Security

synaptiai Bundle

Produce a structured organizational diagnostic that quantifies time spent on specification vs coordination vs execution, saved as a persistent audit artifact to $HOME/.ai-first-kit/. Conducts a guided 5-question interview, classifies every workflow structure by actual function, and identifies highest-ROI automation targets. Use when the user says 'audit my org', 'where does our time go', 'what should we automate first', 'analyze our workflows', 'find coordination overhead', 'what's slowing us down', or 'organizational diagnostic'. Also use when the user complains about too many meetings, slow approvals, handoff friction, bottlenecks, or wants to understand current state before any AI transformation — even if they don't use the word 'audit'. This skill MUST be consulted because it produces a structured diagnostic file that other org-design skills depend on; a conversational answer cannot replace the persistent artifact.

jgsystemsconsulting Bundle

Knowledge base from the FAA Human Factors Design Standard (HF-STD-001B, 2016) — the FAA's consolidated human-factors / human-systems-integration design criteria for systems it manages, operates, or maintains. Use for requirement-level design rules on: general human-factors design principles; automation and function allocation; designing equipment for maintenance; displays, controls, and visual indicators; alarms, audio, and voice communications; the computer-human interface (information presentation, coding, interaction styles, windows, dialogue); keyboards, input devices, and workstation/workplace ergonomics; system security, personnel safety, environment, anthropometry, and user documentation; plus intended-use and tailoring guidance. It is a quantified, source-attributed synthesis (heavily citing MIL-STD-1472G, MIL-HDBK-759C, DOD-HFDG-ATCCS, NUREG-0700, NASA-STD-3000, ANSI, OSHA, ISO 9241). Complements nasa-hsi as a parallel HSI tradition from the civil-aviation domain. Scope limits: it is design criteria,

jgsystemsconsulting Bundle

Knowledge base from MIL-HDBK-61B, the DoD Configuration Management (CM) guidance handbook (7 April 2020, cataloged with Change 1, 2025). Use for defense CM across the acquisition and sustainment life cycle: the five CM functions (planning, identification, control/change management, status accounting, verification & audit), the three configuration baselines (FBL/ABL/PBL) and FCD→ACD→PCD documentation, configuration items (CIs/HWCI/CSCI), change instruments (ECP/NOR/RFV), the CCB and Class I/II classification, CDCA/AA authority, FCA/PCA audits, data management and data rights (CDRL/DID, DFARS rights ladder, master/authoritative source), and tailoring CM by phase (EIA-649-1 R/T/NR matrix, Appendix C templates), plus digital-era CM (digital twin, viewpoints, MOSA). NOTE: 61B is advisory guidance that adopts and points to the SAE EIA-649 / EIA-649-1 / GEIA-HB-649 suite for the authoritative CM requirements — this pack names and describes that suite but does not reproduce its copyrighted requirement text. Thin on:

me-cedric Skill

Audit how much of a project is actually built by diffing its specs, functional docs, and requirement registers against the real code into an honest, verified progress matrix (per feature/subfeature and global). Use when asked how far along a project is, what's left, percent complete, a progress or status/completion report, or to "compare the specs to the code".

me-cedric Bundle

Security verification gate. Scans code for vulnerabilities, detects dangerous patterns, and ensures security decisions are documented. Use when the user mentions security scans, vulnerability detection, security audits, code security, OWASP, injection detection, or sensitive-data leaks. Auto-triggers for new modules, security-related changes, offensive/defensive tasks, and completed refactors.

me-cedric Skill

Use when creating or updating Spec Kit quality, security, UX, or readiness checklists for a feature spec.

me-cedric Skill

Deep PR/MR review governance: compare code to product/spec docs, security, repo rules, tests, docs sync, and UI evidence before writing a summary and inline comments. Use when asked to review a pull request, merge request, branch, or posted review comments.

ondrej-merkun Bundle

Security scanner docs

ondrej-merkun Skill

Reviews skill files and explains security findings.

vetcoders Bundle

READ-ONLY falsification of a completed plan or multi-task implementation. Builds a per-task requirements matrix, then proves or refuses each claim against code + tests evidence. Default verdict is UNVERIFIED — PASS is earned, never assumed. Runs whenever a written plan claims completion, regardless of upstream — workflow, implement, marbles, human work, or a mix. Trigger phrases: "audit", "vc-audit", "task-by-task audit", "verify implementation plan", "spec falsification", "post-marbles audit", "did this plan actually land", "weryfikuj implementację", "audyt planu", "co naprawdę wylądowało", "falsyfikacja completion".

vetcoders Bundle

Operator-side intention-to-runtime truth audit. Use when the team needs to know which planned implementations actually landed in code, which are only partially present, which never materialized, and what the highest remaining truth is. This skill pulls intentions from aicx, reduces them to a bounded implementation checklist, then verifies each item against the live repo. Trigger phrases: "intents", "co z planu siedzi", "which planned items exist", "what from the plan is in code", "check intent coverage", "planned vs code", "highest truth", "checklist from intents".

gulajavaministudio Bundle

Language-agnostic workflow for code reviews and security audits using a Two-Axis (Standards vs Spec) approach against Clean Code/SOLID principles, generating formal refactoring plans.

gulajavaministudio Skill

Applies the "lazy senior developer" mindset. Use this skill whenever generating, modifying, reviewing code, or fixing bugs to prioritize code reuse, minimalism, YAGNI principles, and root-cause fixes. Also use whenever the user says "ponytail", "be lazy", "lazy mode", "simplest solution", "minimal solution", "yagni", "do less", or "shortest path". Supports intensity levels: lite, full (default), ultra. Also includes sub-modes for over-engineering review (ponytail-review), repo-wide audit (ponytail-audit), and debt tracking (ponytail-debt).

gulajavaministudio Bundle

Language-agnostic workflow for code reviews and security audits using a Two-Axis (Standards vs Spec) approach against Clean Code/SOLID principles, generating formal refactoring plans.

gulajavaministudio Skill

Performs mutation testing to audit test suite efficacy and ensure assertions catch code mutations. (Optional Utility)

whb786200 Bundle

PPT审核清洗工具 - 批量处理PPT，敏感词检测，百度文库规则重命名，集成自动化工作流

nolte Skill

Generates executable BDD scenarios from an abstract test-case document (TC-IDs plus behaviors) per spec/project/behavior-driven-development/, emitting English Gherkin `.feature` files and thin `pytest-bdd` step-definition skeletons that honor the page-object decoupling contract of spec/project/bdd-page-object-integration/ (thin steps delegate down, assertions only in the `Then` binding). Groups cases into Features, one Scenario per TC-level behavior, precondition/action/result mapped to Given/When/Then, `@TC-<id>` tags for traceability. Runs an advisory `lektorat-apply` audit over the scenario wording and emits a work-package list for any page-object or app change instead of touching it. Invoke to turn a test-case document into runnable BDD/Gherkin scenarios; also German. Don't derive the cases (test-case-extractor), scaffold a full E2E suite (e2e-test-generator), or audit the scenarios (bdd-scenario-reviewer). Supports resume.

nolte Skill

Determines the release-relevant regression/E2E test scope from a release change-set per spec/project/release-regression-scope/, so a team runs targeted-but-safe regression before rollout. The default `scope` operation resolves the release range, dispatches the read-only release-regression-scope-scanner to attribute each change to its impacted areas via traceability inversion (change → requirement/TC-ID → verifying tests), selects the minimal tier/test set (E2E emphasised) covering those areas, widens non-attributable changes to worst-case full-area regression, and reports an auditable scope (in-scope areas, selected tests, exclusions + rationale, residual risk). A missing verifying test is a coverage-gap blocker. Invoke to scope release regression, pick targeted E2E, or gate a rollout on a fast subset; also German. Don't use to derive test cases (test-case-extractor), run tests (quality-gate), audit pyramid shape (test-pyramid-check), or drive the release (release-publish-trigger). Supports resume.

rrezartprebreza Bundle

Use when an application issues and validates its own first-party JWT access and refresh tokens, including authentication filters, password encoding, RBAC, and method security. For JWTs issued by Keycloak, Auth0, Okta, Cognito, or another authorization server, use oauth2-resource-server.

rrezartprebreza Bundle

Use when introducing or correcting grouped Spring Boot configuration, typed property binding, validation, profiles or secret injection. Do not rewrite unrelated single-value configuration.

rrezartprebreza Bundle

Use when packaging a Spring Boot 3 application as an OCI image or GraalVM native executable. Covers buildpacks, layered images, JVM containers, AOT hints, probes, security, and verification.

iliaal Skill

Audit Whetstone skills, agents, and commands when asked for a plugin quality or consistency audit.

iliaal Bundle

Session retrospective and skill audit. Use when asked to reflect, do a retrospective, review lessons learned, audit what went well or wrong, or review session effectiveness.

iliaal Bundle

Node.js backend patterns: layered architecture, TypeScript, validation, error handling, security, observability, logging, metrics, deployment. Use when building REST APIs, REST endpoints, middleware, Express/Fastify/Hono/NestJS/Koa servers, tRPC procedures, Bun servers, or server-side TypeScript.

andrem-sec Skill

Rules of Engagement authorization gate — required before any security operation, autonomous scanning, or action with real-world effects outside the local codebase

andrem-sec Skill

Plan-mode enforcement — required before edits affecting 3+ files, cross-domain work, or security-sensitive changes

andrem-sec Skill

Audit UI code for AI slop patterns — generic color palettes, missing interaction states, cookie-cutter gradients, and template-clone layouts. Returns SLOP/RISK/CLEAN verdicts with specific remediation.

andrem-sec Skill

Quality audit of installed skills with portfolio health dashboard

andrem-sec Skill

Enforce mobile-first responsive design — breakpoint definition, content reflow audit, touch target validation, and layout stress testing at each tier.

zaxbyhub Bundle

Lightweight PR-time audit for whether changes are compatible with the actual RAGAPPv3 GitHub Actions workflow, dependency lockfiles, scripts, and cross-platform local validation.

zaxbyhub Skill

Validate external reviewer, CI, audit, swarm, or PR findings as claims before implementing or reporting them. Use when given a bundle of review findings, requested-changes comments, audit output, or suspected regressions that must be classified with evidence.

lauraflorentin Bundle

Validate, review, and improve Claude skills against Anthropic's official best practices from "The Complete Guide to Building Skills for Claude." Use when a user says "check my skill", "review this skill", "validate my SKILL.md", "is my skill good", "skill audit", "skill review", "proof check my skill", "grade my skill", or uploads a skill folder or SKILL.md for feedback. Also trigger when the user mentions skill quality, skill triggering issues, skill debugging, or wants to ensure a skill follows Anthropic's official guidelines before publishing or sharing.

nolte Bundle

Creates, translates, indexes, deduplicates, and drift-checks multilingual specifications stored under the project's spec/ folder. Invoke when the user wants to write a new spec, update or translate an existing one, check whether a requirement is already covered, regenerate the spec index, or verify that translations are still in sync with the canonical version. Supports writing the request in any configured language; specs on disk always exist in all configured languages, with one canonical source and the rest as translations kept strictly in sync. Don't use for readiness audit (contradiction detection, audience fit, AC coverage) — use spec-readiness-reviewer. Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Drafts a bilingual EN-canonical + DE-translated blog-post pair per this plugin's blog-author, post-writing-style, and post-audience-communication specs. Walks the operator through briefing inputs (topic-as-thesis, grounded artefact, primary audience, source list, slug, cross-language binding key), writes the EN draft, runs the pre-handover self-check, writes the DE translation, runs the per-pair self-check, executes the consumer's build command (reference `task build`), and dispatches `lektorat-apply` for the editorial audit. Invoke when the user asks to "schreibe einen neuen Blogpost", "draft a blog post about X", "neuer Eintrag zu Y", "operationalize blog-author", or equivalent German-language requests. Don't use to lektor an existing post (use `lektorat-apply`), to author portfolio pages (those live in the consumer's portfolio collection), or to redefine the consumer's post-frontmatter schema. Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Authors, audits, refactors, and validates YAML-encoded JSON Schema 2020-12 documents per `spec/project/yaml-json-schema/`. Scaffolds a new `<slug>-v1.0.schema.yaml` with all mandatory skeleton entries in spec order; audits existing `*.schema.yaml` files for dialect drift, missing identity, inline duplicates, and missing property descriptions; refactors duplicates into `$defs`; runs meta-validation and data-conformance validation. Invoke for: "scaffold a JSON Schema in YAML", "audit our schemas", "extract a `$defs` entry", "validate this YAML against a schema", or German equivalents ("YAML-Schema anlegen", "Schemata auditieren", "Daten gegen Schema validieren"). Skip for: OpenAPI/AsyncAPI Schema Objects, JSON-encoded schemas, feature-frontmatter rules (`spec/project/feature/`), or project-structure scaffolding (`project-structure-apply`). Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Operationalises spec/project/mkdocs-structure/ §Snippet inclusion (DRY). Detects paragraph duplication across MkDocs pages and, with per-snippet user approval, extracts duplicates into `mkdocs-include-markdown-plugin` includes pointing at a canonical source (preferring a live source file over a dedicated per-language _snippets/ folder). Three operations: `audit` (read-only ranked findings), `propose` (surface canonical source, markers, include directives for a target snippet ID, await approval), `apply` (write markers, replace consumer blocks, verify via `mkdocs build --strict`). Invoke when the user asks to dedupe, DRY-refactor, extract snippets, or factor out duplicated MkDocs content; also handles equivalent German-language requests. Don't use for non-MkDocs markdown trees, single-file snippet authoring, prose linting (`prose-vale-curator`), structural scaffolding (`mkdocs-structure-apply`), or drift detection (`docs-freshness-checker`). Supports resume on re-invocation per `spec/claude/resumable-work/`.