Security

melodic-software Bundle

Chart a set of repositories as a C4 System Landscape plus an application-portfolio table: discover the repositories, collect owner/runtime/framework/dependency/last-touched facts from a tested script, draw only relationships a cited fact supports, and write both artifacts into the consumer's declared architecture home. Use when: 'map our landscape', 'system landscape', 'what systems do we have', 'application portfolio', 'who owns which repo', 'what runtimes are we on', 'chart our repositories', 'C4 context across repos', 'inventory our systems'. Skip when: the question is inside ONE codebase (module friction, shallow modules, seam placement) which is /architecture:improve, or the goal is fleet cleanup (stale branches, orphaned worktrees, moved remotes) which is /repo-fleet-hygiene:audit.

melodic-software Bundle

Re-anchor pointer-over-copy discipline, then audit the work in flight for copied content, internal-name coupling, and closed capability lists, and correct by pointing at the living source. Use when: 'point don't copy', 'you copied that', 'don't duplicate the docs', 'cite instead of paste', 'link don't restate', 'you enumerated the tools', 'that couples to internal names', 'this will drift', or at conversation start on documentation work.

melodic-software Bundle

Re-anchor the discipline of actually using the skills available to you. Scan the in-context skill listing, map the conversation and the task to the skills that fit, and invoke them instead of reinventing their procedure from scratch. Then audit the work in flight for a skill that should have fired and did not, and route forward. Invoke it now, and name the relevant skills when delegating to a subagent. Use when: 'use your skills', 'you have a skill for that', 'did you check your skills', 'there's a skill for this', 'you reinvented that', 'you skipped the skill', 'invoke your skills', or at conversation start to set the posture that available skills get used.

melodic-software Bundle

Read coverage artifacts a build already wrote (lcov `.info` including the 2.2 `FNL`/`FNA` records, Cobertura XML, coverage.py JSON, a Go cover profile) and report line coverage per file and function for a change, a path, or the tree, plus CRAP per function (`comp^2 * (1 - cov/100)^3 + comp`, Savoia and Evans 2007) from the sibling complexity numbers. It runs no tests and installs nothing. A missing artifact warns, naming the paths searched, never a silent skip; a function with no executable lines reports null, not 0. Coverage and CRAP default to a null reference (no bar) with its provenance, and no finding, severity, or exit-code gate is emitted. Use when: 'coverage of this change', 'coverage per function', 'CRAP score', 'which functions are complex and untested', 'read the lcov report', 'coverage.xml', 'how covered is this file'; for complexity alone use /code-metrics:audit-complexity; for what these numbers can and cannot say, /code-metrics:principles.

melodic-software Bundle

Re-anchor research and no-assumptions discipline mid-session, then self-audit and correct the current work. Use when: 'do your research', 'you're guessing', 'cite that', 'stop assuming', 'evidence, not vibes', 'you skipped verification', 'that's training-data recall', 'research this properly', 'fact-check that', 'make sure that's right', or at conversation start to set the posture. For a heavy verification fan-out, a typed full inventory of the session's claims verified at a configurable depth, use the sibling do-your-research-deep.

melodic-software Bundle

Re-anchor the anti-fragmentation discipline that when an established way of doing something already exists, an idiom, structure, naming shape, doc format, or process, new work REUSES it or openly REPLACES it (migrate the old uses, record the decision); never a silent second, parallel way alongside. Then audit the work in flight for unexplained divergence from an established way. Replacing is first-class when evidence backs it, the sin is the SILENT second way, not divergence itself. Use when: 'reuse or replace', 'we already have a way of doing this', 'don't invent a second way', 'keep it one way', 'follow the existing pattern or replace it', 'be consistent', 'you added a parallel way', 'this diverges from how we do it elsewhere', or at conversation start on work that extends an established codebase, structure, or process.

melodic-software Bundle

Measure how much of the code is typed for the changed files, a path, or the whole tree, as a percentage per lane: `type-coverage`'s ratio of identifiers whose type is not `any` for TypeScript, and mypy's `--any-exprs-report` coverage over expressions for Python. Because no standard or CWE anchors this measure, the reference is `null` by design and the number is a trend to watch rather than a bar; the report emits no finding, severity, or exit-code gate. Bash and Go have no comparable collector, and C# is not applicable, because an occurrence count is not comparable to a ratio. A lane whose tool is absent says so with an install hint and the run continues. Use when: 'how much of this is typed', 'type coverage', 'how many anys are in this', 'any usage in the change', 'type debt', 'measure our typing', 'mypy any expressions report'; for cyclomatic or cognitive complexity use /code-metrics:audit-complexity, and for what a measure can and cannot tell you use /code-metrics:principles.

melodic-software Bundle

Hunt dead code across a whole repository through four labelled lanes of unequal confidence. Knip (TS/JS unused files, exports, types, enum members), vulture (Python symbols), gopls (Go unexported symbols), and a portable grep lane (shell and other symbol languages), then adjudicate every candidate against the dynamic-usage evidence static analyzers are blind to, emitting Tier 1 (dead) and Tier 2 (uncertain) findings plus paste-ready native suppressions; read-only, no edits applied. Use when: 'find dead code', 'audit dead code', 'what is unused in this repo', 'unused exports', 'unreferenced functions', 'orphaned files', 'is anything here still called', 'dead code sweep', or when long-untouched code needs a deliberate hunt a rotated tidying lane never reaches, not for applying the deletion or Beck's Dead Code tidying (use /code-tidying:tidy), diff-scoped simplification of recently changed files (use /code-tidying:batch-simplify), comment residue (use /code-tidying:audit-comment-residue), or unused dependencies,

melodic-software Bundle

Measure per-function cyclomatic and cognitive complexity and Halstead difficulty for a change, a path, or the tree, per lane (TypeScript/JavaScript, Python, Bash, Go; C# deferred), from whichever external collector already resolves (lizard, radon, ESLint, sonarjs, gocyclo, gocognit, shellmetrics, multimetric); it installs none. Each number cites its reference: cyclomatic 20 from ISO/IEC 5055:2021 §8.2.117, with 10 (McCabe 1976) and 15 (NIST SP 500-235) selectable; cognitive (Campbell, SonarSource) and Halstead (Halstead 1977) carry none, no standard setting one. A lane with no collector says so and the run continues, an unmeasured value is null not zero, and no finding, severity, or exit-code gate is emitted. Use when: 'how complex is this code', 'cyclomatic complexity', 'cognitive complexity', 'complexity audit', 'is this function too complex', 'Halstead difficulty', 'measure complexity of a change'; for lines per file use /code-metrics:audit-size.

melodic-software Bundle

Read-only audit of a Claude Code INSTALLATION directory, the machine-scope `~/.claude` tree plus `~/.claude.json`. Inventorying every file, separating what the product's own retention sweep already manages from what nothing manages, resolving what each number in a filename actually means before any process-liveness check, and detecting a deliberate or mid-experiment state before classifying anything as stale. Reports; never deletes. When the bundled doctor skill resolves in your session, prefer it for the quick native health-and-fix pass; this skill for the deep read-only inventory. Use when: 'audit my .claude folder', 'what is in my ~/.claude', 'why is my Claude Code install so big', 'is anything stale in my Claude directory', 'does Claude Code clean up after itself', 'check cleanupPeriodDays', 'is this lock file dead', 'tidy my Claude Code install'. Not for: a repo's project-scope .claude config (use /claude-config:audit), or deleting anything (use /disk-hygiene:clean).

melodic-software Bundle

Measure duplicated code as clone groups over the changed files, a path, or the whole tree: each group's duplicated lines and tokens with every instance's file and line range, per lane (TypeScript/JavaScript, Python, Bash, Go, C#) from whichever clone detector already resolves. Replication the target repository declares about itself, a file vendored into several plugins and listed by path-within-plugin in a sanctioned-replication registry, is subtracted from the total and reported as an exclusion naming the registry line rather than as debt, and the report emits no finding, no severity, and no exit-code gate. Use when: 'is this duplicated', 'find copy-paste code', 'clone detection', 'duplication report', 'how much of this change is copied', 'DRY check', 'redundant code', 'duplicated lines in the diff'; for lines per file use /code-metrics:audit-size, and for what a duplication number can and cannot support use /code-metrics:principles.

melodic-software Bundle

Re-anchor terseness discipline, say markdown in fewer words without semantic loss, write code in fewer lines when readability holds, then audit the work in flight for avoidable verbosity and tighten it. Use when: 'tighten your output', 'tighten this', 'too verbose', 'say it in fewer words', 'this is bloated', 'trim the code', 'simpler form', 'cut the wordiness', 'be more concise', or at conversation start on prose- or code-heavy work.

melodic-software Bundle

Sweep stale references after renames, the syntactic forms token-only grep misses (slash-tokens, paths, chain prose, numbered table rows, frontmatter chains and globs). Use when: 'rename X to Y', 'I renamed X', 'audit rename', 'find stale refs', 'check for stragglers', 'after git mv', 'sweep references', 'rename impact preview', 'find half-renamed state', 'broken refs after rename', 'pre-PR rename check'. Actions: audit, audit blast, audit half-rename, audit orphans, apply, preview, blocklist; not for framework migrations or repo-wide dead-reference audits.

melodic-software Bundle

Re-anchor to your organization's engineering standards, then audit the work in flight against them and correct violations with doc citations. Use when: 'follow our standards', 'follow the standards', 're-anchor to standards', 'does this match our conventions', 'audit against standards', 'you're drifting from our conventions', or at conversation start on a repo governed by shared conventions.

melodic-software Bundle

Re-anchor the discipline that a tool, library, framework, language, or approach is chosen to fit the actual problem, not reached for out of habit, availability, incumbency, or preconception, then audit the selection in flight and re-derive it from the problem. Use when: 'pick for the problem', 'right tool for the job', 'which library should we use', 'what framework', 'should we build this or use X', 'is this the right approach', 'you defaulted to X', 'we always reach for X', 'evaluate the options', 'choose a dependency', or at conversation start on a build-vs-buy or technology-selection decision.

melodic-software Bundle

Escalate research discipline to a heavy verification fan-out over a TYPED FULL INVENTORY of the session's claims, assumptions, asserted facts, concrete specifics (paths, defaults, flags, signatures), and load-bearing premises, verifying each against a primary source at a configurable depth (tiered by default, or full), then report a per-item ledger with verdict, source, source tier, consensus count, and recency. Use when: 'deep research pass', 'verify every claim', 'audit all our claims', 'fact-check everything', 'go make sure those are all right', 'we've made a lot of load-bearing claims', or when your own judgement is the suspected bias across many claims. For a single or small inline fact-check ('fact-check that'), use the sibling do-your-research.

melodic-software Bundle

Audit and remediate skill-encapsulation violations. External citations reaching into private surfaces inside `.claude/skills/<X>/` or `plugins/<plugin>/skills/<X>/` (marketplace monorepos) beyond the slash invocation. Use when: 'audit encapsulation', 'find skill leaks', 'skill boundary violation', 'who is reaching into <skill>', 'check skill boundaries', 'public API drift', or before refactoring a skill.

melodic-software Bundle

Draft an `autoMode` classifier block for Claude Code by interviewing you about what should and should not be auto-approved, then printing a paste-ready JSON block to stdout. Entries follow the shape the classifier actually reads well: a label, bulleted COVERED / NOT COVERED, one line of rationale. Every section keeps `"$defaults"` so customizing does not discard the built-in rules. Use when: 'help me write auto mode rules', 'draft an autoMode block', 'set up auto mode', 'add an auto-mode rule for X', 'my auto mode rules are too vague', 'rewrite this classifier entry', or after an audit shows rules being dropped or ignored. Prints only, never writes any settings file.

melodic-software Bundle

Report the Claude Code permission state actually in effect. Discovers every settings scope (managed policy, user-global, project, local, and the pre-v2.1.211 start-directory copy), merges them into the effective allow/ask/deny set with each rule's source and precedence mechanic named, and classifies which allow rules auto mode drops on entry. Use when: 'what permissions are actually in effect' or 'show me my effective permissions' (including which settings file a rule comes from and what scopes were checked); 'which of my rules survive auto mode' (the entry diff); 'is my managed policy being read'; or before changing a permission rule you cannot locate. An allow rule ignored because of its shape is `audit-permission-grants`. Report-only, never writes any settings file.

melodic-software Bundle

Escalate upstream-conformance discipline to a heavy fan-out: dispatch fresh-context subagents doc-by-doc over a whole subsystem, framework, or repo, comparing each surface against its CURRENT official upstream docs, then report an inline divergence ledger. Use when: 'recheck the whole subsystem against upstream', 'audit every surface against the docs', 'deep upstream conformance pass', 'check the entire framework config against upstream', 'we depend on a lot of upstream surfaces and they may have drifted'. For a single inline recheck of the surface in play, use the sibling recheck-against-upstream.

melodic-software Bundle

Generates weekly usage reports.

melodic-software Bundle

Converts contracts to redlined drafts. Use when: 'redline this contract', 'compare contract versions'.

golemcloud Skill

Adding secrets to TypeScript Golem agents. Use when the user asks to add secrets, store API keys, manage sensitive config values, or use Secret<T> in TypeScript agents.

golemcloud Skill

Adding secrets to Rust Golem agents. Use when the user needs to store sensitive configuration such as API keys, passwords, or tokens that should not be checked into source control.

bg-szy Bundle

Review a personal Gmail inbox with local, owner-approved spam rules. Use for audit-first quarantine, Trash, sender rules, and header review. Do not use for automatic unsubscribe requests or unreviewed mailbox actions.

robsonkades Bundle

GraalVM Native Image: closed-world reachability, dynamic-feature metadata, class initialization and image-heap state, CPU targeting, GC and PGO choices, observability, and fair comparison with HotSpot. Use when deciding whether AOT fits a workload, diagnosing build or runtime-only failures, or validating startup, footprint, latency, throughput, build-cost, portability, and security trade-offs. Does not cover Graal as a JVM JIT (graalvm-jit), JVM-preserving startup strategies (startup-cds-crac-leyden), or HotSpot warm-up mechanics (jit-compilation).

knuckles-team Skill

Audit whether each citation is reachable, authoritative enough, correctly attributed, and actually supports the nearby claim, including qualifiers and freshness. Use when reviewing a sourced draft, research report, technical memo, or evidence table before relying on or publishing its claims. Do not use to invent replacement evidence or rewrite the document.

knuckles-team Skill

Network SSL/TLS expiry checker atomic skill. Connects to targets, parses TLS certs, and returns expiration days and security grades.

knuckles-team Bundle

Security analysis tools including checking Sentry error logs, conducting threat models, analyzing source code git repositories for security ownership and bus factors, and applying security best practices.

knuckles-team Bundle

Bump every PyPI-resolvable dependency in one or many repos' pyproject.toml files to its newest version on PyPI, preserving comments and formatting via a tomlkit round-trip edit, while safely leaving workspace/intra-repo members, CVE-pinned security floors, and complex (direct-URL/VCS or marker-qualified) specs untouched. Use when the user asks to modernize, refresh, or bump dependencies to the latest version across one repository or a whole fleet of repositories.

knuckles-team Bundle

Search and crawl the web for market-relevant news events for a supplied universe, then audit the citations for reachability and sourcing. Use when a researcher wants a sourced feed of detected news events; this workflow does not classify sentiment or place trades.

knuckles-team Bundle

Discover academic market-factor research, audit its evidence, extract comparable hypotheses, obtain the required market data, and backtest the candidates by composing package-owned and universal atomic skills. Use when a quantitative researcher wants an evidence-linked screening report for candidate alpha factors, not live trading or investment advice.

knuckles-team Bundle

Audit active SSH tunnels and network connectivity alongside system network interface status.

golemcloud Skill

Enabling authentication on HTTP endpoints in MoonBit Golem agents. Use when the user asks to add auth, security, or access control to HTTP endpoints.

ericrisco Bundle

Use when writing, reviewing, testing, or shipping Go code and HTTP services: idioms, `%w` error wrapping, goroutine/context/errgroup concurrency, net/http 1.22 routing, log/slog, project layout, table-driven tests, Go hardening. NOT language-agnostic threat modeling (that is `secure-coding`), NOT Dockerfile/CI shipping (that is `deployment`).

xjli360 Bundle

Reverse-engineer an Amazon breakout case by testing competing explanations across product innovation, brand, keyword breadth, organic visibility, timing, variants, promotions, returns, and compliance. Use for 爆款案例复盘、为什么突然增长、是不是站外、能不能复制、成功因素拆解.