Security Agent Skills

Use when authorship order, CRediT contribution roles, or AI-assistance attribution must be recorded transparently for a manuscript, when an author dispute needs an evidence trail, or before a contributorship statement is required at submission; this skill maintains the human-attribution ledger of who contributed what and in which role (authorship order, CRediT taxonomy, revision responsibilities), which is distinct from the disclosure-metadata audit owned by ai-disclosure-auditor.

Default entry point for any research request — a hybrid router that classifies the question deterministically and either delegates to a specialist research skill (pulse for trends/sentiment, grants for NIH funding, litreview for academic literature, syllabus for course reading, patent for prior-art + IP landscape, dossier for entity research) or runs its own plan-decompose-multi-source-search-synthesize-cite fallback workflow when no specialist matches. Always surfaces the routing decision so users can override. Triggers — "research [topic]", "look into [topic]", "what do we know about [topic]", "investigate [topic]", "find me information on [topic]", "do some research on [topic]", "I need to understand [topic]", or any research request that doesn't obviously match a more-specific specialist skill. Output is a markdown briefing (default) or .docx document (on request) with full citations and an audit log.

Session-end memory garbage collector. Promotes valuable L2 session facts to L1 atomic memory, wipes L2, and rotates oversized audit logs. Run at end of session to prevent context inflation and storage bloat.

Run a comprehensive security review on code

Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong.

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Verify a completed implementation against the original instructions, a declarative source document, an issue brief, or an optional MoonSpec feature packet, plus AGENTS.md repo guidance and required tests. Use when the user asks to run or reproduce `/moonspec.verify`, perform a final read-only implementation check, audit unit and integration test evidence, classify requirement coverage, or decide whether more code or test work is needed.

Harness Audit

Use this skill for scored UI audit, spacing, alignment, states, contrast, hierarchy, polish checklist. Trigger when the task involves web design work related to Design Qa Scorecard, implementation, audits, debugging, strategy, or validation.

Use for PPC work when Codex should audit Meta Ads account structure, delivery, learning, attribution, creative, audience, and spend evidence.

Produce a clean publishing payload, validate it, publish once when authorized, and verify the rendered result.

One-command GitHub repository health audit. Checks for missing standard files, GitHub configuration, branch protection, documentation quality, and code hygiene. Produces a scored health report with prioritized fix recommendations.

Initialize GitHub repositories with standard files and configuration. Generates LICENSE, CONTRIBUTING.md, SECURITY.md, issue/PR templates, CI config, and .gitignore. Detects project type and adapts templates accordingly.

Unified multi-platform paid media audit with parallel execution. Spawns scored audits for Google Ads, Meta Ads, and Microsoft Ads simultaneously, merges results into a budget-weighted aggregate health score (A-F), adds cross-platform analysis (budget allocation, tracking consistency, creative alignment, attribution overlap), and produces a prioritized action plan. Optionally generates a client-ready deck via pro-deck-builder. Use when the user asks for a full paid media audit, cross-platform review, or multi-channel ad assessment.

Landing page audit and optimization for conversion. Covers above-the-fold design, value propositions, CTAs, social proof placement, form design, page speed, and mobile optimization. Use when the user asks about landing page optimization, conversion rate improvement, page audits, or CTA optimization.

NN/g-grounded page enhancement for flows and semantic data wiring — not visual polish. Use when "this page feels AI-generated", "fix UX of /xxx", "improve information density", or "icons all look the same". Composition/type → enhance-web-ui. Heuristics-only → audit-ux.

Audit database schema for consistency, validation, and industry standards. Use when reviewing schema design, naming conventions, constraints, indexes, or migrations. Destructive-op gates → plan-data-integrity. Who-can-read-what RLS → plan-rls-audit. Restore/RPO → plan-backup-dr.

Read-only audit of config/env parity across dev, staging, and prod — missing or misnamed vars, drifted flags, hardcoded values, secrets reused across environments. Use when "works locally but not in prod", "audit our environments", or "config drift". Local runnability → workflow-environment-ready.

Audit and optimize application runtime performance (Core Web Vitals, slow code, load time). Use when "slow page", "LCP/INP/CLS", or "optimize performance". JS payload → audit-bundle-size. Concurrent breaking point → test-load. Timeouts/retries → audit-resilience.

Exhaustive audit for stubs, dead buttons, fake components, unwired handlers, and dead links — then a wiring plan, no implementation. Use when "find dead buttons", "stub checker", "fake components", "unwired handlers", or "dead links". Live QA → test-qa.

Detect and fix repo-wide anti-patterns and consistency drift (naming, organisation, repeated smells). Use when "code smell", "anti-pattern", "technical debt", or "standardize the codebase". This PR/diff review → audit-code-review.

Drive an entire repository to a fully green baseline — typecheck, lint, tests, and build all passing from a clean checkout — when the user has explicitly authorized fixing. Use when "make the repo green", "get CI passing", "fix all the failing tests". Ratchet integrity → audit-gate-logic.

Use this skill when the user asks about hazardous materials (hazmat) transportation under 49 CFR 171-180 — placarding requirements, segregation tables, hazmat employee training (49 CFR 172 Subpart H), Hazmat Safety Permit (HMSP), shipping papers, packaging groups, emergency response phone, security plans, hazmat endorsement on CDL, and bulk vs non-bulk distinctions. Cite specific 49 CFR section.

Use this skill when conducting a self-audit of your DQF library before an FMCSA compliance review. Covers the systematic approach to verifying all 12 documents are current, complete, and properly maintained.

Use this skill when the user asks about CDL classes (A, B, C), endorsements (H, N, P, S, T, X), required for hazmat / passenger / school bus / tank / triple-trailer operations, what each class is permitted to operate, the TSA Security Threat Assessment for hazmat, and ELDT (Entry-Level Driver Training) requirements. Cite 49 CFR 383.

Audit, write, or revise Architecture Decision Records (ADRs), including the decision of whether one is warranted. Use when an architecturally significant decision needs recording, when reviewing an existing ADR collection, or when adding ADRs to a project that has none. Detects existing template (Nygard or MADR) and defaults to Nygard for new repos. Gates comparison ADRs through a decompose-and-verify interview before drafting.

Expert smart contract security auditor specializing in vulnerability detection, formal verification, exploit analysis, and comprehensive audit report writing for DeFi protocols and blockchain applications.

Use the release-audit skill to run the pre-release validation sweep and print

Structured code review with a checklist covering correctness, clarity, tests, security, performance, and style. Use when reviewing a PR, diff, or set of code changes before merging — including phrases like "review this", "check my changes", or "is this ready to merge".

Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong.

Manage environment variables and secrets in Claude Code sessions without exposing their values to logs, diffs, or context.

Use this skill to generate or audit design systems, check visual consistency, and review PRs that touch styling.

Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR.

Provides access to Greip API endpoints for geolocation, IP lookup, threat intelligence, payment scoring, email and phone validation, profanity detection, and account management.

Conduz a execução do actions.md em código. Atualiza checkboxes para [X], escreve progress.jsonl, gera legacy-impact.md e regression-watch.md. Use quando o usuário digitar "/reversa-coding", "reversa-coding", "executar plano" ou pedir para começar a codar a feature ativa. Último skill do ciclo forward, depois de `/reversa-to-do` (e opcionalmente `/reversa-audit` ou `/reversa-quality`).

审计 cron jobs 的活跃度、价值和使用频率，识别冗余/低价值任务并批量暂停或清理。