Security

lonsdale201 Skill

Choose, create, or audit classic PHP WordPress template files for WP 7.1 using the template hierarchy. Covers `template-loader.php`, `index.php` fallback, `front-page.php` vs `home.php`, page/single/archive/taxonomy/search/404/attachment templates, `get_template_part()` with `$args`, child-theme override order, `template_include`, the `is_sitemap()` conditional, and why `template_redirect` should not include-and-exit. Use when deciding which classic template file to add or reviewing page.php/404.php/single/archive behavior.

lonsdale201 Skill

Build or audit media and image output in classic WordPress themes on WP 7.1. Covers `add_theme_support( 'post-thumbnails' )`, `add_image_size()`, `set_post_thumbnail_size()`, `has_post_thumbnail()`, `the_post_thumbnail()`, `get_the_post_thumbnail()`, `wp_get_attachment_image()`, responsive `srcset` and `sizes`, `loading`/`decoding`/`fetchpriority`, attachment metadata contracts, client-side processed uploads, alt text, decorative images, regeneration requirements, and common mistakes such as hand-built `img` tags, full-size archive images, removed dimensions, and broken CLS.

lonsdale201 Bundle

Build or audit a WooCommerce Checkout Block payment-method integration. Covers the separate PHP `WC_Payment_Gateway`, Blocks `AbstractPaymentMethodType`, JavaScript `registerPaymentMethod`, stable gateway identifiers, `onPaymentSetup`, Store API `payment_data`, saved-token UI, legacy `process_payment()` bridging, advanced `PaymentContext`/`PaymentResult` processing, SDK confirmation, security, performance, and classic-versus-Block tests. Use when a gateway works in shortcode checkout but is missing or broken in Checkout Block, or when adding card fields, wallets, tokenization, redirects, or custom payment data to Blocks.

lonsdale201 Bundle

Implement or audit WordPress block editor extensions for the always-iframed post editor in WordPress 7.1. Covers parent UI versus editor-canvas documents, ownerDocument/defaultView, @wordpress/compose useRefEffect, DOM events and observers, block and editor asset placement, block metadata styles, portals/popovers, iframe-safe selections and measurements, persistent admin toolbar effects, classic-theme behavior, Document-Isolation-Policy interaction, and migration testing. Use when editor JavaScript queries document/window, injects styles, listens globally, measures blocks, renders overlays, manipulates selection, adds metabox/editor UI, or breaks after upgrading to WP 7.1.

lonsdale201 Skill

Build or audit WooCommerce shop/archive loops and product cards in a classic PHP theme. Covers `archive-product.php`, `content-product.php`, product taxonomy templates, `woocommerce_product_loop()`, `woocommerce_product_loop_start/end()`, `wc_get_loop_prop()`, `wc_get_template_part( 'content', 'product' )`, `wc_product_class()`, loop hooks, product cards, sale flash, thumbnails, ratings, price, add-to-cart ARIA, result count, ordering, pagination, no-products state, grid columns, and avoiding raw `WP_Query`/postmeta product loops.

lonsdale201 Bundle

Integrate, configure, or audit LW Firewall's password-reset flood protection across core WordPress, WooCommerce, custom lost-password forms, REST handlers, administrator recovery, proof tokens, per-IP/account/global limits, alerts, and reset auto-bans. Use when code references `lostpassword_post`, `lostpassword_form`, `allow_password_reset`, `PasswordResetGuard`, `ResetLimiter`, `ResetPenalty`, `reset_*` options, `retrieve_password`, reset email floods, reset honeypots, `lw_fw_reset_token`, or `wp lw-firewall reset`.

lonsdale201 Skill

Build or audit classic theme widget areas and sidebars for WP 7.1. Covers `widgets_init`, `register_sidebar()`, stable sidebar IDs, `before_widget` and `before_title` wrappers, `dynamic_sidebar()`, `is_active_sidebar()`, `get_sidebar()`, `sidebar-{name}.php`, `show_in_rest`, semantic aside/footer/header widget areas, block-widget era compatibility, and common mistakes such as missing IDs, changing IDs after release, hardcoded widgets, bad wrapper placeholders, and rendering empty sidebars.

community-access Skill

Repository administration command center -- add and remove collaborators, configure branch protection, manage webhooks, adjust repository settings, audit access, and synchronize labels and milestones across repos.

lonsdale201 Skill

Write or audit secure modern classic PHP WordPress theme code for WP 7.1. Covers template output escaping, `esc_html`, `esc_attr`, `esc_url`, `wp_kses_post`, `wp_json_encode`, translation escaping, unslashing plus sanitizing input, validation, nonces and capability checks for theme forms, safe `template_include`/`get_template_part`, enqueued assets instead of inline tags, prepared database queries, WPCS naming/filenames, namespacing/prefixing, no shorthand PHP tags, and no closing PHP tag. Use when reviewing `functions.php`, `header.php`, `page.php`, `404.php`, template parts, search/comment forms, or any classic theme code touching request data or dynamic output.

lonsdale201 Skill

Audit or implement WordPress plugin/theme output so TranslatePress can translate it correctly. Use when code must be compatible with TranslatePress visual translation, gettext string translation, dynamic JS-inserted text, automatic translation exclusions, AJAX/REST-rendered fragments, language-aware caches, or user-facing text generated by shortcodes, widgets, forms, WooCommerce templates, page builders, or theme templates.

lonsdale201 Skill

Build or audit classic theme comments output for WP 7.1. Covers `comments_template()`, `comments.php`, `post_password_required()`, `have_comments()`, `wp_list_comments()`, comment pagination, `comment_form()`, threaded comment reply script loading, closed-comment messaging, accessible comment navigation, excluding private editor Notes, escaping comment titles and labels, and common mistakes such as custom comment forms, missing password guards, loading `comment-reply` globally, broken callback walkers, or showing comments on unsupported post types.

lonsdale201 Skill

Build or audit classic theme loops and PHP template parts for WP 7.1 without block/FSE assumptions. Covers the main Loop with `have_posts()` and `the_post()`, archive/search/single/page content choices, `get_template_part()` with `$args`, `content-none.php`, `post_class()`, secondary `WP_Query` loops with `wp_reset_postdata()`, `rewind_posts()`, pagination, single post navigation, and common bugs such as `query_posts()`, nested loops without reset, raw globals in template parts, and missing no-results states.

lonsdale201 Skill

Build or audit WooCommerce support in a classic PHP WordPress theme. Covers `add_theme_support( 'woocommerce' )`, `wc_current_theme_supports_woocommerce_or_fse()`, supported vs unsupported theme rendering, shop/single wrappers, `woocommerce_before_main_content` and `woocommerce_after_main_content`, product image widths, `product_grid`, gallery zoom/lightbox/slider support, Woo body/post classes, conditional asset loading with `is_woocommerce()`/`is_shop()`/`is_product()`, and the classic-theme boundary versus Woo block templates.

lonsdale201 Skill

Build or audit TranslatePress language UI compatibility for WordPress themes/plugins. Use for custom language switchers, `[language-switcher]`, `trp_custom_language_switcher()`, `[language-include]`, `[language-exclude]`, legacy `[trp_language]`, per-language menus, Navigation Based on Language, conditional language content, Automatic User Language Detection popup/hello bar, translator accounts, Browse as User Role previews, admin bar visibility, and role-specific or logged-in/logged-out translated content.

lonsdale201 Skill

Create or audit WooCommerce template overrides in a classic PHP theme. Covers the `yourtheme/woocommerce/` override path, the WooCommerce template path, `wc_get_template()`, `wc_get_template_part()`, `woocommerce.php`, `single-product.php`, `archive-product.php`, taxonomy templates, `WC_TEMPLATE_DEBUG_MODE`, template `@version` headers, WooCommerce Status outdated-template checks, hook/filter-first customization, child themes, escaping, and when not to override cart/checkout/account/email templates.

lonsdale201 Skill

Audit or implement TranslatePress-compatible WordPress plugin emails, WooCommerce emails, transactional notifications, cron/CLI emails, wp_mail usage, preferred-user-language delivery, trp_translate(), trp_switch_language(), trp_language user/order meta, and email gettext scanning. Use when code sends registration, order, membership, LMS, subscription, invoice, reminder, status, or admin-triggered emails that must arrive in the recipient's language.

asiaostrich Skill

Scan codebase for debug artifacts and code quality issues; optionally auto-fix safe patterns. Use when: before committing, during PR review, or periodic codebase cleanup. Not for: structural code improvement — use /refactor; security-specific scanning — use /scan. Keywords: sweep, debug cleanup, console.log, debugger, TODO, ts-any, code quality.

prorise-cool Skill

Intelligent system governor that continuously shadow-tests APIs for performance while enforcing strict financial and security guardrails against runaway costs.

asiaostrich Skill

[UDS] Diagnose UDS installation health and submit structured feedback upstream. Use when: .standards/ looks broken or out of sync, verifying manifest integrity, reporting friction with an existing UDS standard. Not for: auditing your own application code quality — use /metrics or /code-review; dependency and secret scanning — use /scan. Keywords: UDS audit, health check, manifest integrity, standards feedback, friction, 安裝健康, 標準稽核, 回饋.

asiaostrich Skill

Guide security review and vulnerability assessment following OWASP standards. Use when: security audit, vulnerability check, secure coding review, threat modeling. Not for: automated dependency, CVE, and secret scanning — use /scan; handling a breach in progress — use /incident. Keywords: security, OWASP, vulnerability, authentication, authorization.

jarle Skill

Check your installed packages for known security vulnerabilities

community-access Skill

GitHub security alerts command center -- triage Dependabot, code scanning, and secret scanning alerts entirely from the editor. Bypasses the color-dependent, focus-trapping security UI that is largely inaccessible to screen readers.

asiaostrich Skill

Guide automated security scanning, dependency auditing, and secret detection. Use when: dependency audit, CVE scanning, secret detection, license compliance. Not for: manual threat modeling and secure design review — use /security; general code cleanliness — use /sweep. Keywords: scan, audit, CVE, dependency, secret, SBOM, vulnerability.

crestapps Bundle

Skill for configuring security and authorization in Orchard Core. Covers permission definitions, authorization services, CORS, security headers, content security policies, and OpenID Connect. Use this skill when requests mention Orchard Core Security, Configure Security and Authorization, Enabling Security Features, Security Headers Configuration, CORS Configuration via Recipe, OpenID Connect Server Setup, or closely related Orchard Core implementation, setup, extension, or troubleshooting work. Strong matches include work with OrchardCore.Security, OrchardCore.Cors, OrchardCore.ReverseProxy, OrchardCore.OpenId, OrchardCore.OpenId.Server, OrchardCore.OpenId.Validation, OrchardCore.Security.Permissions, OrchardCore.ContentManagement, OrchardCore.Contents.Security. It also helps with security examples, CORS Configuration via Recipe, OpenID Connect Server Setup, OpenID Server Settings, plus the code patterns, admin flows, recipe steps, and referenced examples captured in this skill.

bookforge-ai Bundle

Run the full SUCCESs stickiness audit on a draft message, pitch, announcement, slide, speech, landing page, or internal memo — the book's capstone diagnostic. Scores the draft across the six SUCCESs principles (Simple, Unexpected, Concrete, Credible, Emotional, Stories) plus the Curse of Knowledge villain axis on a 0/1/2 per-dimension scale (it is a checklist, not an equation), quoting evidence from the draft for every score and producing a top-3 prioritized fix list ranked by impact times effort. Use this skill whenever the user says things like "audit this message", "score this draft", "is this sticky", "run the SUCCESs check", "run the checklist", "will people remember this", "how good is this pitch", "rate this against Made to Stick", "does this pass the kidney heist test", "will this land", "stickiness review", "why is nobody remembering our launch", "I need a communications review", or when any user pastes a draft and asks whether it will resonate, be remembered, or change behavior. Also triggers when a

crestapps Skill

Skill for configuring audit trail in Orchard Core. Covers audit event recording, AuditTrailPart for content tracking, event filtering and sorting, audit settings configuration, custom audit event providers, and audit trail feature setup. Use this skill when requests mention Orchard Core Audit Trail, Configure Audit Trail and Event Tracking, Enabling Audit Trail, Audit Trail Event Categories, Audit Trail Event List Features, Attaching AuditTrailPart via Migration, or closely related Orchard Core implementation, setup, extension, or troubleshooting work. Strong matches include work with OrchardCore.AuditTrail, OrchardCore.ContentManagement.Metadata, OrchardCore.Data.Migration, OrchardCore.AuditTrail.Services, OrchardCore.AuditTrail.Services.Models. It also helps with Audit Trail Event List Features, Attaching AuditTrailPart via Migration, Attaching AuditTrailPart via Recipe, plus the code patterns, admin flows, recipe steps, and referenced examples captured in this skill.

crestapps Bundle

Skill for managing users, roles, and permissions in Orchard Core. Covers user registration, role creation, permission definitions, custom user settings, and authentication configuration. Use this skill when requests mention Orchard Core Users & Roles, Manage Users, Roles, and Permissions, Enabling User and Role Features, Defining Custom Permissions, Registering Permission Provider, Checking Permissions in Code, or closely related Orchard Core implementation, setup, extension, or troubleshooting work. Strong matches include work with OrchardCore.Users, OrchardCore.Roles, OrchardCore.Users.Registration, OrchardCore.Users.ResetPassword, OrchardCore.Users.CustomUserSettings, OrchardCore.Security.Permissions, IPermissionProvider, IAuthorizationService. It also helps with users roles examples, Registering Permission Provider, Checking Permissions in Code, Checking Permissions in Liquid, plus the code patterns, admin flows, recipe steps, and referenced examples captured in this skill.

bookforge-ai Skill

Audit and score an existing offer or service using the four-driver perceived value formula (Hormozi's "Value Equation"): Dream Outcome × Perceived Likelihood of Achievement ÷ (Time Delay × Effort & Sacrifice). Use this skill when an offer is underpriced relative to its actual value, getting price objections, or failing to convert despite being genuinely good. Scores each driver on a binary 0/1 rubric, identifies which drivers are dragging value down, and produces concrete improvement actions for each weak driver. Triggers include: "why won't people pay for this?", "how do I raise my price?", "my offer isn't converting", "I need to make my service more compelling", "how do I justify my premium", "should I be charging more?", "what makes my offer valuable?", "how do I compete against cheaper alternatives?". Applies to: consulting, coaching, courses, agencies, productized services, physical products, SaaS, any offer where perceived value determines willingness to pay.

bookforge-ai Bundle

Audit any set of study habits, training program, or course design for ineffective learning practices and replace them with evidence-based alternatives. Use this skill when someone wants a study habits audit, suspects they are making learning mistakes, reports that their studying is not working, relies on rereading, highlighting, or cramming, wonders whether their training design actually produces learning, or asks "what am I doing wrong?" Also triggers on: ineffective studying complaints, rereading concerns, learning styles assumptions, cramming before an exam, blocked practice schedules, highlighting as primary review method, "I study for hours but nothing sticks," or any study strategy review. Works for individual learners, teachers, corporate trainers, instructional designers, and coaches. Detects five named anti-patterns — rereading trap, massed practice delusion, illusions of knowing cluster, learning styles myth, errorless learning myth — with mechanism explanations, severity ratings, and direct routing

bookforge-ai Bundle

Diagnose and correct false confidence in learning mastery using cognitive science research. Use when you feel confident about a topic but keep failing tests, want to audit your metacognition for illusions of knowing, are preparing for a high-stakes assessment and need to verify actual mastery, or suspect your study method is producing Dunning-Kruger overconfidence. Also use for: identifying which of 7 specific cognitive distortions — fluency illusion, hindsight bias, Dunning-Kruger overconfidence, curse of knowledge, false consensus, imagination inflation, social memory contamination — is inflating your self-assessment accuracy; distinguishing reliable mastery indicators (delayed recall, novel problem transfer, peer explanation) from unreliable ones (rereading fluency, immediate recall, familiarity warmth); selecting calibration instruments (self-quizzing, cumulative quizzing, peer instruction) matched to the specific distortions detected; designing a dynamic testing cycle (assess → identify gaps → target pra

bookforge-ai Bundle

Diagnose a draft for the Curse of Knowledge — the expert blind spot that makes insiders write copy full of unexplained jargon, buried assumptions, strategy-level abstractions, and tacit shared context that lose non-expert audiences. Use this skill whenever reviewing a pitch, announcement, explainer, landing page, onboarding doc, slide, internal memo, or technical write-up for clarity to a non-expert. Activate when the user says things like "why isn't my message landing", "make this clearer", "my audience doesn't get it", "I can't tell if this is too technical", "diagnose this draft", "is this too jargony", "expert blind spot", "tapper listener", "translate for non-experts", "audit this for jargon", "I'm too close to this", or provides a draft plus an audience description and asks for a clarity critique. Also triggers when a user complains that smart readers stare blankly at their copy, when an explainer is full of acronyms, when an announcement leads with context instead of news, or when a strategy deck reads

bookforge-ai Bundle

Incorporate quoted, paraphrased, and summarized sources into research writing by applying a 3-branch selection decision tree, 3 integration methods for quotations, and a 5-mechanism inadvertent plagiarism prevention checklist. Use this skill when drafting or revising a paper that uses sources and you need to decide whether to quote, paraphrase, or summarize a passage; when you need to weave quotations into your prose grammatically and meaningfully; when you need to make explicit to readers why evidence is relevant; when you must choose a citation style; or when you want to audit a draft for the five most common forms of inadvertent plagiarism before submitting.

crestapps Skill

Skill for configuring reverse proxy support in Orchard Core. Covers forwarded headers middleware (X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host), configuration sources (admin UI vs file-based), security considerations for trusted proxies, and multi-tenancy forwarding. Use this skill when requests mention Orchard Core Reverse Proxy, Configure Reverse Proxy Support, Enabling the Reverse Proxy Feature, Configuration Options, Admin UI Configuration (Scenario 1), File-Based Configuration (Scenario 2), or closely related Orchard Core implementation, setup, extension, or troubleshooting work. Strong matches include work with OrchardCore.ReverseProxy, ConfigureReverseProxySettings, OrchardCoreBuilder, CreateBuilder, appsettings.json. It also helps with Admin UI Configuration (Scenario 1), File-Based Configuration (Scenario 2), Partial Override Configuration (Scenario 3), plus the code patterns, admin flows, recipe steps, and referenced examples captured in this skill.

bookforge-ai Bundle

Classify any learning activity, practice structure, or instructional design element as a desirable difficulty (strengthens encoding) or undesirable difficulty (creates friction without learning benefit). Use this skill when an instructional designer, trainer, teacher, or learner wants to audit a course design, training session, study method, or practice regimen for evidence-based difficulty management — even if they don't use the phrase "desirable difficulty." Applies to onboarding programs, corporate training, academic course design, self-study plans, coaching sessions, and skill development programs. Identifies which of six proven difficulty strategies are present or absent (spacing, interleaving, variation, retrieval, generation, elaboration) and generates specific redesign recommendations. Do NOT use this skill to build a full study schedule (use retrieval-practice-study-system), to assess learner readiness or aptitude, or to evaluate content quality unrelated to difficulty structure.

bookforge-ai Bundle

Analyze customer conversation notes or transcripts after a meeting to classify every statement as fact, compliment, fluff, or idea — separating real signal from noise. Use this skill whenever the user wants to review interview notes, check whether a customer call produced reliable data, figure out if enthusiastic feedback was genuine interest or polite lies, identify bad data patterns in a transcript, audit whether a conversation that "went great" actually produced usable facts, or suspects they are collecting compliments instead of validated evidence — even if they don't mention "data quality" or "bad data." Do NOT use this skill to write or improve questions before a conversation (use conversation-question-designer) or to evaluate whether a meeting produced real commitment signals like time, reputation, or money (use commitment-signal-evaluator).

crestapps Bundle

Skill for implementing Orchard Core permission providers. Covers the PermissionProvider pattern, default stereotypes, OrchardCoreConstants role names, and where to place reusable static permission instances and reusable content-part models. Use this skill when requests mention Orchard Core Permission Providers, Create a Permission Provider, Recommended Project Placement, Static Permission Definitions in a Core Project, PermissionProvider Class, Registering the Provider, or closely related Orchard Core implementation, setup, extension, or troubleshooting work. Strong matches include work with CrestApps.Sports.Teams.Core, OrchardCore.Security.Permissions, CrestApps.Sports.Teams.Core.Permissions, CrestApps.Sports.Teams, OrchardCore.Modules. It also helps with permission provider examples, PermissionProvider Class, Registering the Provider, Content Part Placement Guidance, plus the code patterns, admin flows, recipe steps, and referenced examples captured in this skill.