Security

ariffazil Bundle

Audit env.local, SOPS .env, and config files for plaintext secret leaks, key age, missing rotation dates, and overlong-lived credentials. USE WHEN: "secret audit", "key age", "rotate secrets", "credential hygiene", "API key check", "env audit", "secret leak scan".

ariffazil Bundle

Automated TREE777 security checks for Telegram bot tokens, webhook isolation, bot permission scope, and A2A bridge security. v1.1.0: organ paths from registry, ports from live probes. USE WHEN: "telegram audit", "bot security", "webhook check", "token isolation", "TREE777 check", "telegram permissions".

ariffazil Bundle

Use when sealing audit decisions or recording constitutional events. Every decision logged. Irreversible decisions sealed. ΔS ≤ 0 on every output. Receipts > narratives.

oimiragieo Bundle

Expert Electron desktop application development — main/renderer process architecture, IPC communication, native OS APIs (menus, tray, notifications, dialogs), auto-updates, code signing, packaging with electron-builder/forge, security hardening (contextIsolation, sandbox), and performance optimization. Use for building cross-platform desktop apps.

ariffazil Bundle

VAULT999 witness — immutable ledger integration, seal chain verification, and audit trace.

boshi-xixixi Bundle

应用安全专家，专注于认证授权、数据保护和合规性审计。当用户需要：(1) 设计安全的登录认证系统 (2) 进行安全代码审查 (3) 检查 GDPR/隐私合规 (4) 防范常见安全漏洞 (OWASP Top 10) (5) 确保无障碍设计安全使用时使用此 Skill。

ariffazil Bundle

External constitutional audit and bounded forge planning for arifOS federation organs. Detects drift, challenges architecture claims, and prepares contracts.

ariffazil Bundle

Audit and reconcile documentation across federation repositories, preserving canonical signals while removing stale references and graph fragmentation. v2026.08.06: organ topology from registry, no hardcoded /root/<REPO> paths.

tibsfox Skill

Cascade the same edit pattern across N files safely. Use when applying the same refactor to multiple files (e.g. swap import paths across 11 scripts, rename a symbol, migrate a call signature). Detects the common-shape-across-files situation and turns an N-file cascade into a planned audit → apply → verify workflow instead of N sequential manual edits.

tibsfox Skill

Upstream version checking, agentskills.io spec compliance audit, Claude Code feature gap analysis. Activates on updates, version checks, or alignment work.

tibsfox Skill

Audit a skill by running a paired probe — the same task once with the skill loaded and once without — segment both traces into goal-directed phases, align phases, and emit a SIP report (surface anchoring, template copy, excess planning, task recovery, off-task artifact). Use whenever a skill is created, modified, or proposed for retirement. Pass-rate is BLIND to most skill effects: CTA (arxiv 2605.11946v1) shows a single skill can produce 522 measurable behavioural changes across 49 tasks while pass-rate moves only +0.3%. Triggers: "audit this skill", "is this skill helping", "retire skill", "before shipping skill", "behavioural impact of skill X", or any skill review event.

ariffazil Bundle

Capture session failure patterns as constitutional scars — reusable diagnostics that prevent repeat mistakes

ariffazil Skill

Static analysis + README truth checking. Multi-stage automated code health, type-checking, linting, unit test coverage, and AST security vulnerability auditor. Verify that repo READMEs accurately describe current structure, ports, dependencies, and authority boundaries.

ariffazil Bundle

Reverse-engineer the gap between current state and a hard external deadline. Produces a Tier 1/2/3 gap list and a 3-option

oimiragieo Bundle

YARA-X detection rule authoring with expert judgment, linting, atom analysis, and best practices. Teaches how to think like an expert YARA author for malware detection, threat hunting, and indicator-of-compromise identification using YARA-X (the Rust-based successor to legacy YARA).

crestapps Skill

Skill for administering tenant-specific cross-origin resource sharing in Orchard Core. Covers CorsSettings policies, CorsPolicySetting options, CorsService persistence, CorsOptionsConfiguration, admin configuration, deployment, and secure origin restrictions. Use this skill when requests mention Orchard Core CORS, CorsSettings, cross-origin requests, allowed origins, CORS policies, or closely related Orchard Core implementation, setup, extension, or troubleshooting work. Strong matches include work with OrchardCore.Cors, CorsSettings, CorsPolicySetting, CorsService, CorsOptionsConfiguration, CorsOptions, and ManageCorsSettings. It also helps with feature recipes, policy deployment, security validation, and the code patterns captured in this skill.

crestapps Skill

Skill for enforcing HTTPS and HSTS per Orchard Core tenant. Covers HttpsSettings, IHttpsService, HTTPS redirection, permanent redirect status, SSL port selection, HSTS modes, admin settings, and deployment. Use this skill when requests mention Orchard Core HTTPS, HttpsSettings, RequireHttps, HSTS, HTTPS redirection, strict transport security, or closely related Orchard Core implementation, setup, extension, or troubleshooting work. Strong matches include work with OrchardCore.Https, HttpsSettings, IHttpsService, HttpsService, HttpStrictTransportSecurityMode, HttpsSettingsDisplayDriver, HttpsRedirectionOptions, and AddHsts. It also helps with feature recipes, proxy considerations, migrations, and the code patterns captured in this skill.

ariffazil Skill

Seal current session with constitutional audit trail, decisions log, and next-session priorities before ending work

oimiragieo Bundle

Run CodeQL and Semgrep static analysis with SARIF output for vulnerability detection, code quality assessment, and security compliance scanning across multiple languages.

oimiragieo Bundle

Audit content and assets for brand compliance — style guide validation, tone of voice checking, visual identity consistency, brand asset management, and cross-channel coherence.

oimiragieo Bundle

Fintech engineering expertise — payment processing (Stripe, Plaid), PCI DSS compliance, financial data modeling (double-entry bookkeeping), fraud detection patterns, bank-grade security (encryption, tokenization), open banking APIs, cryptocurrency/blockchain integration, regulatory compliance (KYC/AML), and idempotent financial transaction design. Use for payment systems, banking apps, trading platforms, and fintech infrastructure.

oimiragieo Bundle

Use when building, debugging, or documenting Telegram bot polling flows that need safe agent routing, state tracking, and final-only replies without webhooks.

ariffazil Bundle

Unified skill inventory, gap detection, and cross-cutting orchestration for AAA catalog + Grok/Claude/Codex/Hermes/Kimi/OpenClaw harness views

oimiragieo Skill

Security hardening — path normalization, UNC blocking, pattern alignment with Claude Code

oimiragieo Bundle

Detect hardcoded credentials, default passwords, fail-open configurations, insecure default settings, and other security misconfigurations that ship as default behavior in applications.

ariffazil Bundle

Audit, reflect on, and recursively upgrade Kimi Code skills across the arifOS federation. Bounded autonomous ritual — proposes improvements, never auto-writes governed skills without 888_HOLD, caps iterations, enforces ΔS ≤ 0.

oimiragieo Bundle

Render templates by replacing {{TOKEN}} placeholders with actual values, supporting all three templates (specification, plan, tasks) with schema validation and security sanitization

ariffazil Skill

Sub-skill to execute tests, capture failures, and deeply verify alignment with physics, math, and ontology.

sboghossian-mini-claude-for-legal Skill

Use when drafting a Data Processing Agreement (DPA) compliant with GDPR Article 28. Covers all mandatory clauses, the three standard annexes (description of processing, technical/organizational measures, sub-processor list), international transfer mechanisms (SCCs, adequacy, BCRs), UK-GDPR adaptations (IDTA), sub-processor authorization models, audit rights, and liability allocation. P0 data-privacy skill applicable to any controller-processor relationship where EU/EEA personal data is processed.

sboghossian-mini-claude-for-legal Skill

Use when drafting a mortgage, hypothec, or charge over real property as security for a loan or obligation. Covers all core elements — parties, property description, secured amount, payment schedule, default events, power of sale, insurance, and land-registry registration — with jurisdiction-specific guidance for UAE (Dubai/Abu Dhabi), KSA, Lebanon, DIFC/ADGM, France, and UK. Triggers on "mortgage", "hypothec", "charge over property", "real estate security", "رهن عقاري", or "nantissement immobilier" requests.

sboghossian-mini-claude-for-legal Skill

Use when a matter involves immigration, work permits, residence permits, or the status of foreign nationals in Lebanon. Covers the MOL work permit + General Security residence permit framework, sectoral professional restrictions on foreign nationals, Palestinian and Syrian national special regimes, the impact of Lebanon's economic crisis on permit processing, and the position of Lebanese diaspora seeking to return or invest. Triggers on work permit Lebanon, residence Lebanon, foreign worker LB, Syrian workers Lebanon, or Lebanese immigration questions.

oimiragieo Bundle

N-round opposing-stance debates for trade-off analysis. Assigns pro/con roles to agents, runs structured debate rounds with quality scoring, and produces a moderator synthesis with confidence-rated recommendation. Generalizable to architecture, technology, security, and design decisions.

ariffazil Skill

Final APEX contrast for Kimi Code — before emitting verdict, ask "If I had to defend this verdict in front of a hostile technical audit 6 months from now, would I still be right?"

ariffazil Skill

Audit whether every constitutional floor and federation organ has code enforcement, tests, bypass resistance, and trace coverage

sboghossian-mini-claude-for-legal Skill

Use when advising on real estate law across MENA — covering title registration, lease structures, mortgage and security, strata and jointly owned property, major regulatory bodies (RERA Dubai, ADM Abu Dhabi, GCAA KSA), and the distinctive features of Lebanon's old-rent (ijar qadim) vs new-rent regime. Reach for this skill when the user asks about property law, lease agreements, title registration, real estate transactions, or property regulation in UAE, KSA, Lebanon, or Egypt.

ariffazil Skill

Generate structured telemetry for skill runs, including trigger source, chosen branch, command count, runtime, and postcondition checks. Load when you need to parse run logs, compile dashboards, or audit execution performance.