Security

kirkruglov Bundle

Interview-style setup for Claude Cowork Scheduled Tasks. Turns your recurring tasks into ready-to-paste automation prompts. Use when automating weekly reports, digests, or reviews. Triggers: 'set up routines', 'automate my recurring tasks', 'настрой рутины', 'помоги создать scheduled tasks'.

kirkruglov Bundle

Audit installed Claude skills: flag unused, spot duplicates, generate deactivation checklist. Reduces context noise from skill overload. Use when portfolio grows to 10+ skills or sessions feel slow. Triggers: 'audit my skills', 'skill usage review', 'which skills to deactivate', 'аудит скилов', 'какие скилы деактивировать'.

kirkruglov Bundle

Analyze weekly Claude interaction notes to reveal delegation patterns, effective prompts, and optimization areas. Use for weekly AI workflow review, reflecting on Claude usage, improving prompts. Triggers: 'weekly ai workflow review', 'review my claude interactions', 'еженедельный обзор AI-задач', 'паттерны работы с Claude'.

kirkruglov Bundle

Audits a manager's workspace files (meeting notes, plans, tasks, logs) to detect orphaned files, forgotten action items, duplicates, and plan-to-reality drift. Use when you want to clean up your workspace, run a weekly hygiene check, find forgotten commitments buried in notes, or spot conflicting information across project documents. Triggers RU: «аудит воркспейса», «проверь рабочую папку», «найди забытые задачи», «почисти workspace», «что я забыл сделать». Triggers EN: workspace audit, workspace health check, find forgotten tasks, orphaned files, weekly cleanup.

apache Bundle

Read-only audit of GitHub Actions workflow runner compatibility for one repository, an explicit repository set, one Apache project with multiple repositories, or the full Apache GitHub org. Finds obsolete GitHub-hosted runner labels and macOS runner/tool architecture mismatches. Produces TSV evidence files; never edits workflows, opens PRs, or posts comments.

apache Skill

Read-only dependency vulnerability audit for one repository or a local checkout. Detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. Never modifies manifests or lock files and never opens update PRs.

apache Skill

For a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against `<upstream>`, draft the smallest fix for each finding. Re-runs the tool after each batch to confirm the findings are cleared. Produces a commit and a hand-back artefact; never opens a PR on autopilot or merges.

apache Bundle

Attempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from the user's fork, and updates the `<tracker>` tracking issue. Public PR content is scrubbed so it does **not** reveal the CVE, the security nature of the change, or any link back to `<tracker>`.

apache Skill

Run a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default branch), checks correctness, security, and project conventions, and returns a structured report to the developer. No state changes, no PR, no external writes — the report is the output.

apache Bundle

Synchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals and proposes label / milestone / assignee / field / draft-email updates — applying only what the user has explicitly confirmed. Suggests the next step in the handling process and prints the CVE allocation link when a CVE is needed.

apache Skill

Answer a newcomer's "how do I contribute here" question by grounding the response in `CONTRIBUTING.md` and the project's own docs. Classifies the question (setup / workflow / first-issue / out-of-scope), retrieves the relevant guide excerpt, and drafts a concise answer in the Agentic Mentoring teaching register. Routes out-of-scope questions (design, security, deprecation, architectural taste) to a human maintainer. Read-only; produces a draft answer text — no files are written and no comments are posted without the maintainer's explicit action.

apache Bundle

Assemble a per-release audit record from lifecycle artefacts (planning issue, vote thread, artefact list, promote revision, and announcement URL) and propose a PR appending it to the project's audit log. Read-only on every release surface; the only write is a PR the RM reviews and a committer merges.

apache Skill

Walk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: CVE tool link field, cve allocated label, status-change comment, CVE JSON. Chains into `security-issue-sync` afterwards to reconcile the rest of the tracker.

apache Skill

Read-only GitHub Actions workflow security audit for one repository, an explicit repository set, or a whole GitHub org. Runs `zizmor` to surface injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks. Produces a grouped, prioritised finding report; never edits workflow files, opens PRs, or posts comments.

apache Skill

Read-only license compliance audit for one repository or a local checkout. Checks that a LICENSE file exists, that a NOTICE file is present and complete when required by the declared license, and that source files carry SPDX-License-Identifier headers consistent with the project's declared license. Produces a grouped compliance report and proposes remedies for maintainer review. Never modifies any file.

apache Skill

Given an open good-first-issue on the configured `<upstream>` repo, explain it in beginner terms and sketch a concrete approach: which files to read first, what "done" looks like, and where to ask follow-up questions — without writing any code or fix. First runs an issue assessment to confirm the issue is open, non-security, and scope-clear. Then drafts the explanation for maintainer review. Read-only; nothing is posted without explicit maintainer confirmation.

apache Skill

Close an `<tracker>` tracking issue as invalid: apply the `invalid` label, remove the scope label, post a short closing comment, archive the item from the project board, and — for trackers imported from `<security-list>` — draft a polite-but-firm reply to the reporter on the original Gmail thread explaining the team's reasoning (extracted from the tracker's discussion). For trackers opened via `security-issue-import-from-pr`, the email-draft step is skipped per the *no outreach to the PR author* rule of that skill.

apache Skill

Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and regenerates the CVE JSON attachment so both finders land in `credits[]`.

apache Skill

Open one or more `<tracker>` tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the `Needs triage` board column. The file itself is the full report — there is no inbound reporter to reply to and no PR to inspect.

apache Skill

Open a tracking issue in <tracker> for a security-relevant fix that has already been opened (or merged) as a public PR in <upstream>, in the case where there is no inbound `<security-list>` report. The tracker lands in the `Assessed` board column with the scope label applied, `pr created` / `pr merged` reflecting the PR's state, and `Remediation developer` / `PR with the fix` body fields populated from the PR. Pairs with `security-cve-allocate` afterwards.

apache Skill

Triage a security scanner's multi-finding output (read via a pluggable scan-format adapter) and turn findings into security work only after a complete operator-reviewed triage. Reads the scan's finding index plus its per-finding evidence; buckets each finding by disposition; applies only the operator's confirmed per-entry decisions. Publishes the report as a gist and can open a report-back PR.

apache Skill

Optional sub-skill of `security-issue-import`, `security-issue-invalidate`, and `security-issue-sync` that handles the *relay/forwarder* case: a report that did not arrive directly from the reporter but was relayed onto `<security-list>` by an upstream broker (the ASF security team, a third-party disclosure platform, or an internal SOC). Runs after the parent skill's generic classification cascade, dispatches through adapters declared in `forwarders.enabled` per `tools/forwarder-relay/README.md`, applies the matched adapter's preamble-detect + credit-extract + reporter- addressing rules, and hands the routing decision back. Never mutates tracker state on its own.

apache Bundle

Generate a CVE 5.x JSON document from an <tracker> tracking issue, ready to paste into the Vulnogram `#source` tab of the ASF CVE tool at https://cveprocess.apache.org/cve5/<CVE-ID>#source. The conversion is deterministic: same issue in, same JSON bytes out. Handles multiple credits (one per line) and multiple references (URLs extracted from the issue's "Public advisory URL" and "PR with the fix" fields; the "Security mailing list thread" field is treated as internal-only and never exported).

me2resh Skill

Audit dependencies for vulnerabilities, outdated packages, and license compliance.

me2resh Skill

Diataxis docs audit — tutorials, how-to, reference, explanation; checks README, API docs, deployment guides, changelog, staleness.

me2resh Skill

GDPR + ePrivacy audit — consent, privacy policy, data handling, right-to-deletion, DPAs. Deep-dive for /launch-check compliance.

me2resh Skill

Observability audit — logging, error tracking, health endpoints, alerting, runbooks. Deep-dive for /launch-check monitoring.

me2resh Skill

Performance audit — bundle size, image opt, lazy load, code split, caching, CWV. Deep-dive for /launch-check performance.

compozy Bundle

Dogfoods AGH through an autonomous startup scenario with live providers, cross-surface observation, and strict evidence audit. Use for release or complex-integration QA. Do not use for smoke, static, mock-only, or unit-test work.

compozy Bundle

Audits a codebase for refactoring opportunities using Martin Fowler's code smell and technique catalog — long functions, duplication, high coupling, complex conditionals, primitive obsession — and writes a prioritized report to docs/_refacs/. Use when auditing code quality, planning a refactoring sprint, or reviewing architectural health; not for style/formatting, performance, or security audits.

compozy Bundle

Architectural audit that hunts dead code, duplicated functionality, anti-patterns, type confusion, and code smells across a whole codebase. Use when the user asks for architectural analysis, to find dead or unused code, identify duplication, or assess codebase health. Don't use for style/formatting, performance profiling, security audits, or feature-level code review.

compozy Bundle

Partial-failure cleanup audit for AGH Go functions. Use when a changed function acquires, registers, starts, claims, leases, or opens more than one fallible resource before returning. Do not use for pure transformations, read-only helpers, or test-only code.

jayrha Bundle

Reviews a code diff or pull request for correctness bugs, security vulnerabilities, and quality/maintainability problems, producing severity-ranked findings with file/line references and concrete fix suggestions. Use this skill when the user asks to "review this PR", "review my diff", "code review", "look over these changes", "check this code before merge", "find bugs in this change", or pastes a diff/patch and wants feedback. Applies to git diffs, GitHub/GitLab PRs, staged changes, or a set of changed files in any language.

jayrha Bundle

Maintains a CHANGELOG.md in the Keep a Changelog format with Semantic Versioning, grouping user-facing entries under Added/Changed/Deprecated/Removed/Fixed/Security and cutting dated releases from an Unreleased section. Use this skill when the user asks to "update the changelog", "add a changelog entry", "cut a release", "bump the version", "what changed since the last release", or to create/clean up a CHANGELOG.md or release notes.

jayrha Bundle

Generates and hardens production nginx configurations for reverse proxying with TLS termination, HTTP/2, response caching, rate limiting, gzip/brotli compression, and security headers. Use this skill when the user asks to "set up nginx as a reverse proxy", "add TLS/SSL to nginx", "configure nginx caching or rate limiting", "harden an nginx config", "proxy an app behind nginx", "fix nginx 502/504 errors", or write/review nginx.conf and server blocks.

jayrha Bundle

Audits source code against the OWASP Top 10 (2021) and produces concrete, exploitable findings with proof-of-concept, severity ratings, and copy-pasteable fixes. Use this skill when the user asks to "do a security review", "audit this code for vulnerabilities", "check for OWASP Top 10 issues", "find security bugs", "is this code safe", "review for injection/XSS/SSRF/auth flaws", or before shipping security-sensitive code.