Security

spjoshis Skill

Master security assessments with vulnerability scanning, penetration testing, security testing, and security audits.

wojons Bundle

Test application security vulnerabilities

spjoshis Skill

Master security documentation with security policies, incident response plans, security procedures, and compliance documentation.

bybren-llc Bundle

Plan and run programs using the SAFe x AI-DLC fusion. Use when turning an audit, epic, or initiative into Linear structure (initiative, projects, milestones, issues, sub-issues), organizing work as Units of Work and Bolts, wiring a dependency DAG, or running a Bolt swarm with a human-in-the-loop gate. Applies when work spans multiple issues and needs cadence, not just a single ticket.

bybren-llc Bundle

Row Level Security patterns for database operations. Use when writing Prisma/database code, creating API routes that access data, or implementing webhooks. Enforces withUserContext, withAdminContext, or withSystemContext helpers. NEVER use direct prisma calls.

wojons Bundle

Use when you need to manage incidents and conduct post-mortem analysis to improve system reliability and security

bybren-llc Bundle

RLS validation, security audits, OWASP compliance, and vulnerability scanning. Use when validating RLS policies, auditing API routes, or scanning for security issues.

citypaul Bundle

Create or audit maintainable diagrams when relationships, sequence, state, hierarchy, or quantitative comparisons are materially clearer visually than in prose. Selects a format the destination actually renders, preserves source authority, validates output, and includes an accessible text explanation.

wojons Bundle

Apply systematic adversarial thinking patterns including devil's advocate, assumption busting, red teaming, and white hat security approaches

bahayonghang Bundle

Create, advise on, or audit academic figures in four modes. advise profiles the data and recommends a chart type when none is fixed. journal-spec creates or reviews publication-ready figures for journal submission specs using matplotlib, seaborn, plotly, industrytslib, or the optional pubfig backend. from-data fills a named paper-style catalog with user data. from-image reproduces an uploaded paper figure as a matplotlib script and 300 dpi PNG. Use for 论文配图, 期刊图, 科研绘图, 审阅投稿图, 用某论文风格画数据, 复现这张图, a named catalog style, 不知道用什么图 / 选图 / 怎么展示这份实验数据, what chart should I use, 投稿前审计图的字号 DPI 与导出合规, pre-submission figure audit, or 参考图筛选 with AgentFigureGallery. An explicit journal target takes precedence over a style or reference image. Exploratory data checks with no publication goal, paper reading, and multi-paper synthesis route to their dedicated skills.

kmshdev Skill

This skill should be used when the user asks to "review code", "analyze architecture", "assess code quality", "audit the codebase", "review PR", or needs read-only code analysis. Provides structured review checklist for organization, error handling, performance, security, and test coverage.

bahayonghang Bundle

Audit or improve repository-scoped Codex AGENTS.md, AGENTS.override.md, configured fallback instructions, and companion code_map.md navigation. Use for effective-chain audits, nested conflicts, stale commands, scoped-guidance gaps, approved updates, 优化 AGENTS.md, 审计 Codex 项目指导, 更新 AGENTS.md, or 生成 code_map.md. Exclude Claude-only guidance, general Codex workflow advice, explanations, ordinary code/docs review, and implicit fully specified trivial edits.

bahayonghang Bundle

Audit and improve the Claude Code context layer — CLAUDE.md guidance files, .claude/rules/ path-scoped rules, and companion code_map.md navigation maps — against Claude 5 context-engineering rules (judgement over rules, progressive disclosure, no cross-layer conflicts). Asks whether to optimize the current repository (default) or the global ~/.claude context. Use when the user asks to check, audit, optimize, rightsize, slim, or restructure CLAUDE.md or Claude context files, mentions nested CLAUDE.md, code_map.md, or context engineering, or says 优化 CLAUDE.md, 审计 CLAUDE.md, 优化上下文, 精简上下文, 生成 code_map (Claude). Not for trivial single-line edits the user has already fully specified.

spillwavesolutions-doc-serve-skill Skill

Cross-phase audit of all outstanding UAT and verification items

alterlab-ieu Skill

This skill should be used when the user asks about "digital ethics", "media ethics", "AI ethics", "platform governance", "misinformation", "disinformation analysis", "act as a digital ethics advisor", "digital ethics mode", "algorithmic bias", "data privacy", "content moderation", "ethical framework", "deepfake", "surveillance", "fact-checking tools", "verification workflow", "platform audit", "ethics stress test", "algorithmic accountability", "informed consent", "digital rights", "tech regulation", or needs expertise in analyzing ethical dilemmas in digital media, AI, and platform ecosystems. Part of the AlterLab FC Skills collection (New Media & Communication department).

spillwavesolutions-doc-serve-skill Skill

Retroactively audit and fill Nyquist validation gaps for a completed phase

spillwavesolutions-doc-serve-skill Skill

Audit milestone completion against original intent before archiving

spillwavesolutions-doc-serve-skill Skill

Create phases to close all gaps identified by milestone audit

jaykim88 Skill

Design access control — RBAC for coarse function-level checks, Postgres Row Level Security (RLS) for row-level data isolation, ABAC pushed to the app/policy layer. Use when adding permissions, building multi-user data access, or when one user can see another's data. Not for establishing who the caller is (use authentication) or tenant isolation specifically (use multitenancy-audit).

shiiman Skill

ローカル変更（未コミット/ステージ済み）を Claude + Codex + security + simplify の 4 観点で並列レビューし統合結果を表示。「ローカルレビュー」「変更をレビュー」「コミット前レビュー」「手元の変更をチェック」「review」などで起動。GitHub の PR ではなく作業中の変更が対象。

thecraighewitt Skill

When the user wants to analyze a YouTube video's performance, review retention data, diagnose low CTR, or understand why a video underperformed or overperformed. Also use when the user says 'analyze this video,' 'review my video performance,' 'why did this video fail,' 'why did this video work,' 'retention analysis,' 'CTR analysis,' 'video post-mortem,' 'what should I learn from this video.' For full channel health check, see channel-audit. For improving future ideas based on learnings, see idea-generation.

jaykim88 Skill

Choose and implement auth correctly — JWT vs session vs OAuth decision, pin allowed algorithms server-side, rotate refresh tokens with reuse detection, avoid the classic JWT pitfalls. Use when adding login, integrating OAuth, or when token handling looks risky. Not for access control / permissions (use authorization) or a broader OWASP audit (use backend-security-audit).

jaykim88 Skill

Choose a tenant isolation strategy (shared-schema+RLS / schema-per-tenant / db-per-tenant), propagate tenant context reliably per request, and keep an append-only audit log. Use when building multi-tenant SaaS, when tenants could see each other's data, or when compliance needs an audit trail. Not for per-user (non-tenant) access control (use authorization) or general OWASP review (use backend-security-audit).

thecraighewitt Skill

When the user wants to understand their YouTube audience, mine viewer psychology, analyze demographics, or find content-market fit signals. Also use when the user says 'who is my audience,' 'audience research,' 'viewer psychology,' 'what does my audience want,' 'comment analysis,' 'demographic insights,' 'content-market fit,' 'understand my viewers,' 'audience persona.' For channel-level health check, see channel-audit. For generating ideas from audience insights, see idea-generation.

jaykim88 Skill

Audit a backend against the OWASP API Security Top 10 — BOLA/BFLA, injection, secrets, mass assignment — with an exploit scenario per finding. Use when adding auth/external input, before shipping, or on a quarterly security review. Not for implementing auth from scratch (use authentication / authorization) — each finding maps to its sibling skill for the fix.

caphtech Bundle

セキュリティ観測。認可漏れ、インジェクション、機密漏えい、暗号誤用、依存脆弱性を検出。Use when: 認証/認可実装、外部入力処理、依存更新、コミット前チェック、セキュリティレビューして、脅威分析が必要な時。

fr-e-d Skill

Detect security vulnerabilities and governance violations across delivered code, configurations, and deployed environments. Activate after implementation or periodically as a governance check.

duncan-buildroom Bundle

Find 3 to 5 concrete ways to make more money from the customers you already have, without more traffic, more followers, or a bigger audience. Looks at the one thing you sell now and ranks the moves by effort, easiest money first. Use when the user says "how do I make more money from what I have", "audit my offer", "I'm leaving money on the table", "should I raise my price", "add an upsell", "how do I add recurring revenue", "my offer only makes money once", or "/more-from-buyers".

caphtech Bundle

実装・設計・運用に埋め込まれた局所最適を、評価境界・評価指標・変更可能範囲・時間軸を拡張して検出し、外部化された複雑性、変更増幅、境界障害、KPI乖離、移行ロックインを証拠付きで分析する。アーキテクチャレビュー、リファクタリング候補探索、性能調査、Git共変更分析、障害再発分析、レガシー互換層や手動運用の見直しに使用する。

fr-e-d Skill

Spot-check AC internal consistency and scan for pending revisions on delivery-ready stories. Activated by `/gaai-status --audit` as Section 5. Complements the standard status checks with depth checks that standard status skips for speed.

meaningfy-ws Bundle

The Meaningfy release lifecycle — semantic versioning policy (MAJOR/MINOR/PATCH + -rc.N pre-releases), GitFlow release/hotfix branches, changelog + GitHub release notes, semi-automated releases via release-please, publishing Python libraries to PyPI with Trusted Publishing (OIDC, no tokens), opt-in supply-chain hardening (signing/provenance/SBOM), and release governance (SECURITY.md, yanking, deprecation). Use when cutting, versioning, publishing, or documenting a release. Trigger on "cut a release", "bump the version", "publish to PyPI", "write release notes", "release branch / hotfix", "yank a bad release", "how do we version this", "set up the release workflow".

forgivesam168 Bundle

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

forgivesam168 Skill

Comprehensive code quality and security audit for financial systems. Use when asked to "review code", "code review", "security audit", "check for issues", "審核程式碼", "檢查安全性", or before merging changes. Focuses on DDD compliance, financial precision (no floats for money), security vulnerabilities, and test coverage.

charlesjones-dev Skill

Apply safe GEO remediations from the latest /geo-audit report. Updates robots.txt with training-vs-citation bot directives, inserts missing Author/Organization/FAQPage JSON-LD, adds dateModified and article:modified_time, proposes content restructuring for Q&A patterns, and adds sameAs entity-disambiguation links. Diff+confirm workflow with --dry-run support.

charlesjones-dev Skill

Comprehensive Generative Engine Optimization (GEO) audit - Validates llms.txt protocol compliance, AI crawler access (training vs citation bots), citation-worthiness signals, AI-friendly structured data, semantic chunking, content freshness, and entity optimization. Generates a timestamped report in /docs/geo-audit/ with framework-specific remediation and emerging-practice flags.

aki2022 Skill

Close out a finished repository task by optionally running origin-permission-audit, then origin-trouble-log, then origin-doc-update, then origin-git-cleanup. Commit/merge/sync the finished work and remove only approved stale branches and worktrees. Use for "店じまい", "後片付け", "片付けて", "クリーンに", "整理", "wrap up", "close out", "get back to a clean main", or after a PR is merged. Prefer this over origin-git-cleanup alone when docs/ governance exists. Do not use for mid-task rebase, cherry-pick, status-only checks, or docs edits without cleanup intent.