Security

nirholas Skill

Guide to ERC-20 token approvals — how they work, why unlimited approvals are risky, how to check and revoke approvals, and best practices. Use when helping users manage approvals, audit wallet security, or understand approval-related risks.

nirholas Skill

Assess wallet security practices including key management, signing hygiene, approval management, and operational security to protect against common crypto theft vectors.

nirholas Skill

Complete mastery guide for smart contract security auditing — from first principles of EVM bytecode to advanced exploit patterns. Covers manual code review methodology, automated tooling (Slither, Mythril, Foundry fuzz), common vulnerability taxonomy (reentrancy, flash-loan attacks, oracle manipulation, access control, integer math), audit report writing, severity classification (Critical/High/Medium/Low/Informational), gas optimization reviews, upgrade safety, and DeFi-specific audit checklists for lending, AMM, vault, and stablecoin protocols.

nirholas Skill

Guide to Lyra Intel — an intelligence platform for analyzing repositories of any size, from small projects to enterprise monorepos with millions of lines of code. 70+ analysis components including security scanning, AI integration, dependency mapping, and code quality metrics.

nirholas Skill

Guide to integrating Web3Auth for social login in Web3 dApps. Covers email, Google, Apple, Discord, and Twitter login flows. MPC key management, session handling, RainbowKit integration, and migration from traditional wallet-only flows. Zero-friction onboarding.

gked2121 Bundle

Audits a codebase or business process for regulatory compliance across GDPR, HIPAA, SOC2, CCPA, and PCI-DSS. Scans for PII handling, data retention, encryption, access controls, audit logging, consent management, and data transfer issues. Generates a structured compliance report with findings, gap analysis, remediation steps, and evidence requirements.

gked2121 Skill

Cowork-style sweep of a folder of receipts, statements, and expense exports -- categorizes every transaction, matches receipts to statement lines, flags policy violations and anomalies, and outputs a clean expense report plus a findings memo.

gked2121 Skill

Audit your calendar with Cowork's calendar tools -- measure meeting load and fragmentation, identify which recurring meetings earn their slot, propose consolidations and focus blocks, and draft the diplomatic messages that reclaim your week.

gked2121 Bundle

Assesses how ready a business is for AI adoption across six dimensions. Evaluates data maturity, tech stack, team skills, process documentation, budget, and culture. Generates a comprehensive ai-readiness-report.md with scores, gap analysis, and recommended starting points. Aligned with OneWave AI's audit methodology.

agentik-os Bundle

Encrypted-in-repo secret vault (SOPS + age) so a lost laptop never means lost keys: every project's secrets are committed to git as age CIPHERTEXT and a fresh `git clone` + ONE master key restores everything (`sops -d`). A repo leak yields only ciphertext. Implements the R-SECRETS-VAULT doctrine. Use when the user says "vault", "encrypt my secrets", "secret backup", "recover my keys", "commit my API keys", "sops", "age", "never lose a key", or in French "coffre-fort", "chiffrer mes secrets", "sauvegarder mes cles", "recuperer mes cles". NOT for live secret INJECTION into a running app (that stays a plaintext .env in ~/.omega); NOT for public repos (they NEVER carry ciphertext).

agentik-os Skill

Forensic API quality audit v1 (Gestalt-Popper). 23-phase deep analysis of every API surface: Endpoint inventory, REST/GraphQL contract compliance, Authentication (every endpoint — owns STATIC auth correctness; /secaudit owns RUNTIME exploitation), Authorization (role-based access), Input validation (every parameter), Error response format, Status code correctness, Pagination, Rate limiting, Versioning strategy, Documentation accuracy, Response time benchmarks, N+1 detection, Idempotency, Webhook reliability, CORS configuration, Content negotiation, API deprecation handling, plus verdict, fix plan, fix execution, re-audit, and rate-limit safety gate. Reads audits/.dataaudit/verdict.json for schema types when available. Outputs audits/.apiaudit/verdict.json consumed by /secaudit for auth surface exploitation. Score /360. Preamble v1.0 compliant. Audit -> Plan -> Fix -> Re-audit. Use when user says "/apiaudit", "api audit", "api quality check", "endpoint audit", "api security check", "api contract verification".

agentik-os Skill

Forensic dependency & supply-chain audit v1 (Gestalt-Popper). 18-phase deep analysis of everything the project TRUSTS from third parties: dependency CVE exposure (direct + transitive), outdated and abandoned packages, license compliance and contamination, lockfile integrity and reproducible builds, transitive dependency bloat and duplication, typosquatting / dependency-confusion / namespace-takeover risk, postinstall and lifecycle script auditing, pinned vs floating version policy, SBOM generation and completeness, registry trust and provenance, bundle exposure (server deps leaking to client), monorepo workspace hygiene, plus verdict, fix plan, fix execution, re-audit, and build-integrity safety gate. Answers "Is the supply chain SAFE?" Score /360. Preamble v1.0 compliant. Complements /secaudit (which owns RUNTIME exploitation of CVEs) — depaudit owns STATIC supply-chain hygiene, provenance, licensing, and reproducibility. Audit -> Plan -> Fix -> Re-audit. Use when user says "/depaudit", "dependency audit", "

agentik-os Bundle

CIA-grade deep code audit v3. 24-phase forensic analysis: phantom detection, dependency dissection, contract interrogation, data flow tracing, state mutation analysis, concurrency autopsy, blast radius mapping, time bomb hunting, supply chain forensics, error propagation tracing, behavioral fingerprinting, configuration drift detection, feature verification, entropy analysis, git criminal profiling, runtime vivisection, observability, test coverage, API contracts, resilience, verdict, fix plan, fix execution, re-audit. Gestalt-Popper doctrine. Preamble v1.0 compliant. Use when user says "/codeaudit", "audit the code", "deep audit", "code review everything".

agentik-os Skill

Forensic data integrity audit v1 (Gestalt-Popper). 21-phase deep analysis of every data surface: Schema validation, Migration status, Orphaned records, Referential integrity, Data consistency, Type safety (runtime vs schema), Null handling, Duplicate detection, Cascade behavior, Backup verification, Query performance, Index coverage, Data lifecycle (TTL, archival), PII detection, Seed data separation, Transaction integrity, plus verdict, fix plan, fix execution, re-audit, and DB backup safety gate (DESTRUCTIVE audit — verifies backup exists before any write operation). Outputs audits/.dataaudit/verdict.json consumed by /apiaudit for schema-to-contract validation. Score /320. Preamble v1.0 compliant. Audit -> Plan -> Fix -> Re-audit. Use when user says "/dataaudit", "data audit", "data integrity check", "schema audit", "database audit", "orphaned records", "data consistency".

agentik-os Skill

Forensic performance audit v1 (Gestalt-Popper). 23-phase deep analysis of everything that is SLOW RIGHT NOW: Core Web Vitals, bundle size bloat, render performance, JavaScript execution, image optimization, font loading, caching strategy, CDN configuration, SSR/SSG analysis, lazy loading, code splitting, API response times, N+1 query detection, database query performance, memory leaks, connection pooling, resource hints, third-party script impact, plus verdict, fix plan, fix execution, re-audit, and integration smoke gate. Score /360. Preamble v1.0 compliant. Audit -> Plan -> Fix -> Re-audit. Use when user says "/perfaudit", "performance audit", "why is it slow", "speed audit", "optimize performance", "core web vitals", "bundle analysis".

agentik-os Skill

Forensic privacy & data-protection audit v1 (Gestalt-Popper). 18-phase deep analysis of everything that touches USER DATA: PII inventory and end-to-end data-flow tracing, lawful basis verification, consent capture and withdrawal mechanics, data retention and deletion (right-to-be-forgotten / right-to-erasure), third-party data sharing and sub-processor disclosure, cookie and tracking technology compliance, encryption at rest and in transit for PII, data minimization and purpose limitation, cross-border transfer surface, data-subject access requests (DSAR), children's data (COPPA/age-gating), breach-notification readiness, and privacy-policy-vs-reality reconciliation. Covers the GDPR and CCPA/CPRA surface. Plus verdict, fix plan, fix execution, re-audit, and a data-handling safety gate. Score /360. Preamble v1.0 compliant. Audit -> Plan -> Fix -> Re-audit. Use when user says "/privacyaudit", "privacy audit", "is user data handled lawfully", "gdpr audit", "ccpa audit", "data protection audit", "pii audit", "con

agentik-os Bundle

Interview and observe how a product or business actually works, reveal waste and control gaps, decide what to remove, simplify, standardize, delegate or automate, and produce production-ready automation blueprints with monitoring and recovery. Contains 24 specialist agents, 39 skills, 9 protocols and 9 schemas. Use for process audits, workflow simplification, automation design, standard operating procedures, or control-gap review. Trigger words: operations, automation, process audit, workflow, standardize, delegate, automation blueprint, SOP; FR: operations, automatisation, audit de processus, flux de travail, standardiser, deleguer, blueprint d'automatisation.

agentik-os Skill

Audit setup + tracking dashboard. Use when user says "/audit-tracker", "audit status", "audit dashboard", "audit history", "list audits", "where am I with audits", "setup audits", "init audits". Ensures audits/ folder exists, .gitignore configured, tracks all audits run with scores + freshness, recommends re-runs when stale (>30 days). Reads audits/.<audit-id>/verdict.json across all audit subdirs to build dashboard.

agentik-os Skill

Forensic observability audit v1 (Gestalt-Popper). 18-phase deep analysis of whether you can SEE WHAT THE SYSTEM DOES IN PRODUCTION: structured logging coverage, log-level correctness, trace/span propagation (OpenTelemetry), correlation/request IDs, metrics instrumentation (RED: Rate-Errors-Duration, USE: Utilization-Saturation-Errors), dashboard coverage, alerting rules and thresholds, SLO/SLI definition and error budgets, error tracking (Sentry/Rollbar) coverage and grouping, log retention + PII-in-logs hygiene, sampling strategy, cardinality control, health/readiness probes, log/metric/trace correlation, on-call runbooks, and the "3am incident" debuggability test, plus verdict, fix plan, fix execution, re-audit, and instrumentation safety gate. Score /360. Preamble v1.0 compliant. Audit -> Plan -> Fix -> Re-audit. Use when user says "/observabilityaudit", "observability audit", "can we see what it does", "are we observable", "logging audit", "tracing audit", "metrics audit", "do we have dashboards", "alerti

omninode-ai Bundle

Cross-repo integration health audit -- dispatches to node_gap_compute for execution

omninode-ai Skill

Unified worktree management — audit health, triage ship_it/archive/prune, prune merged worktrees, and schedule recurring GC

omninode-ai Skill

Run OmniClaude bus health audit (Layer 2 domain validation)

omninode-ai Bundle

Fetch, parse, and classify changelog entries for Claude Code and key dependencies since the last audit date

omninode-ai Bundle

Audit skill connectivity across 8 layers and surface gaps as actionable, machine-readable output. Supports audit (read-only) and ticketize (create Linear tickets for gaps) modes.

omninode-ai Skill

Functional verification audit of all registered onex skills — classifies by risk tier, invokes read-only skills, greps write skills for stub markers, produces structured per-skill verdicts, and FAILs if any facade/stub is found without a tracked Linear ticket.

vodouai Skill

Audits privacy compliance (GDPR, CCPA), reviews terms of service, checks open source license compliance, assesses data handling practices, and prepares for security audits

theneoai Skill

Codebase architecture review using module depth analysis. Surfaces shallow modules, tight coupling, and locality violations. Proposes deepening opportunities. Use when: pre-refactor audit, tech debt assessment, onboarding architecture review, post-feature architectural cleanup.

changhochien Skill

Use when financial-services work requires root-cause a reconciliation break to its source transaction or posting — follow the audit trail from the break row back to the originating entry on each side and state what differs and why. Use after gl-recon has classified a break..

danmestas Skill

Use when the user wants to "find missing skills", "what skills should I have", "what am I explaining over and over", "/skill-gap", "audit my repeated instructions", or asks which skills they're missing based on session history. Also weekly cron-friendly. Scans recent session transcripts for "I had to explain X 3+ times" patterns and drafts proposed new SKILL.md files for human review. Does NOT auto-install.

danmestas Skill

Audit how bones behaves on a target project by fingerprinting <project> before and after `bones up`, capturing `bones status` plus any other state bones leaves behind, then watching a live operator's Claude Code session in real time to find patterns where bones is not running properly. Produces a structured findings report (bugs, inconveniences, improvements). Use whenever the user wants to spy on a bones session, audit bones on a project, watch a Claude session running with bones to surface rough edges, run `bones up` on something and report what's broken, or generally "find what bones gets wrong on <X>" — even if they don't say the word "spy" explicitly.

danmestas Skill

Live-monitor an active operator session from a worker pane (typically a stasi/wait-watch worker auditing the parent that spawned it). Use when a worker should watch the operator's transcript JSONL in real time, surface audit-worthy events without polling, distinguish active autonomous runs from hangs, and avoid the chat-Stop feedback loop that wakes the operator on every routine eval. Triggers when the user spawns a wait-watch worker and asks it to "watch what I do", "monitor my session", "audit the orchestrator live", "tell me if I do anything wrong", or any equivalent.

aaaaqwq Bundle

Ads — Multi-Platform Paid Advertising Audit & Optimization

aaaaqwq Bundle

Compliance & Audit Readiness Engine

aravinds-wick Skill

Review code changes for correctness, security, performance, and code quality. Use when the user asks to review a diff, review code changes, review commits, or perform a code review. Input can be: (1) a text diff pasted directly, (2) one or more git commit hashes to extract the diff from, or (3) a git range like abc123..def456. The user may also provide task description or requirements that motivated the change.

aravinds-wick Skill

Manage and execute tasks for global-tester. Use when running tests, checking code quality, scanning for security vulnerabilities, verifying builds, or measuring coverage on any codebase. Supports jest, eslint, npm-audit, pytest, vitest, stylelint, security-patterns, build, typescript and 20+ other check types via --checks= flag.

jetbrains Skill

Cross-validate CLI flags, docs, tests, and targets for consistency across the codebase. Use this skill whenever the user asks to: audit the codebase, check for consistency issues, find undocumented flags, verify test coverage, validate targets.yaml, check handler split conventions, or verify oplog instrumentation. This is a read-only audit — it reports issues but never modifies files. Use after large refactors, before releases, or whenever you suspect docs/code/tests have drifted out of sync.