Security

zhizhunbao Skill

Security-first skill vetting for AI agents. Use before installing any skill from community, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

zhizhunbao Skill

插件根目录定位协议。在命令执行前自动触发，确定 resource/、scripts/、references/ 等目录的绝对路径。

zhizhunbao Skill

腾讯云鼎实验室出品，Skill安全审查工具。对用户指定的skill.md文件及其配套的文档、程序、脚本等进行全面安全审计，确保引用安全

filippodesilva Bundle

Enforce multi-tenant isolation and PostgreSQL Row Level Security in NestJS. Use when enforcing tenant isolation or PostgreSQL RLS in NestJS multi-tenant apps.

andurilcode Skill

Apply kaizen continuous improvement philosophy to any codebase — identifying waste, unevenness, and overburden at the code level and producing small, actionable improvement opportunities. Triggers on '/kaizen', 'kaizen this codebase', 'continuous improvement audit', 'find waste in this code', 'what small improvements can we make?', 'improve this codebase incrementally', 'code health check', 'codebase hygiene', 'tech debt sweep', or any request to find incremental improvement opportunities in code. Also trigger when the user says 'clean up', 'tidy up', 'make this codebase better', or expresses frustration about code quality without wanting a full rewrite. This is NOT a code review skill for PRs or diffs — kaizen operates on the codebase as a whole or a focus area, looking for systemic improvement opportunities. Use this skill even for small codebases — the philosophy scales down gracefully.

andurilcode Skill

Apply kintsugi (金継ぎ) repair visibility philosophy to any codebase — finding invisible repairs and making them legible with 'gold' context. Triggers on '/kintsugi', 'kintsugi this codebase', 'repair visibility audit', 'are our fixes documented?', 'why was this changed?', 'undocumented fixes', 'invisible patches', 'git archaeology', 'missing context on past fixes', 'why does this workaround exist?', or any request to understand or document the history behind code changes. Also trigger when someone asks 'why is this code like this?', 'what incident caused this?', 'who knows why we do it this way?', or when tribal knowledge about past repairs is at risk of being lost. This skill audits the history layer of a codebase — not what the code does today, but whether past breaks and repairs are visible and legible to future developers.

andurilcode Skill

Challenge AI-generated (or any) unit tests to find false positives — tests that pass against wrong behavior. Use this skill whenever the user asks to review, audit, validate, or challenge test quality, especially tests generated by AI to increase code coverage. Triggers on phrases like 'review these tests', 'are these tests actually correct?', 'challenge my tests', 'test quality audit', 'false positive tests', 'these tests were auto-generated', 'AI wrote these tests', 'coverage went up but I don't trust it', 'are these tests testing the right thing?', 'validate test correctness', or any situation where tests exist alongside source code and someone wants to know whether the tests are genuinely verifying correct behavior vs. merely mirroring implementation bugs. Also trigger when the user mentions increasing code coverage with AI, copilot-generated tests, or test generation tools — these are high-risk contexts for false positive tests.

dragoon0x Skill

Audit ARIA attributes. Ensure proper usage without over-specification.

dragoon0x Skill

Comprehensive design quality report with specific findings per axis, line references, severity ratings, and fix instructions.

dragoon0x Skill

Audit visual density and whitespace balance across sections.

dragoon0x Skill

Audit nesting depth. Maximum 4 levels of visual containment.

dragoon0x Skill

Audit visual depth. Count distinct heading levels, weight differentiation, size ratios.

dragoon0x Skill

Audit all font-family, font-size, font-weight, line-height, letter-spacing across the codebase.

dragoon0x Skill

Find every color not in the palette or token system.

pinocpie Skill

audit ดีไซน์ 19 rules

anotb Bundle

Designs the sample for a control test before fieldwork starts. Defines the testable population, picks a sampling method (statistical or judgmental), sizes the sample, sets a tolerable deviation rate, names the selection technique, and documents the rationale a reviewer can defend in front of an examiner. Output is a sampling memo that drops into the test plan or workpaper as a referenceable artifact. Best for: - A second-line testing pod or internal-audit team is scoping a control test and needs a defensible sample method, size, and rationale before pulling evidence. - A reviewer is challenging a first-line control owner's self-attested testing because the sampling rationale is missing or thin and the sample needs to be redesigned. - A walkthrough has confirmed control design and the next step is sizing operating-effectiveness testing across a defined population. - A prior-cycle workpaper failed QA on sample-design grounds and the redraft starts at the sampling memo. Not the right tool when: - The control or

anotb Bundle

Drafts the pre-fieldwork test plan for a single control test cycle: scope, control objective, named source criteria, period, population, sampling reference, walkthrough plan, design-effectiveness procedures, operating-effectiveness procedures, evidence-request reference, pass and fail criteria, limitations, downstream consumers, and reviewer sign-off block. Output is the planning artifact that gets reviewer sign-off before evidence pulls and fieldwork begin; it is the contract the workpaper is written against. Best for: - A compliance-testing or internal-audit team is scoping an annual test plan or a one-off targeted review and needs the pre-fieldwork planning workpaper before evidence pulls and fieldwork. - A second-line reviewer is responding to a regulatory-change-management trigger (a new rule, an updated examiner priority, a new exam letter) by standing up a fresh test against an updated control set. - An audit lead is rebuilding a test program after a prior issue, restating control objectives and proced

anotb Bundle

Drafts the testing workpaper for a single control test cycle once evidence has been inspected and procedures executed. Captures source criteria, walkthrough, evidence inspected, procedures performed, sample-level results, exception aggregation, and a separate design and operating effectiveness conclusion. Output is the standard testing workpaper a QA reviewer, internal audit reviewer, or examiner expects, formatted so each conclusion ties back to evidence. Best for: - A compliance-testing or internal-audit team has finished evidence inspection and procedure execution and needs the workpaper drafted from those results. - A second-line reviewer is documenting a targeted, off-cycle review (regulatory-change triggered, incident-triggered, examiner request) and the workpaper is the artifact. - A QA reviewer is rebuilding a workpaper that failed prior QA, working from the same evidence and exception register. Not the right tool when: - Testing has not been done. Pre-fieldwork scoping is `test-plan-builder`; sample

anotb Bundle

Classifies the deviations a control test surfaced into design gaps, operating-effectiveness failures, evidence gaps, scope disagreements, data-integrity issues, and anomalies; ranks severity with rationale; names a root-cause hypothesis; sets disposition (elevate to issue, close at exception, re-test, expand sample); and builds the handoff package downstream issue write-up consumes. Output is an exception register that pairs with the testing workpaper and ladders confirmed exceptions into the issue lifecycle. Best for: - A compliance-testing or internal-audit reviewer has finished sample testing and is sitting on a list of deviations that need to be classified before they become findings. - A QA reviewer is challenging a workpaper's exception treatment because the line between evidence gap and control failure was blurred. - A repeat-issue review needs to confirm whether deviations across testing cycles are the same root cause or coincidental. - A second-line lead is preparing a handoff to issue write-up and w

anotb Bundle

Produces the second-line credit risk governance review pack a US bank's chief credit officer or chief risk officer carries to the credit risk committee or hands the OCC, FRB, or FDIC examiner reviewing credit administration. Organises the artifact around credit policy alignment, underwriting framework, risk-rating discipline, concentration governance, allowance methodology oversight (ACL / CECL), Reg O and Reg W applicability for insider and affiliated credit, second-line challenge of first-line lending decisions, and (for covered banks) the Heightened Standards posture for credit risk. Audience is the chief credit officer, chief risk officer, head of credit risk review, ALLL / ACL governance committee, audit committee, and examiner-in-charge for a credit-administration scope cycle. Best for: - A national bank, state-member bank, state non-member bank, or federal savings association is refreshing its credit policy or credit risk-rating framework and second-line needs to challenge the first-line proposal again

anotb Bundle

Drafts the second-line deposit-operations control matrix for a US bank: account opening and CIP, beneficial-ownership collection at deposit channels, account-opening and advertising disclosures, EFT and ATM controls under the consumer-EFT regime, funds-availability holds and exception-hold notification, NSF and overdraft fee disclosure under the truth-in-savings regime, garnishments and levies, escheatment and dormant-account governance, deposit-insurance coverage representation under the federal misrepresentation rule, FBO-account ledgering and pass-through deposit-insurance recordkeeping for sponsor-bank fintech programs, exception handling, access controls, and evidence retention. Audience is the deposit-operations director, the bank's compliance officer, the BSA officer, internal audit, and the federal banking examiner reading the matrix line-by-line. Best for: - A bank standing up or refreshing the deposit-operations control framework after a process change, a system migration, an internal-audit finding,

anotb Bundle

Drafts a payments risk assessment for a fintech, money transmitter, BaaS platform, neobank, wallet, or sponsor-bank program: a matrix-shaped artifact denominated by rail (ACH, Same Day ACH, wire, card debit / credit, FedNow, RTP, P2P, check, cross-border correspondent, virtual-currency on-ramp), by customer segment (consumer, SMB, payroll-on-demand, gig, BNPL, cross-border remittance, high-risk vertical), and by US-state and corridor geography. Carries fraud, BSA / AML, sanctions, operational resilience, third-party / sponsor-bank dependence, customer-harm / UDAAP, and reporting-control views, with concentration sub-tables for sponsor-bank, processor, and BIN-sponsor exposure. Output suits a sponsor-bank annual review, a state MTL exam preparation file, an internal audit kickoff, or an enterprise risk committee read-out. Best for: - A program operator, sponsor-bank program-management team, or money transmitter is running its annual or semi-annual payments risk assessment and second-line is owning the artifact

anotb Bundle

Drafts a controls inventory and self-evidence pack for consumer-permissioned data sharing under the named US personal-financial-data-rights frame. The pack covers data-provider duties (covered-data scope, developer-interface availability and security, consumer authorisation, scope and duration limits, revocation propagation, third-party screening) and data-recipient duties (consumer authorisation, collection and use limits, retention, deletion-on-revocation, reauthorisation, downstream sharing). The artifact aligns to industry-standard tokenised data-sharing patterns and to the migration off credential-based screen scraping. Audience is the data-provider fintech, the data-recipient fintech (account aggregator, PFM, lender, BNPL, payroll-on-demand), or the sponsor-bank programme acting as either, plus the second-line or advisory team supporting them. Best for: - A data-provider fintech (or its sponsor bank's programme) is preparing for an implementation-tier milestone, an examiner data request, or a sponsor-ba

anotb Bundle

Drafts the incident-review pack for a payments-operations event at a fintech program operator, BaaS platform, money transmitter, neobank, wallet, BIN sponsor, or payments processor. The pack carries an incident summary, customer-impact population, named-rail and sponsor-bank notification triggers, root cause, affected transaction population by rail, remediation actions, sponsor-bank reporting, and the regulator-facing artifact list. Output is review-ready for the program operator's second line and for production to the sponsor bank, the named payment-rail authorities (where applicable), and the regulator-facing incident file. Best for: - An ACH return spike, mis-posted batch, double-debit, stuck FedNow / RTP transfer, faulty Reg E claim queue, card-network fraud-rate or chargeback program escalation, or processor-side outage has happened and second line owns the review pack. - A sponsor-bank annual review, internal audit, or examiner data request includes incident retrospectives and the team needs the structu

brandonburrus Skill

This skill should be used when building an understanding of an unfamiliar codebase or orienting in a new repository. It applies when the user says "onboard me", "help me understand this codebase", "walk me through this repo", "how does this project work", "zoom out", or "where does X happen in here", and when starting substantial work in a repo with no AGENTS.md. It should not be used for evaluating architecture quality (use audit-architecture), for generating a CLAUDE.md (use the bundled init), or for locating one specific symbol (just search).

xobotyi Bundle

Network infrastructure for self-hosted environments: VLANs, firewalls (nftables, OPNsense, pfSense), DNS (Pi-hole, AdGuard Home, split-horizon), reverse proxies (Caddy, Traefik, Nginx Proxy Manager), VPN (WireGuard, Tailscale), TLS/SSL certificate management, DHCP, and security hardening. Invoke when task involves any interaction with network configuration — designing, implementing, debugging, reviewing, or planning network architecture.

teddyjfpender Bundle

Summarize Starknet smart contract security recommendations and common Cairo pitfalls; use when a request involves best practices, safety checks, or audit guidance.

blink-new Skill

Push live events to connected clients in a Blink app via WebSocket channels. Use to trigger UI refreshes, send notifications, broadcast data updates, or push any real-time event to app users. Requires BLINK_PROJECT_ID secret.

blink-new Bundle

Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.

jmsktm Skill

Scan code and infrastructure for security vulnerabilities and compliance issues

kuker24 Bundle

Trace each user-facing control through its handler and shared-store writes to find sequential undo, async races, stale closures, and missing transitions. Use when buttons look wired but do nothing, or after a refactor of shared UI state. Not for exploratory browser QA (playwright-qa), ordinary red-green bugs (diagnosing-bugs), or visual layout (impeccable).

kuker24 Bundle

Install, audit, configure, or remove opinionated Anti-Slop Oxlint rules in local TypeScript or JavaScript repositories. Use ONLY when explicitly requested to add anti-slop rules, audit TS/JS anti-patterns, configure anti-slop profiles, or migrate/remove an anti-slop setup. Skip for Python/Go/Rust, prose editing (use /unslop), and ordinary coding tasks.

kuker24 Bundle

Audit application performance including latency, throughput, memory, and bundle size. Use when profiling applications, identifying bottlenecks, or optimizing performance.

kuker24 Skill

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or \"audit the verify skill\".

notysoty Skill

Runs a systematic checklist review on any code diff or file, covering correctness, security, performance, and readability.

qte77 Skill

Audit README.md files against best practices for repos, accounts, or orgs. Detects missing sections, stale links, inconsistent formatting, and convention violations. Use when reviewing README quality across one or many repos.