Security

tomevault-io Bundle

This skill should be used when users need to lint, format, or validate Python code using the Ruff command-line tool. Use this skill for tasks involving Python code quality checks, automatic code formatting, enforcing style rules (PEP 8), identifying bugs and security issues, or modernizing Python code. This skill should be invoked PROACTIVELY whenever Python code is written or modified to ensure code quality. Use when this capability is needed.

tomevault-io Bundle

Vulnerability review, threat modeling, OWASP patterns, and secure coding assessment. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations. Use when this capability is needed.

tomevault-io Bundle

Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation. Use when this capability is needed.

tomevault-io Bundle

Security Review Skill

tomevault-io Bundle

iDumb Security Skill (SECURITY Package)

tomevault-io Bundle

Exploit Development Mode

tomevault-io Bundle

Wrap audit fix work into two commits (tests + fix) Use when this capability is needed.

tomevault-io Bundle

Calls an API to fetch data. Use when the user wants to retrieve data from our backend API. Use when this capability is needed.

tomevault-io Bundle

Plan quality auditing with completeness scorecard, antipattern risk detection, and readiness checks. Use when auditing implementation plans, evaluating plan completeness, checking error handling strategy, assessing naming and readability pre-checks, reviewing testing strategy, evaluating tradeoff documentation, or running plan-audit on a software project. Covers the 10-point completeness scorecard, code quality pre-checks, antipattern risk assessment, and build-readiness decision. Use when this capability is needed.

tomevault-io Bundle

Use after a PR has accumulated review activity from any source (Codex via request-codex-review, a Claude self-review, a human reviewer leaving comments, etc.) to decide what to do with the findings. Reads the project's PR review policy from CLAUDE.md to determine calibration vs delegated phase. In calibration phase, summarizes findings and stops — the human reads raw output. In delegated phase, applies trivials within a strict allowlist, replies "applied" on the comment, pushes back on findings that don't apply (with quoted code + reason), escalates judgment calls, and appends deferred items to docs/followups.md. Never auto-fixes auth/billing/Stripe/security findings regardless of who flagged them. Auto-trigger when a PR has fresh review activity and Claude has just finished writing the code under review. Use when this capability is needed.

tomevault-io Bundle

Use when auditing codebase for custom implementations that can be replaced with well-known libraries. Provides replacement patterns, audit checklist, and migration strategies.

tomevault-io Bundle

This skill should be used when writing test cases, fixing bugs, analyzing code for potential issues, or improving test coverage for JavaScript/TypeScript applications. Use this for unit tests, integration tests, end-to-end tests, debugging runtime errors, logic bugs, performance issues, security vulnerabilities, and systematic code analysis. Use when this capability is needed.

tomevault-io Bundle

---

tomevault-io Bundle

Verification loop for Django projects - migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR. Use when this capability is needed.

tomevault-io Bundle

Verify whether a claimed EML tree really computes a stated elementary function. Use when a user presents an EML expression (nested eml(...) form or RPN) and asks "does this really equal sin(x)?" / "is this a valid witness for log10?", when auditing proof-engine witness trees, when checking a compiler's output against a reference formula, or when someone needs a branch-cut / removable-singularity audit with an interior-domain sampler. Produces a structured audit report (audit.json, audit.md, audit.blog.md) covering leaf set, shape stats, numerical agreement, branch-cut flags, and removable-singularity caveats. The `--format blog` option emits a self-contained README/blog-friendly markdown artifact with embedded Mermaid, K-context table, witness provenance, and a probe table. Handles complex arithmetic via principal-branch cmath. Use when this capability is needed.

tomevault-io Bundle

Static code analysis for infrastructure-as-code Use when this capability is needed.

tomevault-io Bundle

Manages Intlayer dictionaries and configuration via the Command Line Interface. Use when the user asks to "audit translations", "build dictionaries", "sync content", or run "intlayer" commands.

tomevault-io Bundle

USER-INVOKED ONLY. Use only when the user explicitly invokes $docs-drift or asks to audit Codex guidance drift. Audits AGENTS.md, AGENTS.override.md, .agents/skills, .codex/config.toml, project skill guidance, and other Codex instructions against recent code changes. Inspect real files first; use official OpenAI Codex docs or live web only for current Codex behavior; report findings before edits. Use when this capability is needed.

tomevault-io Bundle

Triggered when the user submits code or requests a code review. Automatically analyzes code quality, identifies potential bugs, security vulnerabilities, and performance issues, and provides improvement suggestions. Trigger phrases include "take a look at this code", "review this", "is there a problem with this function". Use when this capability is needed.

tomevault-io Bundle

Design security controls and threat mitigations. Use for features involving auth, data, or external exposure. Use when this capability is needed.

tomevault-io Bundle

Universal dependency management workflow. Use when updating packages, fixing vulnerabilities, or maintaining dependencies. Covers security-first approach, incremental updates, semantic versioning, and rollback procedures. Works with npm, pip, cargo, go mod, or any package manager. Use when this capability is needed.

tomevault-io Bundle

Apply Divio's four-quadrant documentation system to write, audit, classify, restructure, and review technical documentation. Use when creating or improving tutorials, how-to guides, reference docs, explanations, docs IA, README sections, docs plans, or when documentation feels mixed, bloated, incomplete, or hard to navigate. Use when this capability is needed.

tomevault-io Bundle

Logs merge operations for audit trail Use when this capability is needed.

tomevault-io Bundle

Identify all files a specific author contributed to on a branch vs its upstream, tracing code through renames. Use when asked who edited what, what code an author contributed, or to audit authorship before a merge. This skill should be run as a subagent — it performs many git operations and returns a concise table. Use when this capability is needed.

tomevault-io Bundle

Guidelines for implementing Auth0 authentication with best practices for security, rules, actions, and SDK integration Use when this capability is needed.

tomevault-io Bundle

Guidelines for implementing OAuth 2.0 and OAuth 2.1 authentication flows with security best practices and PKCE Use when this capability is needed.

tomevault-io Bundle

Guidelines for establishing context before an audit. Use when this capability is needed.

tomevault-io Bundle

Review iOS code for compliance with standards, NFRs, and security policy. Use when this capability is needed.

tomevault-io Bundle

Privilege escalation vector detection — role manipulation, admin bypass, and RBAC circumvention Use when this capability is needed.

tomevault-io Bundle

Map security controls between different compliance frameworks including NIST 800-53, ISO 27001, CIS Controls, PCI-DSS, HIPAA, SOC 2, and CMMC. Use this skill for gap analysis, multi-framework compliance, and control rationalization. Use when this capability is needed.

tomevault-io Bundle

Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure. Use when this capability is needed.

tomevault-io Bundle

Guide for understanding and contributing to the awesome-game-security curated resource list. Use this skill when adding new resources, organizing categories, mapping topics across anti-cheat, Windows kernel, DMA, reverse engineering, and game-engine research, or maintaining README.md format consistency. Use when this capability is needed.

tomevault-io Bundle

Doc Module Audit — Full-module compliance scoring

tomevault-io Bundle

Use when auditing iOS/Android app submissions for compliance with Apple App Store Review Guidelines or Google Play Developer Policies. Scan .ipa, .apk, or .zip files against official store policies, generate structured compliance reports, and identify violations with remediation steps.

tomevault-io Bundle

Hardens designs and implementations with structured security reviews. Use when this capability is needed.

tomevault-io Bundle

Secret Scanning