Security

ariadoss Skill

Security scanning via clearwing — source code vulnerability hunting and network pentesting.

ariadoss Skill

Audit → fix → verify the branch diff against KISS, DRY, SOLID, and YAGNI. Finds duplicated logic, units with more than one reason to change, needless abstraction or speculative extensibility, wrong-altitude code, and dead code in the changed files — then applies the smallest safe refactor for each, one atomic commit per fix, under a green test suite. Quality only: it does not hunt for bugs (use /review or /code-review for that). Use when asked to "clean up the diff", "simplify this", "DRY this up", "refactor for SOLID", "remove duplication", "KISS", "YAGNI check", or "tidy before ship".

ariadoss Skill

Database performance audit — detects N+1 queries, missing indexes, join opportunities, slow queries, EXPLAIN analysis, and per-endpoint DB call counts. Use when asked to "optimize the database", "find slow queries", "check for N+1", "analyze query performance", or "audit DB calls".

ariadoss Skill

Conduct systematic visual audits of existing applications and produce phased, implementation-ready design plans. Use when the user requests UI audits, visual design improvements, interface polishing, design consistency reviews, or says "make it look better" or "UI polish".

hmbown Skill

Use Curse Shield when Hermes should protect a surface in a way that makes contact linger on the attacker. The shield is not just there to absorb the next hit or throw an immediate counter; it tags hostile touch with a lasting penalty, mark, or contamination that follows the offender after impact. In practice, Curse Shield is for defended surfaces that impose audit burden, throttling, suspicion, reduced trust, quarantine, follow-up scrutiny, or another durable consequence on whatever keeps pressing into them.

arasz Bundle

Use when ai-badger's own machinery needs to be observed — "did that hook even run?", "enable debug logging", "why is the drift notice silent?", "turn on the audit log", "what did the hooks do?" — or to check, tail, or switch off that logging. Records which hook ran, in which project, under which version, to an append-only log.

arasz Skill

Use when reviewing a diff, PR, or a batch of changed files and you need to know where the risk concentrates — which changed units have the largest blast radius, whether the highest-risk ones are actually covered by tests, and whether the result is safe to merge. Trigger phrases: "review these changes", "how risky is this diff", "what's the blast radius", "did anything untested change", "rank these changes by risk". Not for a pass/fail preflight of style, security, and layering checks — that is `code-review-checklist`; run the checklist for the mechanical gates and reach for this skill to decide where its attention should concentrate. The two compose: checklist for gates, this skill for prioritization.

arasz Bundle

Use when auditing a design doc's acceptance gates BEFORE implementation: check every gate would fail if the feature were broken (HONEST) and the named test file/framework/seam exists (FEASIBLE). Attacks vacuous negatives, timing-window vacuity, port races, env poisoning, unprovable real-time halves. Pairs with dotnet-hosted-service-testing for FakeTimeProvider mechanics.

arasz Bundle

Use when auditing a research record's factual accuracy, citation truth, or grade correctness: adversarially re-derive every load-bearing claim from cited sources, verify quotes verbatim at cited lines, re-run MEASURED claims, audit grade honesty (INFERRED hedged, UNVERIFIED plain), check negative claims for prune/retention explanations, and report ACCURATE/CORRECTED/OVERCLAIMED.

arasz Bundle

Use when auditing docs for drift vs code ('audit and fix documentation drift'): inventory claims with path:line, verify each against real files (scaffolders, manifests, hooks), classify verifiably-false vs design-position vs ambiguous vs historical, fix only the false, and report A/B/C. Also for post-merge doc-gap audits and user-facing doc compaction rewrites.

arasz Bundle

Use when the whole project — not a diff — is the review target and the result must survive being acted on: "review the entire codebase", "full quality review", "MoE review", "what is wrong with this project", "audit everything before the next release", or a review whose findings will become a plan someone implements. Runs ground-truth baseline, parallel expert lanes, integration, an adversarial pass that tries to falsify the findings, severity calibration against production reality, a reviewed plan, waved implementation in isolated worktrees, and a join review on every merge. Not for judging one diff or PR (that is review-changes plus code-review-checklist), one design document's gates (design-gate-audit), or one question (evidence-first-research).

hack23 Skill

Comprehensive secure development lifecycle covering all SDLC phases, AI controls, testing, and security requirements per Hack23 ISMS

hack23 Skill

Comprehensive security architecture for GitHub Agentic Workflows including defense-in-depth, threat modeling, sandboxing, permission models, attack vectors, and security best practices

hack23 Skill

Information security strategy, risk management, security program governance, and compliance framework integration

ortus-boxlang Skill

Use this skill when reviewing BoxLang code or applications for security vulnerabilities, configuring security settings, preventing injection attacks, handling file uploads safely, managing secrets, or applying secure coding patterns drawn from OWASP Top 10 and CFML/Java security history.

ortus-boxlang Skill

Use this skill when working with BoxLang's interceptor/event system: creating interceptors, registering announcement points, announcing custom events with announce() or announceAsync(), building pre/post operation hooks, validation interceptors, security guards, or leveraging BoxRegisterInterceptor() BIF for standalone and module-based interception.

ortus-boxlang Skill

Use this skill when reviewing BoxLang code for quality, correctness, security vulnerabilities, performance issues, style violations, or when providing structured code review feedback following BoxLang best practices and security guidelines.

ortus-boxlang Skill

Use this skill when configuring BoxLang runtime settings via boxlang.json, setting environment variables for config overrides, configuring datasources, caches, executors, modules, logging, security, or schedulers — or when helping someone understand the BoxLang configuration system.

ortus-boxlang Skill

Use this skill when you need the evaluate() BIF in BoxLang for legacy CFML migration or dynamic expression evaluation. This module is explicitly opt-in due to security risks and should be avoided in new code.

ortus-boxlang Skill

Use this skill for the CommandBox embedded server: starting and stopping servers, server.json configuration, JVM args, SSL/TLS setup, URL rewrites, server rules/security, multi-site hosting, server profiles (production/development), basic authentication, bindings, custom error pages, aliases, gzip compression, web roots, HTTPS redirect, and starting as an OS service.

tfcbot Skill

Scan copy for risky claims via Gemini.

math-inc Bundle

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.

math-inc Bundle

Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.

zebbern Bundle

Detect and exploit XSS vulnerabilities using automated scanning with dalfox. Use when testing for reflected XSS, stored XSS, DOM-based XSS, blind XSS, when analyzing parameter reflection, or when validating XSS findings with proof of concept.

zebbern Skill

Review code changes or a pull request — delegates to specialist agents for code quality, security, performance, and documentation.

zebbern Bundle

Analyze SSL/TLS configurations for security weaknesses and compliance. Use when testing HTTPS endpoints, when checking for TLS vulnerabilities, when validating certificates, or when auditing cipher suite configurations.

zebbern Bundle

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.

zebbern Skill

Provides verification checklists for code review including acceptance criteria validation, specification compliance checking, OWASP security patterns, and evidence-based assessment. Use when verifying task implementation quality.

zebbern Skill

Scan targets for vulnerabilities using Nuclei template-based scanner. Use when vulnerability assessment is needed, when scanning for CVEs or misconfigurations, when security testing web applications, APIs, or infrastructure, or when validating security findings.

zebbern Bundle

Write CVE-format security advisories following MITRE CNA operational rules and CVE Record schema. Use when publishing vulnerability disclosures, preparing coordinated disclosure documentation, or creating vendor security advisories that require CVE identifiers.

zebbern Bundle

Scan Git repositories, GitHub organizations, and source code for leaked secrets, API keys, credentials, and sensitive data. Use when analyzing source code security, when checking for credential exposure, or when the user mentions secret scanning or credential leaks.

zebbern Bundle

When editing, creating, writing content and articles to avoid AI writing patterns ("AI-isms") that make text sound machine-generated. Follow the guidelines in the skill description to audit, rewrite, and summarize changes.

zebbern Bundle

Analyze HTTP security headers for misconfigurations and missing security controls using httpx. Use when security header assessment is needed, when checking for clickjacking or XSS protections, when validating OWASP compliance, or when identifying information disclosure.

zebbern Bundle

Dependency auditing: vulnerability scanning, license compliance, outdated package detection, and update strategies. Use when checking or updating project dependencies.

zebbern Bundle

Generate professional vulnerability reports following HackerOne format with CVSS scoring. Use when a vulnerability has been confirmed and needs formal documentation, when preparing bug bounty submissions, or when the user requests a security report.

zebbern Bundle

Specialized in reverse-engineering compiled binaries (JARs, DLLs). Use this when the user asks to compare versions, find security fixes, or analyze binary patches.