Security

robbyt Bundle

This skill should be used when reviewing API designs, auditing REST or gRPC endpoints, designing backend APIs, evaluating BFF architecture, or discussing API best practices. Also triggers on: "review this API", "API design review", "is this API correct", "REST API audit", "gRPC API review", "PATCH vs PUT", "etag", "idempotency", "pagination design", "API error handling", "backward compatibility", "BFF architecture", "resource-oriented design", "TOCTOU", "race condition", "optimistic concurrency", "field mask", "long-running operation", "custom method", "soft delete", "API naming conventions", "declarative-friendly"

robbyt Skill

This skill should be used when the user asks to "audit this video", "analyze video quality", "check this video file", "is this video good quality", "should I reencode this", "what format is this video", or wants to understand a video file's technical properties and quality before working with it.

robbyt Skill

This skill should be used when the user asks "check subtitles", "audit subs", "subtitle font issues", "ASS vs SRT", "missing fonts", "subtitle timing", or wants to analyze subtitle tracks for issues like missing fonts, timing problems, or format limitations.

robbyt Skill

This skill should be used when the user asks "check frame rate", "is this CFR or VFR", "video has duplicate frames", "video stutters", "frame rate issues", "why does video judder", or wants to analyze frame rate characteristics and detect timing problems.

abivan-tech Skill

Practical secure-coding rules for auth, data handling, input validation, and defense-in-depth.

roasbeef Bundle

Refines an existing Go test suite — removes trivial/duplicate tests, strengthens weak assertions, reshapes tests around invariants, and closes branch-coverage gaps. Uses code-guided coverage and (when available) gremlins mutation-testing survivor data rather than relying on line coverage alone. Use when test quality is uneven, after a test-generation pass, before opening a PR, or as a quality gate on critical paths (consensus, channel state, payment flows). Triggers: "refine these tests", "tests are bloated", "tighten assertions", "remove trivial tests", "audit test quality", "/test-refine".

sergebulaev Skill

Repurpose existing content into a native Instagram post. Take a LinkedIn, blog, YouTube script, or X tweet or thread and rebuild it for Instagram: a long piece becomes a carousel or a caption, re-hooked before the 125-char fold, off-platform artifacts stripped (X @-handles, link in bio), published via Publora on approval. Use to adapt content across platforms into Instagram. Not for writing from scratch (use ig-caption-writer or ig-carousel-planner), not for auditing a draft (ig-humanizer --mode audit).

sergebulaev Bundle

Draft an Instagram caption with the hook in the first 125 characters, a skimmable body, and one clear CTA, using a 2026 hook formula chosen by goal (saves, shares, comments, follows). Runs the humanizer pass and, on approval, publishes with the image or video you supply via the Publora media flow. Use to caption a single image or a Reel. Not for slide-by-slide carousels (use ig-carousel-planner) or auditing a draft (use ig-humanizer --mode audit).

sergebulaev Skill

Audit and rewrite an Instagram profile end-to-end for 2026: profile photo, searchable NAME field weighted with a keyword, @handle, bio (150 chars: value plus topic plus proof), goal-matched link, category label, story highlights, the first-9 grid, and up to 3 pinned posts. Triggers on "review my Instagram profile", "fix my bio", "optimize highlights", "profile audit". The whole follow decision happens on the profile header. Not for writing captions (use ig-caption-writer).

constructive-io Skill

Row history / temporal versioning — the DataHistory blueprint node (append-only <table>_history companion recorded by AFTER triggers), optional pg_partman range partitioning with a retention window, and the graphile-history plugin that adds history, versionAt, versionsBetween, and restore<Table>Version to the GraphQL API. Use when asked to 'add row history', 'audit log', 'track changes to a table', 'version history', 'point-in-time query', 'time-travel', 'as-of query', 'restore a previous version', 'roll back a row', 'DataHistory', 'versionAt', 'versionsBetween', 'restoreVersion', 'history retention', or when working with history/versioning in blueprints or the SDK.

blackwell-systems-agent-lsp Skill

Full code quality audit for a file, package, or directory. Supports batch mode (directory walk with --top ranking), comparison mode (--diff for branch-only issues), severity calibration by blast radius, fix suggestions, and confidence tiers. Applies a check taxonomy (dead symbols, silent failures, error wrapping, coverage gaps, test coverage, doc drift, unrecovered panics, context propagation, concurrency safety) using LSP-first strategies. Concurrency checks cover 25 languages across 4 families (goroutine, thread, async, actor). Produces a severity-tiered findings report. Language-agnostic.

constructive-io Bundle

Authorization with Constructive Authz, 25 registry Authz nodes plus platform-applied AuthzHumanOnly, RLS, grants, capabilities, GuardStepUp, read-only access, storage policies, secureTableProvision, and owning the security of a module-generated table. Use for RLS, grants, policies, AuthzAppMemberOwner, AuthzRelatedMemberOwner, AuthzColumnSecurity, AuthzComposite, system-only or human-only operations, column write guards, storage security, capability defaults, step-up auth, replacing a module's default grants or policies (registries, images, repositories, machines), blueprint provisions overrides, or authorization in blueprints and the ORM.

blackwell-systems-agent-lsp Skill

Concurrency safety audit for a type or file. Maps all fields, traces which are accessed from concurrent contexts (goroutines, threads, async tasks), and flags fields that lack synchronization. Produces a field-level safety report. Language-agnostic across 4 concurrency families.

coollabsio Bundle

Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.

danfrdn Skill

A strict quality gate to run AFTER code implementation is complete. Audits for security, correctness, simplicity, data integrity, and performance.

tan-yong-sheng-ai-vision-mcp Bundle

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

tan-yong-sheng-ai-vision-mcp Bundle

USE THIS SKILL whenever any topic related to access control, authorization, permissions, or security policy arises in any form. Triggers include — but are not limited to: RBAC, ABAC, PBAC, ACL, DAC, ReBAC, Zanzibar, OPA, Cedar, Casbin, SpiceDB, OpenFGA, Permify, Oso, Cerbos, Permit.io; any mention of "who can do what", "role", "permission", "policy", "authorization", "multi-tenant access", "least privilege", "Zero Trust", "IAM design", "SaaS permission modeling", "access audit", "compliance access control" (HIPAA, GDPR, SOC2, PCI-DSS, ISO27001); also trigger when designing any new feature that controls what users can see or do, or when reviewing, refactoring, or debugging any auth/authz system. When in doubt — trigger this skill. Access control is architectural and getting it wrong is expensive.

tan-yong-sheng-ai-vision-mcp Skill

Use this skill when aggregating design audit findings across multiple dimensions, deduplicating related issues, or synthesizing results into executive summaries with remediation roadmaps

sounder25 Bundle

Generate comprehensive workspace profile with git signals, build configs, and forensics completeness tracking. Foundation skill for all other workspace operations.

anouar1991 Skill

Audits Progressive Web App readiness: manifest validation, service worker status and scope, offline capability test, HTTPS enforcement, installability criteria, push notification permission, and cache strategy analysis. Produces a PWA scorecard with pass/fail per criterion.

anouar1991 Skill

Analyze all forms on a page: validation states, autocomplete attribute coverage, label/input association, required field audit, submission behavior interception, password field security, and ARIA attributes on custom controls.

anouar1991 Bundle

Comprehensive security posture audit: TLS certificate validation, CSP analysis, mixed content detection, cookie security flags, SRI checks, security headers (HSTS, X-Frame-Options), and open redirect detection via CDP Security and Audits domains.

elie222 Skill

Explain recent changes and provide a structured summary with security checks

anouar1991 Skill

Audits font loading behavior: FOIT/FOUT detection via timed screenshots, font-display validation per family, font file sizes and format efficiency (WOFF2 vs WOFF vs TTF), preload link validation, unused font declarations, and subsetting opportunities. Produces a font-by-font report with loading timeline and recommendations.

anouar1991 Bundle

Measure Core Web Vitals (LCP, INP, CLS) with full attribution across mobile, tablet, and desktop viewports. Produces a multi-viewport report card with pass/fail grades, element-level attribution, and annotated screenshots.

anouar1991 Bundle

Analyzes every image on a page: format efficiency (WebP/AVIF vs legacy), dimension vs display size ratio, lazy loading correctness, responsive images (srcset/sizes/picture), above-fold images that should not be lazy, total weight with savings estimate, missing width/height (CLS risk), and broken images. Produces an image-by-image report with actionable recommendations.

creator-hian Bundle

Dual-AI engineering loop orchestrating Claude Code (planning/implementation) and Codex (validation/review). Use when (1) complex feature development requiring validation, (2) high-quality code with security/performance concerns, (3) large-scale refactoring, (4) user requests codex-claude loop or dual-AI review. Do NOT use for simple one-off fixes or prototypes.

creator-hian Bundle

Dual-AI engineering loop orchestrating Claude Code (planning/implementation) and Gemini (validation/review). Use when (1) complex feature development requiring validation, (2) high-quality code with security/performance concerns, (3) large-scale refactoring, (4) user requests gemini-claude loop or dual-AI review. Do NOT use for simple one-off fixes or prototypes.

creator-hian Bundle

Multi-AI engineering loop orchestrating Claude, Codex, and Gemini for comprehensive validation. USE WHEN (1) mission-critical features requiring multi-perspective validation, (2) complex architectural decisions needing diverse AI viewpoints, (3) security-sensitive code requiring deep analysis, (4) user explicitly requests multi-AI review or triple-AI loop. DO NOT USE for simple features or single-file changes. MODES - Triple-AI (full coverage), Dual-AI Codex-Claude (security/logic), Dual-AI Gemini-Claude (UX/creativity).

diegopherlt Bundle

This skill should be used when the user says "scan this for smells", "audit this code", "what code smells does X have", "review this for quality issues", "find code smells in", or asks about the code quality of a specific file, function, or class. Covers the full refactoring.guru taxonomy of 26 smells across 5 categories, producing located, confidence-scored findings mapped to concrete refactoring techniques — not generic Clean Code advice.

harperreed Skill

Use when asked to organize finances, create a budget, plan debt payoff, build savings goals, audit subscriptions, or do any personal money management task. Triggers on "budget", "finances", "savings", "debt", "subscriptions", "emergency fund", "investing", "cash flow", "money system", "financial plan".

marttp Skill

Use when user needs Java enterprise development help. Examples: "design Spring Boot microservices", "implement JPA queries", "add OAuth2 security", "set up reactive WebFlux", "migrate to Java 17+"

lennetech Skill

Analyzes and optimizes npm package dependencies across five maintenance modes: FULL (update all), DRY-RUN (analysis only), SECURITY-ONLY (urgent CVE fixes), PRE-RELEASE (conservative patch-only), POST-FEATURE (cleanup). Activates on updating packages, `npm audit` findings, deprecated or unused dependencies, "Pakete aktualisieren", "Abhängigkeiten prüfen", or package.json optimization. NOT for @lenne.tech/nest-server version updates (use nest-server-updating). NOT for stack-wide releases (use maintaining-lt-stack).

0x0pointer Skill

Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.

0x0pointer Skill

Deep OAuth 2.0 / OpenID Connect security assessment covering the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, parameter pollution, response mode switching), missing/broken state CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage, authorization code injection, scope escalation, client confusion, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover, OIDC dynamic client registration SSRF (logo_uri, jwks_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing, mobile custom URI scheme hijacking, refresh token persistence, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http payloads with verification logic. Chains from /pentester or /api-security; into /web-exploit, /post-exploit on account takeover, and /credential-audit when tokens are recovered.

0x0pointer Skill

Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerberos configuration. Uses enum4linux-ng, netexec, impacket, ldapsearch, certipy-ad, bloodhound-python, and rpcclient. Produces attack path diagrams, prioritized risk register, and PoCs. Chains into /gh-export for issue filing.