Security

jclfocused Skill

Use when needing to fetch, read, store, or manage secrets and credentials. Triggers on "get secret", "fetch password", "store credential", "1password", "op read", "vault", or when a task requires API keys, tokens, or passwords that might be in 1Password.

kcenon Bundle

Comprehensive security audit covering OWASP Top 10, input validation, authentication, authorization, secret management, dependency vulnerabilities, and injection attack prevention. Use when reviewing security posture, implementing auth flows, handling user input, auditing dependencies, conducting penetration test prep, or before production deployment.

kcenon Skill

Review pull requests with comprehensive analysis covering code quality, security vulnerabilities, performance implications, test coverage, documentation completeness, and architectural impact. Use when reviewing PRs, conducting code reviews, evaluating merge readiness, or assessing change impact across the codebase.

kcenon Skill

Interactive review of stale, flagged, and duplicate memories from the latest audit report. Walks entries one at a time with verify / quarantine / edit / skip choices.

timwukp Bundle

Facilitates sprint planning with security debt baked in: capacity planning from rolling velocity, risk-weighted prioritization balancing feature value against security debt, commitment sizing, and a DevSecOps definition of done. For writing or refining the stories themselves, use user-story-writing instead. Triggers on: "plan the sprint", "sprint planning", "prioritize these stories", "how much can we commit", "balance security debt against features", "sprint capacity".

timwukp Bundle

Analyzes code changes for security vulnerabilities, performance issues, and maintainability concerns. Provides structured feedback with SOLID principle checks and anti-pattern detection. Triggers on: "review this code", "code review", "check my PR", "review my changes".

lttr Bundle

Audit context files (CLAUDE.md, .claude/ tree, READMEs, docs) for broken references and verifiably stale content. Runs a deterministic offline link/path checker first, then a bounded semantic review where every finding must cite evidence. Reports findings; fixes only on request.

lttr Skill

Audit this repo's auto-memory files and suggest promoting each one to a more persistent layer — user or repo CLAUDE.md, an existing or new skill, a settings.json hook, or a checked-in reference doc. Use when the user says "audit memory", "promote memory", "clean up memories", "memory-promote", or wants to move ephemeral memory into durable config.

iuliandita Bundle

· Audit app i18n/l10n: hardcoded strings, locale catalogs, translations, fallback gaps. Triggers: 'i18n', 'internationalization', 'localization', 'locale', 'translate app', 'multilingual', 'add language', 'hardcoded strings', 'next-intl'.

iuliandita Bundle

· Hunt novel vulnerabilities via reversing, patch diffs, fuzzing, and PoCs. Triggers: 'zero-day', '0-day', 'vulnerability research', 'CVE variant analysis', 'patch diffing', 'n-day variant', 'fuzz', 'exploit dev'. Not SAST: security-audit.

iuliandita Bundle

· Audit AI-generated code slop: hallucinated APIs, over-abstraction, duplicate code, test theater, noisy comments. Triggers: 'slop', 'AI-generated code', 'cleanup', 'overengineered'. Not for prose (use anti-ai-prose).

wildwasser Skill

Review pull requests for code quality, security, and conventions. Use when reviewing PRs or preparing code for review.

iuliandita Bundle

· Run exhaustive 5-wave repo audits, persist findings, and generate phased tasks. Triggers: 'deep audit', 'comprehensive audit', 'full audit', 'mega review', 'deep review', 'audit report'. For quick sweeps, use full-review.

iuliandita Bundle

· Review code for correctness: bugs, edge cases, races, leaks, regressions. Triggers: 'review this code', 'code review', 'find bugs', 'check this diff', 'sanity check'. Not for style/slop (anti-slop) or vulnerabilities (security-audit).

iuliandita Bundle

· Run 4 parallel audits: code-review, anti-slop, security-audit, update-docs. Triggers: 'full review', 'four-lens review', 'full repository review', 'code security docs audit', 'review before merge'. For deep coverage, use deep-audit.

iuliandita Bundle

· Audit read-only code slimming: dead/superseded code, unused files, duplicates, wrappers, inert try/catch, copy-per-element functions. Triggers: 'slim codebase', 'dead code', 'unused files', 'dedupe'. Not for bugs or broad reviews.

iuliandita Bundle

· Create/review skills: frontmatter, triggers, overlaps, collection consistency, retrospective updates. Triggers: 'skill creator', 'new skill', 'skill audit', 'skill review', 'update skill library'.

iuliandita Bundle

· Audit code security: OWASP, credentials, auth, access control, supply chain, hardening. Triggers: 'security audit', 'vulnerability scan', 'secret scan', 'OWASP', 'auth review'. Not for offensive work (use lockpick).

tomeraberbach Skill

Audit something against a standard, check every item in scope, and report the findings and the coverage behind them.

stefaniuk Bundle

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.

tomgranot Skill

Audit and remove unused, test, or deprecated forms from HubSpot. Identifies forms with zero submissions, forms not embedded on any page, and test forms left over from development.

tomgranot Skill

Audit and remove unused, empty, or duplicate list definitions from HubSpot. Identifies lists with zero members, lists not used by any workflow or email, and overlapping list criteria.

tomgranot Bundle

Run a comprehensive HubSpot CRM database audit. Analyzes contacts, companies, deals, engagement, data quality, and deliverability. Use when starting a CRM cleanup, onboarding a new client, or performing quarterly health checks.

tomgranot Skill

Inventory the integrations, private apps, and internal tooling that call HubSpot APIs, and flag anything on legacy v1-v4 endpoints ahead of HubSpot's March 30, 2027 end of support. Produces a migration checklist to date-based API versions.

tomgranot Skill

Audit and remove inactive, test, or deprecated workflows from HubSpot. Identifies workflows that have never enrolled contacts, workflows turned off for 90+ days, and test workflows.

tomgranot Skill

Audit and consolidate HubSpot reporting dashboards. Identifies unused, duplicate, or outdated dashboards. Must be performed manually — no dashboard API is available.

stefaniuk Bundle

Run a compliance audit against a technology instruction file, detecting discrepancies, planning workstreams, implementing fixes, and validating quality gates.

stefaniuk Bundle

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.

stefaniuk Bundle

Establish, synchronise, audit, and review an opinionated repository documentation system across entrypoints, architecture, reference, explanation, tutorials, how-to guides, operations, audience indexes, and governance/lifecycle artefacts.

stefaniuk Skill

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

basher83 Bundle

Knowledge and guardrails for the mise + fnox + infisical secrets toolchain, covering secret injection, secret providers, and env var hygiene.

basher83 Bundle

Research-backed skill creation workflow with automated firecrawl research gathering, multi-tier validation, and comprehensive auditing across a 9-phase process from research through final audit, following Anthropic specifications for Claude Code.

tomgranot Skill

Run a comprehensive quarterly CRM audit covering list health, bounce monitoring, data quality, scoring calibration, engagement metrics, and property cleanup. Produces a health report with quarter-over-quarter trend comparison.

tomgranot Skill

Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running /hubspot-audit.

basher83 Bundle

Python JSON parsing best practices covering performance optimization (orjson/msgspec), handling large files (streaming/JSONL), security (injection prevention), and advanced querying (JSONPath/JMESPath).

davidme6-self-learning-skill Bundle

Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to interact with external services. Security: The MATON_API_KEY authenticates with Maton.ai but grants NO access to third-party services by itself. Each service requires explicit OAuth authorization by the user through Maton's connect flow. Access is strictly scoped to connections the user has authorized. Provided by Maton (https://maton.ai).