Security

nolte Bundle

Promotes an open draft pull request on the current branch to a merged state on `develop`, applying repository-declared labels and passing every gate from the pull-request-workflow spec. Invoke when the user asks to promote the draft PR, ship the PR, merge the draft, or bring the PR over the finish line. Also handles equivalent German-language requests. Delegates pre-merge review to the `review` skill (and `security-review` when the diff touches security-sensitive paths), derives labels from the Conventional-Commits type and touched paths, flips draft → ready, triggers automerge by applying the `automerge` label so the repository's automerge workflow squash-merges the PR once every required check is green, and verifies the merge commit landed on `develop`. Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Audits and applies the MkDocs Mermaid setup of the current repository against `spec/project/mermaid-diagrams/<canonical_language>.md`, and helps an author add a single Mermaid diagram (hand-described or derived). Wires up `pymdownx.superfences`, pins `pymdown-extensions`, refuses `mkdocs-mermaid2-plugin`. Picks the diagram type from the supported catalog and prepends the mandatory `<!-- diagram-source ... -->` marker. Audits flag missing source markers, missing direction headers, inline styling, `gitGraph` usage, non-English labels, and derived-source drift. Invoke when the user asks to "wire up Mermaid", "audit Mermaid setup", "draft a flowchart", or equivalent German-language requests. Don't use for general MkDocs scaffolding (use `mkdocs-structure-apply`), spec authoring (use `spec`), the docs-freshness audit (use `docs-freshness-checker`), or non-Mermaid diagrams. Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Audits the repository's `README.md` against the canonical-language file under spec/project/readme-structure/ and, with per-item user approval, scaffolds or patches the file: H1 + tagline, CI badges, six required sections in order (Purpose, Usage, Structure, Related repositories, Status, License), the consumer-first ordering rule, the ≤200-line length budget, and link rules. Three operations: `audit` (read-only conformance report), `scaffold` (greenfield), `patch` (additive fix). Invoke when the user asks to apply, audit, scaffold, or patch the README against the spec; also handles equivalent German-language requests. Don't use for docs/ page content (`audience-doc-author`), MkDocs nav (`mkdocs-structure-apply`), Vale prose linting (`prose-vale-curator`), or the audience artefact (`audience-identify`). Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Audits a repository against the canonical-language file under spec/project/project-structure/ and scaffolds or patches missing artefacts: README (delegated mid-flow to `readme-structure-apply`), top-level orientation file, .gitignore, .pre-commit-config.yaml, Renovate config, Taskfile, the MkDocs site skeleton (delegated mid-flow to `mkdocs-structure-apply`), .claude/ directory, and the full .github/ layout (workflows, settings.yml, release-drafter.yml, boring-cyborg.yml, stale.yml) with the portfolio-wide Probot extends pointers. Verifies via the GitHub API that the backing GitHub Apps (Probot apps `settings`, `boring-cyborg`, `stale`, plus Renovate) are installed; for Renovate also points at the Mend dashboard when the App is installed but no activity is visible. Invoke when the user asks to audit project structure, scaffold missing GitHub configs, generate release-drafter config, check Probot/Renovate app installation, or equivalent German-language requests. Supports resume on re-invocation.

nolte Bundle

Runs the read-only periodic in-flight audit across nolte/* per `spec/portfolio/portfolio-inflight-management/`. Dispatches `portfolio-inflight-collector` for the four data sources (open issues, open PRs incl. drafts, branches without active PR, unresolved review threads + Discussions), applies spec stalling thresholds with optional `project/inflight.yml` overrides, classifies findings via the four-axis matrix into `Critical`/`Warning`/`Suggestion`/`Info`, attaches a specialist slug per finding, and writes a dated Findings-Report under `.audits/portfolio-inflight/`. Invoke when the user asks to "audit the portfolio in-flight", "run the in-flight triage", "check stalled PRs / issues / branches", or equivalent German-language requests. Don't use to merge / close / delete / resolve anything (operator dispatches), for per-repo CI triage (use `workflow-health-triage`), or for capability allocation (`portfolio-audit`). Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Audits a repository against the canonical-language file under spec/project/docs-audience-tracks/ and, with per-item user approval, scaffolds or patches the documentation-tracks layer: per-page `track:` frontmatter across the per-language docs/ tree, required user-docs and developer-docs content blocks, and the audience-to-track mapping in the project's audience artefact. Three operations: `audit` (read-only conformance report), `migrate` (brownfield), `patch` (additive fixes one finding at a time). Invoke when the user asks to apply, audit, migrate, or patch documentation tracks against the spec; also handles equivalent German-language requests. Don't use for the MkDocs skeleton (`mkdocs-structure-apply`), audience artefact (`audience-identify`), page content (`audience-doc-author`), drift detection (`docs-freshness-checker`), or prose mechanics (`prose-vale-curator`). Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Applies the canonical-language file under spec/project/github-issue-templates/ to a target repository — detect the project type, resolve or dispatch the audience artefact, derive triage questions, and scaffold or update .github/ISSUE_TEMPLATE/ (bug_report.yml, feature_request.yml, config.yml, plus project-type-specific extras) as GitHub Issue Forms. Invoke when the user asks to "generate issue templates for this repo", "scaffold GitHub issue forms", "create bug and feature templates", "set up .github/ISSUE_TEMPLATE", "apply the github-issue-templates spec", or equivalent German-language requests. Don't use for pull-request templates (that's `pull-request-workflow`), CODEOWNERS / SECURITY.md, discussion templates, or generic .github/ scaffolding (that's `project-structure-apply`). Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Closes an active sprint per the project sprint spec, validating the deployable artefact and recording the value-delivery audit trail. Invoke when the user asks to close a sprint, review a sprint, finish a sprint, ship a sprint, or wrap a sprint. Also handles equivalent German-language requests. Promotes `active → review`, validates `artifact_ref` per the release-artifact spec's per-project-type rules, confirms the named `verifies_sprint_value` acceptance criterion is checked, optionally chains into `release-notes-curate` and `release-publish-trigger` (operator-opt-in, recorded verbatim in `## Review notes`), then promotes `review → closed`. Falls back to `review → cancelled` with a one-paragraph rationale when artefact validation fails unrecoverably. Supports resume on re-invocation per `spec/claude/resumable-work/`.

nolte Bundle

Runs the project's lint + typecheck + test gate in parallel, tabulates the results, and calls out exactly which checks failed so the caller can triage before a commit, a PR, or a release. Prefers repository-declared Taskfile targets (`task lint`, `task test`, `task typecheck`, `task check`) when they exist so project conventions and ignore lists are honoured; otherwise detects and runs the native tooling directly (ruff, pytest, eslint, tsc, vitest, go test, cargo test, and similar). Invoke when the user asks to "run the quality gate," "run lint and tests," "make sure CI will pass," "run all checks before committing," or equivalent German-language requests. Don't use for CVE scanning (`dependency-audit`) or license compliance (`license-check`), even when task lint wraps a security check and don't use for documentation builds (those are a separate concern).

nolte Bundle

Statically checks a web API's error-handling surface for conformance against the project's own declared error contract — uniform error-body shape, populated required fields, a dynamically-generated error/correlation id, correct HTTP status-code semantics, and no internal-detail leakage (stack traces, raw driver messages, rendered queries, secrets). Detects the web framework (FastAPI / Flask / Django REST / Express / NestJS / Spring and comparable) and the error contract from project signals, falling back to RFC 9457 defaults only when none is declared. Invoke after adding or changing endpoints, before a release, or as a pre-PR error-handling gate; also on requests like "check the API error handling", "audit error responses", or equivalent German-language requests. Read-only: reports and recommends, never edits handler code. Don't use for the whole-codebase security audit (code-security-reviewer) or general code review (review skill).

heyzgj Skill

Dark, clinical security operations aesthetic for AI-powered behavioral threat detection platforms. Severity color spectrum, monospace data hierarchy, live threat feed hero, behavioral baselines, MITRE ATT&CK mappings. Geist + Geist Mono. Data-as-visual, no photography.

heyzgj Skill

Institutional crypto exchange landing page. Coinbase Blue (oklch 0.48 0.22 264) as singular functional accent, Satoshi 900 display with ultra-tight 1.0 line-height, IBM Plex Sans body with tabular-nums on all financial data. Asymmetric hero with atmospheric video right and text-first left. Live price ticker, embedded buy-flow demo card, portfolio allocation bars, staking APY table, cold storage security vault, Base L2 developer code block. Dark/light section alternation, 56px pill CTAs, lowercase button labels. Trust is the product.

pekral Bundle

Use when performing a focused security review for Laravel/PHP projects. Prioritize real exploitability, business logic flaws, and high-risk vulnerabilities.

pekral Bundle

Use when building, configuring, or hardening security-sensitive Laravel features — authentication, authorization, Eloquent safety, CSRF/XSS, API security, file uploads, secrets, and production configuration. Provides condensed, copy-ready secure defaults for Laravel 11 / PHP 8.3.

pekral Skill

Use when asked whether a change or app is production-ready, what could break in production, or for a ship/block decision before a release — assess readiness from cheap local git, code, CI, and config evidence and return a scored verdict with specific fixes.

pekral Skill

Use when the user explicitly requests a penetration test (pentest, ethical hacking, active exploitation, red-team assessment) against an authorized in-scope target — and only then. Runs a methodology-driven offensive assessment that validates exploitability with safe proofs of concept and delivers a risk-rated remediation report. Does not run on a normal code-review, security-review, or resolve-issue pass.

pekral Skill

Use when hunting for exploitable, remotely reachable vulnerabilities in a PHP/Laravel codebase for responsible disclosure or a bounty submission, not a general best-practices review. Biases toward user-controlled attack paths that pay and discards low-signal noise.

pekral Bundle

Use when reviewing authorization / access control in a Laravel project — find IDOR / broken object-level authorization (BOLA), audit which routes are unprotected, check policy / gate coverage, or sanity-check a new endpoint in a PR. Walks the authorization chain of every HTTP route (middleware → authorize/policy/gate → query scoping → API Resource output), anchors every finding to real `php artisan route:list --json` output plus a cited `file:line`, classifies by confidence, and produces a per-route coverage map. Read-only / advise-only — never edits code.

pekral Skill

Use when the user asks for an audit of the codebase or decides to refactor a part of it, and wants the cleanest achievable answer rather than a quick opinion. Runs a coordinator-driven, read-only sweep for materially useful simplifications in data structures, state representation, control flow, algorithms, and ownership — every subsystem inventoried, each finding independently verified, the audit itself audited. Proposes only; never edits, tests, commits, or pushes.

ch4570 Bundle

Orchestrate a consolidated backend review across Kotlin/Spring correctness, refactoring, design patterns, object-oriented design, and security. Use for pull requests, diffs, or backend modules that need one severity-gated report without losing specialist dissent.

ch4570 Bundle

Run Kotlin/Spring, object-oriented design, design-pattern, and behavior-preserving refactoring reviews against one frozen code scope, then reconcile them into one evidence-based verdict. Use for Kotlin changes, including Kotlin/Spring pull requests, diffs, modules, or code snippets that need a multi-angle design and maintainability review without the broader security scope of a full backend audit.

ch4570 Bundle

Freeze a repository test scope, audit test quality, make only authorized Kotlin/JVM test-side improvements, prove fault detection, and reconcile fresh execution evidence without overwriting user changes. Use for a bounded test-quality audit or a safe test refactor; do not use for production fixes, broad cleanup, E2E, or adding test tooling.

cosmix Skill

Service mesh implementation with Istio for microservices traffic management, security, and observability.

cosmix Skill

Comprehensive code review covering correctness, maintainability, performance, security, and best practices.

cosmix Skill

Quick routine security checks for secrets, dependencies, container images, and common vulnerabilities.

cosmix Skill

Comprehensive security audits across applications, APIs, infrastructure, and data pipelines.

hvkshetry Skill

Entity compliance audit — overdue filings, expiring registrations, K-1 status, and state-specific requirements.

hvkshetry Bundle

End-of-year IRS form preparation: document checklist, form identification, form completion guidance, and audit review. Use when preparing tax returns, filling IRS forms, assembling tax document checklists, reviewing form completeness, or reconciling income sources during tax season.

syncfusion Bundle

**CONTENT SECURITY POLICY (CSP) GUIDE** — Assist with configuring Syncfusion ASP.NET Core EJ2 components to work with strict Content Security Policy (CSP) headers. Use when: implementing CSP headers, generating and applying nonces to inline scripts/styles, configuring external font allowlists, or troubleshooting CSP violations.

syncfusion Bundle

Implement the Syncfusion ASP.NET Core SpeechToText control for converting spoken words to text using Web Speech API. Use this skill when implementing speech recognition with Razor Tag Helpers, converting voice to text in ASP.NET Core applications, handling microphone input, processing speech events, customizing button appearance, managing listening states, or building accessible voice-enabled forms. Covers setup, speech recognition features, Razor Tag Helper syntax, events, methods, globalization, and security.

casoon Skill

Schreibt eine Case Study aus Vorher/Nachher-Audit-Daten. Nutzen, wenn ein Kundenprojekt als Referenz aufbereitet wird.

casoon Skill

Formt Audit-Erkenntnisse in einen Newsletter-Abschnitt. Nutzen, wenn aus Ergebnissen/Erkenntnissen ein Newsletter werden soll.

blink-new Skill

Read and write data in a linked Blink project's database and file storage. Use to manage app data, query users, update records, upload/download files. Requires BLINK_PROJECT_ID secret to be set first.

ch4570 Bundle

Audit the autonomous knowledge lane (.claude/knowledge/auto/) — verify each machine-written candidate against current code, then promote true/reusable ones to the curated knowledge base or discard stale/duplicate/wrong ones. This is the curation half of the autonomous learning loop — it replaces the human approval gate that the Stop auto-learn hook bypasses. Use periodically (or when the auto lane has accumulated candidates) to keep the KB from rotting.

ch4570 Bundle

Analyze security vulnerabilities and shared-resource risks across a diff, module, or repository. Use for security scans, hardening, or requests to remove unsafe code: authentication, tenant isolation, secrets, browser and interpreter injection, SSRF, files, configuration, dependencies, resource exhaustion, and destructive DB/cache/search/queue/storage operations. Audit read-only when asked to review; when asked to fix, patch verified risks and run safely isolated regression checks with independent re-review. Never operate shared services to demonstrate a flaw.

jwangkun Skill

Create financial plans for Chinese wealth management clients covering retirement, education, estate, and cash-flow planning. Adapted from the original financial-plan skill for Chinese tax rules, social security, and local financial products. Triggers on "A股财务规划", "理财规划", "financial plan China", "retirement plan China", "财务规划客户", "退休规划", "教育金规划", or "comprehensive financial plan".