Security

tomevault-io Bundle

This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies. Use when this capability is needed.

tomevault-io Bundle

Use when user mentions dead code, unused files, cleaning up codebase, or dependency audit.

tomevault-io Bundle

This skill MUST be invoked when the user says "review constitution", "validate principles", "check quality", "constitution review", "quality check", "version bump", "anti-patterns", or "constitution audit". Use when this capability is needed.

tomevault-io Bundle

Audits a GraphQL Test Strategy document against five production-grade categories (schema integrity, security, performance, operational health, environment parity). Use when reviewing an existing TEST_STRATEGY.md for completeness, clarity, and risk coverage. Use when this capability is needed.

tomevault-io Bundle

Systematically analyze and translate large UE Blueprints (10+ functions) into C++ or other targets. Use when the user asks to convert a Blueprint to C++, audit a complex Blueprint, or understand a large Blueprint's full logic. Use when this capability is needed.

tomevault-io Bundle

Review the last 24 hours of Codex CLI conversations between Jan and the assistant, extract improvements, and update docs/ and/or AGENTS.md accordingly. Use when asked to audit recent chats, harvest lessons learned, or turn conversation gaps into documentation/instruction changes. Use when this capability is needed.

tomevault-io Bundle

OWASP Machine Learning Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in machine learning systems. Use when this capability is needed.

tomevault-io Bundle

Security header auditing, TLS configuration testing, HTTP method analysis, CSP bypass assessment, and deployment hardening verification. Use when this capability is needed.

tomevault-io Bundle

セキュリティを重視したPython開発パターンとベストプラクティス Use when this capability is needed.

tomevault-io Bundle

Identify security vulnerabilities and suggest secure coding practices Use when this capability is needed.

tomevault-io Bundle

Combine security scanning and threat modeling for changes involving data handling, API interception, sync, storage, authentication, or encryption. Use when this capability is needed.

tomevault-io Bundle

Use when handling sensitive data on iOS — Keychain storage, Data Protection, ATS/TLS, secrets management, and biometric (Face ID / Touch ID) authentication.

tomevault-io Bundle

Guide for implementing a new language parser in Codanna. Use when adding language support, implementing parsers, or extending language capabilities. Covers the six-file architecture (mod.rs, definition.rs, parser.rs, behavior.rs, resolution.rs, audit.rs), trait implementation patterns, resolution scope design, and integration workflow. Triggers on requests to add language support, implement new parser, extend language capabilities, or create language implementation. Use when this capability is needed.

tomevault-io Bundle

Detect and resolve package dependency conflicts before installation across npm/yarn/pnpm, pip/poetry, cargo, and composer. Auto-trigger when installing/upgrading packages. Validates peer dependencies, version compatibility, security vulnerabilities. Auto-resolves safe conflicts (patches, dev deps), suggests manual review for breaking changes. Prevents conflicting versions, security vulnerabilities, broken builds. Use when this capability is needed.

tomevault-io Bundle

Audit Claude Code subagents for quality, compliance, and maintainability. Use after creating or modifying agents, before releases, or for periodic quality checks. Use when this capability is needed.

tomevault-io Bundle

Audit Claude Code CLAUDE.md memory files for quality, compliance, and organization. Use to validate import syntax, detect circular imports, and check hierarchy compliance. Use when this capability is needed.

tomevault-io Bundle

Audit content schema for best practices, consistency, and potential issues. Checks naming, relationships, and field usage. Use when this capability is needed.

tomevault-io Bundle

Audit Claude Code skills for quality, compliance, delegation pattern, and maintainability. Use after creating skills, before releases, or for periodic quality checks. Use when this capability is needed.

tomevault-io Bundle

Validates that code actually works through sandbox testing, execution verification, and systematic debugging. Use this skill after code generation or modification to ensure functionality is genuine rather than assumed. The skill creates isolated test environments, executes code with realistic inputs, identifies bugs through systematic analysis, and applies best practices to fix issues without breaking existing functionality. This ensures code delivers its intended behavior reliably.

tomevault-io Bundle

Lightning-fast quality check using parallel command execution. Runs theater detection, linting, security scan, and basic tests in parallel for instant feedback on code quality. Use when this capability is needed.

tomevault-io Bundle

Use when Kyverno policies are blocking resource creation, when ClusterPolicy or Policy resources show errors, when audit results are unexpected, when mutations are not applying, when generate rules fail, or when admission webhook errors occur

tomevault-io Bundle

Security Auth Skill

tomevault-io Bundle

Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks, protected binaries, or debugging security-sensitive game components. Use when this capability is needed.

tomevault-io Bundle

Guided workflow for statistical and ML analysis of clinical data. Use when planning or executing research analyses on MIMIC, eICU, or similar EHR data. Ensures methodological rigor through structured consultation, assumption checking, and stepwise execution with audit trails. Use when this capability is needed.

tomevault-io Bundle

Manage dependencies and supply chain security to prevent vulnerable or malicious packages. Use this skill when you need to audit dependencies, update packages, check for vulnerabilities, understand supply chain attacks, or maintain dependency security. Triggers include "dependencies", "npm audit", "supply chain", "package security", "vulnerability", "npm update", "security audit", "outdated packages". Use when this capability is needed.

tomevault-io Bundle

Operational security guidance for deployment, monitoring, and maintenance. Use this skill when you need to understand which middlewares to apply, configure environment variables, monitor security post-deployment, or follow the pre-deployment checklist. Triggers include "security operations", "deployment security", "security monitoring", "environment variables", "when to use middleware", "pre-deployment", "security checklist", "production security". Use when this capability is needed.

tomevault-io Bundle

Klingai Audit Logging

tomevault-io Bundle

Scanning Api Security

tomevault-io Bundle

Security anti-pattern for insecure temporary files (CWE-377). Use when generating or reviewing code that creates temporary files, handles file caching, or processes uploads through temp storage. Detects predictable paths, insecure permissions, and missing cleanup. Use when this capability is needed.

tomevault-io Bundle

Apply this skill when managing Django settings across environments. Covers split settings pattern (base.py + development.py + production.py), environment variable management, secret handling, and the anti-pattern of hardcoding values. Triggered by phrases like 'Django settings', 'settings.py', 'environment variables', 'DJANGO_SECRET_KEY', or when configuring Django for deployment. Use when this capability is needed.

tomevault-io Bundle

Systematic security audit workflow for hardening a codebase through structured multi-pass analysis. Composes four skills across five phases — threat surface mapping with attack vector identification (risk-management), security-focused code review targeting OWASP and language-specific vulnerabilities (code-review), boundary condition and validation gap analysis (edge-case-coverage), and security test suite construction with fuzzing and property-based tests (testing-framework). Use when hardening an existing codebase before launch, after a security incident, during compliance preparation, or for periodic security reviews. Use when you want a structured audit rather than ad-hoc scanning. NOT for real-time intrusion detection or incident response — use your SIEM. NOT for infrastructure/network security — this covers application code only. Use when this capability is needed.

tomevault-io Bundle

Monthly skill library maintenance with audit scripts and gap detection. Use when auditing skills for 'Use when' patterns, checking activation rates, or maintaining skill quality. Use when this capability is needed.

tomevault-io Bundle

Web Performance Audit

tomevault-io Bundle

Code review skill for autonomous harness. Reviews code changes before marking features complete. Checks architecture consistency, security, code quality, and best practices. Provides actionable feedback or approval. Use when validating code in harness workflow or performing comprehensive code reviews. Use when this capability is needed.

tomevault-io Bundle

Security anti-pattern for fail-open defaults (CWE-1188). Use when reviewing code that uses fallback values for secrets, credentials, or security settings. Detects applications that run with weak defaults when configuration is missing. Use when this capability is needed.

tomevault-io Bundle

Build a minimal but real security policy for sensitive apps. The output Use when this capability is needed.