Security

tomevault-io Bundle

Reviews Rust code for runtime correctness bugs the generic correctness audit misses — panics on realistic input, debug-panic/release-wrap overflow, Option/Result mishandling, ownership/Drop logic bugs, concurrency, async (tokio), and iterator/collection footguns. Use when reviewing Rust changes (.rs files, Cargo crates). For unsafe/UB/soundness use `agentwright:rust-security-audit`; for idioms, API design, and performance use `agentwright:rust-best-practices-audit`. Use when this capability is needed.

tomevault-io Bundle

Improving Skills — Audit & Optimization Guide

tomevault-io Bundle

Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns. Use when this capability is needed.

tomevault-io Bundle

Code Audit Loop

tomevault-io Bundle

Plan Audit Loop

tomevault-io Bundle

Code review heuristics — four-axis review lens (correctness, security, design integrity, test coverage); confidence-based filtering (no finding without a concrete failure scenario); review comment tone (observation over accusation); nitpick filtering; what counts as a real finding vs linter noise. Auto-load when writing or framing a review comment, deciding whether a PR finding is worth surfacing, reviewing a diff for correctness, or filtering review nitpicks. Use when this capability is needed.

tomevault-io Bundle

Audit Claude Code LSP server configurations for quality and compliance. Use when creating or validating plugin LSP servers, or troubleshooting code intelligence issues. Use when this capability is needed.

tomevault-io Bundle

Secure coding practices and defensive programming patterns for building security-first applications. Use when implementing authentication, handling user input, managing sensitive data, or conducting secure code reviews. Use when this capability is needed.

tomevault-io Bundle

Security standards for any code change in any language. Use for implementation, review, dependency changes, authentication, authorization, data handling, or release risk. Use when this capability is needed.

tomevault-io Bundle

Extract CVSS (Common Vulnerability Scoring System) scores from vulnerability data sources with proper fallback handling. This skill covers understanding CVSS v3, handling multiple score sources (NVD, GHSA, RedHat), implementing source priority logic, and dealing with missing scores in security reporting. Use when this capability is needed.

tomevault-io Bundle

Expert CISO coaching and mentorship for security leaders in training. Use when the user asks for CISO coach guidance, executive communication advice, security leadership strategies, or needs help translating technical security issues for non-technical audiences. Also activates for discussions about current security events, threat landscape analysis, board-level security topics, risk communication, or security program development from a CISO perspective. Use when this capability is needed.

tomevault-io Bundle

Solana / Rust Audit Preparation

tomevault-io Bundle

Use when asking about 'FileProtectionType', 'file encryption iOS', 'NSFileProtection', 'data protection', 'secure file storage', 'encrypt files at rest', 'complete protection', 'file security' - comprehensive reference for iOS file encryption and data protection APIs

tomevault-io Bundle

Expertise in LLVM-based code obfuscation techniques including OLLVM, control flow flattening, string encryption, virtualization, and anti-analysis methods. Use this skill when working on code protection, anti-reverse engineering, or implementing custom obfuscation passes. Use when this capability is needed.

tomevault-io Bundle

Expertise in MLIR (Multi-Level Intermediate Representation) and CIR (Clang IR) development for domain-specific compilation and high-level optimizations. Use this skill when building ML compilers, domain-specific languages, or working with multi-level compilation pipelines. Use when this capability is needed.

tomevault-io Bundle

Plan or review CodeQL scanning so security analysis, workflow triggers, language coverage, and SARIF reporting fit the real repository structure. Use when this capability is needed.

tomevault-io Bundle

Validate and sanitize user input to prevent XSS, injection attacks, and ensure data quality. Use this skill when you need to validate forms, sanitize user input, prevent cross-site scripting, use Zod schemas, or handle any user-generated content. Triggers include "input validation", "validate input", "XSS", "cross-site scripting", "sanitize", "Zod", "injection prevention", "validateRequest", "safeTextSchema", "user input security". Use when this capability is needed.

tomevault-io Bundle

Implement secure payments using Clerk Billing and Stripe without ever touching card data. Use this skill when you need to set up subscription payments, handle webhooks, implement payment gating, understand PCI-DSS compliance, or integrate Stripe Checkout. Triggers include "payment", "Stripe", "Clerk Billing", "subscription", "PCI-DSS", "credit card", "payment security", "checkout", "webhook", "billing". Use when this capability is needed.

tomevault-io Bundle

Test security features and verify implementation before deployment. Use this skill when you need to test CSRF protection, rate limiting, input validation, verify security headers, run security audits, or check the pre-deployment security checklist. Triggers include "test security", "security testing", "verify security", "security checklist", "pre-deployment", "test CSRF", "test rate limit", "security verification". Use when this capability is needed.

tomevault-io Bundle

Analyze mock data and examples for cultural assumptions, understanding what they communicate about who the product is for. Use when reviewing test data, documentation, or seed data. Use when this capability is needed.

tomevault-io Bundle

Activate regulatory compliance specialist mode. Expert in SOX, GDPR, HIPAA, and PCI-DSS requirements. Use when reviewing code for compliance, implementing audit trails, data protection, or regulatory controls. Use when this capability is needed.

tomevault-io Bundle

Security anti-pattern for integer overflow vulnerabilities (CWE-190). Use when generating or reviewing code that performs arithmetic on user-controlled values, handles sizes/quantities, or calculates prices/amounts. Detects overflow in validated inputs. Use when this capability is needed.

tomevault-io Bundle

Security anti-pattern for session fixation vulnerabilities (CWE-384). Use when generating or reviewing code that handles user sessions, login flows, or authentication state changes. Detects failure to regenerate session IDs after authentication. Use when this capability is needed.

tomevault-io Bundle

Use when reviewing Go code changes, checking Go pull requests, or validating modified .go files before commit or merge for idioms, concurrency, errors, security, and static analysis issues

tomevault-io Bundle

PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices. Use when this capability is needed.

tomevault-io Bundle

Audits Rust code against the Rust API Guidelines (C-* IDs), the named idiom/anti-pattern catalog, and Clippy's style/perf/complexity groups — error-handling design, ownership idioms, trait/API design, naming conventions, performance, and module/crate hygiene. Use when reviewing Rust changes for idiomatic quality and design. For runtime bugs use `agentwright:rust-correctness-audit`; for unsafe/UB/supply-chain use `agentwright:rust-security-audit`. Use when this capability is needed.

tomevault-io Bundle

<!-- Note: Content in French, consider translating for English-first repo -->

tomevault-io Bundle

Insecure Design Analysis (OWASP A04:2021)

tomevault-io Bundle

Guide for game-engine internals, source trees, plugins, and engine-specific security research. Use this skill when researching Unreal, Unity, Source, Godot, custom engines, engine detectors, engine explorers, or engine protection patterns relevant to modding, reverse engineering, and anti-cheat. Use when this capability is needed.

tomevault-io Bundle

Go Standards Audit

tomevault-io Bundle

Expert knowledge in GitHub Agentic Workflows safe outputs - security architecture, sanitization, controlled AI actions, and write operation patterns Use when this capability is needed.

tomevault-io Bundle

Strategic principles for integrating security from the start, not retrofitting it later Use when this capability is needed.

tomevault-io Bundle

Security Scan Skill

tomevault-io Bundle

Configure pre-commit hooks for code quality, linting, formatting, and security checks. Automate code standards with Git hooks. Use for code quality enforcement, automated formatting, or security scanning before commits. Triggers on pre-commit, git hooks, husky, lint-staged. Use when this capability is needed.

tomevault-io Bundle

Generates technical implementation plans and architectural strategies that enforce the Project Constitution. Use when designing new features, starting implementation tasks, refactoring code, or ensuring compliance with critical standards like Testability-First Architecture, security mandates, testing strategies, and error handling.

tomevault-io Bundle

Audit documentation quality — inline comments, API docs, README completeness, and doc-code sync. Use when assessing whether docs are good and complete. To catch docs that have gone stale versus the code use /doc-gardening instead. Use when this capability is needed.