducing cognitive load. Use when auditing code, refactoring complex logic, or enforcing project standards.

aimskr Bundle

코드 리뷰, PR 리뷰, 품질 리뷰, 성능 리뷰, code review - Expert at reviewing code for quality, adherence to architectural principles, security, and performance. Use when reviewing PRs, verifying code quality before merge, or auditing implemented features. Do NOT use for initial implementation or debugging.

diegocconsolini Bundle

Use when applying the same security fix across many files or repos at once — large-scale vulnerability remediation. Provides 7 copy-paste /batch recipes (XSS, HTTPS, SQLi, input validation, log PII, secret rotation, CVE patches) each with a safety tier and false-positive trap, plus scan_diff.py to prove the migration introduced no new HIGH/CRITICAL findings.

diegocconsolini Bundle

Use this skill to seed Claude Code's auto-memory with pre-built security/compliance patterns — known-safe code patterns, false-positive suppressions for the plugin-security-checker, org compliance rules, and supply-chain best practices. Helps Claude apply consistent security judgment across sessions.

aimskr Bundle

보안, 보안 리뷰, 보안 검토, 취약점, 보안 분석, OWASP, 인증, 인가, 취약점 점검 - Systematic security analysis based on OWASP Top 10. Reviews code for vulnerabilities, designs auth/authz systems, and produces severity-classified reports. Use when auditing security, designing authentication, or pre-deployment security checks. Do NOT use for general code quality reviews (use code-reviewer) or debugging (use debug-specialist).

jmerta Bundle

Use when the user asks to update documentation after code or configuration changes, audit documentation drift, or prepare README, API, runbook, or release docs. Changes only affected documentation and verifies examples, links, contracts, and operational steps against source code.

jmerta Bundle

Use when the user asks to draft release notes, changelog entries, or GitHub Release text from commits, tags, branches, or merged pull requests. Resolves an exact Git range and surfaces breaking changes, migrations, security impact, and upgrade steps.

ricardoroche Skill

Automatically applies when managing Python dependencies. Ensures proper use of uv/Poetry, lock files, version constraints, conflict resolution, and dependency security.

jmerta Bundle

Use when the user asks to list, audit, prune, or delete local or remote Git branches, especially stale, merged, gone-upstream, protected, worktree-bound, or open-PR branches. Identifies safe candidates and performs only explicitly authorized cleanup.

jmerta Bundle

Use when the user asks to update, bump, or migrate Java, Kotlin, Gradle, Maven, Node, or TypeScript dependencies; audit direct or transitive dependencies for CVEs or security advisories; or remediate a dependency vulnerability. Preserves the package manager, applies small verified upgrades, and checks vulnerability, release-age, and supply-chain risk.

jmerta Bundle

Use when the user asks for a pre-PR or diff security and privacy review, especially for authentication, authorization, tenant isolation, public endpoints, webhooks, payments, secrets, logs, personal data, files, exports, or observability access. Reports only reachable regressions introduced or materially changed by the diff.

sergebulaev Skill

Repurpose existing content into a native X (Twitter) post or thread. Take a LinkedIn post, blog, YouTube script, or newsletter and rewrite it for X: re-hook for the no-fold first line, refit to 280 chars or a thread, strip off-platform artifacts, run the humanizer, publish via Publora on approval. Not for writing from scratch (use x-post-writer or x-thread-builder), not for auditing a draft (use x-humanizer --mode audit).

sergebulaev Bundle

Draft a single tweet or short auto-thread for X (Twitter) using a 2026 X hook formula (one-liner contrarian, data-point, build-in-public, mini-list, relatable cold-open), picked by goal (replies, reposts, likes, bookmarks). Respects the 280-char limit (25,000 on Premium), runs the humanizer pass, and publishes via Publora on approval. Use to write a tweet from notes. Not for long threads (use x-thread-builder) or auditing a draft (use x-humanizer --mode audit).

jander99 Bundle

Configure, implement, secure, validate, and audit Spring Security with SecurityFilterChain, JWT validation, OAuth2 resource server, method security, and CORS. Use when adding authentication, authorization, or protecting REST APIs.

sergebulaev Bundle

Build a long-form X (Twitter) thread (tweetstorm) using a 2026 thread formula (listicle-thread, story thread, curiosity-gap opener, how-I teardown), picked by goal (bookmarks, likes, reposts, replies). Structures tweet 1 as a promise plus open loop, paces one beat per tweet, and closes for the repost. Publishes via Publora, which auto-splits long content into a numbered (1/N) thread. Not for single tweets (use x-post-writer) or auditing a draft (use x-humanizer --mode audit).

sergebulaev Skill

Audit and rewrite an X (Twitter) profile end-to-end for 2026: bio (160 chars), display name with a searchable keyword, @handle, header image, pinned tweet, link, and location. Triggers on "review my X profile", "fix my bio", "rewrite my Twitter bio", "optimize my header", "pin the right tweet", "X profile audit". Turns a default profile into one that converts visitors into followers. Not for writing tweets (use x-post-writer).

foxj77 Skill

Use when Kyverno policies are blocking resource creation, when ClusterPolicy or Policy resources show errors, when audit results are unexpected, when mutations are not applying, when generate rules fail, or when admission webhook errors occur

leynos Bundle

Generate, modify, or audit `.codescene/code-health-rules.json` files that control CodeScene's code health scan behaviour. Use this skill whenever the user wants to customize CodeScene rule weights, disable specific smells, adjust metric thresholds, scope rules to test vs application code, apply language-specific overrides, or add in-source `@codescene` directives. Also trigger when the user asks why a CodeScene rule is firing, or wants to suppress a smell across a repo or folder subtree.

dmitryprg-ai Bundle

Review code for quality, security, and maintainability. Use when reviewing pull requests, examining code changes, doing QA checks, architecture review, or CTO review. Also trigger for COMPLEX tasks affecting more than 5 files, API contract changes, or data migrations.

reggiechan74 Skill

This skill should be used when the user asks to "show audit trail", "why did we make this decision", "what happened after this", "trace this decision", "show decision history", "search audit log", or needs to understand the decision history and rationale behind code changes verified through coherence check.

rbozydar Bundle

This skill should be used when building PreToolUse, PostToolUse, SessionStart, or other hook types for Claude Code plugins. It provides patterns, security best practices, and configuration guidance.

rbozydar Bundle

Audit and trim Claude Code instruction setups that have grown bloated over time. Use when outputs feel worse, rules have accreted across CLAUDE.md/skills/context files, or you want a recurring setup hygiene check.

satoshistackalotto Bundle

Greek social security (EFKA) integration — employee records, contribution calculations, APD declarations. Human approval for submissions.

gannonh-kata-skills Bundle

Verify milestone achievement against its definition of done, checking requirements coverage, cross-phase integration, and end-to-end flows. Triggers include "audit milestone", "verify milestone", "check milestone", and "milestone audit". This skill reads existing phase verification files, aggregates technical debt and gaps, and spawns an integration checker for cross-phase wiring.

gannonh-kata-skills Bundle

Create phases to close all gaps identified by milestone audit. Triggers include "plan milestone gaps", "plan gaps".

doodledood Bundle

Consults external AI models (100+ via LiteLLM) for complex analysis. Use for architectural review, security audit, deep code understanding, or when extended reasoning is needed. Runs async with session management.

bang-isme Bundle

Use for security review, audit, hardening, compliance, DevSecOps, network, infrastructure, or application security with focused references.

arosenkranz Bundle

Pin GitHub Actions from mutable tags (e.g., @v4) to immutable commit SHAs to prevent supply chain attacks. Use when editing .github/workflows files, hardening CI security, looking up action SHAs, pinning actions to specific commits, or replacing "uses: owner/repo@tag" references with SHA-pinned equivalents.

dralgorhythm Skill

Audit a codebase holistically for SOLID, DRY, and consistency violations — a user-invoked Codebase Auditor workflow.

dralgorhythm Skill

Run an adversarial, multi-perspective code review with root-cause analysis and security focus — a user-invoked Adversarial Reviewer workflow.

dralgorhythm Skill

Assess vulnerabilities and audit for security compliance using OWASP and STRIDE methodology — a user-invoked Security Auditor workflow.

nimrodfisher Bundle

Track and document analytical assumptions and decisions. Use when making analytical choices, documenting trade-offs, ensuring transparency, or creating audit trails for analytical work.