Security

garyld1962 Skill

Audit project dependencies: check for vulnerabilities, outdated packages, unused deps, and license compliance. Use periodically or before releases.

garyld1962 Skill

Use periodically or when setting up a new project to audit Claude Code skills/plugins/agents, research marketplaces, gap-analyze, and implement recommendations.

garyld1962 Skill

Audit a repository before planning or extending it. Produces an implemented/missing/duplicated/broken checklist without editing files.

garyld1962 Skill

Audit this repo's custom Claude Code skills for description-level overlap with native skills (superpowers, plugins, built-ins) using the current session's live skill list as the catalog. Identifies skills whose descriptions compete with natives and recommends per-skill verdicts: tighten, cross-reference, integrate as sub-primitive, hand off, or redundant. Trigger phrases: 'audit native skill overlap', 'check overlap with native skills', 'do my custom skills compete with natives', 'native skill audit', 'evaluate skills against natives'.

garyld1962 Skill

Reusable 7-point security review for diffs. Embedded by /hotfix (mandatory), /pr, /ship, /domain-review (conditional, per canonical trigger criteria). Not user-invokable.

garyld1962 Skill

Reusable taxonomy for classifying code dependencies by their testability and trust boundary. Drives test strategy and audit judgments. Embedded by /test-plan, /audit-existing, and any skill that needs to reason about how a dependency should be tested or treated.

garyld1962 Bundle

Domain-aware code review controller. Triage a diff, select review lenses, and report line-cited findings for correctness, security, tests, architecture, performance, and operability.

hmbown Skill

Knock is specifically about restoring legitimate access through authorized channels. It is NOT about: - Performance optimization (slow queries, throughput issues) → different spell - Removing safety controls (approval gates, compliance checks) → different spell - Simple bug fixes (typos, wrong ports) → different spell - Breaking constraints (resource limits, CPU throttling) → different spell - Security analysis (encryption schemes, certificate inspection) → different spell

hmbown Skill

In D&D, Symbol inscribes a powerful glyph with a predefined effect — death, fear, sleep, stunning — that triggers when conditions are met. Unlike Glyph of Warding (which protects a specific place or object), Symbol marks a conceptual boundary with a named policy. The real-world version is semantic policy tagging: marking a database column as PII so access triggers audit logging, tagging a deployment as HIPAA-scoped so changes require compliance review, or labeling an API endpoint as rate-limited-aggressive so traffic spikes trigger automatic throttling. The symbol is the policy, and the policy enforces itself.

hmbown Skill

Hold Person = hard freeze. Nothing moves. In-flight operations stop. Requires authority. Used for security incidents, fraud, compliance holds, misbehaving systems. Sleep = graceful suspension. State is preserved and queued. Operations resume automatically. Used for maintenance windows, temporary pauses, planned downtime.

hmbown Skill

Use this skill when a message must sound serious because the situation is serious: security findings, compliance obligations, deadline-backed escalations, or non-optional remediation notices. It is about calibrated force, not bluster; the tone should match the facts and consequences.

hmbown Skill

Illusory Script is for audience-gated or self-expiring content: burn-after-reading notes, scoped links, ephemeral secrets, and documents that should only mean something to the right reader in the right window. The spell is partly social pattern and partly security mechanism. It is useful, but it is not a substitute for mature secrets management or compliance records.

shengdabai Bundle

Account ban risk monitor for Claude Code. Detects dangerous usage patterns that could trigger rate limiting, account suspension, or banning. Auto-triggers on session start. Manual trigger: /risk-guard. Checks: concurrent sessions, tool call velocity, automation loops, session frequency, config risks, secret exposure, telemetry leaks, file permissions. Triggers on: 'risk', '风险检查', '封号检查', 'ban check', 'account safety', '账号安全'.

shengdabai Bundle

Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site. (gstack)

shengdabai Skill

Portfolio-wide code audit across multiple repos with ledger-based resumption. Use when the user wants to audit, review, or fix bugs across 3+ projects in parallel. Generates a TODO ledger first (cheap), then executes per-repo sub-agents in batches that survive usage-limit interruptions.

shengdabai Skill

Brain health checks: back-link enforcement, citation audit, filing validation, stale info detection, orphan pages, and benchmarks. Use when asked to check brain health, run maintenance, or audit quality.

delorenj Skill

Review source files changed during a phase for bugs, security issues, and code quality problems

delorenj Skill

Retroactively audit an executed AI phase's evaluation coverage — scores each eval dimension as COVERED/PARTIAL/MISSING and produces an actionable EVAL-REVIEW.md with remediation plan

delorenj Skill

Retroactively verify threat mitigations for a completed phase

delorenj Skill

Retroactively audit and fill Nyquist validation gaps for a completed phase

delorenj Skill

Audit milestone completion against original intent before archiving

delorenj Skill

Create phases to close all gaps identified by milestone audit

vibeeval Skill

Release preparation workflow - security audit → E2E tests → review → changelog → docs

vibeeval Skill

Security audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan

vibeeval Skill

Security scan, dead code detection, and code quality audit for any project

vibeeval Skill

Pre-push API key and credential scanner - blocks git push if secrets found

vibeeval Skill

30+ service-specific secret detection regex patterns, entropy-based detection, PEM/JWT/Base64 identification, and false positive filtering.

vibeeval Skill

SOC2 Type II compliance - Trust Service Criteria, access controls, audit logging, change management, incident response, evidence collection

vibeeval Skill

Detect fail-open configurations, hardcoded secrets, weak authentication defaults, permissive CORS, disabled security features, and other insecure-by-default patterns. Adapted from Trail of Bits. Use during security review or when auditing configuration and initialization code.

vibeeval Skill

GDPR data handling, audit logging, data classification, retention policies, and consent management for regulatory compliance.

vibeeval Skill

Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs, commits, or code changes for security implications.

vibeeval Skill

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

vibeeval Skill

Scan .claude/ directory for security misconfigurations, exposed secrets, unsafe permissions

vibeeval Skill

Payment provider abstraction, webhook security, subscription lifecycle, dunning flows, pricing models, invoicing, tax handling, and refund patterns for SaaS applications.

vibeeval Skill

Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.

ascend-ai-coding Bundle

End-to-end AscendC custom operator development for Ascend NPU in an ascend-kernel (csrc/ops + build.sh + torch_npu PyTorch custom op) project. Use to design, generate, build, test, document, and tune a new AscendC operator from a name and a math/functional spec. Covers project init, two-level tiling design, op_host/op_kernel code generation, framework registration, compile/install/debug, PyTorch-style API docs, precision evaluation and root-cause debugging, torch_npu.profiler performance benchmarking, performance optimization, and security code review.