Security

qte77 Skill

Detect hardcoded secrets, API keys, tokens, and credentials in code and git history. Use when auditing for leaked secrets or before publishing code.

qte77 Bundle

Audit and tighten codebase quality gates — architecture, lint, types, tests, docs, code review. Use when onboarding a project, before a release, or when validation is too permissive.

qte77 Skill

Scan project dependencies for vulnerabilities, license issues, and supply chain risks. Use when auditing third-party packages or before releases.

qte77 Skill

Audit code against OWASP Top 10 vulnerabilities with structured findings. Use when reviewing code for security issues or conducting security audits.

qte77 Bundle

Verify an external or AI-generated security report against the actual codebase before acting on it. Use when handed a scanner PDF, automated teardown, audit report, or bug-bounty submission — classifies every finding CONFIRMED / OVERSTATED / FALSE-POSITIVE / FABRICATED and salvages the real work items.

frankxai Skill

Ops health monitor for the machine substrate. Checks Memory Bus, brain_watchdog, Voice Operator, dashboard, audit-log freshness, and scheduled tasks. Cross-cutting skill that any repo can invoke when daemons feel off or before starting a heavy work session.

frankxai Skill

Disk audit and dedup-hint skill. Reports repo sizes, oversized files, worktree bloat, and surfaces candidates for archival/cleanup. Cross-cutting machine-layer skill, sibling to /pp and /heart.

frankxai Skill

Scan any export, file, or vault batch for credentials, API keys, tokens, and sensitive data before they leave the local machine. Fires automatically on all Claw export operations. Default skill for Starlight Sentinel and Attestation Claw.

eliasoulkadi Skill

Expert code reviewer. Analyze PR changes for correctness, security, performance, and quality. Returns findings as JSON. CRITICAL: this skill is costly, don't use it unless user explicitly requested to use it.

eliasoulkadi Skill

Review code changes for correctness, security, performance, and code quality. Use when the user asks to review a diff, review code changes, review commits, or perform a code review. Input can be: (1) a text diff pasted directly, (2) one or more git commit hashes to extract the diff from, or (3) a git range like abc123..def456. The user may also provide task description or requirements that motivated the change.

eliasoulkadi Skill

Apply professional-grade security standards to any web application task. Use this skill when writing code that handles authentication, authorization, user input, APIs, file uploads, sessions, secrets, payments, or any data from external sources. Also use when the user asks to review, audit, or assess security of code or a web app. Covers OWASP Top 10 (2025), secure coding, threat modeling, and defensive architecture. Activate even when security is not explicitly mentioned — treat every web feature as a security surface.

iceflower Bundle

GraphQL API design and implementation patterns including schema design principles, type system (Object, Input, Interface, Union, Enum), resolver patterns, N+1 problem prevention with DataLoader, pagination (Cursor-based, Relay Connection), error handling, query complexity and depth limiting, authentication/authorization at field level, and Federation (Apollo). Covers Spring for GraphQL, Netflix DGS Framework, and GraphQL security (OWASP GraphQL Cheat Sheet). Use when designing GraphQL schemas, implementing resolvers, optimizing query performance, setting up GraphQL Federation, or reviewing GraphQL API security.

iceflower Bundle

Framework-agnostic security rules including input validation, auth principles, CORS, API headers, rate limiting, secret management, authentication patterns (JWT, OAuth2, session, MFA), web protection (CSRF, XSS, injection defense, TLS), container security, and software supply chain security (SBOM, Cosign, Sigstore, SLSA). Use when implementing security-related code.

iceflower Bundle

REST API design principles including URL design, HTTP methods, status codes, pagination, versioning, security, and OpenAPI documentation. Use when designing or implementing REST APIs.

iceflower Bundle

Dockerfile best practices including multi-stage builds, layer caching, security, JVM/Spring Boot containerization patterns, BuildKit features (cache/secret mounts), multi-architecture builds, signal handling, and image provenance (cosign, SBOM). Use when writing or reviewing Dockerfiles.

iceflower Bundle

Code review checklist, comment guidelines, and PR review best practices. Covers PR review workflows, code suggestions, nitpick vs blocking review classification, LGTM criteria, review checklist (correctness, security, performance, readability), and constructive feedback patterns. Use when reviewing pull requests, providing code suggestions, or establishing a team code review process and review comment conventions.

iceflower Bundle

Spring Framework core conventions including IoC/DI, AOP, transaction management, event system, bean lifecycle, WebMVC, WebFlux, validation, scheduling, configuration management, and JPA/data access patterns. Includes Spring Boot implementation patterns for caching, error handling, HTTP client, monitoring (Actuator, Micrometer), security (SecurityFilterChain), troubleshooting (HikariCP, connection pool, OOM), and integration with Exposed ORM and Kotlin interop. Includes migration guides for Framework (5.x → 7.0) and Boot (2.7 → 4.0). Use when working with Spring Framework or Spring Boot features, Actuator health probes, Bean Validation, @Transactional, RestClient, WebClient, or Spring Security.

nethereum Skill

Encrypt and decrypt Ethereum private keys using Web3 Secret Storage (keystore JSON files) with Nethereum. Use this skill whenever the user asks about encrypting private keys, keystore files, Web3 secret storage, Scrypt encryption, PBKDF2, password-protected keys, key encryption, or loading encrypted wallets in C#/.NET.

frankxai Bundle

Preserve a consequential venture decision, its tradeoffs, owner, review date, and supporting evidence when the user asks to decide, approve, reject, document, or audit a decision.

arcadeai Skill

Deep review of any work-product — code, docs, specs, plans, decisions — grounded in current authoritative sources. Use when double-checking against latest docs, verifying versions or claims, checking security, or pressure-testing correctness and elegance before something ships. Complements the automatic quality hook with ecosystem verification. NOT for divergent ideation (brainstorm), weighing still-open options (figure-it-out), your own spec's framing (self-review), or scenario review (review-spec).

mphinance Bundle

Meta-skill that forges, audits, and refines other skills. Three modes – forge a new skill from a brief, audit recent chat transcripts for new-skill candidates and pain points, or refine an existing skill with additive-only changes. Triggers on "skill-forge a thing that does X", "forge a skill", "skill-forge audit", "skill audit", "refine my skills", "skill-forge refine <name>", or "/skill-forge". Auto-opens a PR against mphinance/alpha-skills (never auto-merges).

mphinance Skill

ML-powered single-ticker analysis — Random Forest price-range prediction (5-day horizon) plus emoji-annotated technical insights for the Single Ticker Audit view. Use when Michael wants a price prediction, a read on one ticker's technicals, or to explain the audit view's prediction card and confidence.

impertio-studio Bundle

Use when implementing the Frappe/ERPNext permission system. Covers roles, user permissions, perm levels, data masking, and permission hooks for v14/v15/v16. Prevents common access control mistakes and security issues. Keywords: permissions, roles, user permissions, perm levels, data masking,, restrict records, who can see what, department access, row-level, user cannot see document, access denied. access control, security, has_permission.

stanestane Bundle

Audit a game, feature, level sequence, combat loop, progression curve, onboarding path, event structure, or return-player journey through the lens of Flow theory. Use when evaluating whether challenge and skill stay aligned over time, diagnosing boredom, anxiety, frustration spikes, difficulty cliffs, dead zones, or pacing drift, or identifying where a design stops feeling absorbing and starts feeling exhausting or empty.

stanestane Bundle

Audit a game, feature, session, level, event, onboarding flow, reward sequence, or return-player experience through the lens of the peak-end rule. Use when evaluating which moments players are most likely to remember, whether the emotional high points are strong enough, whether endings, exits, and completions leave the right aftertaste, or why an experience with decent average quality is still remembered as flat, frustrating, or unexpectedly great.

stanestane Bundle

Audit a video game pitch deck, publisher deck, funding deck, or investor-facing game presentation for clarity, structure, persuasiveness, visual readability, business-case completeness, and publisher-fit. Use when reviewing a pitch deck before sending to publishers, polishing a deck for meetings, checking whether the deck answers the essential questions about who, what, why, when, budget, and opportunity, or evaluating whether a deck sells both the game and the collaboration case rather than just dumping information.

stanestane Skill

Audit game design goals, feature objectives, OKRs, initiative aims, or any stated design intent against the SMART criteria adapted for game design. Use when a user shares a design goal, player experience target, retention goal, or feature aim and wants it evaluated or rewritten. Trigger on phrases like "audit my design goals", "is this a good design objective", "my feature goal is...", "we want players to feel...", "our aim for this feature is...", or whenever someone states what a design should achieve and it feels vague or unmeasurable. Also trigger when a design document contains aims or success criteria that need stress-testing. Even soft goals like "players should feel powerful" are valid — apply the framework and return both the audit and a rewritten version.

stanestane Bundle

Audit a game, feature, combat scenario, progression step, failure state, onboarding beat, or reward outcome through the lens of attribution theory: how players explain success and failure. Use when evaluating whether players will blame themselves, the system, luck, or hidden rules; diagnosing perceived unfairness, learned helplessness, rage, or churn after losses; or identifying where clarity, control, and feedback are too weak for healthy learning.

stanestane Skill

Audit an existing leaderboard or competitive ranking system in a game for stagnation risk, scale problems, goal density, motivation quality, reward bracket design, group composition fairness, and top-of-ladder sustainability. Use when evaluating a leaderboard that feels flat, unfair, or disengaging; when reviewing a competitive feature before launch; or when diagnosing why a leaderboard isn't driving expected engagement or retention.

stanestane Bundle

Audit a game, feature, encounter structure, roguelite run, puzzle sequence, onboarding path, or progression gate through the lens of its failure loop: what happens after the player fails, what they learn, what they lose, and why they would or would not try again. Use when diagnosing whether failure teaches, motivates, stalls, humiliates, exhausts, or ejects the player, or when tuning punishment, retry structure, and post-failure recovery.

stanestane Skill

Audit an existing or proposed premium pass (battle pass, season pass) for value proposition integrity, progression health, free track balance, reward pacing, engagement loop quality, and economy impact. Use when evaluating a pass before launch, diagnosing why a pass is underperforming, reviewing a competitor's pass design, or stress-testing a proposed structure before committing to production.

stanestane Bundle

Audit a game, feature, event, progression system, social system, live-ops loop, or onboarding flow through the lens of Bartle player archetypes: Achievers, Explorers, Socializers, and Killers. Use when evaluating who a design motivates, who it neglects, whether a feature over-serves one archetype at the expense of others, how a system will be perceived by different motivational player types, or why engagement is uneven across different player motivations.

stanestane Skill

Audit a game, feature flow, economy path, onboarding journey, progression chain, or live-ops loop for friction quality and friction accumulation. Use when diagnosing where players stall, disengage, churn, or feel overloaded; when distinguishing productive challenge from harmful friction; or when evaluating whether constraints, waiting, confusion, resource pressure, or multi-step dependencies are creating strategy, tension, frustration, or deadlock.

stanestane Bundle

Evaluate a game design, feature proposal, system concept, pitch, or prototype on the novelty spectrum between too familiar and too novel. Use when assessing whether a concept has enough differentiation, whether it violates player expectations too strongly, how it balances familiarity and innovation, or whether its innovation pattern is best understood as incremental innovation, recombination, simplification, or a more radical break from established mental models.

stanestane Bundle

Audit a game feature, system concept, prototype plan, or preproduction proposal to determine whether the prototype is meant to sell the idea or reveal unknowns, and whether the prototype scope matches that intent. Use when teams are unclear about why they are prototyping, when a prototype risks becoming a demo in disguise, or when precious prototype time may be spent proving known strengths instead of testing real uncertainties.

stanestane Bundle

Audit a game, feature, task system, quest flow, event track, puzzle chain, progression layer, or return loop through the lens of the Zeigarnik effect: the tension created by incomplete, interrupted, or unresolved tasks. Use when evaluating whether a design creates healthy return motivation through open loops, whether it leaves players with productive unfinished business, or whether it turns incompletion into anxiety, clutter, guilt, or manipulative pressure.