Security

zts212653 Skill

外部高风险 claim 与研究贡献审计。Use when: 数字、benchmark、因果、趋势、模型能力、 外部论文或会进入 docs/ADR/PPT 的结论。Not for: 低风险常识、只读官方原文且不外推、 已进入 deep-research 的重调研。Output: claim ledger + source / non-triviality / decision-fit 三轴 verdict + provenance。

luissambrano Bundle

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.

luissambrano Bundle

This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.

luissambrano Bundle

This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.

luissambrano Bundle

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

luissambrano Bundle

Autonomously deep-scan entire codebase line-by-line, understand architecture and patterns, then systematically transform it to production-grade, corporate-level professional quality with optimizations

luissambrano Bundle

Expert security auditor specializing in DevSecOps, comprehensive

luissambrano Bundle

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

anastasiyaw Bundle

Ranked symbol map of a codebase within a token budget — a compact "what matters in this repo" before reading files. Use when starting work in an unfamiliar/large codebase, before a refactor or deep-review fan-out, when you need JIT context instead of dumping whole files, or asked "give me a map of this repo / where are the important functions / what's the structure". Zero-dependency (stdlib only); Aider-inspired regex extraction and PageRank ranking, not a tree-sitter parser. Do NOT use to find correctness/security defects in a change or to audit a diff; use deep-review for that (this only ranks and lists symbols, it does not evaluate code quality).

anastasiyaw Skill

Scaffold a new layer in a project's docs/layers/ tree following the feature-layer architecture (principle 28). A layer is a bounded concern (security, data, ui, infrastructure, domain) with its own invariants, decisions, gotchas, patterns, and feature narratives. Use when: "create a new layer", "add security layer", "scaffold layer", "start tracking <concern> separately", "/layer-new", "add bounded concern". Operates on the kb-skeleton structure; idempotent -- will not overwrite existing layers. Do NOT use to scaffold an individual feature narrative inside an existing layer; use /feature-new for that (a layer is the container, not the per-feature doc).

anastasiyaw Bundle

Find likely software bugs in a codebase, rank concrete bug candidates, and prove or reject them with focused regression tests before proposing a fix. Also turn bug reports, stack traces, screenshots, failing behavior, support tickets, and regressions into minimal reproducible cases with red-to-green evidence. Use when Codex needs to hunt for unknown bugs, audit code for correctness defects, test suspicious edge cases, reproduce a reported failure, isolate root cause, or verify that an approved fix works without regressions. Honor explicit user authority for the requested fix; use approval gates only for authority that the request did not already grant or when scope materially changes. Do NOT use for ordinary implementation where no bug investigation or reproduction is needed.

uxcel-lab Skill

Audit interface copy — labels, buttons, errors, empty states, tooltips, notifications, form hints — against UX-writing standards. Produces a severity-rated issue list with concrete rewrites. Use when reviewing UI copy for clarity, tone, and consistency, or as a validation step on any generated screen.

uxcel-lab Skill

Audit the visual quality of a UI against established visual-design principles — hierarchy, emphasis, contrast, spacing, alignment, grouping, consistency, and depth. Produces a severity-rated issue list with concrete fixes. Specializes in catching overdesign, clutter, and competing focal points. Use when reviewing whether a screen looks professional, or as a validation step after generating UI.

uxcel-lab Skill

Audit a UI, flow, or copy for dark (deceptive) patterns — design that manipulates users into unintended actions. Produces a prioritized findings list naming each pattern, its intent, severity, and an honest-design fix. Use when reviewing conversion flows, checkouts, paywalls, sign-ups, or cancellation flows for ethical design issues.

uxcel-lab Skill

Design or critique how a product prevents, surfaces, and recovers from errors — input/validation errors, system & network failures, AI/prediction failures, destructive actions, and 404/dead-end pages. Leads with prevention (most errors are designable away), applies the always-true core (validate without interrupting, write recoverable messages, give a safety net, never dead-end) and gates context-dependent levers (confirm vs. undo, validation timing, humor, degradation, transparency vs. security) with trade-offs. Trigger when the user asks to design or review error states, error messages, form validation, a 404/error page, undo/confirmation flows, failure handling, or graceful degradation.

uxcel-lab Skill

Run a structured quality audit on a product decision or its rationale — a build/buy/sunset/re-platform/pricing call, a decision log, a retrospective, or any "we decided X because…". Produces a severity-rated issue list with concrete fixes — catches outcome-based reasoning (resulting), deliberation mismatched to reversibility, uncalibrated confidence, confirmation/anchoring/framing/sunk-cost bias, missing pre-mortems, and undocumented reasoning. Use when reviewing a major decision or its write-up, or as a validation step after a decision is made.

uxcel-lab Skill

Run a structured information architecture audit on a sitemap, navigation tree, category structure, menu labels, or multi-screen product. Produces a severity-rated issue list with concrete fixes — catches scheme/task mismatches, narrow-and-deep hierarchies, low-information-scent labels, inconsistent labeling systems, single-path findability, and dead-end pages. Use when auditing IA, site structure, categories, taxonomy, or labels, or as a validation step after generating navigation or any multi-screen structure.

bestdeejay-design Bundle

Documentation Timekeeper — 5 AI agents (Chronos, Censor, Dewey, Veles, Canon) for documentation integrity. Checks: duplicates, broken links, missing required docs, orphans, classification (L1-L6), stale dates. Use when: "check documentation", "docs audit", "audit docs", "docs integrity", "find duplicates in docs", "broken links", "stale documentation", "classify docs", "documentation health", "orphan docs", "validate docs", "doc quality", "docs lint", "chronos".

bestdeejay-design Bundle

Security review orchestrator for dependency lockfiles and source: inventory of lockfiles/manifests (npm, pip, cargo, go, gem, maven, gradle, composer), exit-code classifier for 13 security tools (semgrep, bandit, gitleaks, osv-scanner, pip-audit, trufflehog, checkov, trivy, grype, npm audit, cargo audit), JSON normalizer to a unified finding schema, and human-readable reports. Stdlib-only Python helper + workflow for OWASP-aligned security review.

bestdeejay-design Bundle

DEPRECATED meta-skill. Routes to the four focused repository skills that replaced it: repo-readme-assets (README + animated SVG header/footer), repo-community-files (LICENSE/CODE_OF_CONDUCT/CONTRIBUTING/SECURITY/SUPPORT/templates), repo-metadata-health (description/topics/GitHub Pages/community health/audit), repo-social-preview (og:image PNG). Load one of the four directly instead. Triggers: 'github hygiene', 'repo polish', 'github repo docs', 'оформить репозиторий', 'репозиторий готов к публикации'.

bestdeejay-design Bundle

Create and maintain repository community/legal files: LICENSE, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, SUPPORT.md, issue/PR templates, FUNDING.yml. No scripts — template-driven. Triggers: 'license file', 'code of conduct', 'contributing guide', 'security policy', 'support file', 'issue template', 'pr template', 'funding yml', 'community files', 'repo legal files', 'contributor covenant'.

bestdeejay-design Bundle

Audit and update GitHub repository metadata and community health: description (gh repo edit), topics (PUT /repos/topics, max 20), GitHub Pages link + homepage, community-health percentage via the Community Profile API, and a 16-point check checklist. Script: validate_repo.py (gh API + filesystem, auto-detect from git remote). Triggers: 'repo description', 'repo topics', 'github topics', 'github pages', 'community health', 'repo audit', 'repo metadata', 'repo checklist', 'health percentage', 'repo about'.

smicolon Skill

This skill should be used when the user asks to "create an API endpoint", "add a view", "write a viewset", "create a serializer", or when writing Django REST Framework code. Enforces security requirements (permissions, authentication, rate limiting).

smicolon Skill

Enforces NestJS security best practices including input validation with class-validator, rate limiting with @nestjs/throttler, route authentication guards, Helmet headers, and CORS configuration.

erikpr1994 Skill

Supabase client setup, Row Level Security (RLS), edge functions, and real-time. Use when working with Supabase database, auth, or edge functions.

holon-run Bundle

Operate Binance Web3 public market and research APIs through UXC with a curated OpenAPI schema. Use when tasks need token search, token metadata/market snapshots, address holdings, rankings, token audit, or smart money signals on Binance Web3.

understudy-ai Skill

Host security hardening and risk-tolerance guidance for Understudy deployments. Use when a user asks for security audits, firewall/SSH/update hardening, exposure review, or recurring checks on a machine running Understudy.

droodotfoo Bundle

Zero-knowledge circuit design with Noir (Aztec's ZK DSL). TRIGGER when: working with .nr files, Nargo.toml, ZK circuits/proofs, Aztec contracts, zoir extension, or discussing zero-knowledge proof design. Covers circuit architecture, constraint optimization, ZK-specific security, and Aztec integration. DO NOT TRIGGER when: only Noir language syntax is needed (droo-stack handles that), working with Solidity only (use solidity-auditor skill), or hybrid Solidity + Noir projects with both foundry.toml and Nargo.toml (use zk-x-ray skill).

droodotfoo Bundle

Pre-audit report generator for ZK + EVM hybrid protocols (Noir circuits + Solidity verifier / oracle layers). Produces an x-ray report, a classified entry-points map, an invariant catalog with a Circuit↔Solidity Consistency section, a per-circuit map, and an EIP-readiness verdict. TRIGGER when: project has both `foundry.toml` (or hardhat config) AND a `Nargo.toml` workspace; user asks for "zk-x-ray", "audit zk", "audit zkp", "zk readiness", "pre-eip review", "circuit-solidity audit", or "zk pre-audit"; EIP/ERC draft is being prepared for submission and a hybrid Solidity + Noir codebase needs a structural readiness check. DO NOT TRIGGER when: protocol is Solidity-only (use solidity-auditor skill or pashov's x-ray); deep circuit-design questions without Solidity integration (use noir skill); general Ethereum tooling questions (use ethskills); when a full external audit is the goal rather than a pre-audit briefing.

droodotfoo Bundle

Structured code review with blast radius analysis, security scanning, quality scoring, and a 30+ item checklist. TRIGGER when: user asks to review a PR, diff, changeset, or code for quality/security/breaking changes; user runs /review or /code-review; reviewing staged or committed changes. DO NOT TRIGGER when: writing new code from scratch, refactoring without review context, general debugging.

droodotfoo Bundle

Property-based and generative testing across the polyglot stack. TRIGGER when: user asks about property-based testing, generative testing, QuickCheck, Hypothesis, proptest, StreamData, fast-check, fuzzing test inputs, or finding edge cases that example tests miss. DO NOT TRIGGER when: user asks about TDD workflow (use tdd), mutation testing (use tdd), load testing (use performance-profiler), or security fuzzing (use security-auditor).

droodotfoo Bundle

General-purpose application security auditing across Python, TypeScript, Go, and Rust. TRIGGER when: user asks for a security audit, vulnerability assessment, threat modeling, code security review, OWASP analysis, variant analysis, or asks about injection, XSS, SSRF, path traversal, deserialization, or crypto misuse in application code. DO NOT TRIGGER when: working with .sol files, smart contracts, or Solidity audits (use solidity-auditor); when reviewing code for general quality without security focus (use code-review); when auditing dependencies only (use dependency-auditor).

droodotfoo Bundle

Solidity development standards and security auditing. TRIGGER when: working with .sol files, foundry.toml, hardhat.config.*, smart contract auditing, security review, or vulnerability analysis. Covers Foundry-first development patterns, vulnerability taxonomies, and audit methodology. DO NOT TRIGGER when: general Ethereum tooling/ecosystem questions (use ethskills skill), or Noir/ZK circuits (use noir skill).

droodotfoo Bundle

Automated tech debt scanning, classification, and cost-of-delay prioritization. TRIGGER when: user asks to find tech debt, audit code quality or code health, prioritize refactoring, track debt trends, identify cleanup candidates, or assess where to invest engineering effort; user runs /tech-debt or /debt-scan. DO NOT TRIGGER when: writing new features, doing code review (use code-review skill), debugging specific bugs.

droodotfoo Bundle

Multi-language dependency vulnerability scanning and license compliance auditing. TRIGGER when: user asks to audit dependencies, check for vulnerabilities, review licenses, detect outdated or bloated packages, or assess supply chain risk. DO NOT TRIGGER when: user is adding a specific dependency they have already chosen, or debugging a build failure unrelated to dependency versions.

bitterbot-ai Skill

Host security hardening and risk-tolerance configuration for Bitterbot deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, Bitterbot cron scheduling for periodic checks, or version status checks on a machine running Bitterbot (laptop, workstation, Pi, VPS).