Security

frankxai Skill

API Security Best Practices Skill

stuffbucket Bundle

Use when configuring Tauri v2 access control — writing capability files, granting plugin permissions, scoping filesystem/shell/http access, debugging "not allowed" errors, or hardening CSP/asset protocol/http headers.

stuffbucket Bundle

Use when setting a Content-Security-Policy in a Tauri v2 app — configuring `app.security.csp` and `app.security.devCsp`, the Tauri-specific directives (`ipc:`, `http://ipc.localhost`, `asset:`, `https://asset.localhost`, `'wasm-unsafe-eval'`), automatic hash injection for inline scripts/styles, when to lift `dangerousDisableAssetCspModification`, frame-ancestors, nonces, and the dev-vs-prod delta (Vite HMR `ws://`, broader `connect-src` in dev).

stuffbucket Bundle

Tauri v2 Permission Scopes

stuffbucket Bundle

Use when serving local files into a Tauri v2 WebView — enabling `app.security.assetProtocol`, scoping which paths it exposes, using `convertFileSrc` to produce `asset://` / `https://asset.localhost` URLs, the matching CSP `img-src`/`media-src` directives, persisting user-picked paths with `tauri-plugin-persisted-scope` (`protocol-asset` feature), and choosing the asset protocol over base64-via-command for performance.

stuffbucket Bundle

Use when hand-writing Tauri v2 capability JSON files — choosing identifiers, matching windows/webviews by label (never title), filtering by platform, distinguishing `local` vs `remote.urls`, merging multiple capability files with set-union semantics, naming platform-specific files (`-android.json`, `-ios.json`, `-desktop.json`), and understanding how `tauri build` validates them.

equinor Skill

Select and audit NeqSim thermodynamic initialization levels for correctness and performance. USE WHEN: implementing or reviewing flashes, phase stability, EOS root selection, process-equipment thermodynamics, property access, or performance changes involving init(...) or initProperties().

equinor Skill

Define the PaperLab whole-book release workflow: audit order, blocker rules, render commands, artifact freshness checks, and release gate reporting.

equinor Skill

Audit PaperLab books for claim, figure, equation, notebook, citation, and unit traceability. Use when a book must become scientifically defensible and reproducible, especially for NeqSim-backed quantitative chapters.

equinor Skill

Audit how concepts recur across PaperLab books so they are introduced, practiced, deepened, assessed, and reused without shallow repetition.

equinor Skill

Aggregate PaperLab audit outputs into chapter readiness scores and a release dashboard. Use when deciding which chapters are ready, need minor revision, need major revision, or block a release.

equinor Skill

Generate and audit worked examples from PaperLab equations, notebooks, benchmarks, and case studies with assumptions, units, solution steps, and checks.

equinor Skill

Audit equations, dimensions, symbols, notation, and formula variants in PaperLab books. Use when technical chapters contain equations, units, and engineering correlations that must remain consistent across chapters.

the-utopia-studio Skill

Detects and connects development tools — Slack with GitHub, Linear with Git, error tracking with notifications. Provides step-by-step setup procedures for each integration. Use when the user asks to "connect tools", "link Slack", "set up notifications", "integrate Linear", or "connect my tools". Don't use for monitoring setup (use monitoring-setup), deployment (use deployment-engineer), or security (use security-auditor).

viktorsbaikers Bundle

Frame an ad-hoc ask before coding, then audit the diff. Use for underspecified imperative asks, raw-diff self-audits, or `/rite-quick` setup. Not a lifecycle gate.

viktorsbaikers Bundle

Review polished feature diff for correctness, readability, architecture, security, tests proving acceptance, Critical/Important findings, and quality dimensions before seal.

viktorsbaikers Bundle

Audit a completed spec for missing decisions before strategy or architecture. Use after /rite-spec when coverage is incomplete or stale; not for spec writing.

viktorsbaikers Skill

Audit and reconcile an older released DevRites workspace. Proves a current-contract defect, then routes its phase owner while preserving completed work and history.

viktorsbaikers Skill

Audit one feature read-only for security, performance, or simplification risks. Use for one bounded audit axis; not for code changes.

oleg-koval Skill

Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor / major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe ones", or at the start of a maintenance window.

oleg-koval Skill

Diagnose and fix Claude Code's skill context budget overflow, identify heavy plugin bundles that exceed the 2% budget, remove domain-specific ones, deactivate rarely-used skill sets, and validate the warning clears. Use when Claude Code shows "Exceeded skills context budget" or skill descriptions are stripped.

muhammedadnank Bundle

Audit a WordPress plugin's REST surface and produce a standardized audit document proposing Abilities API registrations. Produces a markdown doc with a YAML schema and prose sections that humans and agents can both consume when planning a registration rollout. Works on any WP plugin.

muhammedadnank Bundle

Verify a WordPress plugin's Abilities API registrations: enumerate abilities, check that callback behavior matches each annotation's claim (the adversarial readonly-but-writes detection), validate permissions and schemas, and validate audit documents produced by wp-abilities-audit.

howard-lynn-ye Skill

Futures and broad-based index options are marked to market on the last business day of the year and split 60/40 long/short regardless of holding period, so two options with the same payoff can have different after-tax P&L. TRIGGER - section 1256, 1256 contract, 60/40, sixty forty, mark to market at year end, marked to market December 31, regulated futures contract, nonequity option, broad-based index option, narrow-based security index, SPX vs SPY tax, XSP, VIX options, futures tax treatment, Form 6781, blended rate on futures, "do I owe tax on an open position", net section 1256 loss carryback, qualified board or exchange. Modelling assumptions for backtests, not tax advice. SKIP for stock lots and cost basis (tax-lot-matching-and-cost-basis), for the wash-sale rule that does not reach these contracts (wash-sale-rules), for reporting an after-tax Sharpe (after-tax-backtesting), and for option pricing and lifecycle mechanics (options-backtesting).

deepleaper Skill

基本安全审查——密码策略、数据备份、权限管理、开源合规

dallascrilley Bundle

Intelligent pattern selector for Fabric CLI - suggests most relevant patterns from 242+ specialized AI prompts based on user intent. Provides copy-paste ready commands and chainable scripts. USE WHEN user mentions fabric, needs to process/analyze content, extract insights, summarize text, create content, or transform data. Covers analysis, security, development, writing, visualization, and 20+ categories.

dallascrilley Bundle

Comprehensive technology stack evaluation and comparison tool with TCO analysis, security assessment, and intelligent recommendations for engineering teams

braxtonrose4 Bundle

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.

braxtonrose4 Bundle

Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.

crawlora-org Bundle

Researches independent Shopify-powered storefronts — products, collections, pages, sitemaps, search suggestions, and product recommendations — using the Crawlora API, returning clean JSON for any store by domain, plus 14 pre-wired DTC brand storefronts (Allbirds, Brooklinen, Cole Haan, Everlane, Fashion Nova, Gymshark, J.Crew, Kylie Cosmetics, Oh Polly, Quince, Rothy's, SKIMS, Steve Madden, The Body Shop). Use when the user asks to audit a Shopify store's catalog, crawl its sitemap, look up a product or collection, or pull search/recommendation data — instead of scraping the store's pages directly.

crawlora-org Bundle

Analyzes Android APKs through the Crawlora API — submit an APK or public URL, inspect static-analysis results, compare versions, build timelines, and compare ownership signals — returning clean JSON. Use for mobile-app security, provenance, SDK, permission, signing, and release-history research.

akhilkannur Skill

---

kevinaimonster Skill

[中危] 应尽快修复

stijnman Skill

Reviews code changes for bugs, style, security, and maintainability. Use for: review code, code review, check my PR, review my changes.

stijnman Skill

Audit a SKILL.md definition for reliability, security, testability, workflow clarity, and production readiness, then prioritize concrete improvements. Use for: audit this skill, review SKILL.md, score skill quality, adversarial skill test.

stijnman Skill

Stress-tests skills with edge-case prompts and scoring rubric. Use for: test skill, hyper test, skill QA, audit skill quality.