Security

acaprino Skill

Runs as the testing-quality dimension of /senior-review:team-review and /senior-review:code-review, and as the engine of /testing:test-audit. TRIGGER WHEN: auditing a test suite, reviewing test hygiene, detecting flaky or dead tests, or assessing test redundancy, layer distribution or placement. DO NOT TRIGGER WHEN: tests should be written (use test-writer), or quarantine or consolidation applied (use /testing:test-audit --fix or /testing:test-consolidate).

acaprino Skill

Audit a codebase for structural entropy, or with --diff check whether a change introduces new entropy. Report-only; auto-launches /codebase-xray:analyze when .codebase-xray/ is missing. TRIGGER WHEN: the user asks to audit duplicated knowledge, competing sources of truth, redundant models, derivable state, or wrong abstractions.

acaprino Skill

Run each ecosystems own tooling; report only what tools, registries, and advisory databases say. Covers npm/pnpm/yarn/bun, pip/uv/poetry, cargo, go, gem, composer, maven/gradle, nuget. TRIGGER WHEN: the user asks to audit dependencies, scan for CVEs, check license obligations or compatibility, find outdated packages, assess supply-chain risk, or prepare a dependency-update PR. DO NOT TRIGGER WHEN: dead-code or unused-dependency cleanup (use /senior-review:code-review --fix), a Python-only lint/type/coverage audit (use /python-development:python-audit), or a Stripe webhook event audit (use /stripe:audit-webhooks).

acaprino Skill

Hunts coupling violations, broken abstractions, resource leaks, stale caches, and anti-patterns. TRIGGER WHEN: the user asks for a code review, architecture audit, quality scoring, failure-path analysis, or pattern consistency check. DO NOT TRIGGER WHEN: the task is security-specific auditing (use security-auditor).

acaprino Skill

Checks shipped documentation against the code and plans the fixes. TRIGGER WHEN: the user asks to audit, update, or verify existing technical docs against the current codebase, or to detect documentation drift on any of the 20 dimensions (endpoints removed but still documented, env vars renamed, schema fields added/dropped, dependencies upgraded, alerts removed, etc.). DO NOT TRIGGER WHEN: creating new docs from scratch (use /codebase-mapper:docs-create) or humanizing prose style (use /codebase-mapper:humanize-docs).

acaprino Skill

Run ruff, mypy/pyright, vulture, complexipy/radon and pytest, then report prioritized fixes. TRIGGER WHEN: the user asks to audit a Python codebase across lint, types, complexity, dead code and coverage, or to prepare a codebase for release review. DO NOT TRIGGER WHEN: only one dimension is in scope: restructuring (use /python-development:python-refactor), dead code alone (use /senior-review:code-review --fix), or test writing (use python-development:python-tdd).

acaprino Skill

Always-on hygiene dimension of /senior-review:team-review. TRIGGER WHEN: the user asks for a cleanup review, technical-debt audit, dead code, orphan assets, generated artifacts tracked in VCS, unused dependencies, stale docs and historical artifacts, or leftovers of finished work (migrations, debug tooling, stale branches). DO NOT TRIGGER WHEN: the user wants removal (use /senior-review:code-review --commit, Step 7c), architecture or security review (use code-auditor or security-auditor), or one language only (use typescript-development:knip or python-development:python-dead-code).

acaprino Skill

Surface every drift and let the user decide each one. TRIGGER WHEN: the user asks to audit, update, verify, or improve an existing CLAUDE.md against the current codebase. DO NOT TRIGGER WHEN: creating one from scratch (use /project-setup:create-claude-md).

acaprino Skill

Attacker-mindset pass over the target: assumes it is exploitable and proves it. TRIGGER WHEN: the user asks for a security review, SAST audit, OWASP or CWE analysis, secret-leak scan, or an authentication or authorization code review; injection vectors, auth bypasses, crypto mistakes, or missing security headers. DO NOT TRIGGER WHEN: the concern is general code quality (use code-auditor) or infrastructure and network security (use platform-reviewer).

acaprino Skill

Quick health check for any Claude Code plugin marketplace. TRIGGER WHEN: the user asks to validate marketplace.json, check plugin file references, report plugin counts and version status, or audit structural integrity. DO NOT TRIGGER WHEN: reviewing plugin content quality (use /marketplace-ops:marketplace-review) or authoring new plugins.

acaprino Skill

Audit a codebase against the platform-engineering rulebook. TRIGGER WHEN: the user asks for a platform-level review, cross-platform security audit, Electron or Tauri hardening check, or an SPA, PWA, mobile, or desktop compliance review. DO NOT TRIGGER WHEN: reviewing generic code quality with no platform dimension (use /senior-review:code-review).

acaprino Skill

Report reliability and production-readiness defects, plus the venue assumptions nobody checked. TRIGGER WHEN: the user asks to review, audit, or validate an IB or TWS trading system: contracts, orders, brackets, pacing, error handling, reconnection, deployment. DO NOT TRIGGER WHEN: building from scratch (use ibkr-architect), answering a single behaviour question (use /trading-broker-integration:ibkr-verify), or MetaTrader 5 (use /trading-broker-integration:mt5-audit).

acaprino Skill

Documentation engineer for a single dimension or a whole project, generation or drift audit. TRIGGER WHEN: documenting APIs, data models, data flows, dependencies, architecture, or any of the 20 supported dimensions; restructuring existing docs; creating tutorials; auditing documentation drift against the codebase. DO NOT TRIGGER WHEN: pure prose or style rewriting of existing docs (use codebase-mapper:doc-humanizer), a full multi-document narrative project guide (use /codebase-mapper:map-codebase), or a public-facing README (use docs:readme-craft).

acaprino Skill

Adversarial reviewer that assumes violations of the platform-engineering rulebook exist and proves them. TRIGGER WHEN: auditing PRs or code for security, architecture, or performance compliance across SPA, PWA, mobile, and desktop (Electron/Tauri) platforms.

acaprino Skill

Authority on Interactive Brokers integration: contracts, orders, brackets, data, error verdicts, resilience and deployment, across equities, options, futures, FX, CFDs and crypto. TRIGGER WHEN: building or debugging anything on the TWS API with ib_async, or answering a question about how IBKR behaves. DO NOT TRIGGER WHEN: auditing an existing system end to end (use /trading-broker-integration:ibkr-audit), MetaTrader 5 (use mt5), or broker-agnostic strategy logic.

argentaios Skill

Host security hardening and risk-tolerance configuration for ArgentOS deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, ArgentOS cron scheduling for periodic checks, or version status checks on a machine running ArgentOS (laptop, workstation, Pi, VPS).

thinkfleetai Skill

Systematic code review: security checks, performance analysis, complexity assessment, best practice validation, and review checklists.

thinkfleetai Skill

Audit APIs for OWASP top 10 vulnerabilities, test authentication flows, validate input handling, and check rate limiting.

thinkfleetai Skill

iOS HealthKit data sync CLI commands and patterns. Use when working with healthsync CLI, fetching Apple Health data (steps, heart rate, sleep, workouts), pairing iOS devices over local network, or understanding the iOS Health Sync project architecture including mTLS certificate pinning, Keychain storage, and audit logging.

thinkfleetai Skill

Secret Scanner

thinkfleetai Skill

Audit project dependencies for vulnerabilities, outdated packages, license compliance, and supply chain risks.

thinkfleetai Skill

Comprehensive US tax advisor, deduction optimizer, and expense tracker. Covers all employment types (W-2, 1099, S-Corp, mixed), estimated tax payments, audit risk assessment, life event triggers, multi-state filing, RV-as-home rules, tax bracket optimization, document retention, and proactive year-round tax calendar nudges. Your CPA in the pocket.

thinkfleetai Skill

Static analysis, dependency vulnerability scanning, secret detection, and container image scanning using open-source tools.

netvar1337 Skill

Use to run Semgrep security/quality scans, including multi-language parallel workers.

netvar1337 Skill

Use to triage/audit IDA binaries: suspicious behavior, crypto/network, multi-table queries.

dnyoussef Bundle

Security

dnyoussef Bundle

Style Audit

dnyoussef Bundle

Compliance

dnyoussef Bundle

Systematic technology and market reconnaissance for extracting actionable intelligence from repositories, papers, and competitive landscapes.

dnyoussef Bundle

Functionality Audit

dnyoussef Bundle

Sandbox Configurator

dnyoussef Bundle

Reproducibility Audit

dnyoussef Bundle

Theater Detection Audit

dnyoussef Bundle

Network Security Setup

dnyoussef Bundle

Reverse Engineer Debug

dnyoussef Bundle

Reverse Engineering Deep