Security

pedrohcgs Skill

Read-only R code review protocol for `.R` scripts. Checks code quality, reproducibility, domain correctness, tidyverse idioms, and professional standards; produces a report without editing. Use when user says "review this R script", "check the R code", "audit the analysis code", "code review on the R", or when an R file is touched as part of a paper submission. NOT for running the code — pair with `/audit-reproducibility` for numeric verification.

pedrohcgs Bundle

Comprehensive adversarial audit of a theory, proof, math/econ paper, codebase, or set of claims — decompose into components, fan out independent skeptics that must return CONCRETE defects, adjudicate every finding with a separate judge, fix all confirmed defects, then re-verify. Use when correctness must be bulletproof and single-pass or round-by-round review is too slow and too shallow. Invoke for "audit this rigorously", "find ALL the bugs/gaps", "make this rock solid", "converge faster on correctness".

pedrohcgs Skill

Adversarial visual-layout audit of a Quarto `.qmd` or Beamer `.tex` deck. Flags overflow, font inconsistency, box fatigue, spacing, and alignment issues. Use when user says "visual audit", "check the layout", "does this overflow?", "look for visual issues", "audit the slides", or after reworking a deck's appearance. Does NOT check writing or pedagogy — pair with `/proofread` or `/pedagogy-review`.

pedrohcgs Skill

Multi-agent comprehensive slide review (visual + pedagogy + proofreading, plus TikZ / parity / substance conditionally). Use when user says "full review", "excellence pass", "comprehensive check", "review everything", "pre-release review", "slide excellence", or before teaching / shipping a deck. Fanout wrapper — for a single lens, use `/visual-audit`, `/pedagogy-review`, or `/proofread` directly.

pedrohcgs Bundle

Enforce the replication-protocol.md rule by cross-checking numeric claims in a manuscript against the actual R / Stata / Python outputs. Report PASS/FAIL per claim against tolerance thresholds. Use before submission and before releasing a replication package.

armanzeroeight Bundle

Configures SSL/TLS certificates, implements secure protocols and ciphers, and sets up security headers. Use when setting up HTTPS, SSL certificates, TLS configuration, or web security hardening.

armanzeroeight Skill

Analyzes project dependencies for known security vulnerabilities using npm audit, pip-audit, or similar tools. Use when auditing packages, checking for CVEs, or updating vulnerable dependencies.

armanzeroeight Skill

Detects hardcoded secrets, API keys, passwords, and credentials in source code. Use when checking for leaked secrets, credential exposure, or before committing code.

armanzeroeight Skill

Audit API security for OWASP Top 10 vulnerabilities, authentication issues, and authorization flaws. Use when securing APIs, fixing security vulnerabilities, or implementing security best practices.

armanzeroeight Bundle

Scans code for security vulnerabilities, identifies CVE patterns, and provides severity ratings with remediation guidance. Use when scanning for security issues, code vulnerabilities, or OWASP top 10 problems.

armanzeroeight Bundle

Validates CloudFormation templates for syntax, security, and best practices. Use when validating CloudFormation templates, checking for security issues, or ensuring compliance with best practices.

rooseveltadvisors-claude-agent-stack Bundle

Structured OSINT investigations — people lookup, company intel, investment due diligence, entity/threat intel, domain recon, organization research using public sources with ethical authorization framework. USE WHEN OSINT, due diligence, background check, research person, company intel, investigate, company lookup, domain lookup, entity lookup, organization lookup, threat intel, discover OSINT sources.

rooseveltadvisors-claude-agent-stack Bundle

Security news from tldrsec, no.security, Krebs, Schneier, and other sources. USE WHEN security news, security updates, what's new in security, breaches, security research, sec updates, tldrsec, Krebs, Schneier.

rooseveltadvisors-claude-agent-stack Bundle

Aggregate and analyze annual security reports from major vendors — extract trends, compare threat landscapes year-over-year, produce synthesized threat intelligence summaries. Fetch, list, and update report sources. USE WHEN annual reports, security reports, threat reports, industry reports, vendor reports, threat landscape, fetch report, list sources, update sources.

gate Bundle

gate-dex CLI market & token data skill: K-line, liquidity, trading stats, token info, security audit, rankings, new listings, chain config, and raw RPC. Read-only; no signing. Use this skill whenever the user asks for on-chain market data, token info, or security audits via the gate-dex CLI. Trigger phrases include K-line, token price, market cap, token risk, honeypot check, token rankings, new tokens, liquidity, tx stats, chain config, rpc.

gate Bundle

Token and address risk assessment. Use this skill ONLY when the user's query is exclusively about token/contract/address security with no other analysis dimensions. Trigger phrases: is this token safe, check contract risk, is this address safe, honeypot, rug. If the query ALSO mentions fundamentals, technicals, news, sentiment, or any other analysis dimension, use gate-info-research instead — it handles multi-dimension queries in a single unified report. Address risk mode (is this address safe) is exclusive to this skill and must NOT be routed to gate-info-research.

snqb Bundle

Make any web app a 100% installable PWA. Covers manifest, icons, service worker, Apple meta/splash, offline, Lighthouse audit. Use when adding PWA support, fixing install prompts, or debugging Lighthouse PWA score.

snqb Bundle

Use when working with Payload CMS projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Triggers: collection definitions, field configs, hooks, access control, queries, custom endpoints, auth, uploads, drafts/versions, live preview, plugins. Also for debugging validation errors, security issues, relationship queries, transactions, or hook behavior.

gate Bundle

Single-coin comprehensive analysis. Use this skill ONLY when the user asks to analyze one coin with no additional explicit dimension (e.g., no separate risk check, no separate trend-only request). Trigger phrases: analyze SOL, how is BTC, is ETH worth buying. If the query ALSO mentions security/risk, event attribution, multi-coin comparison, or any other analysis dimension beyond single-coin comprehensive, use gate-info-research instead — it handles multi-dimension queries in a single unified report.

dmccreary Bundle

Generates a status report of all diagrams and MicroSims across an intelligent textbook's chapters, including difficulty, Bloom's level, and UI complexity. Use to audit visualization coverage before a content review.

blakeox Skill

Zero-assumption dependency audit. Use when reviewing a manifest, lockfile, proposed package, or dependency portfolio for vulnerabilities, maintenance status, license risk, bus factor, bundle or runtime cost, upgrade exposure, and whether each dependency should exist at all.

blakeox Skill

Evidence-backed, blameless incident postmortem. Use after an outage, security event, failed deployment, data incident, or material near miss to reconstruct the timeline from git, deploys, metrics, and logs; identify technical and control failures; and define owned corrective actions.

blakeox Skill

Zero-assumption test-suite audit focused on real confidence rather than coverage percentage. Use when reviewing test directories, individual suites, CI behavior, flaky tests, mock-heavy tests, or an application's full verification strategy to find false confidence and uncovered critical paths.

blakeox Skill

Zero-assumption developer-experience audit. Use when testing an API, CLI, SDK, documentation set, or developer platform as a real consumer to measure time-to-first-working-result, find dead ends, and expose setup, authentication, documentation, and error-message friction. Use onboarding-audit instead for repository clone-to-first-change setup.

blakeox Skill

Orchestrate multiple specialist reviews against one target and synthesize a prioritized, deduplicated verdict. Use when a pre-merge review, deep audit, project-health check, post-incident review, test overhaul, design audit, or operational-risk review genuinely needs several independent review skills or subagents.

blakeox Skill

Paranoid staff-engineer code review for production risk that ordinary CI misses. Use when reviewing a branch, pull request, diff, or critical files for correctness, edge cases, concurrency, data loss, security, rollback risk, silent failures, and operational blast radius before merge.

blakeox Skill

Evidence-backed security review that traces concrete exploit and abuse paths across trust boundaries. Use when reviewing authentication, authorization, admin actions, uploads, parsers, webhooks, secrets, sensitive data, exposed APIs, background jobs, or other surfaces where an attacker or careless operator could gain access, escalate privilege, alter data, or cause material harm.

blakeox Skill

Practical delivery reviewer for APIs, dependencies, and developer experience. Bundles API review, dependency audit, and onboarding audit. Use for public/internal APIs, package changes, setup friction.

blakeox Skill

Zero-knowledge repository onboarding audit. Use when testing whether a new developer can clone, configure, understand, run, test, and safely change a project without tribal knowledge, undocumented credentials, external searches, or hidden setup steps.

blakeox Skill

Security and trust-boundary specialist. Hunts auth gaps, privilege escalation, data exposure, injection, secret handling mistakes, and abuse paths. Use for exposed surfaces, auth changes, admin flows, uploads.

kbanc85 Skill

Show everything Claudia knows with provenance tracing and entity counts. Triggers on "what do you know?", "show memories", "memory audit", "what do you remember about". See also: `memory-health` for system-level stats and data quality; `diagnose` for connectivity troubleshooting.

kbanc85 Skill

Check memory system health and data quality. Use when user asks "how's my memory?", "system health", "memory stats", "data quality", "how's my brain?", or for periodic self-diagnostics. See also: `memory-audit` for content-level provenance; `diagnose` for daemon connectivity issues.

wojons Bundle

Think and act like an attacker to identify security vulnerabilities, weaknesses, and penetration vectors through adversarial security testing

wojons Bundle

Build defensive security capabilities, implement security by design, and practice ethical hacking to protect systems proactively

spjoshis Skill

Master Spring Boot with auto-configuration, REST APIs, JPA, security, testing, and production-ready features for enterprise applications.

spjoshis Skill

Master threat modeling with STRIDE, attack trees, risk assessment, and identifying security threats in systems and applications.