Security

tomevault-io Bundle

Benchmarking and performance auditing for the Wax repo. Use when running or interpreting Wax benchmarks, diagnosing CPU, memory, or I/O bottlenecks, or investigating Swift 6.2 concurrency issues such as Sendable, actor isolation, `@unchecked Sendable`, task-group fan-out, and data races. Use when this capability is needed.

tomevault-io Bundle

Audit a Go package in this repository for incorrect or misleading code comments — places where the documentation contradicts what the code actually does. Optimized for Pebble- and CockroachDB-style code where comments encode contracts, invariants, and ownership rules that callers depend on. Use when this capability is needed.

tomevault-io Bundle

Host security hardening and risk-tolerance configuration for OpenCog deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenCog cron scheduling for periodic checks, or version status checks on a machine running OpenCog (laptop, workstation, Pi, VPS). Use when this capability is needed.

tomevault-io Bundle

Pre-release checklist and quality gate to verify codebase health, docs, and security before interacting with Git. Activate when preparing to tag/publish a release, concluding milestones, or running final verification on a pull request. Use when this capability is needed.

tomevault-io Bundle

Audit firmware and embedded code for security vulnerabilities and best practices. Use when user says "firmware audit", "embedded security", "IoT security check", or working with C/C++/Rust firmware. Checks for hardcoded credentials, buffer overflows, and insecure boot. Use when this capability is needed.

tomevault-io Bundle

Security Audit Skill

tomevault-io Bundle

Security vulnerability detection and variant analysis skill. Use when hunting for dangerous APIs, footgun patterns, error-prone configurations, and vulnerability variants across codebases. Combines sharp edges detection with variant hunting methodology. Use when this capability is needed.

tomevault-io Bundle

Audit report writing for smart contract vulnerabilities. Triggers on weasel report, weasel write up, or weasel document. Use when this capability is needed.

tomevault-io Bundle

Audit Swarm — 并行多角色代码审计

tomevault-io Bundle

Cut, validate, publish, or document PerfectHash releases. Use when working on `ci/cut-release.sh`, `.github/workflows/release.yml`, `docs/release-process.md`, `ci/README.md`, `RELEASE-NOTES.md`, or `agents/RELEASE-ENGINEERING-*`, or when the user asks to prepare a release tag, dry-run a release, audit release automation, or update release-process documentation. Use when this capability is needed.

tomevault-io Bundle

Run architecture, security, and code quality audits on the Maslow codebase. Use when reviewing changes before commit, checking for security issues, validating boundary rules, or assessing build readiness. Invoke with /maslow-audit [scope] where scope is one of full, security, architecture, deps, or encryption. Use when this capability is needed.

tomevault-io Bundle

Audit SD.Next API route definitions and verify endpoint parameters plus request/response signatures against declared FastAPI contracts. Use when this capability is needed.

tomevault-io Bundle

Audits Solidity DEX integrations and smart contracts for slippage vulnerabilities enabling sandwich attacks including zero/missing minAmountOut parameters, block.timestamp or missing deadlines, on-chain slippage calculation via manipulable quoters, multi-hop swaps without final output protection, decimal precision mismatches between token pairs, hard-coded slippage preventing withdrawals during volatility, and fixed fee tier assumptions breaking when liquidity migrates Use when this capability is needed.

tomevault-io Bundle

Extract puzzle and secret entities from narrative text. Use when analyzing puzzles, riddles, traps, hidden paths, easter eggs, mysteries, and enigmas. Use when this capability is needed.

tomevault-io Bundle

Use when testing code, skills, commands, or configs through mental execution — trace logic line-by-line with concrete values to find bugs, logic errors, edge cases, contract violations, and AI hallucinations. Use when user says "paper test", "trace this", "find bugs", "check for edge cases", "audit this code", "verify AI code", "test this skill", "validate this implementation", "review this logic", "check dependencies", "check this config". MUST verify external calls — never assume methods exist. Use proactively before deploying changes or after AI generates code.

tomevault-io Bundle

Run multi-language Static Application Security Testing for the current repository or selected paths. Use when the user asks to scan code for vulnerabilities, review security issues, analyze Git changes, generate SARIF, triage findings, or prepare CI security gates. Use when this capability is needed.

tomevault-io Bundle

Conduct proactive, hypothesis-driven threat hunting. Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies. For Tier 3 analysts or dedicated threat hunters. Supports iterative search, pivoting, and comprehensive documentation. Use when this capability is needed.

tomevault-io Bundle

Verify secrets and configmaps in a namespace. Use for deployment config verification, debugging missing env vars, or auditing secret presence. Use when this capability is needed.

tomevault-io Bundle

Claude applies OWASP security best practices to web applications. Use when preventing vulnerabilities, implementing input validation, securing authentication, configuring security headers, or conducting security reviews. Use when this capability is needed.

tomevault-io Bundle

Security-first Uniswap v4 hook development. Use when user mentions "v4 hooks", "hook security", "PoolManager", "beforeSwap", "afterSwap", or asks about V4 hook best practices, vulnerabilities, or audit requirements. Use when this capability is needed.

tomevault-io Bundle

Expert code review of current git changes with a senior engineer lens. Detects SOLID violations, security risks, and proposes actionable improvements. Use when this capability is needed.

tomevault-io Bundle

Audit devloop against Claude Code updates to identify integration opportunities. Use after Claude Code releases, monthly maintenance, or when exploring new features. Use when this capability is needed.

tomevault-io Bundle

Security Basics

tomevault-io Bundle

Security-first code generation specialist that enforces safe defaults for secret management, input validation, authentication, dependency hygiene, and data exposure prevention across any language or framework. Use when generating code that handles user input, external APIs, authentication, file uploads, database queries, environment configuration, or shell commands. Trigger for asks like "add auth", "handle user input", "connect to database", "read env vars", "run shell command", "handle file upload", "is this secure", or any task that processes untrusted data or touches credentials. Use when this capability is needed.

tomevault-io Bundle

Run an OWASP Top 10 (2025) security assessment of whatever codebase is at hand — any language, any stack — and produce a dated, versioned English report. Use when the user asks for a security assessment, OWASP review, vulnerability audit, codebase security analysis, security posture check, wants to refresh or update an OWASP report, or says things like "analyze security", "security findings", "run the owasp scan", or "check vulnerabilities". Use when this capability is needed.

tomevault-io Bundle

Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage Use when this capability is needed.

tomevault-io Bundle

Security Audit Skill

tomevault-io Bundle

Audit and reduce heap/dynamic allocations in Rust, TypeScript/JavaScript, and Python. Covers profiling tools, stack-only alternatives, zero-copy patterns, and cache-friendly design. Use when analyzing allocation-heavy code or optimizing memory performance. Use when this capability is needed.

tomevault-io Bundle

Web application security testing skills organized by OWASP Top 10 2021 categories. Use when this capability is needed.

tomevault-io Bundle

Cross-Site Scripting (XSS) testing methodology with payloads for reflected, stored, and DOM-based XSS Use when this capability is needed.

tomevault-io Bundle

Audit CLI output, docs, and site content for personality and tone consistency Use when this capability is needed.

tomevault-io Bundle

Create and run custom background analysis workers with composable phases. Use when you need automated code analysis, security scanning, pattern learning, or API documentation generation. Use when this capability is needed.

tomevault-io Bundle

Deep architectural context building for security audits. Use when conducting security reviews, building codebase understanding, mapping trust boundaries, or preparing for vulnerability analysis. Inspired by Trail of Bits methodology. Use when this capability is needed.

tomevault-io Bundle

Generate strategy documents from completed Primr research. Use when the user wants AI, CX, security, or data strategy deliverables from an existing report. Use when this capability is needed.

tomevault-io Bundle

Write security checks using the CheckDefinitionV2 system. Use when creating new checks, converting V1 checks to V2, or when the user asks to implement a vulnerability scanner check. Covers defineCheckV2, defineRegexCheck, CheckContext API, parameter injection, testing with testCheck/mockTarget, and registration. Use when this capability is needed.

tomevault-io Bundle

Customize, fix, override or extend openclacky itself — change a built-in tool's behavior, intercept/audit/block tool calls, plug in a new IM channel (Slack, in-house IM…), or add UI to the Web UI (panel, button, settings tab). Trigger on "patch openclacky", "block dangerous commands", "audit tool use", "add Slack channel", "extend the web ui", "改 openclacky 内置", "拦截工具调用", "扩展 web 界面". Do NOT trigger for ordinary feature work in the user's own project that doesn't touch openclacky. Use when this capability is needed.