Security

tomevault-io Bundle

Audit and implement security best practices for GitHub repositories. USE THIS SKILL when user says "security audit", "check security", "add gitleaks", "secret scanning", "dependency audit", or needs security hardening. Use when this capability is needed.

tomevault-io Bundle

Weekly review partner that compounds productivity gains over time. Tracks velocity, logs friction, sets next-week targets, recognizes patterns across weeks, and feeds insights back to the audit for the next loop. Use when you want a weekly review, need to identify friction, want to see patterns, or want to update your system map. Part of the architect-system loop. Outputs to system/compounder/week-{date}.md. Use when this capability is needed.

tomevault-io Bundle

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection. Use when this capability is needed.

tomevault-io Bundle

Doc Garden — Documentation Drift Audit & Normalization

tomevault-io Bundle

End-to-end XRPL development playbook. Covers XRP Ledger dApp development including project scaffolding (create-xrp), wallet integration (xrpl-connect), client SDKs, transactions, tokens, NFTs, DEX/AMM, cross-chain interoperability (Axelar), and security best practices. Use when this capability is needed.

tomevault-io Bundle

Shell Script code review for correctness, security, maintainability, and best practices. Use for manual review of shell scripts checking design decisions and security patterns requiring human judgment. For detailed category-specific checks, see reference/. Use when this capability is needed.

tomevault-io Bundle

Full-codebase audit using 1M context window. Security, architecture, and dependency analysis in a single pass. Use when you need whole-project analysis. Use when this capability is needed.

tomevault-io Bundle

Security fix patterns for configuration and deployment vulnerabilities (path traversal, debug mode, security headers). Provides language-specific secure implementations. Use when this capability is needed.

tomevault-io Bundle

Security fix patterns for cryptographic vulnerabilities (weak algorithms, insecure randomness, TLS issues). Provides language-specific secure implementations. Use when this capability is needed.

tomevault-io Bundle

Rust Security

tomevault-io Bundle

Landing page quality assessment for paid advertising campaigns. Evaluates message match, page speed, mobile experience, trust signals, form optimization, and conversion rate potential. Use when user says landing page, post-click experience, landing page audit, conversion rate, or landing page optimization. Use when this capability is needed.

tomevault-io Bundle

Blog Audit -- Full-Site Health Assessment

tomevault-io Bundle

Review and analyze authentication and authorization patterns for security vulnerabilities. Use when this capability is needed.

tomevault-io Bundle

OWASP Package URL (PURL) format expert Use when this capability is needed.

tomevault-io Bundle

Add a comment to a case to document findings, actions, or recommendations. Use to maintain audit trail during investigations. Requires CASE_ID and comment text. Use when this capability is needed.

tomevault-io Bundle

Maintain CodexMonitor and Codex app-server protocol parity. Use when asked to audit supported or missing app-server notifications/requests, trace event routing, diagnose schema drift in app-server payloads, or update docs/app-server-events.md after upstream Codex changes. Use when this capability is needed.

tomevault-io Bundle

Integrates Firebase AI Logic into Flutter apps. Use when setting up the firebase_ai plugin, calling Gemini models, handling AI service errors, or applying security and privacy considerations for AI features.

tomevault-io Bundle

Injection Analysis (OWASP A03:2021)

tomevault-io Bundle

Security Misconfiguration Analysis

tomevault-io Bundle

WebSocket Security (WS)

tomevault-io Bundle

Use this skill when designing data schemas, implementing sharing workflows, or auditing access control in Jazz applications. It covers the hierarchy of Groups, Accounts, and CoValues, ensuring data is private by default and shared securely through cascading permissions and invitations.

tomevault-io Bundle

Audit a Rust DSP crate for real-time-safety violations — verifies `#![no_std]`, no `alloc` dependency, `panic = "abort"`, runs targeted clippy lints, greps for banned constructs in the hot path, and scans the compiled LLVM-IR for allocator symbols. Designed to be run on any Rust DSP crate before merge. Use when this capability is needed.

tomevault-io Bundle

AI-assisted pair programming with multiple modes (driver/navigator/switch), real-time verification, quality monitoring, and comprehensive testing. Supports TDD, debugging, refactoring, and learning sessions. Features automatic role switching, continuous code review, security scanning, and performance optimization with truth-score verification. Use when this capability is needed.

tomevault-io Bundle

Project Audit

tomevault-io Bundle

Use when working with Payload CMS projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.

tomevault-io Bundle

Security patterns, guards, and best practices enforced across the Docklift codebase. Use when this capability is needed.

tomevault-io Bundle

Analyze Sui Move test coverage, identify untested code, write missing tests, and perform security audits. Includes Python tools for parsing coverage output and generating reports. Use when this capability is needed.

tomevault-io Bundle

Shared Python best practices for LlamaFarm. Covers patterns, async, typing, testing, error handling, and security. Use when this capability is needed.

tomevault-io Bundle

Harness Platform administration including delegates, RBAC, connectors, secrets, templates, policy as code (OPA), user management, audit logs, and governance Use when this capability is needed.

tomevault-io Bundle

Comprehensive code review with security, performance, and quality analysis. Use when users ask to review code, analyze code quality, evaluate pull requests, or mention code review, security analysis, or performance optimization. Use when this capability is needed.

tomevault-io Bundle

Lvergro Claude Code Orquesta Audit

tomevault-io Bundle

Automatic review gate that runs after brainstorming completes - spawns PM, Architect, Designer, Security, and CTO agents in parallel, iterates until all approve Use when this capability is needed.

tomevault-io Bundle

Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems. Use when this capability is needed.

tomevault-io Bundle

Comprehensive Ruby and Rails code review using Sandi Metz rules and SOLID principles. Analyzes changed files in current branch vs base branch, runs rubycritic and simplecov, identifies OOP violations, Rails anti-patterns, security issues, code smells, and test coverage gaps. Outputs REVIEW.md with VSCode-compatible file links. Use when reviewing Ruby/Rails code, conducting code reviews, checking for design issues, pull request review, code quality analysis, or when user mentions Sandi Metz, POODR, 99 Bottles, SOLID, Law of Demeter, or "Tell Don't Ask". Use when this capability is needed.

tomevault-io Bundle

Use when the user wants to list, search, install, remove, inspect, validate, audit,

tomevault-io Bundle

Pre-delivery self-review gate and prioritized review dimensions (security, correctness, data integrity, reuse, performance, readability) with change-quality criteria. Use BEFORE declaring any code change complete, and when asked to review a diff, PR, or branch. Use when this capability is needed.