Security

blacklanternsecurity Skill

Exploit Python eval(), exec(), and compile() injection in web applications. Distinct from OS command injection (shell operators) and SSTI (template engines) — this targets direct Python code evaluation of user input.

blacklanternsecurity Skill

Exploit .NET deserialization vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Exploit password reset vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Exploit Linux kernel vulnerabilities and escape restricted shells for privilege escalation.

blacklanternsecurity Skill

Exploit Windows kernel vulnerabilities, vulnerable drivers, and privileged file operations for local privilege escalation to SYSTEM.

blacklanternsecurity Skill

Offline credential and file recovery with hashcat and john. Use when any skill captures hashes (NTLM, Kerberos TGS/AS-REP, shadow, MSCACHE2) or encrypted files (ZIP, Office, PDF, KeePass, SSH key, 7z, RAR). Trigger phrases: "recover this hash", "offline recovery", "john", "hashcat", "zip2john", "password-protected file". Do NOT use for online password attacks (spraying, brute force against services) — use password-spraying instead.

blacklanternsecurity Skill

Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.

blacklanternsecurity Skill

Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.

blacklanternsecurity Skill

Exploit Windows token privileges for local privilege escalation to SYSTEM.

blacklanternsecurity Skill

Exploit sudo misconfigurations, SUID/SGID binaries, and Linux capabilities for privilege escalation.

devexpress Bundle

XAF Security System covering authentication (password, Windows, OAuth2), user and role setup for EF Core and XPO, authorization and Permission Policy, type/object/member/navigation permissions, current-user and role checks, security APIs including ApplicationUser, ISecurityUserWithRoles, ISecurityProvider, and IsGrantedExtensions, predefined users and roles, owner-based access patterns, Audit Trail, and security tiers (Integrated, Middle Tier, UI-level caveat).

bm629 Bundle

Use when surveying documented security prior art for a product BEFORE it is built — deriving a threat-vocabulary map (translating a product's surfaces into the terms security corpora index), executing one search angle across weakness and attack-pattern taxonomies (CWE, CAPEC, ATT&CK), vulnerability registries (CVE/NVD, OSV, GitHub Advisory), exploitation-evidence catalogs (KEV, EPSS, Exploit-DB), vendor advisories (CSAF/VEX), incident corpora (VERIS) and control standards (OWASP ASVS, Top 10, MASVS) — or deep-reading ONE source item into an extraction whose evidence tier carries its receipts. Produces schema-validated artifacts with status-typed coverage records and mandatory zero-hit cells. Keywords: security prior art, threat research, vulnerability survey, attack patterns, CVE, CWE, CAPEC, OWASP, KEV, EPSS, advisories, supply chain. Covers the SEARCH, EXTRACT and SYNTHESIS waves.

bm629 Bundle

Use when judging a finished security prior-art artifact — a threat-vocabulary map, a per-angle search output, an extract record, or the threat register — to decide whether the research craft is honest, complete against its own contracts, and proportionate. An acceptance gate, not authoring: it runs the producer's validator once, then judges what a validator cannot see — whether a coverage claim is provable, whether a source failure was typed or written as a zero, whether a bail was a confident relevance bail rather than a hedge, whether an evidence tier follows from evidence the record's own body agrees with, and whether a register names threats from a real vocabulary rather than coining them. Emits VERDICT: approve|revise with condition-named findings. Keywords: security prior art review, threat research review, coverage honesty, survey acceptance gate. Judges all three survey waves.

zju-real Bundle

Systematic code review patterns covering security, performance, maintainability, correctness, and testing — with severity levels, structured feedback guidance, review process, and anti-patterns to avoid. Use when reviewing PRs, establishing review standards, or improving review quality.

easyzoom Skill

Use when integrating, porting, configuring, or debugging TinyCrypt cryptographic primitives, AES, SHA, HMAC, ECC, CTR/CCM, RNG, or embedded security code

nledford Skill

Security review and audit guidance for concrete code, config, docs, and command-surface changes. Use when implemented changes touch authentication, authorization, crypto, certificates, tokens, signatures, secrets, passwords, sessions, session cookies, CORS, CSP, CSRF, OAuth/OIDC/SAML, redirect/callback handling, input validation, file paths, command execution, or other trust boundaries. Pair with code-review for review findings; use threat-modeling for design-time boundary analysis and dependency-supply-chain-review for supply-chain-specific review.

nledford Skill

Review test strategy, confidence gaps, TDD and BDD fit, flaky tests, boundary coverage, and suite maintainability. Use for a risk-focused audit of tests or test plans; do not use to write a single test, debug an active failure, or run a routine TDD loop.

nledford Skill

Onion Architecture guidance centered on explicit concentric domain, application, and infrastructure rings with dependencies pointing inward. Use when the main design question is ring membership, domain/application separation, or keeping infrastructure at the edge, especially when the project names Onion Architecture. Use hexagonal-architecture when inbound/outbound ports around external actors are primary, clean-architecture for use-case/interactor and interface-adapter policy flow, and architecture-review for a read-only audit. Do not use for simple CRUD, prototypes, or framework-convention-first apps where added layers reduce clarity.

nledford Skill

Perform repository-wide or focused technical-debt audits covering maintainability, complexity, duplication, dependency health, testing gaps, architecture erosion, documentation drift, and remediation priorities. Use when the user asks to assess accumulated debt, modernization risk, change friction, quick wins, or blockers to future work or scaling. Do not use for an ordinary diff review, an active unexplained failure, implementation, or a vulnerability-only audit.

nledford Skill

Implement, change, review, or test checked-in CI and release provider configuration, including workflow triggers, job graphs, matrices, caches, artifacts, permissions, concurrency, environments, automated versioning, tags, releases, and package or binary publication. Do not use to choose a semantic patch, minor, or major bump from application changes; use semantic-versioning. Do not use for underlying language/test commands, Justfile wrappers, manual Git operations, final ship/hold decisions, unexplained CI failures, supply-chain-only or security-review-only audits, or production deployment infrastructure implementation.

nledford Skill

Hexagonal Architecture / Ports and Adapters guidance centered on how external actors drive or are driven by an application through explicit inbound and outbound ports and adapters. Use when classifying port ownership, replacing delivery or infrastructure mechanisms, or testing the core through those seams. Use clean-architecture when entities, use cases/interactors, and interface-adapter policy flow are primary, onion-architecture for explicit concentric domain/application rings, and architecture-review for a read-only audit. Do not use for simple CRUD, prototypes, or trivial pass-through interfaces.

nledford Skill

Randomness, generated identifiers, random words, sentences, passphrases, synthetic text, and test data guidance. Use when generating random numbers, UUIDs, CUIDs, ULIDs, nonces, tokens, filenames, fixture data, reproducible seeded simulations, human-readable synthetic content, or collision-resistant IDs in code or tests. Prefer cryptographically secure randomness for secrets, passphrases, security-sensitive IDs, and public IDs that must be unguessable; use explicit seeded PRNGs for reproducible tests and simulations. Do not use for fixed examples with no randomness, copyediting fixed text, or database-native ID/index design without a generated-value decision.

nledford Skill

Companion evidence checklist for security-sensitive changes and reviews. Use only with security-review, threat-modeling, or dependency-supply-chain-review to keep evidence sanitized, scoped, and tied to repository policy. Do not use as standalone security analysis.

nledford Skill

Observability, telemetry, and production diagnostics guidance. Use when designing, adding, reviewing, or testing structured logs, metrics, traces, span/context propagation, correlation or request IDs, sampling, labels/cardinality, dashboards, alerts, SLO/SLI/error-budget signals, OpenTelemetry/Prometheus/Grafana/Datadog-style instrumentation, operational runbooks, or incident visibility. Do not use for ordinary language implementation, active debugging without durable instrumentation changes, security review except telemetry leakage or audit controls, BDD/TDD mechanics, or documentation-only edits; load those existing skills instead or alongside this skill when their trigger is primary.

nledford Skill

Dependency and software supply-chain security review. Use for dependency audits, SBOM/SCA output, CVE/GHSA advisories, package or binary provenance, registry trust, manifests, lockfiles, checksums/signatures, install/postinstall scripts, vendored/generated code, transitive dependency risk, CI actions, container or base-image pinning, or package-manager security policy. Do not use for routine package-manager workflow, language-specific dependency implementation, or third-party API docs without a supply-chain risk question.

nledford Skill

Internationalization and localization guidance, including Project Fluent and Fluent Translation List (.ftl) files. Use when adding, changing, reviewing, or testing localized, multilingual, or localization-ready user-facing text, locale negotiation, translation catalogs, plural/select behavior, localized date/number formatting, or Fluent integrations in JavaScript, TypeScript, PHP, Python, Rust, or web UI. Do not use for fixed-language copyediting with no localization surface. Consult current official documentation for Fluent binding APIs and use security-review plus security-review-evidence when localized content crosses trust boundaries.

fatih-developer Bundle

Develop, compare, refine, or audit strategic names for companies, products, services, applications, platforms, features, and rebrands. Use when a user asks for brand or company name ideas, wants names from particular languages or concepts, rejects earlier suggestions, needs a shortlist or final choice, wants a naming method, or asks to check pronunciation, memorability, meaning, brand architecture, domain, social-handle, company-name, or trademark risk.

fatih-developer Bundle

Analyzes and enforces security protocols on the skill ecosystem. Operates via Audit, Guard, and Trust modes to prevent malicious commands, PII leakage, and excessive permissions.

fatih-developer Bundle

Comprehensive map and workflows for the Mobile domain. Triggers when users ask to 'design a mobile app', 'mobile architecture', 'audit the app before launch', 'prepare for release', or 'view the mobile ecosystem'.

fatih-developer Bundle

Audits skills or the entire ecosystem for security vulnerabilities, enforces runtime guard rules, and assigns trust scores. Three modes: Audit (static analysis), Guard (runtime protection), Trust (permission mapping). Trigger on skill security, audit skill, is this skill safe, skill trust score, or ecosystem security scan.

vanducng Bundle

Turn a chosen approach into a phased implementation plan with concrete steps, file changes, and success criteria. Use after `vd:interview` and `vd:brainstorm` (or a cleared `vd:interview --wayfinder` chunk, or any decided design) when you need to sequence the work before building. Default produces plan.md + phase files; pass `--quick` for a single-file plan, `--deep` for research dispatch + red-team review, `--audit` to independently check an existing plan. Do not use while the approach is still foggy across multiple fronts - that's vd:interview --wayfinder.

vanducng Skill

Retrieve credentials (API keys, tokens, passwords) from the local gopass password store. Use when a task needs a secret that the user has stored in gopass - instead of asking the user to paste it, search the store and read the value with `gopass find` / `gopass show -o`. Also covers inserting, generating, listing, searching, syncing, and TOTP.

vanducng Skill

Deep technical research with multi-option evaluation. Use for technology selection, architecture decisions, library/framework comparison, security and performance analysis. Default mode is thorough; pass `--deep` for exhaustive coverage with expanded comparison matrices and edge-case analysis. For inventing and stress-testing options without external evidence, use vd:brainstorm.

vanducng Bundle

Drive a Claude Code session toward a verifiable goal until done or a hard cap fires - autonomous loop, no user intervention. Use for refactor batches, test-suite green-up runs, migration loops where success is a check command (tests, lint, custom predicate) plus a fresh-context audit. Hosts the loop intra-session via Stop hook with two-vote completion gate; supports optional Codex /goal delegation. For numeric-metric keep/discard loops, use vd:optimize-loop.

vanducng Bundle

Mine your Claude Code sessions and code-review history for the corrections you keep repeating, cluster them, adversarially verify each candidate, and distill the survivors into CLAUDE.md rules - or check that existing rules still hold. Uses a dynamic Workflow harness with one verifier per rule to avoid false positives. Use when the user says 'mine my sessions for rules', 'what corrections do I keep making', 'turn my repeated feedback into CLAUDE.md rules', 'audit my CLAUDE.md rules', or 'why does Claude keep missing X'.

vanducng Bundle

Mine your Claude Code and Codex session history for how your skills actually get used - invocations, coverage, tool-error rates, corrections, interrupts, tokens - attributed per invocation rather than per session, then turn the aggregates into a reviewed report. Use when the user says 'audit my skills', 'which skills do I actually use', 'skill usage stats', 'are my skills working', 'mine my session history', or asks which skills to keep, merge, or drop.