Security

zate Skill

Language-specific vulnerability detection patterns for JavaScript/TypeScript, Python, Go, Java, Ruby, and PHP. Provides regex patterns and grep commands for common security vulnerabilities.

truchot Bundle

Expert UX/UI Design pour recherche utilisateur, wireframes et prototypes. Utilise ce skill quand: (1) recherche utilisateur et personas, (2) wireframing et maquettage, (3) prototypage interactif, (4) tests utilisateurs, (5) design d'interfaces, (6) audit UX, (7) branding et identité visuelle.

truchot Bundle

Expert securite applicative et infrastructure - OWASP, pentest, secure coding, threat modeling. Utilise ce skill quand: (1) audit de securite applicative, (2) implementation SAST/DAST/IAST, (3) secure coding practices, (4) threat modeling et analyse de risques, (5) tests de penetration, (6) conformite RGPD/SOC2/ISO27001.

openaec-foundation-erpnext-anthropic-claude-development-skil Bundle

Use when implementing the Frappe/ERPNext permission system. Covers roles, user permissions, perm levels, data masking, and permission hooks for v14/v15/v16. Prevents common access control mistakes and security issues. Keywords: permissions, roles, user permissions, perm levels, data masking,, restrict records, who can see what, department access, row-level, user cannot see document, access denied. access control, security, has_permission.

truchot Bundle

Expert Legal & Compliance pour RGPD, CGV et conformité juridique. Utilise ce skill quand: (1) mise en conformité RGPD, (2) rédaction de CGV/CGU, (3) mentions légales, (4) politique de confidentialité, (5) audit de conformité, (6) gestion des cookies et consentements.

wolverin0 Bundle

Run a fail-closed end-to-end project hardening cycle: static audit, exhaustive real-browser validation, semantic screenshot review, multi-role/security/visual-regression probes, isolated remediation, and re-verification. Use when the user asks to battle-test or prove production readiness. Default is the full cycle; --quick runs a clearly weaker smoke/readiness check and can never emit a battle-tested verdict. Main integration requires --push-main; deployment is never automatic.

wolverin0 Skill

Guided 13-layer production-readiness self-check for a vibe-coded app. Use when the user asks "is this production ready", "what am I missing before launch", "ship check", "did I forget anything", or wants to harden an AI-generated MVP. Walks the 13 layers, runs cheap detections + manual tests, emits a per-layer PASS/GAP scorecard. Lighter than /audit (which is full due-diligence).

wolverin0 Bundle

Review security-sensitive code changes involving auth, user input, secrets, APIs, payments, files, RLS, or third-party integrations.

wolverin0 Skill

Run the methodology setup phase of a technical audit — fingerprint the stack, inventory the repository, and produce a system map. Use this BEFORE running any audit domains. Output: detected stack, repo summary, and high-level architecture in 3-5 paragraphs. No findings yet.

wolverin0 Bundle

Inventory every safe visual route, capture authenticated light/dark desktop/tablet/mobile screenshots, detect responsive and browser-runtime failures, semantically review every image, and optionally remediate and rerun. Use when the user asks to screenshot or visually audit all endpoints without running the complete battle-test security, CRUD, and architecture cycle.

wolverin0 Skill

Standardize remediation decisions, baseline-policy entries, and legal-review banners for accepted, deferred, or policy-blocked audit findings.

wolverin0 Skill

Walk the H1-H11 hard-stops catalog systematically against an audit scope. Use as the FIRST audit phase after audit-method completes. Runs detection commands for each hard stop class and reports FOUND / NOT FOUND with evidence. If any hard stop is found, the audit verdict locks to 🛑 DO NOT LAUNCH.

wolverin0 Bundle

Audit websites, web apps, mobile apps, design systems, and user flows against the full public Checklist Design corpus. Use for comprehensive or targeted product/UI/UX audits, source-linked inspiration comparisons, evidence-backed scoring, and remediation plans.

wolverin0 Skill

Audit what a normal production app at this scale would have but is absent — health checks, error tracking, feature flags, audit logs, on-call. Run as part of /audit Phase E.

wolverin0 Skill

Audit the security domain — auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.

wolverin0 Skill

Audit the database and data layer — schema design, query patterns, migrations, indexing, RLS, soft-delete, transactions. Run as part of /audit Phase E.

wolverin0 Skill

Audit the legal/privacy/compliance signals — privacy policy alignment, data retention, GDPR/CCPA basics, cookie consent, export/delete capabilities. Run as part of /audit Phase E.

wolverin0 Skill

Audit the performance domain — query efficiency, caching, async / blocking calls, payload sizes, scaling assumptions. Run as part of /audit Phase E.

wolverin0 Skill

Audit the reliability domain — error handling, retries, idempotency, race conditions, partial failures, timeouts, graceful degradation. Run as part of /audit Phase E.

wolverin0 Skill

Audit the architecture and code quality domain — module boundaries, abstraction layers, code organization, naming, documentation. Run as part of /audit Phase E.

wolverin0 Skill

Audit the gap between demo-quality and production-quality — hardcoded test data, dev-only configurations shipped, missing prod hardening. Run as part of /audit Phase E.

wolverin0 Skill

Audit code integrity and coherence — duplication, hallucinated references, Tambon signatures, spec drift, Frankenstein patterns, mystery code. THIS DOMAIN incorporates findings from the Tambon hunt and most of the blind-spots walk. Run as part of /audit Phase E.

wolverin0 Skill

Audit the dev experience and maintainability — local setup, documentation, test quality, CI feedback time, debuggability. Run as part of /audit Phase E.

wfukatsu-architecture-redesign-agent Skill

セキュリティ分析エージェント - 既存システムのセキュリティ状況を分析し、OWASP Top 10対応状況とゼロトラスト準備状況を評価。/security-analysis [対象パス] で呼び出し。

datasciencemonkey Bundle

Unity Catalog system tables and volumes. Use when querying system tables (audit, lineage, billing) or working with volume file operations (upload, download, list files in /Volumes/).

ckorhonen Bundle

Security audit smart contracts for exploitable vulnerabilities from an unprivileged context. Use when analyzing Solidity contracts, reviewing bytecode, testing exploits on forks, or searching for ways to extract funds without owner access. Covers verified and unverified contracts, bytecode disassembly, vulnerability ranking, proof-of-concept exploit generation, DeFi protocol attacks, and cross-chain bridge security.

adelaidasofia Skill

Use when maintaining the vault ITSELF as a system, not its content: knowledge-graph build/rebuild/query (graphify), second-brain mapping, vault diagnose/audit/hygiene, drift detection, extract rules from vault, backfill journals, setup vault types, consolidate memory (index over cap), Obsidian tooling (CLI/Bases/Markdown/JSON Canvas), vault bloat or Obsidian slow. Answering questions FROM the graph, use graph-query tools; daily journal/coaching/pattern detection, use those skills.

ahgraber Bundle

Use to cut slop out of working code: duplication, dead code, needless indirection, comment noise, defensive padding. Point it at the current changes, a file, a directory, or the whole repo. Triggers: 'simplify this', 'clean this up', 'de-slop this code', 'strip the cruft', 'tighten this diff', 'this code is bloated', 'audit this for slop'. Not for judging correctness or merge readiness (use code-review), and not for structural change that needs a plan and approval (use refactor).

adelaidasofia Skill

Use when the user says /security-snapshot, /snapshot <domain>, "run a security check on X", "generate a security report for [company]", or wants a security hygiene snapshot or free lead-magnet report on a prospect's public domain: SSL/TLS grade, HTTP security headers, SPF/DMARC email authentication, server fingerprint leaks. Passive, unauthenticated scans only. NOT for penetration testing, internal infrastructure audits, or application-layer vulnerability assessment.

adelaidasofia Skill

Use when correctness matters more than speed: about to commit non-trivial code, make an architectural call under uncertainty, work in unfamiliar code, or assert what the compiler cannot check ('this is safe', 'thread-safe', 'this scales', 'matches the spec'). Strongest on high-stakes surfaces (production deploys, security-sensitive logic, data migrations, irreversible operations) and when the user asks to sanity-check, red-team, double-check, or get a second opinion on a decision.

muhammedalkhudiry Skill

Read-only audits of project verification coverage, effectiveness, reliability, and cost across tests, static analysis, lint, and CI.

ahgraber Bundle

Use when writing or reviewing code that handles external input, manages access, touches data or crypto, or changes dependencies. Triggers: endpoints, auth/authz, DB/ORM, file handling, secrets, "is this secure?", "security review". NOT for formatting, pure UI, or explaining code.

ao-cyber-systems Skill

Manage milestones: start a new one, audit a finished one, complete it, or plan gap-closure objectives. Subcommand-style: /devflow:milestone new | audit | complete | gaps Use when explicitly requested.

ao-cyber-systems Skill

Scan the codebase for security vulnerabilities — checks for secrets, auth flaws, dependency risks, and OWASP Top 10 issues. Standalone — works without project setup. Covers secrets, auth, dependencies, and code-level vulnerabilities. Triggers on: "security audit", "scan for vulnerabilities", "check for secrets", "security review", "find security issues"

ao-cyber-systems Bundle

Validate that a monorepo follows the AO Cyber Systems layout convention — root CLAUDE.md declares every area, every area has its own CLAUDE.md, no compiled binaries are tracked in git. Reads the root `CLAUDE.md` Layout table, walks the working tree, and reports drift in a single Markdown summary. Standalone — works on any repo. Triggers on: "audit monorepo layout", "monorepo doctor", "is this monorepo healthy?", "check the layout", "find binaries in the repo".

ahgraber Bundle

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.