Security

serpro69 Bundle

Code review of current git changes with an expert senior-engineer lens. Detects SOLID violations, security risks, and proposes actionable improvements. Use when performing code reviews.

serpro69 Bundle

Review a written architecture artifact — an ADR (docs/adr/), a broader architecture doc, the architecture section of a design doc, or a domain-reference kit (glossary + traps pages, reviewed as one composite artifact) — against the system it claims to describe. Verifies the EXISTENCE and TOPOLOGY of declared mechanisms (structural boundaries, data ownership, NFR mechanisms, failure isolation, state consistency, evolution/versioning, domain binding) plus decision soundness, reversibility, and provenance (self-certification of reverse-engineered claims). Use after an ADR, architecture doc, domain glossary, or domain kit is written, before or during implementation. NOT for behavioral/runtime correctness (that is $kk:review-code and $kk:review-spec). Security architecture is out of scope — delegate threat modeling to the PAL secaudit tool (mcp__pal__secaudit).

damilola-elegbede-org Bundle

Manage dependencies with security scanning and safe updates. Use when auditing or updating dependencies.

akaihola Bundle

Check whether every deployment of a skills repo is current across a fleet of accounts and machines. Use when the user asks "are my skills up to date everywhere", "audit skill deployments", "find stale or broken skill links", or after changing how skills are deployed. Reports only anomalies — stale checkouts, broken symlinks, cross-user absolute links, and copies that have drifted from the repo.

greenmamba29 Skill

Scans and opens PRs for outdated npm/pip/cargo dependencies weekly. Use to automate dependency maintenance and security patching across repositories.

greenmamba29 Skill

Automatically review GitHub pull requests for code quality, security vulnerabilities, style violations, missing tests, and logical errors. Posts inline comments and a summary review via the GitHub API.

greenmamba29 Skill

Audit supplier networks, procurement records, and logistics data to identify ESG risks, compliance gaps, pricing anomalies, and single-source dependencies. Generates risk-scored supplier reports.

greenmamba29 Skill

Scans application dependencies, container images, and infrastructure for known CVEs and security vulnerabilities with automated remediation suggestions

damilola-elegbede-org Bundle

Vet any idea, artifact, or output by running it through all seven InfoSec color-wheel team constructs — Red attacks it, Blue mitigates, Yellow prices the build, Orange hardens the design, Green makes failure visible, Purple re-attacks the mitigations until nothing new surfaces, White issues the verdict. Read-only; returns PROCEED / PROCEED WITH CONDITIONS / REVISE / KILL plus a ranked fix list. Use when D says "run this through colorwheel", "red team blue team this", "wargame this idea", "stress-test this", or hands over an idea, plan, spec, draft, or output and asks whether it holds up. Not for genuine penetration testing or security auditing of real systems — those route to security-review.

buzzbysolcex Skill

Transaction governance layer for crypto wallet operations. 3-state evaluation: BLOCK / WARN / ALLOW with receipt. Schema-frozen with AION (Aldo/CODÉ). Checks token score, deployer identity, liquidity depth, and contract security before any wallet interaction proceeds.

dyoshikawa Skill

Review a pull request for code quality and security issues. Use when the user wants to review a PR, check PR code changes, or audit a pull request. Triggers on: "review PR", "review pull request", "check this PR", "the `review-pr` skill".

dyoshikawa Skill

Review a pull request for code quality and security issues without using subagents. Use when the user wants a lighter-weight PR review in a single skill.

dyoshikawa Skill

Scan for malicious code in git diff between a tag/commit and HEAD

toilahuongg Bundle

Comprehensive code investigation and audit tool. Discovers all project features, then dispatches parallel subagents to analyze issues, risks, dead code, missing functionality, and redundancies. Produces a prioritized risk report. Use this skill when the user asks to "investigate code", "audit project", "find risks", "check code quality", "analyze codebase", "what's wrong with this code", "project health check", "code review entire project", "find dead code", "find redundant code", or any request for a thorough codebase analysis.

toilahuongg Skill

Security best practices for Shopify Apps. Covers OWASP Top 10, authentication, data protection, webhook verification, and secure coding patterns for Remix applications.

tachyon-beep Bundle

Use when a system makes procedural decisions that must be defensible after the fact — rule firings, governor decisions, state transitions, gate verdicts, eligibility determinations, automated approvals — and you need a verifiable provenance chain rather than ordinary observability. Use when an auditor, regulator, customer, or court might later ask "prove it" about a decision the system made. Use when retention, redaction, or right-to-be-forgotten obligations conflict naively with append-only storage. Do not use for ordinary observability or for system-level threat modelling.

tachyon-beep Bundle

Use when writing or improving documentation - ADRs, APIs, runbooks, READMEs, architecture docs, security/compliance docs, post-mortems, register review or translation (technical/policy/government/public-facing/executive/academic), fact-checking research papers, or surgical edits on large (>=2000 line) files

mgriot Bundle

Expert Git, GitHub, and binary search automation. Use this skill for ALL git and GitHub (gh CLI) operations — version control, branching (switch/restore), semantic commits, worktrees, interactive rebase, bisect regression hunting, and secret/PII protection. Trigger on any mention of git commands, pull requests, commits, branches, merges, rebases, GitHub workflows, or version control problems, even if the user doesn't explicitly say "use git-pro".

aztr0nutzs Bundle

Use when you need Clawdbot to perform security operations, including vulnerability scanning, security audits, monitoring, threat detection, and compliance checks.

karchtho Bundle

Express middleware patterns including authentication, validation, error handling, rate limiting, request logging, CORS, compression. Use when implementing auth middleware, input validation, error handlers, rate limiting, request/response logging, or security middleware.

outfitter-dev Bundle

This skill should be used when auditing code for security issues, reviewing authentication/authorization, evaluating input validation, analyzing cryptographic usage, or reviewing dependency security. Provides OWASP patterns, CWE analysis, and threat modeling guidance.

karchtho Skill

Audit Unity scripts for modern development practices. Use when reviewing code for outdated patterns, checking Input System usage, async/await adoption, dependency injection, or object pooling opportunities.

karchtho Skill

Validate and audit game jam starter scripts for quality, integrity, and correct initialization. Use when running pre-jam checks, verifying startup scripts work, or auditing script quality before a game jam begins.

plevasseur Skill

Run the FLS spec lock audit and summarize changes.

plevasseur Skill

Audit FLS drift for an issue, write an evidence report, and open a spec-lock-only PR when guideline updates are not required.

outfitter-dev Bundle

Scan codebase for Outfitter Stack adoption candidates. Identifies throw statements, console usage, hardcoded paths, and custom errors. Use when assessing adoption scope or checking readiness.

outfitter-dev Skill

Audits code for Outfitter Stack compliance including Result types, error handling, logging patterns, and path safety. Use for pre-commit reviews, code quality checks, migration validation, or when "audit", "check compliance", "review stack", or "stack patterns" are mentioned.

outfitter-dev Skill

Audits Claude Code plugins for structure, quality, and best practices. Use when validating plugins, checking plugin health, or before publishing.

ingpoc Skill

Design a deterministic blocking gate for a repeated unsafe or invalid transition after advisory guidance has failed. Use when the operator asks to enforce a state transition, prevent a destructive or secret-bearing action, or convert a proven verification rule into a runtime guard. Do not assume Claude hook events or invent a hook surface; confirm the current runtime's supported mechanism first.

ingpoc Bundle

Compatibility and deterministic maintenance layer for locally authored skills. Use when the official skill-creator has drafted a skill, or when the operator asks to audit, validate, optimize, shrink, repair, or diagnose activation of an existing skill. Owns local schema, reference, and progressive-disclosure checks; it does not own first-draft authoring or portfolio-level duplicate routing.

jasonwarrenuk Skill

Investigate this repo's dependencies in detail

joellewis-skill-library Skill

Builds investor pitches and funding proposals that prove a 'secret' through data and narrative — answering 'Why Now?' and 'Why Us?' using Thiel's definite optimism framework. Use when creating pitch decks, internal presentations, or funding requests.

qte77-claude-code-utils Bundle

Apply OWASP MAESTRO, MITRE ATLAS, NIST AI RMF, and ISO 42001/23894 security frameworks to MAS designs

qte77-claude-code-utils Bundle

Provides concise, focused code reviews matching exact task complexity requirements. Use when reviewing code quality, security, or when the user asks for code review.

zoom-skills Bundle

Zoom WebSockets for real-time event notifications via persistent connection. Alternative to webhooks with lower latency, bidirectional communication, and enhanced security. Use when you need real-time event updates, are in security-sensitive industries, or want faster event delivery than webhooks.

qte77-claude-code-utils Skill

Audit README.md files against best practices for repos, accounts, or orgs. Detects missing sections, stale links, inconsistent formatting, and convention violations. Use when reviewing README quality across one or many repos.