Security

joogy06 Bundle

Use when starting a long-running session, before claiming task completion, or every several major tool calls to prevent AI drift from initial instructions. Defines drift mechanisms (context rot, lost-in-the-middle, persona collapse, instruction budget), symptoms to watch for, and protocols for periodic checkpointing, state externalization, metacognitive audit, and recency anchoring. Builds on hard-rules-checklist.md. Trigger phrases: "anti drift check", "drift check", "checkpoint rules", "am I still on task", "session discipline", "re-anchor", "state externalization", "metacognitive audit".

joogy06 Skill

Use when running Static Application Security Testing (SAST) on a codebase — wraps bandit (Python), semgrep (multi-language, OSS rule packs), eslint-security (JavaScript/TypeScript), and CodeQL (GitHub-hosted, license-gated for private repos). Standardises on SARIF 2.1.0 output, feeds the G_SECURE gate in _meta/gates.py, integrates with forge Step 1 advisory, alf sweeps, and pre-commit/CI workflows. Trigger on - SAST, static analysis, bandit, semgrep, CodeQL, eslint-security, SARIF, security linting, code-injection scan, "scan code for vulnerabilities", "find security bugs", "OWASP scan".

joogy06 Bundle

Use when installing, configuring, or managing IBM WebSphere Application Server on RHEL 9 — WAS traditional (8.5.5/9.0) profiles and deployment, WebSphere Liberty/Open Liberty configuration and development, application deployment (WAR/EAR), security (SSL/TLS, LTPA, LDAP/AD integration, SAML/OIDC), JVM tuning (heap, GC policies), clustering and ND topology, JDBC data sources, JMS/MQ integration, wsadmin scripting (Jython), systemd services, SELinux contexts, and firewalld rules. Part of the ibm-* skill family.

joogy06 Skill

Use when administering WordPress sites — wp-config.php configuration, security hardening, performance optimization (object cache, page cache, CDN), user roles and capabilities, database maintenance and cleanup, backup and migration (WP-CLI search-replace), debugging (WP_DEBUG, error logs, white screen of death), multisite network setup, cron system configuration, auto-updates, or troubleshooting WordPress errors.

joogy06 Skill

Use when configuring web servers on RHEL 9 (and AlmaLinux/Rocky 9) — Nginx, Apache (httpd), Caddy setup and tuning, virtual hosts, SSL/TLS certificates, Let's Encrypt/certbot, reverse proxy patterns, load balancing, HTTP/2/3, security headers, SELinux booleans for web services, and performance optimization. Part of the rhel-* skill family.

ericrisco Bundle

Use when you land in an unfamiliar or inherited codebase and must get productive fast: a breadth-first map of entry points, request flow, module ownership, hidden side effects (cron, webhooks, workers) and churn hotspots, committed as CODEBASE-MAP.md. NOT a deep audit of one module (that is `analyze`) or chasing one failure (that is `debug`).

rweisssieker-xp Skill

Assign risk scores to Power BI reports, datasets, and delivery plans. Use for business risk, KPI risk, security risk, performance risk, refresh risk, maintenance risk, adoption risk, and portfolio prioritization.

rweisssieker-xp Skill

Use when Power BI work touches finance, regulated industries, audit, ESG, quality, export control, privacy, validation, internal controls, or compliance standards such as IFRS, HGB, US GAAP, SOX, CSRD, ISO 9001, IATF 16949, GMP, FDA, GxP, GDPR, or sanctions.

rweisssieker-xp Skill

Use when Power BI reports, semantic models, AI outputs, sharing, exports, RLS, labels, PII, SOX, GDPR, audit evidence, or governance policies need AI-assisted compliance review.

planifest Bundle

Systematic debugging workflow for isolating software root causes, implementing proportional fixes, and verifying recovery with reproducible evidence. Use when application/runtime failures, regressions, or flaky behavior are observed and the task requires both diagnosis and remediation. When specialized skills are available in the environment, defer GitHub Actions failure triage to `github-fix-ci`, commit-introduction isolation to `git-bisect-debugging`, profiler-led hotspot analysis to `performance-profiling`, active security incident command to `security-incident-response`, and postmortem-only reporting to `incident-postmortem`. Do not use for broad feature implementation or speculative hardening without evidence.

planifest Bundle

Interactive developer experience plan review. Explores developer personas, benchmarks against competitors, designs magical moments, and traces friction points before scoring. Three modes: DX EXPANSION (competitive advantage), DX POLISH (bulletproof every touchpoint), DX TRIAGE (critical gaps only). Use when asked to "DX review", "developer experience audit", "devex review", or "API design review". Proactively suggest when the user has a plan for developer-facing products (APIs, CLIs, SDKs, libraries, platforms, docs). (gstack) Voice triggers (speech-to-text aliases): "dx review", "developer experience review", "devex review", "devex audit", "API design review", "onboarding review".

planifest Bundle

Run full-scope code review for correctness, maintainability, and regression risk when no single specialty dominates. Use for broad merge-readiness reviews with explicit findings and evidence; if security or performance risk is primary, prioritize `code-review-security` or `code-review-performance` first.

planifest Bundle

Run security-focused code review when changes cross trust boundaries or may affect authentication, authorization, input validation, secrets handling, or sensitive-data exposure. Use for merge decisions requiring explicit security findings; do not use for non-security-only review scope.

planifest Bundle

Security workflow for authorization boundaries, least-privilege policy, and enforcement design. Use when permission models, access decisions, or privileged action controls are required; do not use for authentication factor selection or non-security quality tuning.

planifest Bundle

Security workflow for secure-by-default coding decisions and vulnerability prevention in implementation changes. Use when application code paths process untrusted input, sensitive data, or privileged operations; do not use for policy-only governance without code impact.

planifest Bundle

Security workflow for authentication architecture, credential lifecycle, and session/token assurance. Use when login, identity proofing, MFA, or session security decisions are required; do not use for authorization policy design or non-security quality tuning.

planifest Bundle

Security workflow for threat modeling using assets, trust boundaries, attacker capabilities, and abuse paths. Use when systems or major features need explicit security design validation before implementation or major release; do not use for active incident containment.

planifest Bundle

Quality attribute specification workflow after functional requirements are defined. Use when approved functional requirements need measurable performance/reliability/security/operability/compliance targets before implementation planning; do not use for initial requirement elicitation or sprint task breakdown.

planifest Bundle

Security workflow for secret inventory, storage, distribution, rotation, and auditability controls. Use when API keys, credentials, certificates, or signing secrets lifecycle decisions are required; do not use for generic config management that excludes sensitive material.

planifest Bundle

Design and maintain GitHub Actions workflows with explicit trigger scope, security boundaries, and reliable job orchestration. Use when GitHub automation (build/test/release jobs, triggers, permissions, caching, concurrency, environments) must be created or revised; do not use for non-GitHub runtime architecture or data-layer design.

planifest Bundle

Security workflow for vulnerability intake, triage, remediation planning, and fix verification. Use when vulnerabilities from scans, reports, or incidents must be prioritized and driven to closure; do not use for incident command during ongoing active compromise.

allinherog-star Bundle

网站质量审查助手适合technical、产品、市场营销、software在用户提出“网站质量够好吗”这类问题，需要快速拆解目标、判断重点并形成可执行结果时使用，帮助基于输入材料生成问题归因、服务改进建议、SOP 或 FAQ 清单。

allinherog-star Bundle

文案诊断助手适合内容创作者、运营、市场营销、内容媒体在用户提出“这段文案能打动人吗”这类问题，需要快速拆解目标、判断重点并形成可执行结果时使用，帮助基于输入材料生成摘要、诊断结论、行动建议和可复用交付物。

iamwaqargulzar Bundle

When the user wants to audit or optimize an App Store or Google Play listing. Also use when the user mentions 'ASO audit,' 'app store optimization,' 'optimize my app listing,' 'improve app visibility,' 'app store ranking,' 'audit my listing,' 'why aren't people downloading my app,' 'improve my app conversion,' 'keyword optimization for app,' or 'compare my app to competitors.' Use when the user shares an App Store or Google Play URL and wants to improve it.

iamwaqargulzar Bundle

Compatibility skill for aso audit. Use when a user or upstream workflow invokes this name; route the task to `aso` while preserving the requested scope and source-specific intent.

deciqai Bundle

Activate when: our KPI is going up but the real outcome isn't improving; people seem to be gaming the metric; we're about to tie bonuses or promotions to a number; an algorithm is producing results nobody intended; a test or audit system is being designed. Do NOT activate when: the metric IS the goal with no proxy gap; measurement is purely descriptive with zero stakes attached. More: deciqai.com/s/goodharts-law

deciqai Skill

Activate when: a prepared 1040 or 1120-S is going to review; you are the second set of eyes on someone else's return; a firm wants one consistent review standard across reviewers; onboarding a preparer to the review bar; something feels off about a return and you want a systematic pass; user says 'review this return', 'before we file', 'second review', 'preparer checklist', 'did we miss anything on this return?'. Do NOT activate when: the return is not yet prepared; the question is a single technical treatment; the work is chasing missing documents rather than reviewing; the question is what an examiner would attack or whether a position invites audit rather than whether the return is right (use tax-prep-pre-file-audit-premortem instead — it applies to 1120-S as much as 1040). More: deciqai.com/s/cpa-return-review

deciqai Bundle

Activate when: user says 'Bayesian', 'prior', 'posterior', 'base rate', 'likelihood ratio', or 'update my belief'; someone treats 'the evidence is consistent with X' as proof of X; a high-stakes decision rests on interpreting a test result, security alert, fraud flag, A/B result, or hiring signal; base rates are being ignored in favor of a vivid story. Do NOT activate when: the decision is genuinely deterministic and probabilities do not apply; there is no data or domain knowledge to anchor a prior (Bayes amplifies information, it does not create it from nothing). More: deciqai.com/s/bayesian-reasoning

deciqai Skill

Activate when: user says 'contrarian question,' 'the Thiel question,' 'what important truth do very few people agree with you on,' 'is this actually contrarian,' or 'what valuable company is nobody building'; user is drafting or stress-testing a startup thesis, pitch 'secret,' or investment view that claims to be non-consensus; user is preparing for an interview or pitch where they must defend an unpopular claim; user suspects their bold-sounding claim is really consensus in edgy clothing. Do NOT activate when: the user needs the broader portfolio-level discipline of hunting for edges across many bets (use non-consensus-thinking instead); the claim is a matter of taste or values with no evidence path to being right or wrong; the user wants validation or applause for a provocative take rather than a gate that might fail it. More: deciqai.com/s/contrarian-question

deciqai Skill

Activate when: user asks 'what do we know that others don't,' 'where is our edge,' 'what important truth do few people agree with me on,' 'is this idea defensible,' or is hunting for a startup idea, an untapped market, or a hidden opportunity; a business plan claims uniqueness but can't name the truth it rests on; user says 'Zero to One,' 'Thiel secret,' or 'contrarian opportunity.' Do NOT activate when: 'secret' means credentials, API keys, passwords, encryption, secret management, or any security/privacy topic — this is a business-opportunity skill, not a security skill; the user wants execution help on an already-validated idea rather than the truth beneath it. More: deciqai.com/s/zero-to-one-secrets

deciqai Bundle

Activate when: someone says 'they don't believe we'll follow through', 'how do I make my threat credible?', 'how do we deter a competitor from entering?', 'we need to lock in this customer/partner', 'should we burn our bridges?', or when a stated threat or promise is being discounted by the other side. Do NOT activate when: the problem is capability (you cannot execute the threat, not just credibility that you will), or when the environment is changing so fast that any lock-in creates more rigidity than credibility gain. More: deciqai.com/s/strategic-commitment

deciqai Bundle

Activate when: a founder asks 'can we avoid competing head-on with big players?', someone asks 'is this disruption or just a price war?', an investor wonders if a startup's entry angle creates durable structural advantage, an incumbent spots a cheap new entrant and needs to know if it's a real threat, a product team wants to know which features to deliberately leave out of an MVP. Do NOT activate when: the market requires absolute performance with no 'good enough' threshold (aircraft engines, Class III medical devices), or the competitive situation is a pure price war with no cost-structure asymmetry. More: deciqai.com/s/disruptive-innovation

deciqai Skill

Activate when: a client receives an IRS notice or letter; an examination opens or an IDR arrives; a client has unfiled returns, a balance owed, or a lien/levy pending; deciding whether to appeal an adjustment or collection action; scoping a representation engagement; user says 'IRS notice', 'audit letter', 'exam', 'IDR', 'levy', 'lien', 'back taxes', 'unfiled returns', 'Form 2848', 'appeal this', 'the IRS is after my client'. Do NOT activate when: the work is return preparation or review with no controversy; the matter is purely a state or local authority (different rules and timelines); facts suggest criminal exposure — stop and involve counsel. More: deciqai.com/s/cpa-irs-representation

deciqai Bundle

Activate when: user says 'everyone agrees on this,' 'the obvious move is X,' 'why go against the grain?'; user is entering a crowded market where the right strategy feels obvious; user has an early signal conflicting with the mainstream narrative; user is making a high-stakes allocation where popular choice and correct choice may diverge. Do NOT activate when: user just wants to be different with no specific edge to audit; context is purely creative where originality is the goal rather than competitive decision-making. More: deciqai.com/s/non-consensus-thinking

deciqai Bundle

Diagnoses the buyer/seller deadlock in any trade of information — the buyer cannot value what they cannot see, but once they see it they have it for free — and selects the disclosure mechanism (patent, NDA, staged disclosure, trusted intermediary + escrow, reputation, or proxy demonstration) that lets the buyer estimate value WITHOUT the seller losing appropriability. Activate when: user must sell, license, or pitch information/technology/know-how and asks 'how much do we reveal before they'll pay', 'how do we prove it works without giving it away', 'should we patent this or keep it secret', 'they want to see the code/formula/method before signing', 'how do we let a buyer value our tech in due diligence without leaking it', or describes an M&A/VC/licensing/consulting deal where the thing being sold IS the information. Do NOT activate when: the good has no information-appropriability problem (a commodity, a physical product that can be inspected without transferring the design); the information is already publ

deciqai Skill

Activate when: preparing any return claiming EITC, CTC/ACTC/ODC, AOTC, or Head-of-Household status; onboarding a paid-preparer workflow; a reviewer says 'did we document due diligence?', 'are we 8867-covered?', 'EITC audit risk.'. Do NOT activate when: no refundable credit / HOH is claimed; the return is self-prepared with no paid preparer; the question is purely tax-law calculation (use a calc tool, not this). More: deciqai.com/s/tax-prep-8867-due-diligence