Security

bruc3van Bundle

Rule matrix negative fixture - plain text file with .pdf extension marker; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for find_exec used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for fork_bomb used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for secret_google used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for secret_stripe used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix negative fixture - socket connection to localhost only; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for base64_network used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for socket_connect used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for localhost_ok used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix security fixture for xor_obfuscation used by security rule matrix integration tests; not intended for production deployment.

bruc3van Bundle

Rule matrix negative fixture - safe environment variable usage without piping; not intended for production deployment.

bruc3van Bundle

Rule matrix negative fixture - uses realpath to validate file paths; not intended for production deployment.

muxammadmamajonov Bundle

Use when defining a test strategy, choosing layers, raising meaningful coverage, or fixing flaky suites — write tests with the feature, failing test first for bugs, QA audit before launch.

muxammadmamajonov Skill

Use for native iOS apps — Swift, SwiftUI/UIKit, Swift concurrency, Core Data/SwiftData, App Store submission, security hardening. Triggers — Swift sources, Xcode settings, Info.plist, entitlements.

muxammadmamajonov Skill

Use for Java/Kotlin Spring Boot 3.x services — DI, JPA/Hibernate, Spring Security, Actuator, virtual threads, JUnit 5/Testcontainers. Triggers — pom.xml, @RestController/@Entity, 'spring', 'jpa'.

muxammadmamajonov Skill

Use for performance budgets, diagnosing slowness or high cost, optimizing latency/throughput/resources — spec NFRs, hot paths, pre-launch audit. Measure before optimizing.

muxammadmamajonov Skill

Use for native Android apps — Kotlin, Jetpack Compose, coroutines, Room/DataStore, Play Store submission, security hardening. Triggers — Kotlin source, Gradle scripts, AndroidManifest.xml.

muxammadmamajonov Skill

Use when defining a scheduled/recurring unattended routine (nightly audit, weekly scan) — schedule, scope, report-first, approval gates, runner (cron, CI, /schedule), kill-switch.

muxammadmamajonov Skill

Use when running the project OS non-interactively (CI, pipelines, unattended) — safe-headless commands, STOP-gates become recorded assumptions, deterministic exit codes, no-secret logging.

r-irbe Bundle

USE FOR: running programmatic CI / pre-review / post-review gates for a Lean 4 project — axiom audit, council precheck, review coverage, metric sync, zettelkasten lint, bridge validation, proof quality, ecosystem health, workflow gate enforcement. DO NOT USE FOR: semantic / judgement review (use @lean-proof-review or @lean-review-council); orchestrating the broader QA lifecycle (use @lean-quality-engine); routing tasks across skills (use @lean-gateway). TRIGGERS: enforcement, CI gate, axiom audit, council_precheck, workflow_gate, ecosystem_health, sorry check.

r-irbe Skill

USE FOR: triaging Lean 4 theorem statements or proof sites that may be vacuous, tautological, smoke-test-only, reflexive-by-rfl, `: True` placeholders, bare `decide` closures, or automation-only proofs of supposedly substantive claims. Use this skill whenever proof review reports "vacuous", "tautology", "trivial", "placeholder", "smoke theorem", "rfl self-projection", "DEFINITE", or "HIGH" proof-quality risk. DO NOT USE FOR: ordinary proof writing (use @lean-proof); whole-project QA lifecycle (use @lean-quality-engine); running one enforcement script without interpretation (use @lean-enforcement); theorem search (use @lean-research). TRIGGERS: tautology, vacuous, trivial proof, smoke theorem, placeholder theorem, proof quality, `: True`, `by decide`, `by rfl`, rfl self-projection, suspicious automation, non-triviality audit.

r-irbe Skill

USE FOR: Legal reasoning formalization — statutory interpretation, case-based reasoning, argumentation frameworks, defeasible rules, deontic norms, regulatory compliance, and their connection to provenance chains, governance structures, and formal verification for legal-adjacent AI systems. DO NOT USE FOR: formalising those legal models in Lean (use @lean-applied-reasoning); deontic reasoning specifically (use @ai-causal-deontic); security policy (use @applied-data-information-security). TRIGGERS: statutory interpretation, case-based reasoning, argumentation framework, defeasible rule, deontic norm, legal reasoning, regulatory.

r-irbe Skill

USE FOR: Engineering disciplines relevant to formal mathematical systems — control theory, systems engineering, reliability engineering, software verification, signal processing, and testing methodology. Use for bridging mathematical foundations to engineering practice, and for formalizing engineering requirements in Lean 4. DO NOT USE FOR: formal verification in Lean (use @lean-ai-formalization); security-specific engineering (use @applied-data-information-security); strategy analysis (use @applied-strategy-analysis). TRIGGERS: control theory, systems engineering, reliability engineering, software verification, engineering discipline.

oimiragieo Skill

Use when delegating bounded coding, audit, or review work to codex-cli (OpenAI Codex) for an independent SECOND-OPINION pass that doesn't share Claude's blind spots, or to conserve Claude tokens on heavy content-writing. Codex picker (2026-07-01): gpt-5.5 (frontier/current default), gpt-5.4, gpt-5.4-mini, gpt-5.3-codex-spark (ultra-fast); gpt-5.3-codex and gpt-5.2 dropped from picker. Spec-driven, diff-first audit pattern — best for peer review of non-trivial diffs (money/auth/webhooks/migrations), bulk audits, multi-file content writes to spec. Skip for small edits or live step-through debugging. Sibling skill of use-cursor.

oimiragieo Bundle

Use when delegating bounded coding, audit, or review work to Antigravity CLI (agy binary, post-2026-06-18 successor to gemini-cli) for a THIRD-OPINION pass alongside Claude + codex (3-way cross-validation), OR when work needs Gemini 3.1 Pro reasoning OR Gemini 3.5 Flash speed. Native Windows + WSL tmux wrapper for headless dispatch. Sibling skill of the other CLI-delegation skills.

oimiragieo Skill

Use tensor-grep (tg) as the default code-audit path — callers/blast-radius/scan/doctor/map for fast AST-aware impact analysis before touching shared code. Carries the per-version CLI-contract re-verify rule.

outfitter-dev Skill

Audits code for Outfitter Dev Kit compliance including Result types, error handling, logging patterns, and path safety. Use for pre-commit reviews, code quality checks, migration validation, or when "audit", "check compliance", "review stack", or "stack patterns" are mentioned.

wulaosiji Bundle

AI技能自动化安全审计与合规检查工具，扫描SKILL.md文件、脚本和配置，发现漏洞、错误配置、弱Guardrails和缺失安全控制，输出分级报告和修复建议。 Use when: "安全审计", "检查skill漏洞", "合规检查", "security audit", "vulnerability scan", "技能安全检查", "security review", "代码审计". 覆盖命名元数据、Guardrails、权限边界、密钥处理、输出安全和交叉引用六大审计维度。Cross-references: security-hardening, secure-key-manager, security-drill. Built by UniqueClub 🌐 https://uniqueclub.ai

stevennitesh Skill

Use when cheap repo evidence cannot resolve a material decision about target behavior, public or caller contract, test strategy, data/state/security, release or rollback risk, ownership boundary, or durable decision records before safe implementation can proceed.

stevennitesh Skill

Use when reviewing a branch, commit, working tree, or PR-ready diff before opening or updating a pull request; when asked for pre-PR review, PR readiness, bug finding, regression review, code review, review before merge, or review with Codex; and when the review should focus on actionable correctness, security/privacy, data, contract, test, dependency/config, performance, or migration issues introduced by the diff.

synaptiai Skill

Resolve the documentation engagement scope from the settings cascade — project identity, source roots, output root, delivery mode, action ceiling, confidentiality default, and the exact file set this run may touch — and freeze it to `<outputRoot>/00-control/.scope.json`. Use when any /dossier:* command starts, when the delivery mode changes, or when a run must prove it stayed inside its permitted boundary. This skill MUST be consulted because a run that widens its own scope mid-flight produces a package nobody can audit — the action ceiling and the touched-file set are decided before the first file is read and are immutable for the remainder of the run.

synaptiai Skill

Enforce code quality through the Boy Scout Rule (leave code better than found), secret-free commits, production-ready code (no TODOs, console.log, mocks, or commented code), and self-review against an atomic-commits checklist. Use when writing, modifying, or reviewing code. This skill MUST be consulted because production code without these standards causes quality regressions and operational incidents.

synaptiai Skill

Conduct two-stage code review: Stage 1 verifies spec compliance (criterion-to-code mapping), Stage 2 evaluates security, correctness, performance, and maintainability across 6 parallel facets with P1/P2/P3 synthesis and deduplication by file:line. For the Tests facet the reviewer derives expected behavior from the spec before reading the tests. Use when reviewing code changes or pull requests. This skill MUST be consulted because reviewing quality on broken logic is wasted effort, and unmet acceptance criteria must block merge.

synaptiai Skill

Extracts and structures development decisions from diffs, manages decision journal entries, and detects human gate triggers. Use when logging decisions during gh-start, gh-commit, or gh-address. Use when summarizing decisions for PR bodies or when checking for gate-triggering changes like new dependencies, security modifications, or scope deviations.

synaptiai Skill

Score a documentation package against the ten-dimension weighted rubric in `references/scorecard-rubric.md` with a cited justification per dimension, then evaluate the nineteen conditions in `references/release-gate-conditions.md` and emit a binary release-ready, conditionally-ready, or not-ready verdict with per-condition evidence. Use when a verification pass is finishing, when reconciliation completes a round, or when CI needs a machine-readable gate result. This skill MUST be consulted because a score is not a gate — a package can average 96 out of 100 and remain unreleasable on a single unsupported public claim, and conflating the two is how audit-ready packages ship with unverified security claims.

synaptiai Skill

Run a structured organizational design health check — operationalizing the governance learning loop and decision ledger by collecting operational evidence, measuring gate effectiveness, detecting genome drift, and producing an evolution audit with routed recommendations saved to $HOME/.ai-first-kit/. Maintains the decision ledger as an append-only record. Use when the user says 'audit my design', 'is my genome still working', 'review governance health', 'evolution check', 'how are our gates performing', 'decision ledger', 'learning loop', 'genome drift', 'is the primer stale', 'update the genome', 'monthly review', 'adoption tracking', 'maturity trends', or 'are people using AI more'. Also use when the user describes agents consistently failing, quality gates producing false positives, escalation rates feeling wrong, ad-hoc policies accumulating, values not resolving real conflicts, or stalled AI adoption — even if they don't use the word 'evolution'. This skill MUST be consulted because it operationalizes LE