Security

mike007jd Skill

Use when auditing responsiveness, rewards, failures, danger telegraphing, or state-transition feedback in a game.

mike007jd Skill

Use when converting game audit findings into a structured multi-axis scorecard.

mike007jd Skill

Use when auditing rollback, compatibility, corruption, or operational risks in a shipped or live-risky game.

mike007jd Skill

Use when auditing UI sounds, reward/failure cues, danger cues, or audio feedback layering in a game.

mike007jd Skill

Use when auditing HUD hierarchy, readability, controls discoverability, or mobile thumb-zone pressure.

mike007jd Skill

Use when auditing core verbs, loop integrity, progression, or whether implemented systems form a playable game.

mike007jd Skill

Use when auditing whether delivered features actually match the promised scope and quality target.

mike007jd Skill

Use when auditing whether a game project meets production-grade standards for release or continued iteration.

mike007jd Skill

Use when auditing structure, boundaries, coupling, or state-management risks in an existing game project.

bitranox Bundle

Use when writing or reviewing Rust and deciding how to handle errors, secrets or credentials, dependency/crate choices, or type design - or when a review flags a synthetic std::io::Error used for a non-IO condition, a non-constant-time secret/token comparison, an inline --password, a heavyweight crate pulled in for one narrow job, or a struct whose invalid field combinations are constructible.

bitranox Bundle

Use when auditing or reviewing a whole catalogue of already-shipped skills for defects - stale claims, references that no longer resolve, instructions a reader cannot follow - rather than authoring or editing one skill. Also use before a release that touches many skills, when a skill's tool has moved on and the skill may not have, or on "audit the skills", "review the skill catalogue", "check the shipped skills".

fatih-developer Bundle

Design and review web interfaces with trend-aware, performance-conscious, accessible rules. Triggers on design a page, build UI, review my site, audit this page, create a landing page, check my dashboard.

fatih-developer Bundle

Replace generic perspectives with domain-specific expert roles selected dynamically per request. Automatically picks the 3 most relevant experts from a role pool (Security, Performance, UX, Cost, DX, Architecture, etc.) based on the task context.

fatih-developer Bundle

Orchestrates the Security Ecosystem by running security-auditor and adaptive-guard in the correct order. Manages audit phases, trust scoring, guard activation, incident response, and calibration. Trigger on 'security orchestrator', 'run security', 'audit and guard', or 'security workflow'.

fatih-developer Bundle

Designs and implements row-level security (RLS), column-level masking, and role-based access control policies (RBAC/ABAC).

fatih-developer Bundle

Evaluates mobile app security against the OWASP Mobile Top 10. Implements certificate pinning, secure storage, and reverse-engineering protections.

forgeyclap Skill

Runs Forge's self-test + secret-leak scan across source, tests, and dashboard. Use before shipping or when asked to test everything, check it executes, or find leaks.

gannonh Skill

Launch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.

gannonh Bundle

Audit and improve AGENTS.md files in repositories. Use when user asks to check, audit, update, improve, or fix AGENTS.md files. Scans for all AGENTS.md files, evaluates quality against templates, outputs quality report, then makes targeted updates. Also use when the user mentions "AGENTS.md maintenance" or "project memory optimization".

gannonh Bundle

Comprehensive App Store compliance audit covering all 5 Apple guideline categories (Safety, Performance, Business, Design, Legal) with mandatory GitHub issue output

gannonh Bundle

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for ps-maintain-verification-skill or "audit the verify skill".

afine907 Bundle

【安全扫描】对代码进行安全漏洞扫描，检测 OWASP Top 10、硬编码密钥、不安全配置、依赖漏洞等安全问题。 触发时机： - 用户要求"安全检查"、"安全扫描"、"检查安全漏洞" - 代码提交前的安全自查 - 安全审计前的预检 纯静态分析，不执行代码，不发送网络请求。

aradotso Skill

AI-powered security review GitHub Action using Claude to analyze code changes for vulnerabilities in pull requests

asdc163 Bundle

Use when an AI feature may generate, inspect, modify, or execute code and a product manager needs an explicit sandbox, filesystem, network, package, secret, approval, cancellation, artifact, and verification contract before a run is allowed.

envoydev Bundle

Professional npm usage for consuming and publishing packages: lockfile + npm ci discipline, the supply-chain baseline (ignore-scripts, the min-release-age cooldown, allow-git=none, OIDC publishing, scoped internal packages), honest npm-audit gating, overrides vs --legacy-peer-deps, exports maps and ESM-first publishing, update-bot cooldowns. Fires on package.json / package-lock.json / .npmrc work, npm install/ci/publish questions, dependency updates or vulnerability reports, supply-chain concerns, 'set up npm for this repo'. NOT for TS language style (typescript skill), Angular framework conventions (angular-conventions), or authoring CI pipelines beyond npm's own steps (the devops family).

envoydev Skill

ASP.NET Core OpenAPI conventions - how a service emits a correct, generated OpenAPI document and serves a browsable docs UI from it. Picks the generator by framework floor (Swashbuckle or NSwag on .NET 8; the built-in Microsoft.AspNetCore.OpenApi with AddOpenApi / MapOpenApi on .NET 9 and up), shapes the spec with transformers, declares security schemes, splits versioned documents, and renders with Scalar. Floors at .NET 8 / C# 12. Load before adding API docs, editing the generated spec, declaring a security scheme, or standing up the docs UI. Companions: dotnet-minimal-api (the endpoint metadata feeding the document), dotnet-web-backend, dotnet-authentication. Skip it for non-HTTP code and internal APIs with no published contract.

envoydev Skill

Ionic / Capacitor mobile security-hardening reference for the native attack surface a WebView app adds beyond its web risks: secret storage in the Keychain / Keystore (never localStorage or Preferences - plaintext on-device), deep links as untrusted input, least-privilege native permissions, cleartext traffic and WebView debugging off in release, an allowNavigation allowlist and no live-reload server.url in production, FLAG_SECURE and backgrounding snapshots, plugin trust, pinning and biometric gating. Targets Capacitor 6+. Load when hardening or reviewing an Ionic/Capacitor feature - 'is it safe to store the token like this', 'lock the app behind Face ID', 'review our deep links' - or when the security-auditor sweeps the mobile stack. Points at angular-security, dotnet-security, capacitor-release. Do NOT load for non-security work.

envoydev Bundle

.NET application-security hardening reference, organized by the OWASP Top 10 (2021) mapped to concrete ASP.NET Core / .NET 8 mitigations: broken access control (fallback authz policy, resource-based ownership checks against IDOR, CORS lockdown), injection and XSS, cryptographic and integrity failures, insecure deserialization, misconfiguration, vulnerable dependencies, SSRF, and security logging. Owns the do-not-use list for dead-but-tempting APIs (BinaryFormatter, Code Access Security, .NET Remoting). Floors at .NET 8 / C# 12. Load when hardening a feature, threat-modeling an endpoint, or reviewing a change for vulnerabilities. Companions: dotnet-authentication, dotnet-cryptography, database-security. Do NOT load for building the sign-in flow itself (dotnet-authentication) or choosing crypto primitives (dotnet-cryptography) - this skill reviews and hardens; those build.

envoydev Bundle

.NET conventions for mechanically enforcing code quality - making the house style a build gate, not a review opinion. Floors at .NET 8 / C# 12. Load when setting up or fixing formatting, analyzers, .editorconfig, warnings-as-errors, or a CI quality gate, or when the user names CSharpier, dotnet format, Roslynator, editorconfig, analyzer, AnalysisLevel, or NoWarn. Companions: csharp (the conventions this enforces), dotnet-project-setup (Directory.Build.props), dotnet-security (CA3xxx/CA5xxx rules), dotnet-migrate (analyzer churn on upgrades). Do NOT load for authoring Roslyn analyzers/source generators (dotnet-source-generators) or test-suite quality (dotnet-testing).

envoydev Skill

Use when a build is assembled and you want to review it in THIS chat with no dispatch - the single-chat, no-agents form of the verifier seat, and the inline alternative to /code-review's fan-out. Loads the stack's trap-list skills, reruns build + tests, gates the code against its plan, RUNS the app on failable inputs (a test can pass under WebApplicationFactory while the live endpoint 500s), traces a changed wire contract to its consumers, and returns a ranked punch-list - all inline, dispatching nothing. Trigger on review the build, review this here, check the code without agents, review before done, verify the build. Not the plan audit (project-verify-plan, before code), not the dispatched verifier seat or /code-review's parallel angles - this is the review you run without spawning anything.

envoydev Skill

Use when you have an implementation plan or design in hand and want to audit it BEFORE writing code - a risk-coverage review that checks the plan names the non-obvious traps its stack will actually hit, matches the requirement's scope, covers the edge and safety cases, and stays minimal. The cheapest place to catch a design error, since a flawed plan built perfectly is still wrong. Pairs with writing-plans (which creates the plan) and precedes project-verify-code (which reviews the built code). Trigger on review this plan, is this design sound, does the plan miss anything, before I build.

envoydev Bundle

ASP.NET Core auth conventions covering both halves - authentication (who the caller is) and authorization (what they may do). Pick the scheme by surface: JWT bearer for stateless APIs, cookies for server-rendered apps, OpenID Connect for delegated SSO. Validate every token field, lean on ASP.NET Identity as the user store, and gate access with named policies and authorization handlers rather than scattered role strings. Floors at .NET 8 / C# 12. Load before standing up a sign-in flow, wiring JWT or OIDC, writing an authorization policy, or protecting an endpoint. Companions: csharp, dotnet-minimal-api, dotnet-web-backend, dotnet-cryptography, dotnet-security. Do NOT load for the OWASP hardening sweep or secret placement (dotnet-security) or crypto primitives (dotnet-cryptography).

kaiohenricunha Skill

Create an evidence-based audit document and save it to docs/audits/. Triggers on: "audit", "review", "assessment".

kaiohenricunha Bundle

Audit an already-implemented spec against the codebase. Walks each constraint (ARCH-N, PERF-N, KD-N, etc.) and acceptance criterion, grounds findings in file:line evidence, runs the spec.json acceptance_commands, and writes a single audit doc to docs/audits/. Use whenever the user asks to "validate a spec", "audit a spec", "check if spec is implemented", "verify the spec is done", "is this spec really done", or otherwise wants closure on spec-driven work. Read-only against the spec — produces an audit, never modifies the spec itself.

jperezduerto Skill

Decompile and reverse engineer Android APK, DEX, AAR, and JAR files using JADX (skylot/jadx, 43k+ stars). Use when performing mobile application security assessments, hunting for hardcoded secrets/API keys, analyzing AndroidManifest.xml for exported components, reverse engineering API calls, or preparing for dynamic analysis with Frida. Covers jadx CLI and jadx-gui, output structure, deobfuscation options, Smali vs Java output, Gradle export, thread tuning, secret/key hunting workflows, and integration with Frida for dynamic analysis following static review.

jperezduerto Skill

Write, compile, and apply YARA rules for malware detection and threat hunting. Use when the user needs to create pattern-matching rules for malware samples, write detection signatures for threat intelligence, scan files or process memory, integrate YARA with ClamAV or LOKI, or work with the YARA-X Rust rewrite. Covers rule syntax, string types, conditions, modules (pe, elf, math, hash, cuckoo), CLI usage, writing detection rules for real-world malware families, and integration into SOC/IR workflows.