Security

florianbuetow Bundle

This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDOR vulnerabilities", "audit CORS configuration", "check for privilege escalation", or mentions "access control", "authorization", "IDOR", "CORS", "JWT tampering", or "directory traversal" in a security context. Maps to OWASP Top 10 2021 A01: Broken Access Control.

florianbuetow Bundle

This skill should be used when the user asks to "check business logic security", "find logic flaws", "audit workflow security", "check for coupon abuse", "detect negative amount exploits", "analyze state machine security", or mentions "business logic", "workflow bypass", "negative amount", "coupon abuse", "self-referral", "state manipulation", or "time-based exploit" in a security context.

florianbuetow Skill

This skill should be used when the user asks to "check for non-compliance", "analyze GDPR compliance", "find CCPA violations", "check HIPAA compliance", "audit regulatory requirements", or mentions "non-compliance" in a privacy context. Maps to LINDDUN category N2. No STRIDE equivalent exists.

florianbuetow Skill

This skill should be used when the user asks to "check for information disclosure", "analyze data leakage risks", "find data exposure vulnerabilities", or mentions "information disclosure" in a security context. Maps to STRIDE category I.

florianbuetow Skill

This skill should be used when the user asks to "decompose the application", "map trust boundaries", "identify components and roles", "catalog permissions", or is running PASTA stage 3. Also triggers when the user asks about role-based access control mapping, data classification, or service-to-service trust in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 3 of 7).

florianbuetow Bundle

This skill should be used when the user asks to "check for race conditions", "find TOCTOU bugs", "analyze concurrency issues", "detect double-spend vulnerabilities", "check for check-then-act patterns", "find shared state bugs", or mentions "race condition", "TOCTOU", "double-spend", "concurrency", "atomicity", or "thread safety" in a security context.

florianbuetow Skill

This skill should be used when the user asks to "define business objectives", "identify business-critical assets", "determine risk appetite", or is running PASTA stage 1. Also triggers when the user asks about compliance requirements, acceptable risk thresholds, or business impact analysis in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 1 of 7).

florianbuetow Skill

This skill should be used when the user asks to "check for privilege escalation", "analyze authorization risks", "find access control vulnerabilities", or mentions "elevation of privilege" in a security context. Maps to STRIDE category E.

florianbuetow Bundle

Scan a software repository for ISO 27001:2022 compliance of its software development controls. Produces a per-control compliance report covering Annex A controls 8.4, 8.25–8.33 (source code access, secure SDLC, application security requirements, secure architecture, secure coding, security testing, outsourced development, environment separation, change management, and test data). Use this skill whenever a user mentions ISO 27001, ISMS compliance, security audit readiness, Annex A controls, secure SDLC compliance, or wants to check whether their codebase meets information security standards. Also trigger when the user asks about audit preparation for software development, security control gaps, or compliance posture of a repository — even if they don't mention ISO 27001 by name but describe wanting to verify security practices against a standard.

florianbuetow Bundle

Analyze Claude Code session token usage to flag waste and optimization opportunities. Use when the user asks to "analyze token usage", "check token efficiency", "audit token spend", "tokeneconomics", "reduce token costs", "optimize token usage", "check my burn rate", or mentions token waste, session costs, usage limits, cache efficiency, or conversation sprawl.

florianbuetow Skill

This skill should be used when the user asks to "check for non-repudiation privacy risks", "analyze excessive audit logging", "find privacy issues related to accountability", "check for forced identity linking", or mentions "non-repudiation" in a privacy context. Maps to LINDDUN category N. This is the INVERSE of STRIDE repudiation -- here too much proof is the threat.

florianbuetow Bundle

This skill should be used when the user asks to "check SOLID violations", "audit class design", "review code quality", "find design smells", or "improve object-oriented architecture". Also triggers when the user mentions a principle by name (e.g., "check SRP", "is this violating LSP?", "dependency inversion"), or asks about coupling, cohesion, or class responsibilities. Supports checking all five principles at once or focusing on a single principle.

florianbuetow Skill

This skill should be used when the user asks to "analyze documentation structure", "audit progressive disclosure", "restructure CLAUDE.md", "restructure AGENTS.md", "create a documentation index", "organize project docs", "find orphaned docs", "map documentation references", "improve context loading", or mentions progressive disclosure, documentation hierarchy, root configuration file organization, or context rot prevention. Analyzes or restructures how a repository discloses documentation through root configuration files.

florianbuetow Bundle

This skill should be used when the user asks to "check architecture principles", "audit system design", "review code for coupling", "find architecture smells", or "improve system-level design". Also triggers when the user mentions a principle by name (e.g., "check separation of concerns", "is this violating DRY?", "Law of Demeter", "KISS", "YAGNI", "resilience", "evolvability", "loose coupling"). Supports checking all ten principles at once or focusing on a single principle.

florianbuetow Bundle

This skill should be used when the user asks to "explain system tradeoffs", "analyze architecture tradeoffs", "what tradeoffs does this system make", "reverse-engineer design decisions", "audit distributed system design", or "explain the design choices in this codebase". Also triggers when the user mentions a tradeoff axis by name (e.g., "consistency vs availability", "latency vs throughput", "CAP theorem", "PACELC", "sharding tradeoffs", "resilience patterns", "data distribution strategy"). Supports analyzing all six axes at once or focusing on a single axis.

damionrashford Bundle

Search and fetch WebRTC specs from W3C and IETF: W3C WebRTC 1.0 (RTCPeerConnection, RTCRtpSender/Receiver/Transceiver, RTCDataChannel, RTCDtlsTransport, RTCIceTransport, RTCSctpTransport, RTCStatsReport), WebRTC-Extensions (simulcast, encoded transforms), WebRTC Stats, Media Capture and Streams (getUserMedia), Screen Capture, WebCodecs, WebTransport. IETF RFCs: 8825 (overview), 8826/8827/8828 (security), 8829+9429 (JSEP), 8831/8832 (data channels), 8834 (RTP in WebRTC), 8835 (transports), 8836 (congestion), 8837 (DSCP), 8866 (SDP, obsoletes 4566), 8445 (ICE), 8489 (STUN), 8656 (TURN), 5764 (DTLS-SRTP), 3711 (SRTP), 3550 (RTP), 6184 (H.264), 7798 (HEVC), 7741 (VP8), 7587 (Opus), 9725 (WHIP), draft-ietf-wish-whep (WHEP). Use when the user asks to look up an SDP attribute, verify an ICE behavior, check an RFC number for WebRTC, or find the canonical spec for a WebRTC feature.

naveedharri Bundle

Turn a task you just finished into a small, reliable, single-purpose skill by reverse-engineering the process from the conversation you already had. Also improves or audits an existing skill. Use this AFTER you have done a piece of knowledge work in a chat (research, a draft, an analysis, a prep doc) and want to lock the process in as a skill. Triggers include "build a skill from this", "turn this into a skill", "make a skill out of what we just did", "skill-ify this", "build a skill", "improve this skill", "audit my skill", "why does my skill suck", "make my skill smaller", or when the user finishes a repeatable task and wants to reuse it. Built for knowledge workers, not just engineers. For skills you have NOT done yet (only an idea), hand off to process-interviewer instead.

mediar-ai Bundle

Automate social media posting across Reddit, X/Twitter, LinkedIn, and Moltbook. Find threads, post comments, create original posts, track engagement stats. Use when: 'post to social', 'social autoposter', 'find threads to comment on', 'create a post', 'audit social posts', 'update post stats'.

selamy-labs Skill

Use when designing a system where state-change history matters — audit, replay, temporal queries, debugging, or telemetry provenance. Record every change as an immutable domain event and derive state from the log; guard external side effects during replay.

yeaight7 Skill

Use when package manifests carry unused or redundant third-party dependencies that slow builds, widen the security surface, or complicate updates.

yeaight7 Skill

Use when reviewing BigQuery spend, query failure patterns, or scan inefficiencies -- identifying which jobs, users, or projects drive cost, or preparing optimization recommendations for a cost review.

yeaight7 Skill

Use when about to commit, push, or publish -- staged changes touch config or environment files, generated artifacts (relay sessions, logs, build output) are being added, or the session handled credentials even indirectly.

muvon Skill

macOS administration: hardware and release detection, launchd domains, managed updates, security boundaries, packages, diagnostics, and recovery.

muvon Skill

Read-only audit harness for content quality. Detects the content type (X post / X thread / LinkedIn / Threads / Bluesky / Mastodon / Hacker News / Reddit post, or blog / article), routes to the matching social-* skill plus the cross-cutting voice/humanize/grounding/geo checks, scores per-axis 0–10 + overall 0–100, emits a canonical findings report with severity tiers, evidence, and suggested rewrites. For X surfaces also emits a Phoenix-style verdict (Pass / Borderline / Likely-Suppressed / Kill-Switch-Risk). Single source of truth for the diagnostic shape — used by content:audit (read-only) and content:editor (diagnose-then-edit).

muvon Skill

The dimensions of a deep code review — correctness, security, concurrency, performance, design/maintainability, tests — what each lens hunts for, and the adversarial verification discipline that keeps a multi-reviewer pass from multiplying false positives. Consensus is not correctness; every finding must be refuted before it is trusted.

viktorbezdek Bundle

Systematically assess and mitigate risks using risk registers, probability-impact matrices, mitigation strategies, and contingency plans. Use when the user asks to assess risks, build a risk register, plan for failure modes, evaluate downside scenarios, prepare contingency plans, or quantify uncertainty before a decision or launch. NOT for finding conceptual flaws or blind spots in ideas (use critical-intuition). NOT for security vulnerability auditing in code (use code-review). NOT for identifying boundary conditions in code (use edge-case-coverage).

viktorbezdek Bundle

Stress-test, critique, and challenge existing ideas through pattern recognition, bias detection, Bayesian reasoning, blind-spot exposure, and red-flag identification. Use when the user asks to stress-test a plan, challenge assumptions, find flaws, identify risks in an idea, expose hidden biases, audit a proposal for blind spots, or "poke holes in this". NOT for generating new ideas or solutions (use creative-problem-solving), NOT for structured risk registers or mitigation plans (use risk-management), NOT for brainstorming or divergent thinking (use creative-problem-solving).

viktorbezdek Bundle

Identify and document boundary conditions, corner cases, error scenarios, and validation requirements that implementations must handle. Use when the user asks to find edge cases, identify corner cases, specify validation rules, enumerate error scenarios, harden a function against bad inputs, or think through what can go wrong at the boundaries of a system. NOT for writing the actual tests (use testing-framework or test-driven-development). NOT for structured risk registers around project-level risks (use risk-management). NOT for security vulnerability scanning (use code-review).

viktorbezdek Bundle

Research before craft for long-form technical content. Profile the audience (knowledge level, jobs-to-be-done, prior beliefs), tier sources (primary > peer-reviewed > authoritative > popular > vendor), triangulate every load- bearing claim across three sources, manage evidence types (data, expert quotes, demonstrations, case studies, source code), and apply citation discipline (when, how, link-rot mitigation, footnote vs inline). Use when the user asks to research a technical article, profile an audience, find sources for a deep-dive, fact-check a draft, build a claim-evidence map, or audit citations. NOT for code documentation research (use documentation- generator). NOT for line-level editing (use long-form-polish or communication/clarity-editing). NOT for the article structure itself (use long-form-structure). NOT for UX research or persona definition for product (use persona-definition).

viktorbezdek Bundle

Structure long-form technical articles around the hook → promise → setup → development → payoff contract. Pick from canonical templates (deep-dive, tutorial, opinion, case study, whitepaper, technical narrative). Engineer section transitions and signposting. Match length to ambition (when 800 vs 1500 vs 3000 vs 5000+ words is right). Use when the user asks to outline a technical article, structure a deep-dive, plan a tutorial, organize a whitepaper, pick an article template, fix pacing across sections, or audit the structure of an existing draft. NOT for short-form work writing like RFCs or memos (use communication/structured-writing — BLUF, Pyramid). NOT for line-level editing or pacing within paragraphs (use long-form-polish). NOT for fiction or character-driven story arcs (use storytelling). NOT for research, sourcing, or citation (use technical-research).

viktorbezdek Bundle

Establish and enforce uniform naming conventions, taxonomy standards, style guides, and content reuse patterns across a project. Use when the user asks to audit for consistency, standardize naming, create a style guide, align terminology across docs, eliminate drift, or define reuse patterns across content or code. NOT for formal knowledge graphs or semantic ontologies (use ontology-design). NOT for CMS content types or editorial workflows (use content-modelling). NOT for language-specific code conventions (use typescript-development or python-development).

viktorbezdek Bundle

Systematic security audit workflow for hardening a codebase through structured multi-pass analysis. Composes four skills across five phases — threat surface mapping with attack vector identification (risk-management), security-focused code review targeting OWASP and language-specific vulnerabilities (code-review), boundary condition and validation gap analysis (edge-case-coverage), and security test suite construction with fuzzing and property-based tests (testing-framework). Use when hardening an existing codebase before launch, after a security incident, during compliance preparation, or for periodic security reviews. Use when you want a structured audit rather than ad-hoc scanning. NOT for real-time intrusion detection or incident response — use your SIEM. NOT for infrastructure/network security — this covers application code only.

thelobbi Bundle

Deep expertise in Microsoft 365 tenant administration via Microsoft Graph API — managing users, groups, licenses, Exchange Online, SharePoint, Teams, Intune, PIM, access reviews, usage reports, guest users, administrative units, Microsoft Search, and domain/federation management with proper auth, rate limiting, and audit trails.

yogsoth-ai Skill

Surface all assumptions, classify by vulnerability (load-bearing × likely-false), validate causal logic. Focus on dangerous assumptions — high load-bearing + non-explicit.

criptogus Skill

Designer Who Codes: visual audit then fixes with atomic commits and before/after screenshots Use when the user asks for design review work, or mentions od, design, review.

criptogus Skill

Reviews application source code against the OWASP Top 10 (2021) and produces a prioritized list of findings with file:line references and concrete remediations. Use when the user asks for owasp top 10 code auditor work, or mentions owasp, code, audit.