Security

talont-org Skill

Audit codebase for adherence to architectural standards, practices, and rules. Use when user says "audit arch", "audit architecture", "check architecture", or "architectural review". Spawns parallel subagents to examine multiple architectural aspects and generates a structured report.

talont-org Skill

Audit the test suite for useless tests, consolidation opportunities, over-mocking, weak assertions, placement/organization issues, xdist safety violations, test path filter integrity, and other test quality issues. Use when user says "audit tests", "audit test suite", "review tests", or "test quality check". Generates an improvement plan in temp/ with explanations for each proposed change.

microsoft Skill

Use when a Power Apps mobile project needs dependency updates or an npm audit review. Checks the mobile-app plugin first, then updates the native host, other Microsoft packages, and all remaining direct npm packages in order with validation and rollback.

huytieu Skill

Audit and export open issues from any project tracker with summary analysis and vault archival

talont-org Skill

Audit codebase for internal cohesion - how well components fit together and maintain consistent patterns. Distinct from audit-arch (which checks rule violations); this checks integration fitness and convergence. Use when user says "audit cohesion", "check cohesion", "cohesion audit", or "alignment check".

talont-org Skill

Validate audit findings from audit-arch, audit-tests, or audit-cohesion against actual code, git history, and design intent using 9–10 parallel subagents. Removes contested findings, documents exceptions, adjusts severities. Use when user says "validate audit", "validate findings", "validate report", or "check audit results".

talont-org Skill

Reviewer-facing deep analysis of an integration-to-main promotion. Performs domain risk scoring, breaking change audit, regression risk assessment, test coverage delta, and cross-domain dependency analysis. Use when you want a reviewer's guide before approving a promotion PR.

talont-org Skill

Automated diff-scoped PR code review using parallel audit subagents. Posts inline GitHub review comments and submits a summary verdict. Use after a PR is opened to gate CI on review approval.

talont-org Skill

Analyze historical bug patterns by mining Claude Code project logs for /autoskillit:investigate skill invocations since a specified date. Identifies recurring root causes, architectural gaps, and proactive detection strategies. Use when user says "audit bugs", "bug patterns", "analyze investigations", or "bug audit".

talont-org Skill

Audit documentation for drift, staleness, and inconsistency against the actual codebase. Use when user says "audit docs", "check documentation", "docs audit", or "documentation review". Spawns parallel subagents to explore codebase subsystems, then cross-references all documentation sources against findings.

talont-org Skill

Parallel subagent-driven claim extraction and citation integrity audit for research PRs. Extracts claims by section, matches against available evidence, classifies unsupported claims as findings, and emits a verdict for recipe routing.

talont-org Skill

Investigate a bug pattern audit report and design architectural guards (tests, contracts, structural changes) that provide immunity to each identified pattern. Use when user says "design guards", "design defenses", or wants architectural solutions for bug patterns.

talont-org Skill

Scan Claude Code project logs for friction patterns — repeated failures, approach loops, tool errors, misunderstanding cycles, and stuck workflows. Categorizes and counts friction events to surface what causes the most resistance. Use when user says "audit friction", "find friction", "friction audit", or "what keeps going wrong".

microsoft Skill

Build and verify a third-party `.ppmplugin` end to end. This recommended entry point detects Android and iOS source, confirms target platforms, then invokes the manifest, platform build, assemble, and audit stages in order. Advanced users can invoke a stage directly for focused reruns or debugging. Produces a native-only bundle (`manifest.json` plus an Android DEX and/or iOS framework) and stops on any failed stage rather than emitting an unverified partial build. Run after the native module exists.

zangxin75 Bundle

Security engineer for vulnerability assessment, penetration testing guidance, and secure code review. Use for OWASP Top 10 checks, threat modeling, or security architecture review. Covers authentication flaws, injection vulnerabilities, access control, and compliance requirements.

talont-org Skill

Create Security architecture diagram showing trust boundaries, validation layers, and process isolation. Security lens answering "Where are the trust boundaries?"

talont-org Skill

Automated diff-scoped research PR review using parallel audit subagents aligned to research quality dimensions. Posts inline GitHub review comments and submits a summary verdict. Use after a research PR is opened to gate on review approval.

talont-org Skill

Audit feature flag isolation — traces import chains, runtime gates, tool/skill tag coverage, UI surfaces, and test markers to detect leakage and miswiring.

talont-org Skill

Validate test audit findings with test-domain semantic rules and intent analysis. Adds import-path-as-contract recognition, precondition-as-assertion detection, provenance verification, split-era lifecycle awareness, and deletion-vs-improvement distinction to the standard validation workflow. Use when validating reports from audit-tests specifically.

talont-org Skill

Create Anti-Pattern Detection visualization audit showing severity-tiered catalog of visualization anti-patterns present in or planned for the experiment. Diagnostic lens answering "Which visualization anti-patterns are present?"

talont-org Skill

Fetch claim findings from audit-claims, run citation-aware intent validation (ACCEPT/REJECT/DISCUSS), apply targeted citation fixes, escalate findings requiring experiment reruns, and post inline replies.

georgekhananaev Skill

Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, and Agentic AI security (2026).

talont-org Skill

Audit merged PR review threads for agreed-but-deferred suggestions (design decisions, future work, out-of-scope items) that were never implemented. Mines REVIEW-FLAG markers from resolve-review and legacy keyword signals. Produces a structured markdown report with VALID/RESOLVED/STALE classifications and annotates processed threads with [AUDIT] markers to prevent re-identification on future runs.

talont-org Skill

Audit the codebase against defense standards derived from historical bug patterns. Standards accumulate over time as new patterns are discovered via audit-bugs and design-guards. Use when user says "audit defenses", "audit defense standards", "check defenses", or "defense audit".

georgekhananaev Bundle

Maintain a CHANGELOG.md following the Keep a Changelog standard. Use after commits, on /commit, when the user asks to update the changelog, or when releasing a version — maps conventional-commit types to Added/Changed/Fixed/Security categories. Archives old releases into per-major files (changelog/CHANGELOG-1.x.md) so the main file stays small no matter how many versions accumulate.

talont-org Skill

Create a validity threat matrix identifying alternative explanations and design mitigations. Adversarial lens answering "What alternative explanations survive?"

talont-org Skill

Validate review-decisions audit findings with mandatory intent analysis and seven evidence-gathering rules. Adds docstring-as-contract recognition, deliberate-change detection, test-as-intent-signal, consumer-impact verification, architectural feasibility checks, behavioral simulation, and symmetry-as-design recognition to the standard validation workflow. Use when validating reports from audit-review-decisions specifically.

georgekhananaev Bundle

Security-focused static analysis and code auditing skills from Trail of Bits. Includes CodeQL deep analysis, Semgrep scanning, and SARIF result processing. Use when performing security audits, running static analysis, scanning for vulnerabilities, or processing scan results.

tianzecn Skill

⚡ PRIMARY TOOL for: 'what's the architecture', 'system design', 'how are layers organized', 'find design patterns', 'audit structure', 'map dependencies'. Uses claudemem v0.3.0 AST structural analysis with PageRank. GREP/FIND/GLOB ARE FORBIDDEN.

tianzecn Skill

⚡ PRIMARY TOOL for: 'how does X work', 'find implementation of', 'trace data flow', 'where is X defined', 'audit integrations', 'find all usages'. Uses claudemem v0.3.0 AST with callers/callees analysis. GREP/FIND/GLOB ARE FORBIDDEN.

tianzecn Skill

⚡ AUTO-INVOKE when user asks: 'audit', 'investigate', 'how does X work', 'find all', 'where is', 'trace', 'understand', 'map the codebase', 'comprehensive'. MUST run BEFORE Read/Glob when planning to read 3+ files. Prevents tool familiarity bias toward native tools.

talont-org Skill

Create Reproducibility Artifacts experimental design diagram showing run instructions, environment capture, data availability, determinism controls, and audit trail. Transparency lens answering "Could an independent party reproduce this?"

avav25 Skill

Use this skill when the user asks to validate a feature, write or improve tests, report a bug, or audit acceptance criteria coverage — /qa = QA-task workflows (verification, test creation, bug reports, exploratory). /test-strategy = test design principles + pyramid + coverage targets (knowledge). /test-local = test execution workflow.

newkub Bundle

Package manager สำหรับ Node.js ที่เร็วที่สุด รองรับ lockfiles หลายรูปแบบ มี security defaults...

avav25 Bundle

Use this skill when reviewing a pull request, merge request, or code change before merge, conducting an architecture review, auditing code for security/performance/quality, or running a pre-merge quality gate — including when applied by a Reviewer or QA subagent — to produce a verdict (APPROVE / REQUEST_CHANGES / COMMENT) using Google's eng-practices framing (code health over perfection) and conventional comments vocabulary (nit / suggestion / issue / praise). Distinct from /security-scan (no dependency CVE scan) and /security-audit (no full OWASP audit).

kortix-ai Skill

How this repo manages API secrets and the four local-run environments (local/dev/staging/prod). They are dotenvx-ENCRYPTED in git and the keys live in Dotenv Armor. Load this WHENEVER you touch a secret, API key, token, credential, or any apps/api/.env* file; whenever the user pastes a key/token/secret to store or use; whenever choosing/switching which environment to run; and whenever adding, reading, rotating, or sharing a secret.