Security

jacob-balslev Skill

Use when a goal, plan, design, strategy, or assumption should be examined by reversing it: ask how to guarantee failure, how the opposite could be true, or what would have to happen for the desired outcome not to occur. Covers objective reversal, failure-path enumeration, obstacle-first planning, opposite-hypothesis testing, and prevention design. Do NOT use for decomposing a problem to irreducible premises (use first-principles-thinking), post-failure root-cause analysis (use debugging), recurring failure clustering (use pattern-recognition), or claim/source grounding (use epistemic-grounding). Do NOT use for Break this pricing model down to irreducible assumptions. Do NOT use for This incident already happened; find the root cause. Do NOT use for Score every webhook failure mode with severity, occurrence, and detectability. Do NOT use for Facilitate a team pre-mortem session with independent written generation.

delorenj Bundle

Multi-workspace Plane sprint board management with intelligent automation, ticket creation, and BMAD workflow integration. Use this skill when: - Creating tickets, task descriptions, or audit findings - Auditing board organization (ticket clustering, label optimization, status bottlenecks) - Selecting the next optimal ticket to work on - Promoting completed tickets to production and generating changelogs - Working with multiple Plane workspaces - Understanding the canonical Plane CRUD → n8n HMAC → Bloodbank → Candystore event side effect - For higher-level orchestration — "what's next", "clear the board", "orchestrate this ticket" — route to the **`momo`** skill, which surveys the board, triages, decides, and delegates implementation to subagents. Triggers: "create ticket", "board audit", "what should I work on", "next ticket", "promote to production", "changelog", "sprint status", "WIP limit", plane ticket operations

jacob-balslev Skill

Use when deciding whether to route a task to the balanced implementation tier (Claude Sonnet) — feature work, bug fixes, test writing, multi-step code — as the default lane that is cheaper/faster than the frontier tier and more capable than the fast tier. Covers the cost/quality tradeoff vs Opus and Haiku, the shared 1M context window, effort behavior, and the 1M-context subscription billing caveat. Do NOT use for the hardest reasoning/architecture/security work (use claude-opus), high-volume mechanical or low-latency work (use claude-haiku), loop design (use autonomous-loop-patterns), or Claude API request syntax (read the claude-api reference).

dykyi-roman Bundle

Yii framework knowledge base. Provides Yii3 modular architecture, DDD integration, PSR-7/PSR-15 compliance, persistence, DI, security (RBAC, auth), event system (PSR-14), queue/jobs, infrastructure components (cache, rate limiter, HTTP client), testing, and antipatterns for Yii PHP projects.

jacob-balslev Skill

Use when creating a new SKILL.md from scratch, restructuring a draft before it becomes a stable skill, or teaching another author the canonical Skill Metadata Protocol frontmatter, body, and audit-state.json sidecar structure. Covers flat schema-conformant frontmatter, the sidecar split, v8 classification, body layout by skill intent, semantic-layer discipline (description vs activation vs Coverage), teaching-layer mechanics (TEMPLATE NOTE blockquotes), native skill-creator handoff, public/private safety, and routing-eval honesty. Do NOT use when modifying an already-written skill (edit it directly), writing general technical documentation, routing an existing request across skills, or fixing malformed library health at scale (use `skill-infrastructure`). Do NOT use for refactor my existing skill to be more concise. Do NOT use for my skill's routing isn't activating — why? Do NOT use for audit my skill library for stale frontmatter. Do NOT use for write a developer guide for the contributor docs.

jacob-balslev Skill

Use BEFORE any tool call that could modify state, touch sensitive targets, rewrite history, install dependencies, publish packages, or expose credentials/environment data. Classifies intent into Passive/Read, Reconnaissance, Modification, or Destructive/Irreversible using operation type plus target sensitivity, then runs Identify / Confirm / Verify before action. Do NOT use for deciding what code to write, executing already-classified work, reactive post-execution guardrails, or defining upstream governance policy. Do NOT use for design the deterministic safety hook that blocks destructive commands. Do NOT use for decide whether to use a switch or a chain of ifs. Do NOT use for actually execute the migration after we've classified the risk. Do NOT use for scan this repo for OWASP top 10 vulnerabilities. Do NOT use for review this AI-generated PR for correctness. Do NOT use for the loop is stalling — what's the steering signal.

kevinnft Skill

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

dykyi-roman Bundle

Laravel framework knowledge base. Provides architecture, DDD integration, Eloquent persistence, service container, security, queues, events, infrastructure components, testing, and antipatterns for Laravel PHP projects.

dykyi-roman Bundle

Symfony framework knowledge base. Provides architecture, DDD integration, persistence, DI, security, messenger, workflow, events, infrastructure components, testing, and antipatterns for Symfony PHP projects.

kevinnft Skill

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

dykyi-roman Skill

Audits CORS configuration security. Detects wildcard origins, credentials with wildcards, dynamic origin reflection, missing preflight handling, and overly permissive policies.

dykyi-roman Skill

Audits HTTP security headers configuration. Checks CSP, X-Frame-Options, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cache control headers.

dykyi-roman Skill

Detects OWASP A04:2021 Insecure Design vulnerabilities. Identifies missing rate limiting, account lockout, CAPTCHA, TOCTOU races, business logic flaws, and threat modeling gaps.

jscraik Bundle

Plan, diagnose, and validate 1Password CLI workflows. Use when tasks need op CLI sign-in, secret references, op run, op inject, item reads, env injection, or service-account secret access.

dykyi-roman Bundle

CodeIgniter 4 framework knowledge base. Provides CI4 MVC architecture, DDD integration, persistence, services, security (Shield auth, Filters authorization, CSRF), event system, queue (codeigniter4/queue jobs, workers, retry), infrastructure components (cache, HTTP client, email, throttler), testing, and antipatterns for CodeIgniter PHP projects.

jscraik Bundle

Create, migrate, or validate Better Auth implementation work. Use when the user wants Better Auth added or changed in code, including OAuth, passkeys, 2FA, magic links, or org flows.

dykyi-roman Skill

Detects OWASP A09:2021 Security Logging and Monitoring Failures. Identifies log injection, PII in logs, missing audit trails, insufficient error context, and blind spots.

jscraik Bundle

Audit, review, and harden Better Auth integrations. Use when the user wants Better Auth security review, config debugging, provider hardening, session checks, or operational risk guidance.

jscraik Bundle

Run, audit, and design authorized Recon Workbench workflows when scoped target interrogation needs evidence artifacts, redaction, validation, and safe reporting.

dykyi-roman Bundle

Framework-less PHP knowledge base. Provides pure PHP project architecture, DDD integration, PSR-7/PSR-15 HTTP, standalone persistence, DI containers, security (JWT lcobucci/jwt, RBAC middleware, password hashing, CSRF), event system (PSR-14, league/event, domain events, async processing), queue (enqueue/enqueue, php-amqplib, workers, supervisor), infrastructure components (PSR-6/16 cache, PSR-18 HTTP client, mailer, rate limiting), testing, and antipatterns for projects without a full framework.

dykyi-roman Bundle

Access Control knowledge base. Provides ACL, RBAC, ABAC, ReBAC models, multi-tenancy patterns, and PHP implementations (Symfony Voters, Laravel Gates) for security audits and generation.

jscraik Bundle

Analyze git-history security ownership when sensitive files, CODEOWNERS coverage, bus factor, contributor concentration, and remediation evidence need mapping.

dykyi-roman Bundle

Documentation QA knowledge base. Provides quality checklists, audit criteria, and metrics for documentation review.

jscraik Bundle

Review Harness Engineering diffs, PRs, commits, and readiness claims for introduced risk. Use when correctness, validation proof, security posture, traceability, closure safety, or review-thread resolution must be assessed before merge or handoff.

jacob-balslev Skill

Use when implementing or reviewing an inbound webhook handler for any third-party provider - verifying signatures, deduplicating retries, choosing the right HTTP status code for retry vs no-retry, persisting raw payloads before canonical mapping, and quarantining unverifiable events. Covers signature schemes, idempotency patterns, provider retry contracts, raw-then-canonical pipelines, quarantine, secret rotation, and PII-capture timing. Do NOT use for outbound webhook publishing (use `event-contract-design`), general background-job orchestration, or chasing a webhook handler that has already failed in production (use `debugging`). Do NOT use for design our outbound webhook product (we want to deliver events to customers). Do NOT use for the production webhook is failing — find the root cause. Do NOT use for explain our webhook patterns in the contributor docs. Do NOT use for review this AI-generated webhook handler for correctness. Do NOT use for refactor the webhook handler helpers for clarity.

jscraik Bundle

Assists with questions about Hannah Foxwell's talk 'The Reinvention of the Dev Team'. Use when a user asks about Foxwell's arguments on agentic software development, engineering team composition, AI-driven velocity, dev-to-PM ratios, the three anchors (build something worth building, speed requires safety, people matter), the Keep/Trash/Try inventory, on-call sustainability, broken-comb skills, or wants to audit their own team against Foxwell's framework.

dykyi-roman Skill

Analyzes PHP dependencies for security vulnerabilities. Detects outdated packages, known CVEs, unsupported versions, vulnerable transitive dependencies.

jscraik Bundle

Answers questions about, applies frameworks from, and generates artifacts based on Tammuz Dubnov's talk "When Our PM Started Writing Code: What Merge Rate Taught Us About AI Adoption." Grounds every response in the bundled transcript and outline files. Use when a user asks about AI-native org design, merge rate measurement, non-technical contributors shipping PRs, harness engineering, zero-dev-touch rate, AI adoption ROI, or wants to audit their team against Tammuz's framework, apply his concepts to their situation, draft a measurement dashboard or checklist, or understand terms like Calamarous Coding and the PM-to-engineer authority collapse.

jacob-balslev Bundle

Use as the v8-conformant fixture exercising the full Understanding surface — the five flat top-level fields (mental_model, purpose, concept_boundary, analogy, misconception) in SKILL.md frontmatter, paired with comprehension_state: present in the audit-state.json sidecar. Activate this skill when verifying that the cross-file lint accepts the flat Understanding fields when the sidecar declares comprehension_state: present. Do NOT use as a production skill (use a real capability skill from the canonical library).

jacob-balslev Skill

Use when designing or auditing dependency structure: package boundaries, runtime vs build dependencies, adapter layers, duplicate-purpose libraries, supply-chain risk, upgrade policy, lock-in, and dependency graph health. Do NOT use for choosing a major framework (use `framework-fit-analysis`), vulnerability-only review (use `owasp-security`), or routine refactoring without dependency boundary changes (use `refactor`). Do NOT use for choose between Next.js, Remix, and Astro for a new app. Do NOT use for scan dependencies only for known vulnerabilities. Do NOT use for refactor this module without changing dependency boundaries. Do NOT use for write an ADR after the dependency decision is accepted.

jacob-balslev Skill

Use when locating a bug in an unfamiliar codebase, tracing a failure from symptom to source, or choosing between candidate fixes after the symptom is observed but before a patch lands. Covers the locate-to-solve workflow: problem-statement contract, search-space reduction, boundary-based fault localization, good-vs-bad path comparison, binary search through a call chain, minimal repro, root-cause isolation, fix option comparison, blast-radius review, and post-fix verification. Do NOT use for broad task planning once the bug is localized, test-pyramid design, or performance forensics. Do NOT use for plan the next 6 weeks of work for the team. Do NOT use for review this PR for code quality. Do NOT use for this endpoint is slow under load — find the bottleneck. Do NOT use for scan this repo for OWASP top 10 vulnerabilities. Do NOT use for run scientific-method debugging on this stack trace. Do NOT use for I see the symptom but cannot find the root cause of this nil panic.

jscraik Bundle

Reviews and improves SKILL.md packages by fixing audit findings, triggers, examples, evals, token budget, release proof, safety verdicts, comparator/baseline choices, and bounded code-lens hardening. Use when the user says improve a skill, fix a skill file, review SKILL.md, raise Tessl score, reduce context cost, add skill evals, or prepare a plugin skill for release.

jacob-balslev Bundle

Negative fixture for the gate-conformance suite: the SKILL.md frontmatter is fully valid, but the sibling audit-state.json sidecar is missing the required `owner` field. Activate only inside test-gate-conformance.js to prove the structural lint gate validates the sidecar against schemas/skill-audit-state.schema.json. Do NOT use as a production skill.

jacob-balslev Bundle

Use when writing or reviewing Postgres queries in a multi-tenant SaaS where every table row must be scoped to a single organization. Enforces the FORCE ROW LEVEL SECURITY + USING + WITH CHECK triple on every tenant-bound table, and wraps application queries in an `orgQuery(orgId)` helper that sets `app.current_org_id` before each statement. Do NOT use for cross-org system queries such as billing cron jobs or admin panels (those bypass RLS intentionally via the service role); use a service-role query wrapper instead.

jacob-balslev Bundle

Warning fixture for the gate-conformance suite: the sidecar is schema-valid but omits the four durable Audit Status verdict fields. Activate only inside test-gate-conformance.js to prove lint warns without failing. Do NOT use as a production skill.

coderabbitai Skill

Vercel Firewall and security expert guidance. Use when configuring DDoS protection, WAF rules, rate limiting, bot filtering, IP allow/block lists, OWASP rulesets, Attack Challenge Mode, or any security configuration on the Vercel platform.