Security

tomevault-io Bundle

Audit a verified source against the current state of its upstream API/SDK, find breakages and outdated patterns, and propose (or implement) a fix plan with credential-free unit tests. Use when users report a source is outdated or broken, or for periodic source maintenance. Use when this capability is needed.

tomevault-io Bundle

Use when designing audit logging systems for accountability and compliance evidence. Covers event catalogs, log schemas, retention policies, immutability requirements, and compliance reporting. Do not use for regulatory gap analysis (use compliance-review) or data sensitivity classification (use data-classification).

tomevault-io Bundle

Use when designing integration strategies for device hardware APIs including camera, sensors, biometrics, and Bluetooth. Covers permission flows, cross-platform abstraction evaluation, fallback behavior, and power impact analysis. Do not use for platform guideline compliance (use platform-audit) or navigation architecture (use navigation-design).

tomevault-io Bundle

Use when enumerating security claims from a design, formalizing them as invariants, checking for hidden assumptions, and assessing verification feasibility. Covers safety invariants, temporal properties, and verification tool recommendations. Do not use for writing TLA+ specifications directly (use formal-spec) or implementation-level security review.

tomevault-io Bundle

Use when analyzing microarchitectural attack surfaces by mapping shared hardware structures, identifying speculative execution vectors, quantifying speculative windows, and proposing countermeasures. Covers cache timing, transient execution, and contention channels. Do not use for RTL-level design review (use rtl-security-review) or physical implementation analysis (use physical-design-security).

tomevault-io Bundle

CrowdStrike Fusion Workflow Builder

tomevault-io Bundle

Integrates Firebase Realtime Database into Flutter apps. Use when setting up Realtime Database, structuring JSON data, querying, performing read/write operations, implementing offline capabilities, or applying security rules.

tomevault-io Bundle

Delegates implementation-heavy or repetitive coding work (batch edits, boilerplate, multi-file refactors with clear patterns, test scaffolding) from Claude to OpenAI Codex CLI. Use when token cost outweighs judgment cost. Trigger phrases include "delegate to codex", "let codex do this", "batch refactor across files", "scaffold tests for". Avoid for architecture, security review, or root-cause debugging. Use when this capability is needed.

tomevault-io Bundle

Authorization security standards covering RBAC, ABAC, policy enforcement, OAuth2 scopes, resource-based access control, and NIST 800-53 compliance (AC-3, AC-4, AC-6) for production systems Use when this capability is needed.

tomevault-io Bundle

Maintain .ai/project/state.json (stage and non-secret config references) via projectctl for consistent automation gates. Use when this capability is needed.

tomevault-io Bundle

GitHub Actions workflow validation covering syntax, security, and best practices using actionlint, ghalint, and zizmor. Always use validate.sh script for comprehensive validation. For troubleshooting, see reference/. Use when this capability is needed.

tomevault-io Bundle

Apply security fixes based on scan findings Use when this capability is needed.

tomevault-io Bundle

Security considerations for Jackson JSON deserialization in Java applications. Covers timing of validation, raw input interception, and common deserialization attack patterns. Use when this capability is needed.

tomevault-io Bundle

Exact detection thresholds for identifying malicious network patterns including port scans, DoS attacks, and beaconing behavior. Use when this capability is needed.

tomevault-io Bundle

Level 2 patterns - vulns, lic, sbom, doctor (security, compliance, environment health) Use when this capability is needed.

tomevault-io Bundle

Dependency Audit Skill

tomevault-io Bundle

Audit your information diet across HN and RSS feeds — beautiful reports with category breakdowns, ASCII charts, and personalized recommendations. Use when this capability is needed.

tomevault-io Bundle

Use automatically before and after code changes. Ensures documentation, formatting, type safety, and audit standards. Use when this capability is needed.

tomevault-io Bundle

Audit and improve SwiftUI runtime performance from code review and architecture. Use for requests to diagnose slow rendering, janky scrolling, high CPU/memory usage, excessive view updates, or layout thrash in SwiftUI apps, and to provide guidance for user-run Instruments profiling when code review alone is insufficient. Use when this capability is needed.

tomevault-io Bundle

Audit and fix git hygiene on a dmzoneill repo. Checks .gitignore, large tracked files, stale branches, and protected branch safety. Use when this capability is needed.

tomevault-io Bundle

Use when classifying data elements by sensitivity tier and defining per-tier handling requirements. Covers data inventory, sensitivity classification, PII flow mapping, encryption and masking specifications, and cross-boundary transfer documentation. Do not use for regulatory gap analysis (use compliance-review) or audit logging design (use audit-trail-design).

tomevault-io Bundle

Use when reviewing RTL designs for security vulnerabilities including access control gate bypasses, insecure FSM transitions, timing-dependent information leakage, and unintended data paths. Covers Verilog, SystemVerilog, and VHDL modules with security-critical functions. Do not use for physical implementation review (use physical-design-security) or microarchitectural attack analysis (use microarch-analysis).

tomevault-io Bundle

> **[IMPORTANT]** Use `TaskCreate` to break ALL work into small tasks BEFORE starting — including tasks for each file read. This prevents context loss from long files. For simple tasks, AI MUST ATTENTION ask user whether to skip.

tomevault-io Bundle

API安全测试的专业技能和方法论 Use when this capability is needed.

tomevault-io Bundle

Inspect the current Stallion posture, enabled protections, and recent audit events. Use when this capability is needed.

tomevault-io Bundle

CrowdStrike Fusion Workflow Builder

tomevault-io Bundle

Extract and analyze security controls from OSCAL catalogs, profiles, and SSPs. Use this skill to get detailed information about control hierarchies, statements, parameters, and implementation status for compliance analysis. Use when this capability is needed.

tomevault-io Bundle

Plan and manage security evidence collection for compliance audits and assessments. Use this skill to identify required evidence, track collection status, and ensure audit readiness. Use when this capability is needed.

tomevault-io Bundle

Integrates Firebase App Check into Flutter apps. Use when setting up App Check, selecting providers per platform, using debug providers during development, enabling enforcement, or applying App Check security best practices.

tomevault-io Bundle

Defend before attackers find the gaps. Use when this capability is needed.

tomevault-io Bundle

Use when performing adversarial security testing on SUI Move contracts — generating attack tests for access control bypass, integer overflow, object manipulation, economic exploits, reentrancy, and DoS vectors. Triggers on "red team", "attack test", "find vulnerabilities", "exploit", "pentest", "security test", or when the user wants to stress-test their contract's security. For defensive security setup (scanning, hooks, checklists), use sui-security-guard instead.

tomevault-io Bundle

Create, debug, and optimize GitHub Actions workflows with security best practices. USE THIS SKILL when user says "create workflow", "fix workflow", "workflow fails", "add CI", "reusable workflow", or needs help with GitHub Actions. Use when this capability is needed.

tomevault-io Bundle

Blog Analyzer -- Quality Audit & Scoring

tomevault-io Bundle

Arthur onboarding helper — Refresh Arthur Platform OAuth2 token using arthur_client. Reads CLIENT_ID/SECRET from .arthur-engine.env, writes ARTHUR_PLATFORM_TOKEN back to state. Use when this capability is needed.

tomevault-io Bundle

Evaluate hook security, performance, and SDK compliance. Use for audits. Use when this capability is needed.

tomevault-io Bundle

Deep OWASP API Security Top 10 testing for REST, GraphQL, gRPC, and WebSocket APIs — BFLA, mass assignment, rate limiting, and unsafe consumption. Use when this capability is needed.