Security

jetbrains Bundle

Design and generate layered Kotlin + Spring tests that balance speed, realism, and regression value across unit, slice, and integration levels. Use when adding coverage for business logic, controllers, repositories, security, serialization, or end-to-end workflows, and when generic AI output would otherwise overuse `@SpringBootTest`, misuse mocks, or ignore MockK and coroutine testing idioms.

jetbrains Bundle

Review Kotlin + Spring changes for behavioral regressions, transaction and proxy bugs, API and serialization mistakes, persistence risks, security issues, configuration drift, and missing tests. Use when reviewing a PR, diff, patch, or design change where generic style-focused review would miss Spring-specific correctness and operational risks.

jetbrains Bundle

Diagnose and prevent Kotlin plus Spring proxy failures around `@Transactional`, `@Cacheable`, `@Async`, method security, retry, configuration proxies, and JPA entity requirements. Use when AOP annotations appear to do nothing, transactional or cache behavior is inconsistent, compiler plugins may be missing, self-invocation is suspected, or Kotlin final-by-default semantics may break Spring behavior.

jetbrains Bundle

Plan and execute risky Spring Boot, Spring Framework, Kotlin, Gradle, JDK, and major dependency upgrades with explicit compatibility checkpoints and rollback thinking. Use when preparing or diagnosing a major version jump, navigating `javax` to `jakarta`, K2 adoption, plugin compatibility, auto-configuration drift, behavior changes in Hibernate or Security, or project-specific upgrade sequencing.

jetbrains Bundle

Design and audit Spring Security configurations for Kotlin plus Spring services, including filter chains, JWT or OAuth2 resource server setup, method security, CORS, CSRF rationale, and public endpoint exposure. Use when adding or reviewing authentication and authorization, narrowing access rules, validating token handling, or checking for insecure defaults and accidental exposure.

dauquangthanh Bundle

Audits third-party dependencies: lists direct + transitive deps, cross-references against CVE databases (via WebSearch/WebFetch), surfaces licence conflicts and abandonware. Records audit as a dated file so subsequent runs show drift. Use when checking for security vulnerabilities in dependencies, performing a licence audit, or reviewing third-party packages for risk.

serejaris Bundle

Document a business process — flowcharts, RACI, and SOPs. Use when formalizing a process that lives in someone's head, building a RACI to clarify who owns what, writing an SOP for a handoff or audit, or capturing the exceptions and edge cases of how work actually gets done.

gked2121 Bundle

Plans security penetration tests for web applications. Analyzes codebase, API routes, auth implementation, and infrastructure config to generate comprehensive pentest plans. For authorized testing only.

moliboy5000 Skill

Audit codebases for quality, consistency, and broken patterns — use for pre-release or tech debt review. Use when: AUTOMATICALLY ACTIVATE when user requests auditing:. "audit and check the entire app". "audit X for Y" or "check for broken features"

moliboy5000 Skill

Expert multi-AI code review with quality and security analysis

moliboy5000 Skill

Trace codepaths in diffs, map against tests, auto-generate missing coverage. Use when: AUTOMATICALLY ACTIVATE when user requests coverage analysis:. "check test coverage" or "coverage audit". "what's not tested" or "find untested code"

moliboy5000 Skill

URL validation and content wrapping for untrusted sources. Use when: This skill provides SECURITY UTILITIES - it should be referenced by other skills,. not invoked directly by users. Auto-integrate when:. Fetching content from URLs

danmestas Skill

Use when evaluating developer experience or user experience, assessing usability of a CLI/SDK/API/UI, scoring project ergonomics, identifying friction in workflows, or when asked to audit DX or UX. Triggers on "DX score", "UX audit", "developer experience", "user experience", "workflow friction", "usability audit", "how hard is it to use this".

danmestas Skill

Use when cutting a new rtk release — runs the full pre-release checklist (cargo fmt/clippy/test, hyperfine startup benchmark, integration tests), bumps SemVer in Cargo.toml, creates an annotated git tag, and pushes to trigger the release CI; covers rollback options (patch, yank, revert) and dependency audit

danmestas Skill

Use when you want a full rtk repo health pass that runs `/rtk-issue-triage` and `/rtk-pr-triage` in parallel and then cross-references the results — surfaces double-coverage (two PRs for one issue), security findings without PRs, P0/P1 bugs without PRs, our dirty PRs with probable causes, and untracked PRs. Saves the report to `claudedocs/RTK-YYYY-MM-DD.md`. Args: `en`/`fr` (default fr), `save`/`no save`.

danmestas Skill

Health check the Obsidian wiki vault. Finds orphan pages, dead wikilinks, stale claims, missing cross-references, frontmatter gaps, empty sections, misfiled pages, and catalog gaps (pages absent from a bucket _index.md or the master index.md). Creates or updates Dataview dashboards. Generates canvas maps. Triggers on: "lint", "health check", "clean up wiki", "check the wiki", "wiki maintenance", "find orphans", "wiki audit".

vignesh2027 Skill

Activates CybersecurityAnalyst for advanced threat detection, hunting, and incident response. Use when you need MITRE ATT&CK framework-based threat modeling, threat hunting hypothesis development and query writing, digital forensics and incident response (DFIR) investigation guidance, dark web and threat intelligence analysis, or security operations center (SOC) playbook design.

mochocyang Bundle

Use when generating or analyzing male-oriented behind-the-scenes, mastermind, hidden controller, organization puppet, or secret-layout outlines and chapter outlines.

mochocyang Bundle

Use when generating or analyzing female-oriented secret love, long-time crush, reunion romance, broken mirror, second chance, or emotional healing outlines and chapter outlines.

takazudo Skill

Audit project dependencies and replace CLI-only tools with npx/pnpm dlx to reduce installed packages. Use when: (1) User wants to reduce dependencies, (2) User says 'npxify', 'dlxify', 'reduce deps', (3) User wants to clean up package.json, (4) User asks which deps can use npx/pnpm dlx.

dkbnull Skill

Spring Boot开发专家助手。当用户需要进行Spring Boot项目搭建、REST API开发、MyBatis Plus、Security或微服务开发时调用。

dkbnull Skill

安全审查专家助手。在代码编写完成后进行安全扫描，涵盖注入攻击、认证授权、数据安全、配置安全、依赖安全，减少代码安全漏洞和风险。

zaxbyhub Skill

Full execution protocol for MODE: DEEP_DIVE — read-only codebase audit with parallel explorer waves, 2 independent reviewers, and sequential critic challenge for HIGH/CRITICAL findings. Loaded on demand by the architect when the deep-dive command emits a [MODE: DEEP_DIVE ...] signal.

zaxbyhub Bundle

Codex adapter for research-before-planning work. Use when a task depends on current external facts, unfamiliar libraries, APIs, standards, security advisories, release notes, product behavior, or repo behavior that must be verified before planning or implementation.

zaxbyhub Bundle

Codex adapter for deep technical-debt and CI-stability audits. Use when asked to find test theater, flaky tests, missing or mis-scoped tests, brittle CI/toolchain behavior, structural debt blocking green PRs, or a remediation order for opencode-swarm.

peterbamuhigire Bundle

Use when authoring an internal-control policy, risk-management framework, control matrix, or risk register for an East African organisation; use `finance-policy-and-manual` for finance procedures and defer accounting controls, audit evidence, and close doctrine to Chwezi Accounting Doctrine.

vodouai Bundle

Run a multi-step thinking session on a topic via Vodou-Enhanced-Thinking — quick, thorough, or deep audit

vodouai Skill

Structured code review workflow with parallel automated analysis using security scans, quality checks, test coverage, and pattern consistency

legioncodeinc Bundle

Security audit for SvelteKit, Neon/Drizzle, WorkOS, Stripe, Vercel, Doppler, and GoHighLevel. First gate of the Ship Gate - scans, triages, and remediates vulnerabilities before quality-stinger.

legioncodeinc Bundle

SaaS legal document generation and maintenance specialist. Covers Terms of Service, Privacy Policy, DPA, MSA, and Cookie Notice using the template+lawyer-review path. Anchored in Termly/Iubenda generators and GDPR/CCPA/Quebec Law 25/LGPD compliance postures. Use when the user says "generate a privacy policy", "draft a DPA", "set up our Terms of Service", "review a customer DPA redline", "which legal doc generator should I use", "GDPR compliance for SaaS", or when legal-docs-worker-bee is invoked. Do NOT use for technical data-protection controls (security-worker-bee), database schema for personal-data fields (db-worker-bee), or contract negotiation strategy beyond the DPA (legal team).

legioncodeinc Bundle

Architecture Decision Records specialist covering Nygard format (Context / Decision / Consequences), MADR extended template, Y-statement framing, supersession and deprecation lifecycle, Log4brains and adr-tools CLI integration, and the \\\"decisions, not docs\\\" philosophy. Use when authoring a new ADR, superseding an existing decision, auditing the ADR log, setting up Log4brains, or onboarding a team to ADR practice. Do NOT use for general knowledge-base authoring (library-worker-bee), code entity extraction (wiki-worker-bee), or security review of the decisions themselves (security-worker-bee).

legioncodeinc Bundle

Initializes a repo to a healthy baseline: library/ docs, GitHub CI, README, .gitignore, CODEOWNERS, SECURITY.md, CHANGELOG.md. Use when bootstrapping a repo or auditing one for missing hygiene files.

legioncodeinc Bundle

Operational runbook authorship specialist covering canonical templates (break-fix, scheduled operation, diagnostic), the no-implied-context audit protocol, exact-command discipline, escalation path architecture, rollback procedure standards, runbook-as-test (game day) methodology, and postmortem-to-runbook linkage. Activate when the user says \\\"write a runbook\\\", \\\"audit this runbook\\\", \\\"our runbooks are out of date\\\", \\\"we need a runbook for this alert\\\", \\\"turn this postmortem into a runbook\\\", \\\"schedule a game day\\\", \\\"our on-call docs are weak\\\", or when `runbook-writing-worker-bee` is invoked. Do NOT activate for incident management tooling setup (PagerDuty/OpsGenie, route to ci-release-worker-bee), infrastructure provisioning decisions (route to ci-release-worker-bee), or documentation culture/process design beyond the runbook format (route to library-worker-bee).

legioncodeinc Bundle

npm supply-chain hygiene specialist: dependency updates, lockfile discipline, audit triage, SBOM, and provenance. Use when auditing dependencies, fixing lockfile noise, or checking publish safety.

legioncodeinc Bundle

Customer support surface specialist — Intercom, Crisp, Plain, Pylon, Help Scout — widget integration, HMAC/JWT identity verification, conversation routing, AI deflection (Fin 2.0, Ari, Crisp Bot), and the data-export discipline. Use when the user says "integrate live chat", "set up Intercom", "add a support widget", "wire HMAC identity verification", "configure AI deflection", "design conversation routing", or "set up customer support for our SaaS". DO NOT use for managing deployments (devops-worker-bee), application authentication (auth-worker-bee), or security audits of the resulting integration (security-worker-bee).

legioncodeinc Bundle

Writing docs well -- the Diataxis framework (tutorial / how-to / reference / explanation), inverted-pyramid prose structure, scannable headings, code-example discipline, the \\\"what does the reader already know?\\\" reader-lens, ghostwriting vs voice consistency, and the docs-as-code review workflow. Distinct from library-worker-bee (which owns docs-site architecture and where a doc lives); this stinger owns the craft of writing. Use when the user says \\\"review this document\\\", \\\"is this doc well-written\\\", \\\"audit this page\\\", \\\"write a tutorial for X\\\", \\\"apply Diataxis\\\", \\\"ghostwrite this guide\\\", \\\"my docs PR needs a writing review\\\", or any request about documentation quality rather than documentation tooling.