Security

irahardianto Skill

Structured logging implementation patterns: log levels, mandatory context fields (correlationId, userId, duration), security (PII scrubbing), and per-language library choices (Go slog, TypeScript pino, Python structlog). Load when implementing logging in any operation entry point. Prerequisite: logging-and-observability-mandate.md.

oceanfsdfsvfdsvs Bundle

Audit SaaS license exports, HR rosters, and usage CSVs to find reclaim, downgrade, duplicate-account, departed-employee, stale-admin, and owner-review opportunities. Use when IT, finance, procurement, MSP, or operations teams need a local-first license rightsize report before renewals, QBRs, budget reviews, or access cleanup without calling vendor APIs.

oceanfsdfsvfdsvs Bundle

Review vendor bank-account change requests for payment-redirection, vendor impersonation, and audit-trail risk before AP updates bank details or releases ACH/wire/check payments. Use when finance, accounting, procurement, founders, or operators need a local-first callback and evidence check without connecting to an ERP, bank portal, or supplier portal.

oceanfsdfsvfdsvs Bundle

Triage B2B customer security questionnaires, vendor risk assessments, SIG/CAIQ/HECVAT-style requests, and due-diligence spreadsheets before a seller responds. Use when a user needs evidence-backed answers, reviewer routing, redaction guidance, or a safe response pack without inventing security claims or leaking sensitive details.

oceanfsdfsvfdsvs Bundle

Audit employee or contractor offboarding exports for lingering access, privileged roles, direct-login SaaS accounts, active sessions, unreturned assets, and unrotated secrets before a departure or role-change access review is closed. Use when IT, security, HR ops, MSP, founders, or compliance owners need a local-first deprovisioning evidence report without connecting to an IdP, HRIS, MDM, or SaaS admin API.

oceanfsdfsvfdsvs Bundle

Preflight residential rental security deposit return or deduction disputes before a tenant, renter helper, housing advocate, property manager, or small-claims filer sends a demand letter, complaint, or court packet. Use when the user needs to check refund deadlines, itemized deduction statements, normal wear-and-tear claims, move-in and move-out evidence, forwarding-address proof, receipts or estimates, deposit-cap issues, redaction risks, and owner next steps without making legal conclusions or filing live claims.

smicolon Skill

This skill activates when detecting hardcoded strings that look like API keys or credentials, creating .env files, referencing process.env or os.environ without Infisical, or working with configuration files that contain sensitive values. It enforces secret hygiene practices and recommends moving secrets to Infisical.

smicolon Skill

Auto-enforce authentication security best practices. Activates when implementing password policies, rate limiting, session security, CSRF protection, or security headers in auth flows.

smicolon Skill

This skill activates when managing environment variables, configuring .infisical.json, organizing workspace environments, or discussing secret management patterns with Infisical CLI. It provides conventions for secret naming, folder organization, auth selection, and local development workflows.

redhat-developer Bundle

Edits or audits prose that the caller supplies as text or a file, preserves its claims and voice, removes machine-writing patterns, and verifies the result with the bundled linter. Use for explicit requests such as "rewrite this draft", "edit this existing PR body", "make this sound human", or "audit this prose without changing it". It does not review code, decide what a pull request or Jira issue should say, or compose from a blank sheet.

redhat-developer Bundle

Moves the @backstage/* dependency versions of a Backstage plugin, workspace, app, or the redhat-developer/rhdh monorepo forward to a chosen release, staying within what a Red Hat Developer Hub version ships: read backstage.json and package.json, pick the target from the RHDH compatibility matrix or an explicit version, run versions:bump and versions:migrate, preserve the repository's dependency range style, audit stale resolutions, work through release changelogs, and re-verify the repository. Use for "upgrade @backstage dependencies", "bump Backstage in rhdh", "versions:bump", "which Backstage version does RHDH 1.8 ship", moved package namespaces, or dependencies that are too old for the API they need.

redhat-developer Bundle

Adversarially audits an OpenSpec change's artifacts against each other — and lightly against the codebase and repository conventions — for cross-artifact consistency before implementation. Use for "audit this change" or "run the audit". This is pre-implementation artifact coherence; for post-implementation code-vs-artifact verification, use openspec-verify-change instead.

redhat-developer Bundle

Verifies that an implementation matches its OpenSpec change's artifacts — completeness (tasks, spec coverage), correctness (requirement and scenario coverage), and coherence (design adherence, pattern consistency) — post-implementation, before archiving. Use for "verify this change", "does the code match the spec", or "is this ready to archive". For pre- implementation artifact-to-artifact consistency, use openspec-audit-change instead.

seed-forge Bundle

技术债全生命周期运维：审计分析→建议报告→确认后重构（微观+宏观）→回归验证。覆盖从“发现债务”到“安全消除”的闭环。Triggers on "重构", "技术债", "技术债审计", "audit", "god class 太大", "拆分模块", "refactor", "tech debt", "代码太乱要重构", "tech debt audit".

ntaffzii Bundle

Retire, preserve, explain, or replace old skills without silently deleting useful history. Use when the user asks to deprecate a skill, replace a skill, audit stale skills, or understand why a skill should no longer be used.

ntaffzii Skill

Code review skill for finding bugs, regressions, risky behavior, missing tests, and maintainability problems in diffs, pull requests, or local changes. Use when the user asks for review, scrutinize, audit, inspect, or feedback on code.

ntaffzii Skill

Design Codex automations, scheduled research jobs, recurring reports, reminders, monitors, thread follow-ups, and workspace jobs. Use when the user asks to set up, improve, schedule, template, audit, or design an automation, monitor, reminder, or recurring Markdown report.

jasonkneen Bundle

Anti-AI-slop design skill for greenfield pages, audits, redesigns, and design extraction from URLs or screenshots. Use when the user asks to build a new app or landing page, wants to redesign something, invokes Hallmark by name, or uses audit/redesign/study.

carta Bundle

SPA coverage audit across your portfolio — categorizes every equity investment as missing, unexecuted, executed, or not needed. Use when asked about SPA coverage, missing SPAs, unexecuted SPAs, or document completeness.

iamdemetris Skill

Use when writing, reviewing, or upgrading a Java service on JDK 21 LTS or newer; designing records, sealed interfaces, pattern matching, virtual threads (Project Loom), and structured concurrency; building Spring Boot 3 services (Spring Web, Spring Data JPA, Spring Security, Actuator) or evaluating Quarkus, Micronaut, Helidon for native image; tuning the JVM (G1, ZGC, heap sizing), reading JFR recordings, running async-profiler; managing Maven or Gradle builds; testing with JUnit 5, AssertJ, Mockito, and Testcontainers against real Postgres or Kafka. Triggers: Java, JDK, JVM, Spring Boot, Hibernate, JPA, sealed, switch expression, virtual thread, Maven, Gradle, GraalVM, native image, Testcontainers, G1, ZGC. Produces Spring Boot services and controllers, JPA entities and migrations, virtual thread and structured concurrency configs, JUnit 5 plus Testcontainers suites, and JVM tuning plans. Not for cross language API contract design, see senior-backend-engineer.

iamdemetris Skill

Use when building, integrating, or reviewing healthcare software: patient portals, clinician tools, EHR integrations, telehealth, digital therapeutics, claims and eligibility flows, or anything that touches PHI. Covers HIPAA, HITECH, 42 CFR Part 2, SaMD scope, FHIR R4, HL7 v2, DICOM, ICD-10, LOINC, SNOMED CT, NPI, Epic / Cerner / athenahealth integration, patient matching, audit trails, break glass access, and BAA inventory. Produces PHI data flow diagrams, FHIR resource maps, audit log shapes, access control matrices, BAA tracking sheets, HL7 v2 interface specs. Triggers: healthcare, HIPAA, PHI, ePHI, EHR, EMR, FHIR, HL7, DICOM, ICD-10, LOINC, SNOMED, NPI, SaMD, clinical, clinician, patient portal, Epic, Cerner, telehealth, BAA. Not for HIPAA program management, see compliance-engineer; not for general threat modeling, see principal-security-engineer.

iamdemetris Skill

Use when reviewing dependencies, lockfile diffs, CVE alerts, supply chain risk, SBOM generation, npm audit, pip-audit, dependabot or renovate PRs, version bumps, postinstall scripts, transitive packages, or package manifests like package.json, requirements.txt, Cargo.toml, go.sum, pom.xml, Gemfile.lock. Produces a dependency audit report, an SBOM (CycloneDX or SPDX), a remediation plan with owners and due dates, a CI policy proposal, and a risk score rubric. Defensive only: own repos, authorized audits, and CI security hardening. Do not invoke for offensive supply chain work, malware authoring, or attacks on third party registries. Hand severity classification on critical CVEs and org wide policy to `principal-security-engineer`, CI enforcement to `senior-devops-sre`, and active exploitation to `incident-commander`.

zhaixin244-wq Skill

Health check the Obsidian wiki vault. Finds orphan pages, dead wikilinks, stale claims, missing cross-references, frontmatter gaps, and empty sections. Creates or updates Dataview dashboards. Generates canvas maps. Triggers on: "lint", "health check", "clean up wiki", "check the wiki", "wiki maintenance", "find orphans", "wiki audit".

nethereum Skill

Sign Ethereum transactions with Ledger and Trezor hardware wallets using Nethereum. Use this skill whenever the user asks about Ledger signing, Trezor signing, hardware wallet integration, HSM device signing, external signers, or hardware security modules for Ethereum in C#/.NET.

rgourley Bundle

Workflow composite that runs change-point-detector + hurst-exponent on SPY plus the 11 SPDR sector ETFs. Reports per-name the last detected regime shift, current persistence classification (mean_reverting / random_walk / trending), and cross-sector summary (broad_regime_shift / localized_regime_shift / trend_dominated / mean_reversion_dominated / mixed_stable). Requires Stocks Basic. Runs on the free tier.

rgourley Bundle

Take a book (weights per ticker), compute the daily portfolio return series, and run the full tearsheet with deflated Sharpe correction (Bailey & Lopez de Prado) plus rolling IC vs benchmark. Emits a verdict (real_alpha / possibly_alpha / essentially_beta / underperforming / no_edge_evident) based on DSR significance, alpha annualized, and beta. Answers "is this book actually alpha, honestly?" Requires Stocks Basic.

syncfusion Bundle

Common utilities and features for Syncfusion Angular components. Use this skill when the user needs to implement animations, drag-and-drop, state persistence, RTL support, localization, globalization, security, templates, and advanced features for Syncfusion Angular components.

kuker24 Bundle

Design or review REST API contracts — resource naming, HTTP methods, status codes, pagination, filtering, errors, versioning, and rate-limit headers. Use when shaping or auditing HTTP endpoints. Not for library/API docs (research/Context7), consumer-provider schema ownership (contract-first), or auth/secrets review (full-audit-keamanan).

jpcaparas Skill

Define clear constraints—performance, security, testing, architecture, dependencies—so AI generates code that meets your project standards

jpcaparas Skill

Remove unneeded Composer packages and assets to improve boot time, memory, and security surface

knowledgeislands Bundle

Explains first-time Knowledge Islands activation through the `ki` CLI: bootstrap a user, select a verified canonical harness, and distinguish user skills from repository-declared governance. Use for guidance on `ki bootstrap`, `ki harness`, `ki skill add/remove`, `ki repo skill add/remove`, and `ki dev local`; the CLI itself owns all mechanics. Triggers: "set up KI", "what does ki bootstrap do", "activate a KI skill", "why won't ki repo audit run". For repository coverage use `ki-repo`; for command behaviour use `ki --help`.

knowledgeislands Bundle

Defines Knowledge Islands Markdown, TOML, README composition, and knowledge-placement conventions. Use to format or audit Markdown or TOML, shape a repository README, decide where a durable learning belongs, or refresh house style. Use `ki-skills` for a SKILL.md, `ki-repo` for repository requirements or a configuration contract, and `ki-engineering` for the toolchain.

knowledgeislands Bundle

Audit, conform, or scaffold a Knowledge Islands `tools-*` repo — ONE standalone CLI per repo, distributed by a `curl | bash` installer and companion Homebrew formula. Governs shared shape and public conventions language-agnostically: executable + bit, installer, version/release, changelog, CI, help/errors/status, one documented `completion <shell>` action, and optionally installed/linkable portable-roff `man/<tool>.1`. Conditionals: shell → shellcheck + bats; physical manual → mandoc CI; package.json → `ki-engineering`. Triggers: "audit this tool repo", "scaffold a CLI tool", "release a command-line tool", "does this tools- repo follow our standard", "check my tools- repo". Off-ramps: tap/formula → `ki-repo-homebrew-tap`; README/LICENSE/GitHub settings → `ki-repo`; TS/Bun toolchain → `ki-engineering`. Not individual tool behaviour.

knowledgeislands Bundle

Codify, audit, and maintain Decision Records in any Knowledge Islands repo — the unified instrument replacing ki-adrs and ki-kdrs. Each decision type has its own prefix: GDR- (governance), ADR- (architecture), KDR- (knowledge), SDR- (strategy), PDR- (product), DDR- (data), XDR- (security), ODR- (operations), RDR- (research). Serials are per-prefix within scope. Governs universal metadata, the Nygard five-section format, and placement: docs/decisions/ for code repos, Admin/Governance/Decisions/ for KB repos. A DR's status records document currency, never a decision lifecycle. Use when writing, auditing, or conforming decision records. Triggers: "write a DR", "create a decision record", "document this decision", "audit the DRs". Off-ramps: ki-repo-kb (island structure and frontmatter standard), ki-repo-kb-streams (Enactment Process).

knowledgeislands Bundle

Governs repository-scoped Codex session acquisition and later housekeeping. Use for "acquire Codex sessions", "import Codex sessions", "audit Codex sessions", "clean up Codex sessions", or "delete old Codex threads". It guides discover, list, faithful read, checkpoint, staging, harvest, and safe later cleanup for one exact physical repository; it performs no automatic retention and never substitutes for portable repository maintenance owned by ki-work-housekeeping.

knowledgeislands Bundle

Project an approved portable KI subagent role into Codex standalone TOML and audit its native source mechanics. Use after ki-subagents establishes runtime-neutral identity, selection, instructions, lane, grounding, hand-offs, orchestration, and evidence. This skill does not prove installation, publication, activation, effective settings, or execution; current Harness host support is unavailable and must be routed.