Security

edwinhu Bundle

Review a GitHub/GitLab PR, commit range, working tree, or file in the tuicr TUI — and read the user's annotations back out of the session — or answer questions about tuicr usage and config. Use when the user says "tuicr", "tuicr pr <N>", "review this PR", "review PR #N", "review with tuicr", "code review TUI", "review the working tree", "tuicr all files", "tuicr <file>", "address my tuicr annotations", "read my tuicr review", "what did I annotate in tuicr", "tuicr config", "tuicr keybindings". Use proactively when a finished change needs the user's eyes before it ships, even if they never say "tuicr". NEGATIVE ROUTING: inside a running /craft, /dev, /writing or /workshop loop, human review is that workflow's own phase — follow it rather than starting a bare tuicr session; and when the user wants CLAUDE to find the problems rather than annotate them themselves, that is /code-review or /security-review, not this skill.

edwinhu Bundle

ALWAYS use for ANY legal citation question, even if the user never says 'Bluebook' - 'cite this case', 'how do I cite a statute', 'is this footnote formatted right', 'id. or supra here', 'cite a law review article', 'what signal goes here', 'format these footnotes', 'short form for this cite', 'block quote this', 'where does the ellipsis go', 'is this quote altered right', or writing or checking any citation or quotation in a legal manuscript. NOT for auditing a whole manuscript's footnotes (use bluebook-audit) and NOT for rendering these rules in Typst (use docx-typst).

edwinhu Bundle

ALWAYS use when a draft's citations need checking against what the sources actually say — 'check citations', 'check my cites', 'verify cites', 'cite-check', 'run citation review', 'are my citations grounded', 'does this source actually support that claim', 'does source X support claim Y', 'what does source X say about Y', 'did I cite that right', 'make sure the cites hold up before I send this'. Use proactively before a draft goes out. NOT for Bluebook formatting (use bluebook / bluebook-audit) and NOT for detecting citations that do not exist at all (use source-verify).

edwinhu Skill

Use when the user says 'verify my sources', 'check the citations', 'fact-check the footnotes', 'are my cites real', 'did I make this cite up', 'does the source actually say that', 'check this quote against the source', or 'source check before I submit'. Use proactively whenever a draft's citations or quotations have not been checked against the actual sources. NOT for Bluebook formatting - use bluebook or bluebook-audit.

edwinhu Bundle

This skill should be used when the user asks to 'audit footnotes', 'check Bluebook formatting', 'audit citations', 'run footnote audit', 'check my footnotes', 'bluebook audit', or needs systematic Bluebook compliance checking of a law review manuscript.

edwinhu Skill

This skill should be used when the user asks to 'create a plugin', 'scaffold a plugin', 'set up plugin structure', 'new plugin', 'edit the plugin manifest', 'wire plugin hooks', 'validate plugin structure', 'audit my plugin's enforcement', or needs plugin-level work spanning multiple components. Use proactively whenever plugin.json, marketplace.json or hooks/hooks.json is being edited, even if the user never says 'plugin'. NEGATIVE ROUTING: never invoke plugin-dev:create-plugin, plugin-dev:plugin-structure or plugin-dev:plugin-validator directly — this skill is the wrapper that adds the enforcement audit they lack. Creating or editing a single skill, even inside a plugin, goes to skill-creator; designing, repairing or auditing a multi-phase workflow goes to workflow-creator.

edwinhu Skill

Phase 2: Run mechanical checks and Gemini formatted audit

edwinhu Skill

Use when a Bluebook footnote audit's findings need to be turned into a report the user can review before any corrections are applied - 'show me the audit results', 'what did the audit find', 'write up the citation problems', 'give me the report', 'which footnotes are broken', 'summarize the Bluebook errors'. Produces scratch/AUDIT_REPORT.md. NOT for running the checks themselves or applying fixes.

edwinhu Skill

Use immediately after Bluebook corrections have been written into a DOCX, before archiving — 'verify the fixes', 'did the corrections apply', 're-scan the corrected docx', 'check the small caps got fixed', 'confirm the footnotes are clean now', 'run the verify phase'. ALWAYS run this rather than trusting that applied fixes landed; silent fix failures are common.

edwinhu Skill

Phase 4: Apply corrections to DOCX

edwinhu Skill

Phase 1: Extract footnotes from DOCX with formatting annotations

atomicinnovation Skill

Security review lens for evaluating threats, vulnerabilities, and missing protections. Used by review orchestrators — not invoked directly.

serac-labs Skill

Build ServiceNow Security Operations — sn_si_incident with NIST-aligned state transitions, sn_vul_vulnerable_item with CVSS/risk scoring, sn_ti_indicator IOC matching, and containment playbooks.

timurgaleev Skill

Live developer experience audit. Uses the browse tool to actually TEST the developer experience: navigates docs, tries the getting started flow, times TTHW, screenshots error messages, evaluates CLI help text. Produces a DX scorecard with evidence. Compares against /plan-devex-review scores if they exist (the boomerang: plan said 3 minutes, reality says 8).

allemaar Bundle

Plan and organize a bounded folder, project, or vault using map-rules; audit first, show simple proposals, and apply only selected changes. Trigger when the Handler says "organize this scope", "map this project", or "housekeep this vault".

allemaar Bundle

Diagnose semantic repetition, filler, fake structure, stock AI rhetoric, and avoidable reading load in existing text. Trigger phrases: "/prose-audit", "find the AI filler", "audit this for bloat". Not for rewriting text; use /human-rewrite after diagnosis.

allemaar Bundle

Post-implementation retrospective — map blast radius, audit documentation, extract skills, update KIs, document lessons learned. Trigger when the user runs /retro or asks for a "retrospective", "post-mortem", "lessons learned", or "what changed" after completing significant implementation work. Use insight-skill-gap when the goal is specifically to identify new or updated skills.

borda Bundle

Reproduce-first bug resolution — capture bug in failing regression test, apply minimal fix, run quality stack and review loop. TRIGGER when: user reports a bug, regression, or unexpected behaviour in Python code with a traceback, failing test, or issue number; phrases: "fix this bug", "repair X", "broken since Y", "test failing". SKIP when: CI-only failures without local traceback (use `/develop:debug` first); new features (use `/develop:feature`); `.claude/` config issues (use `/foundry:audit`); non-Python projects.

borda Skill

Investigation-first debugging — gather evidence, form confirmed root-cause hypothesis, hand off to fix mode with diagnosis file. TRIGGER when: user reports a symptom or failing test with Python traceback, or asks to investigate a runtime/CI failure with reproducible evidence; phrases: "debug this failure", "why is X broken", "find the root cause of <error>", "investigate this CI failure". SKIP when: pure config quality issues (use `/foundry:audit`); broad system-wide diagnosis without traceback (use `/foundry:investigate`); user already knows the fix (use `/develop:fix`); non-Python project.

borda Skill

Paper-vs-code consistency audit. After research:scientist implements a method from a paper, verify the implementation matches paper claims across five dimensions — formula matching [F], hyperparameter parity [H], eval protocol [E], notation consistency [N], and citation chain [C]. Reads paper (PDF path / arXiv URL / pasted text), maps claims to codebase, emits verification table with match status and severity.

borda Bundle

Test-first refactoring — audit coverage, add characterization tests, apply changes with safety net, run quality stack and review loop. TRIGGER when: user wants to restructure existing Python code without changing behaviour; phrases: "refactor X", "clean up Y", "extract Z", "restructure this module", "improve code quality". SKIP when: bug fixes (use `/develop:fix`); new features (use `/develop:feature`); mixed refactor+feature — run `/develop:refactor` first, then `/develop:feature`; non-Python projects.

borda Skill

Codemap integration: audit|plan|apply|sync|demo; skip query/index rebuilds.

air-gapped Bundle

Triage and fix the Microsoft Secure Boot 2011→2023 UEFI certificate rotation across Dell PowerEdge / iDRAC9 bare metal, Ubuntu/Linux servers, and Harvester HCI / KubeVirt guest VMs. Two 2011 CAs expired June 2026 and Windows Production PCA 2011 expires 2026-10-19 — but UEFI firmware ignores certificate expiry, so nothing stopped booting; the real risks are forward-compat once a 2023-only-signed shim arrives (already true on aarch64) plus a dbx/revocation freeze. Routes to the per-platform fix: iDRAC BIOS-staged keys applied on reboot (Dell), fwupd-free manual `db` append self-authenticating via the existing 2011 KEK (Linux), and the Harvester virt-launcher OVMF floor (v1.6.0) with ephemeral-vs-persistent NVRAM triage (VMs). Covers the PK→KEK→db trust chain, the missing generic 2023 KEK payload, backup/rollback, and audit via mokutil / efi-readvar / racadm bioscert / Redfish.

epicenterhq Skill

Tauri commands, permissions, capabilities, security config, path handling, cross-platform file ops, and native filesystem APIs. Use when mentioning Tauri, desktop apps, Rust commands, invoke, capabilities, permissions, ResourceId, file paths, or platform differences.

epicenterhq Skill

Find recurring Epicenter code smells and scope the cleanup they require. Use for periodic audits, cleanup PRs, post-refactor reviews, or reviews of a primitive’s consumers.

epicenterhq Bundle

Remove indirection that does not earn its boundary across a diff or package. Use when the user asks to run a collapse pass, simplify this broadly, audit dead abstractions, or shrink a surface, not when one function’s branching is the target.

allemaar Skill

Audit every site of a constant whose value is duplicated across multiple call sites (retry budgets, timeouts, page sizes, magic numbers, feature flags). The author-maintained `SEE ALSO` trail is documentation, not enforcement — one missed site means the trail lies. Trigger on /audit-coupled-constant, "audit budget consistency", "find all sites of this value", "check coupled invariant", "before raising this constant", or after any edit to a constant that has SEE ALSO cross-references in its comments. Pairs naturally before /cold-review on a "raise the budget" PR. Not for extract-constant refactors that consolidate scattered values into a single named import — use /improve-codebase-architecture. Not for constants enforced by the type system (TypeScript `as const` literal imported everywhere) where the compiler is the audit — skip.

ci Bundle

1Password/op: service-account first, targeted secret read/store/inject, tmux.

ci Bundle

Refresh stale learning docs and pattern docs under docs/solutions/ by reviewing them against the current codebase, then updating, consolidating, replacing, or deleting the drifted ones. Trigger this skill when the user asks to refresh, audit, sweep, clean up, or consolidate stale docs in docs/solutions/ (phrases like "refresh my learnings", "audit docs/solutions/", "clean up stale learnings", "consolidate overlapping docs", "compound refresh", "/ce-compound-refresh"), or when ce-compound has just captured a new learning and flagged a specific older doc in docs/solutions/ as now inaccurate or superseded — invoke with the narrow scope hint ce-compound provides. Also trigger when the user points at a specific learning or pattern doc under docs/solutions/ and calls it stale, outdated, overlapping, or drifted. Do not trigger for general refactor, migration, debugging, or code-review work unless the user has explicitly directed attention to docs/solutions/ itself.

heyeddi-com Bundle

Captures screenshots, reviews UI against product.md and design.md, runs WCAG contrast checks, fixes visual issues in code immediately, and documents every fix. Mandatory after implement/handoff. Auto-fix — never report-only unless user explicitly says audit-only.

heyeddi-com Bundle

ALWAYS-ON: audits plans and code for KISS, YAGNI, DRY, SOLID, and testability; maintains .heyeddi/docs/engineering/. Use on every chat that plans or changes code, before merge, refactor, ADRs, or reuse-catalog work. Not for visual UX (ux-flow-auditor) or full CI (pre-merge-gate includes this audit).

zyrexnn Skill

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

zyrexnn Skill

Master orchestrator skill for end-to-end authorized web application penetration testing, mapping OWASP Top 10 vulnerabilities, coordinating specialized sub-skills, source code auditing, browser automation, and deterministic PoC reporting.

zyrexnn Skill

Assesses authentication flows, OAuth2 / OIDC implementations, session lifecycle management, and JWT security.

zyrexnn Skill

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

zyrexnn Skill

Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.