Security

bromso Skill

Classify data by sensitivity level

bromso Skill

Plan encryption at rest, in transit, and key management

bromso Skill

Design security monitoring, alerting, and observability

bromso Skill

Define containment, eradication, and isolation procedures

bromso Skill

Plan centralized logging, retention, and audit trail design

bromso Skill

Assess and manage third-party and supply chain security risks

bromso Skill

Draft communication templates for incidents

bromso Skill

Identify and implement improvements from incidents and tests

bromso Skill

Identify and classify vulnerabilities across systems and code

bromso Skill

Answer customer security/compliance questionnaires

gaelic-ghost Bundle

Review and improve macOS defensive posture. Use for updates, XProtect and Gatekeeper, FileVault, firewall, remote access, accounts, background items, privacy, backups, credentials, and monitoring after a security assessment or incident.

gaelic-ghost Bundle

Design macOS MailKit extensions for content blocking, message actions, compose sessions, and message security with explicit privacy, capability, target, and validation boundaries. Use when a macOS app needs to extend Apple Mail.

gaelic-ghost Bundle

Assess a suspected macOS threat using exact host and artifact evidence. Use for suspicious apps, processes, downloads, profiles, extensions, alerts, persistence, privacy, or network activity while keeping protections distinct.

gaelic-ghost Skill

Build or modify a Falco web application in idiomatic F#, using functional routing, request and response helpers, explicit ASP.NET Core integration, security boundaries, and focused tests.

gaelic-ghost Bundle

Route an ambiguous cybersecurity request before tools run. Use for suspicious files, links, messages, host behavior, malware, vulnerability reports, authorized pentests, incidents, threat hunting, detection work, or security advice.

gaelic-ghost Bundle

Use installed Objective-See macOS security tools as evidence adapters. Use for KnockKnock, BlockBlock, LuLu, ProcessMonitor, FileMonitor, WhatsYourSign, TaskExplorer, or related tools with explicit permissions, limits, and ownership.

gaelic-ghost Bundle

Assess whether suspicious evidence indicates a real threat and explain it plainly. Use for confidence, protective actions, uncertainty, impact, and advice after artifact, endpoint, identity, or incident evidence.

gaelic-ghost Bundle

Check reputation for a suspicious artifact, signer, hash, URL, domain, certificate, package, or vendor. Use when threat intelligence informs triage while privacy, stale data, false positives, and behavior limits stay explicit.

gaelic-ghost Bundle

Contain a macOS threat and verify recovery. Use for isolation, process or service containment, credential response, persistence removal, quarantine, restore, erase/reinstall, monitoring, and return-to-service decisions.

gaelic-ghost Bundle

Test an authorized web application or API using OWASP guidance. Use for authentication, authorization, sessions, input, schemas, business logic, file handling, server-side requests, configuration, transport, errors, and data exposure.

gaelic-ghost Bundle

Prioritize a vulnerability using actual asset exposure and impact. Use when versions, reachability, prerequisites, privileges, data, exploit maturity, mitigations, detection, business criticality, and urgency matter beyond CVSS.

gaelic-ghost Bundle

Audit or align a GitHub repository's server-side settings, rulesets, security automation, Dependabot, and sign-off policy. Use for server-side GitHub policy work, not ordinary local Git commits, PR collaboration, or releases.

gaelic-ghost Bundle

Preserve security evidence before analysis, containment, or remediation changes it. Use for artifacts, volatile host state, vulnerability validation, records, logs, screenshots, commands, hashes, timelines, and reproducible handoffs.

gaelic-ghost Bundle

Write a security assessment or penetration-test report from evidence. Use when findings, scope, methodology, limitations, impact, remediation, retest criteria, and an executive explanation need calibrated reporting.

tomevault-io Bundle

Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines. Use when writing unit tests, integration tests, or E2E tests; creating test strategies or automation frameworks; analyzing coverage gaps; performance testing with k6 or Artillery; security testing with OWASP methods; debugging flaky tests; or working on QA, regression, test automation, quality gates, shift-left testing, or test maintenance.

robsonkades Bundle

Defining a versioned API, event, data, integration, security, or operational contract for a feature after its behavior is agreed and before implementation is planned. Use when callers, consumers, stored data, or operators will depend on a changed boundary and its success, failure, ownership, compatibility, and verification must be explicit. Does not choose the architecture or transport (feature-solution-analysis), record the decision (feature-decision-analysis), or implement the contract (feature-execution).

robsonkades Bundle

Assembling everything established about a feature into one document another engineer could execute without re-deriving the architecture: the resources in dependency order, the schema, contract, configuration and security changes named individually, the test strategy per resource, the migration, deployment and rollback story, and acceptance criteria a test can be written from. Use once the decisions are taken and before implementation starts, when a plan is a list of file names, when the plan and the code have drifted apart, when a feature is being handed to someone else or resumed after a break, or when the rollback story is discovered during the rollback. Does not produce the breakdown it orders (feature-decomposition), does not execute it (feature-execution), does not track status against it (feature-progress-tracking), and does not invent dates or effort estimates (estimation-under-uncertainty).

robsonkades Bundle

Application-security judgement for Java 21+: password storage with current memory-hard KDF parameters, constant-time verification, secure randomness, authorisation inside the protected operation, adversarial validation, reversible-cryptography boundaries, and secret-safe types. Use when a password, hash, salt, token, API key or pepper appears in a diff; when MessageDigest, SecureRandom, Random, UUID, Cipher, Mac or PasswordEncoder is called; when a controller annotation is the only authorisation check; when identity comes from the request instead of the principal; or when a generic CryptoUtils wrapper is proposed. Code-level only: layered validation is java-defensive-programming, redaction is structured-logging, ReDoS is java-strings-and-text, and deserialisation is java-serialization-hardening.

robsonkades Bundle

Runtime access to code the compiler cannot check: what reflection costs beyond speed — no compile-time checking, invisible to refactoring and dead-code analysis, blocked by module encapsulation, and constrained by closed-world native-image analysis — the alternatives that keep the checking (interfaces, ServiceLoader, annotation processing, code generation), MethodHandles and VarHandles for genuinely dynamic access, and the security boundary around resolving a name that came from outside. Use when reflection appears in application code, when setAccessible needs --add-opens, when a framework works on the JVM and fails under native image, when a class name arrives from configuration or a payload, when Method.invoke or invokeWithArguments sits on a hot path, or when a runbook still sets sun.reflect.inflationThreshold or noInflation. FFM and JNI mechanics are jni-and-ffm, the annotations reflection reads are java-annotations, and deserialisation attack surface is java-serialization-hardening.

melodic-software Bundle

Proactively hunt unobserved bugs in resting code: a read-only two-stage scan, recall-biased per-lens hunter subagents, then a separate fresh-context default-refute gate, over a target path/feature/diff or a rotated lane, emitting only verified 5-field findings. Use when: 'find a bug', 'bug hunt', 'scan for bugs', 'hunt for bugs in <X>'. Skip when: reviewing a diff (`review:code-review`); security auditing (`review:security-review`); root-causing an observed failure (`debugging:debug`); doc/config/code/arch claim drift, all dimensions (`codebase-health:audit`); structural tidying (`code-tidying:tidy`); comment markers (`work-items:scan-todos`); coverage gaps (`testing:audit`, `mutation-testing:audit`). Disambiguation: 'scan repo for issues' is the upstream known-issue registry (`claude-ops:known-issues`); 'file a bug' you already observed is `bugs:write`. Bare invocation neither edits nor files; `--track` files verified findings as raw intake (subject to the team's `filing_posture`).

melodic-software Bundle

Bring a machine's plugin fleet current on demand: marketplace refresh, update the plugins that actually load (including in-repo project/local-scope installs), install new catalog plugins per policy, detect scope divergence, and surface (never silently fix) drift, with a terse actionable report; refuses to downgrade by default. Actions: sync (default, mutating), audit (read-only dry run), converge (explicit scope consolidation). Use when: 'sync plugins', 'update my plugins', 'are my plugins current', 'check plugin drift', 'converge plugin scopes', or before relying on a plugin that might be stale.

melodic-software Bundle

Audit an arbitrary directory tree for orphaned, temporary, stale-lock, failed-write, partial-download, and empty leftover artifacts; classify evidence into confidence tiers; and optionally remove exact validated paths after explicit per-tier approval. Read-only by default and manual-only. Use when: 'audit this directory', 'find orphaned files', 'what junk can I clean up', 'reclaim disk space', 'find temp or lock leftovers', 'clean up my home directory'. Skip when: repository cache/build cleanup belongs to repo-hygiene, a product has its own prune/GC command, or the target is an OS-managed root.

melodic-software Bundle

CI code-review lane for a GitHub pull request. High-signal correctness and maintainability findings only, scoped out of security when a security lane exists. Use when: 'CI code review', 'claude-review lane', '/review:code-review', or a reusable workflow invokes the org code-review plugin command.

bg-szy Bundle

Draft, restructure, or plan Nature-style manuscript sections and initial-submission materials from author-provided claims, results, figures, notes, or Chinese drafts. Use for abstracts, introductions, related work, methods, Results or experiments, discussions, conclusions, titles, full manuscript arguments, and first-submission packages such as cover letters, title pages, highlights, author contributions, availability or declaration text, and reviewer suggestions. Also use to classify Results evidence, decide what belongs in main text, captions, Methods or source data, or Supplementary Information, compress Results to the shortest sufficient evidence chain, prevent revision accretion, and audit paragraph necessity or claim repetition. Trigger on drafting a paper or section, structuring a manuscript, academic writing, first submission, 投稿材料、首次投稿、投稿信、标题页、亮点、作者贡献、数据可用性声明、推荐审稿人.

bg-szy Bundle

The Claude Security menu — pick a job: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose).

bromso Skill

Score brand compliance of any content against the brand guidelines