Security

jefflyt Skill

Gather natural-language context and generate runtime/process evidence collection guidance for Mandate 2.3.7 (UI/UX Behavioural Safeguards and Trust Calibration), including concrete system command templates and artifact checklists for final compliance evaluation.

jefflyt Skill

Gather natural-language context and generate runtime/process evidence collection guidance for Mandate 2.4.1 (Resource Consumption Limits), including concrete system command templates and artifact checklists for final compliance evaluation.

ccplugins Skill

Adversarial self-review for code that touches a trust boundary. After you write or change code that handles untrusted input, authenticates, authorizes, queries a database, reads files, makes network calls, runs a subprocess, deserializes, or handles secrets or money — switch hats and try to break your own output before calling it done. Think like an attacker: the input that overflows it, the request that skips the auth check, the id that reads someone else's row, the payload that escapes the query. Fix what lands, report what you tried. Supports intensity levels: lite, full (default), ultra. Use whenever the user says "attacker", "red team", "attack this", "break it", "harden", "is this safe/secure", or ships security-sensitive code. This is DEFENSIVE — you attack your OWN code to fix it. Do NOT use to attack systems you don't own, or for non-coding requests.

martinopolo Skill

Reviews a branch, working diff, or PR across specialist axes (security, performance, tests, quality) and optionally applies the fixes. Use when asked to review code, changes, or a pull request.

martinopolo Skill

Diagnoses and fixes fallow dead-code audit failures, suppressing or baselining findings when justified.

ccplugins Skill

Applica regole di sicurezza (hardening) ogni volta che si costruisce, modifica o revisiona un sito web o un'app. Copre security headers, CSP, HTTPS, validazione input, cookie, CORS, upload, gestione errori e OWASP Top 10. Trigger - "crea un sito", "costruisci un'app", "metti in sicurezza", "proteggi il sito", "hardening", "security headers", "build a website".

ccplugins Bundle

Aggiunge alle repository GitHub dei siti workflow di sicurezza automatici - scansione dipendenze vulnerabili, ricerca di segreti/chiavi nel codice, analisi statica CodeQL e Dependabot. Trigger - "sicurezza repo", "GitHub Actions di sicurezza", "scansione repository", "metti la sicurezza nella repo", "dependabot", "secret scanning".

ccplugins Skill

Protegge dati di pagamento e abbonamenti quando un sito/app gestisce checkout, carte, subscription o fatturazione. Copre integrazione sicura Stripe/PayPal, verifica firma webhook, PCI-DSS, GDPR, minimizzazione dati e ciclo di vita degli abbonamenti. Trigger - "pagamenti", "checkout", "abbonamento", "subscription", "Stripe", "PayPal", "carta di credito", "fatturazione", "privacy dei pagamenti".

ccplugins Bundle

Progetta e installa un'infrastruttura di sicurezza a 4 livelli dove il cuore (dati e chiavi) è offline e staccato, lo scudo è invisibile agli scanner e il server reale è nascosto. Usare quando l'utente vuole un sistema "chiuso in una scatola", un reverse proxy invisibile, un'alternativa self-hosted a Cloudflare, server nascosto, VPN WireGuard, o backup offline irraggiungibili. Trigger - "fortezza", "scatola chiusa", "offline", "invisibile", "nascosto", "mini cloudflare", "reverse proxy", "air gap", "cassaforte", "WireGuard".

ccplugins Skill

Implementa autenticazione sicura quando un sito/app richiede registrazione, login o account utente. Copre verifica email con codice, autenticazione a due fattori (2FA/TOTP), passkey e chiavi di sicurezza, hashing password, sessioni e recupero account. Trigger - "login", "registrazione", "verifica email", "codice di verifica", "2FA", "doppio fattore", "autenticazione", "passkey", "account utente".

catlog22 Bundle

OWASP Top 10 and STRIDE security auditing with supply chain analysis. Triggers on "security audit", "security scan", "cso".

martinopolo Skill

Repo-wide audit of code-quality suppressions (eslint-disable, ts-ignore, fallow-ignore) that fixes unjustified ones and opens a PR.

scdenney Bundle

Fact-check manuscript claims against cited sources in a per-source Markdown knowledge base. Use to audit claim support, overclaiming, direction, scope, and misattribution after source intake is complete.

scdenney Bundle

Operate or audit a live Qualtrics survey via the v3 APIs without breaking fielding — publish gating, quotas, flow routing, embedded data, panel-vendor redirects, read-back verification, and a read-only pre-fielding audit. Use when publishing or patching a fielding instrument, when a quota counts but never blocks, when wiring panel-vendor redirects or flow gates, or when auditing a survey before launch (consent-before-anything gates, force-response completeness, quota and redirect checks, anti-bot instrumentation, and language-arm symmetry).

scdenney Bundle

Scaffold or audit an entire research project repository organized around its source library. Use when starting, structuring, organizing, or reviewing a research repo. Build sources/{og,md,unprocessed}, references.bib, a PDF-to-Markdown converter, a repo-local process-source skill, AGENTS.md, .gitignore, .venv, and the relevant analysis/manuscript/review folders; or audit an existing layout. Not for one-PDF intake or publication replication packages.

scdenney Bundle

Audits the citation layer of a manuscript — in-text and reference-list parity, fabricated or nonexistent sources, DOIs that resolve to a different work, style and completeness against APA 7 or a named journal style, and whether each cited work actually supports the claim attached to it. Verifies against Crossref, OpenAlex, DataCite, and Semantic Scholar, drives LaTeX audits off the keys actually cited, and marks anything it cannot check as NOT CHECKED rather than guessing. Use when the user asks to check citations or references, suspects an AI-invented source, wants a .bib checked against the text, or asks whether the DOIs are right. Figures and tables go to figure-table-audit.

scdenney Bundle

Drafts a referee report on someone else's manuscript for a journal editor — a recommendation, a summary of the claim and design, three to six major concerns that drive the decision, additional concerns, and a coherent revision plan, produced by five parallel adversarial finders (Breaker, Butcher, Shredder, Void, Situator), a Blue Team error filter, a Chief Reviewer synthesis, and a Tone Guard legal pass, with an optional confidential note to the editor. Use when the user has been asked to referee a manuscript for a journal. Self-audit of the user's own draft goes to paper-review-lite or presubmit, and writing an author-side response to reviewers goes to referee-response.

scdenney Bundle

Draft or audit scientific introductions. Use for argument logic, framing, contribution structure, and coherence across multiple studies or experiments.

scdenney Bundle

Scaffold or audit a social-science replication package, and audit the manuscript and its archived research objects against the FAIR principles. Scaffold mode writes the folder structure, README, master.R, figure/table crosswalk, codebook template, LICENSE placeholder, .gitignore, and pre-release checklist. Audit mode grades an existing package against that checklist and runs the FAIR block over data, code, materials, prompts, preregistrations, DOIs, metadata, licenses, access restrictions, and availability statements. Use when setting up or repairing a replication package, checking one before submission, auditing research objects against FAIR (Findable, Accessible, Interoperable, Reusable), or drafting and verifying data-, code-, and materials-availability statements. Adapted from Yusaku Horiuchi's replication-package-guide; platform-neutral (Harvard Dataverse, OSF, Zenodo, GitHub releases, institutional archives).

scdenney Skill

Audit fielded survey response data for registered elements, data quality, bot and AI-automation screening, and sample integrity. Emits an appendix-ready quality report.

coowoolf Skill

A quality control mechanism with a designated interviewer from outside the hiring chain who has veto power to ensure candidates raise the bar (better than 50% of current employees in role). Amazon's talent density secret.

coowoolf Skill

Review your calendar, color-code activities by energy impact (Green/Red), and systematically delegate draining tasks to maximize time in your Zone of Genius.

lerianstudio Bundle

Using lib-commons v5, Lerian's shared Go library (non-observability surface), in two modes. Sweep Mode detects DIY code replaceable by lib-commons at file:line. Reference Mode catalogs lifecycle (Launcher), outbox repo, circuit breakers, tenant management, idempotency, security/TLS, database, and HTTP toolkit. Observability moved to ring:using-lib-observability. Go-only. Skip for non-Go.

ngxtm Bundle

Security standards for .NET applications based on OWASP guidelines.

ngxtm Bundle

Authentication, RBAC, and Hardening standards.

ngxtm Bundle

Security standards for Flutter applications based on OWASP Mobile.

lerianstudio Skill

Auditing a dependency for supply-chain risk before install (pip/npm/go/cargo): checks typosquatting, maintainer/age risk, vulnerability DBs (OSV, GHSA, Socket), and lockfile hash pinning, then emits a risk score and approve/conditional/escalate/block decision. Use when adding or updating a dependency, reviewing a dependency PR, or investigating a compromise. Skip when no new dependency is involved or it is already vetted.

ngxtm Bundle

Secure coding practices for building safe TypeScript applications.

ngxtm Bundle

Authentication, authorization, JWT, OAuth2, CSRF, CORS, and security filter chain.

rwilson504 Skill

Gap-analyze an existing Dataverse Classic Workflow against new requirements and flag risky patterns. Use when user says "I have new requirements, what needs to change", "does this workflow meet this spec", "gap analysis", "review this workflow", "what is wrong with this workflow", "why does this loop", "is this workflow going to run away", "audit this workflow", or supplies a requirements document alongside a `.xaml`. Produces a requirement-by-requirement verdict plus a change plan, and checks the documented failure modes: infinite-loop protection (the 16-in-a-short-window rule), hierarchical Under / Not Under operator behavior, scope and run-as mismatches, and MS Learn best-practice violations. Do NOT use for plain summarization (use dataverse-classic-read) or for applying the changes (use dataverse-classic-write).

sitaggart Bundle

Use when the user asks for a code review, PR review, pre-commit audit, or review of a branch or local diff after implementation exists. Review-only; use document-review for plans and requirements.

kesslerio Skill

Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture.

kesslerio Bundle

Create, edit, improve, tidy, review, audit, or restructure AgentSkills and SKILL.md files.

allanninal Skill

Review pull request for code quality, security, performance, and best practices. Use when reviewing PRs, checking code before merge, or providing feedback.

allanninal Skill

Hunt threats using Sigma detection rules and security analysis techniques. Use when investigating security incidents, creating detection rules, or analyzing suspicious activity.

allanninal Skill

Find bugs and security vulnerabilities in code changes. Use when analyzing branch changes, reviewing diffs, or hunting for defects.