Security

managedcode Bundle

Work on WCF services, clients, bindings, contracts, and migration decisions for SOAP and multi-transport service-oriented systems on .NET Framework or compatible stacks. USE FOR: working on WCF services, bindings, or clients; deciding whether a service should stay WCF or move to modern HTTP APIs; reviewing transport, security, or interoperability. DO NOT USE FOR: unrelated stacks; generic tasks that do not need this specific guidance. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.

managedcode Bundle

Build, debug, modernize, or review ASP.NET Core applications with correct hosting, middleware, security, configuration, logging, and deployment patterns on current .NET. USE FOR: working on ASP.NET Core apps, services, or middleware; changing auth, routing, configuration, hosting, or deployment behavior; deciding between ASP.NET Core sub-stacks. DO NOT USE FOR: unrelated stacks; generic tasks that do not need this specific guidance. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.

managedcode Bundle

Classifies existing tests by standard traits and reports their distribution. MUST USE to tag all tests with category attributes, categorize/tag/label each test, compare happy vs error paths, audit the test mix, describe coverage shape by test type, or tag then verify the project builds. Read bodies when names mislead. Apply canonical attributes; otherwise report only. DO NOT USE for test-quality audits, executed coverage or CRAP, behavioral gaps, writing tests, or migration.

managedcode Bundle

Audit a test file or suite; produce a severity-ranked diagnostic report. ALWAYS USE for tests that verify nothing, missing/tautological assertions, swallowed/broad exceptions, flaky/order-dependent tests, duplication, or magic values. Polyglot. DO NOT USE for direct edits: writing-mstest-tests owns supplied MSTest assertions/attributes/lifecycle; code-testing-agent owns new tests. Exclude running tests, migration, assertion metrics (assertion-quality), raw .NET coverage collection (run-tests), non-.NET coverage collection/analysis (native tooling), project-wide .NET coverage/CRAP (coverage-analysis), named-target .NET CRAP (crap-score), behavioral/pseudo-mutation gaps (test-gap-analysis), test-mix/ happy-vs-error classification and trait distributions (test-tagging), or the testsmells.org catalog (test-smell-detection).

managedcode Bundle

Scan C# source files for hard-to-test static dependencies — DateTime.Now/UtcNow, File.*, Directory.*, Environment.*, HttpClient, Console.*, Process.*, and other untestable statics. Produces a ranked report of static call sites by frequency. USE FOR: find untestable statics, scan for static dependencies, testability audit, identify hard-to-mock code, find DateTime.Now usage, detect static coupling, testability report, static analysis for testability. DO NOT USE FOR: generating wrappers (use generate-testability-wrappers), migrating code (use migrate-static-to-wrapper), general code review, or finding statics that are already behind abstractions.

bruc3van Bundle

Rule matrix security fixture for network_declared used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for path_traversal_open used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for undeclared_network used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix negative fixture - subprocess usage in test helper; not intended for production deployment.

ma08 Bundle

Use when the user asks to commit, clean, audit, reconcile, push, pull, or coordinate dirty personal_os changes across the VM and Mac checkouts, especially when live task-specific sessions may own folders, orphaned artifacts need curated commits, or divergent main histories must be synchronized safely.

ma08 Bundle

Compare, audit drift, and sync skills between botfiles-style visible skill trees (`claude/skills`, `codex/skills`) or hidden project-local skill trees (`.claude/skills`, `.codex/skills`), and sync local Codex skills against upstream skill repositories such as OpenAI curated skills or the Oracle skill with protected local forks. Use when the user asks to keep skills aligned across Claude and Codex, compare local skills to upstream, sync all or selected skills, or identify where drift exists.

involvex Skill

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

dtsong Skill

Use when designing end-to-end test suites, visual regression testing, or cross-browser test strategies. Covers Playwright/Cypress test architecture, page object patterns, test data management, visual snapshot comparison, cross-browser matrix, and CI integration. Do not use for unit/integration test strategy (use testing-strategy) or code pattern audit (use pattern-analysis).

dtsong Skill

Use when testing a SOX 404 control or designing a controls walkthrough. Covers control description, design effectiveness, operating effectiveness, deficiency evaluation, and remediation. Do not use for evidence-package preparation (use finance-evidence-package — Phase 3+).

dtsong Skill

Use when reconciling a balance-sheet account during the close cycle. Covers sub-ledger to GL ties, intercompany eliminations, exception triage, and audit-ready documentation. Do not use for journal-entry construction (use finance-journal-entries) or close orchestration (use finance-close-checklist).

outfitter-dev Bundle

Bun-first development: prefer native APIs over npm packages, audit for migration opportunities, eliminate unnecessary dependencies. Use when evaluating packages, starting projects, or migrating from Node.js.

dhaupin Skill

Does CI work?

dhaupin Skill

Does this meet standards?

dhaupin Skill

Is it running?

dhaupin Skill

Does it work well?

dhaupin Skill

Is everything okay?

dhaupin Skill

Is this safe?

dhaupin Skill

Can it recover?

drn Skill

Audit outdated dependencies, check for vulnerabilities, and upgrade with test verification. Use for dependency audits, security checks, or upgrading packages.

drn Skill

Pre-commit safety check for secrets, security antipatterns, and test breakage. Use for pre-commit checks, secret scanning, or verifying test safety.

servosity Bundle

Every NinjaOne report, plus a local store that answers fleet-wide questions no single API call can: patch compliance, backup gaps, AV blast-radius, health, drift. Trigger phrases: `check patch compliance in ninjaone`, `which ninjaone devices have no backup`, `ninjaone av threat sweep`, `ninjaone fleet health for an org`, `show stale ninjaone devices`, `use ninjaone`, `run ninjaone`.

servosity Bundle

Every TAP Threat Insight endpoint, plus a local threat store that answers the cross-endpoint questions - who is both attacked and clicking, what touched this user - inside Proofpoint's punishing daily quotas. Trigger phrases: `pull proofpoint siem events`, `who are my VAPs`, `decode this urldefense link`, `proofpoint incident brief`, `top clickers this month`, `use proofpoint`, `run proofpoint-cli`.

servosity Bundle

Every ThreatLocker Portal API feature, plus the write operations the read-only tools lack and a cross-tenant offline store no other ThreatLocker tool has. Trigger phrases: `triage threatlocker approvals`, `approve this hash across all tenants`, `export the threatlocker audit log`, `which threatlocker agents are offline`, `why is threatlocker returning 401`, `use threatlocker`, `run threatlocker`.

servosity Bundle

The maintained single-binary successor to the retiring mgc - every MSP-relevant Microsoft Graph surface, plus an offline store that finds wasted licenses, privileged-access risks, over-privileged third-party app consents, and stale devices no single API call can. Trigger phrases: `find unused microsoft 365 licenses`, `who has global admin in this tenant`, `audit third-party app consent`, `which apps can read our mail`, `triage microsoft defender alerts`, `list non-compliant intune devices`, `microsoft graph tenant snapshot`, `use microsoft-graph`, `run microsoft-graph`.

servosity Bundle

Use when the user asks to list, search, or inspect ConnectWise Control (ScreenConnect) remote-support and access sessions, run a command on a guest machine, rename or tag sessions, manage instance users, or read the audit log. Turns the ScreenConnect instance surface into typed commands with an offline SQLite mirror. Trigger phrases: `list connectwise control sessions`, `screenconnect session detail`, `run command on a screenconnect guest`, `connectwise control audit log`, `use connectwise control`, `run connectwise-control-cli`.

irahardianto Bundle

Pre-flight checklists before coding, post-implementation self-review after. Catches arch violations, missing observability, security oversights.

irahardianto Bundle

Structured code review protocol: inspect against full rule set. Use for audit workflows, code reviews, or when user requests review. Produces findings document with severity tags.

irahardianto Skill

SBOM generation, CVE scanning, supply chain attack detection, license compliance, dependency pinning, and artifact verification.

natea Skill

Validate skill files for structural compliance and behavioral correctness. Three modes: static (linter), spec (behavioral), audit (coverage report).

natea Skill

Audit GDD-specified content counts against implemented content. Identifies what's planned vs built.

natea Skill

Audit the game for security vulnerabilities: save tampering, cheat vectors, network exploits, data exposure, and input validation gaps. Produces a prioritised security report with remediation guidance. Run before any public release or multiplayer launch.