Security

knowledgeislands Bundle

Governs accumulated Claude state from Desktop, Cowork, Claude Code (`~/.claude/`), and VSCode chat: sessions, artifacts, backups, plugins, project cache, and selected native auto-memory. It guides repository-scoped Claude Code session acquisition and later housekeeping: discover, list, faithful read, checkpoint, staging, harvest, and safe cleanup. Triggers: "acquire Claude Code sessions", "import Claude sessions", "audit Claude memory", "Claude memory hygiene", "clean up Claude storage", "obsolete Cowork sessions", "Claude housekeeping audit", "check ~/.claude". It is not a Knowledge Islands base memory cascade (`ki-repo-kb`) or context cost (`ki-tokenomics`).

knowledgeislands Bundle

Audit and write the Claude Code Markdown/YAML projection of a portable KI subagent. Use after `ki-subagents` establishes the runtime-neutral role, selection, instructions, lane, grounding, hand-offs, and orchestration intent. Carries source-shape checks for YAML, required Claude fields, and Claude-specific configuration. It does not prove installed, selected, activated, or executed Claude agents. For Codex TOML use `ki-subagents-codex`; for portable semantics use `ki-subagents`.

knowledgeislands Bundle

Codify, audit, and scaffold the Knowledge Islands Homebrew tap — the `homebrew-<x>` distribution repo that holds `Formula/*.rb` for Knowledge Islands command-line tools. This skill WRAPS Homebrew's external standard (the Formula Cookbook + `brew audit`/`brew style`) rather than inventing a house one: it checks the tap's shape (a `Formula/` dir, one formula per tool, the README formulae table, a versioned-tarball source) and reports the explicit `brew` checks required for formula correctness. Use when auditing the tap, adding a formula, scaffolding a new tap, or refreshing against Homebrew's rules. Triggers: "audit the homebrew tap", "add a formula", "does the tap follow Homebrew's standard", "scaffold a homebrew tap", "is this formula valid", "refresh the homebrew-tap standard". Governs the tap **container** — the repo shape and the formula shape — not the tools themselves (for a `tools-*` CLI repo use `ki-repo-tools`) nor the repo's GitHub settings and standard files (for those use `ki-repo`).

knowledgeislands Bundle

Governs recurring repository housekeeping templates: their placement, identity, cadence, last-run evidence, and safe due-run spawning through ki-next. Use for "add recurring maintenance", "define housekeeping", "audit housekeeping", or "create a monthly repository check". In a non-KB repository templates live in docs/housekeeping; in a Knowledge Base they live in Streams/Housekeeping. It does not perform runtime-specific state cleanup, which is ki-housekeeping-claude.

tbc-servicos Bundle

Perform comprehensive AdvPL/TLPP code review covering SonarQube rules, Protheus.doc documentation, security, performance, clean code, and TOTVS Protheus framework best practices. Use when a user says "review this code", "code review", "check this source", "audit this AdvPL/TLPP", or needs a structured quality assessment of .prw/.tlpp/.prx files.

aks-builds Bundle

When the user wants to audit, refactor, or rescue a Cucumber / Gherkin / SpecFlow / Reqnroll / behave BDD suite from common failure modes. Use when the user mentions "BDD anti-patterns," "Gherkin anti-patterns," "scenario refactoring," "imperative steps," "feature file review," "BDD smells," "BDD failing," "Cucumber feedback loop," "scenarios as scripts," or "is BDD worth it." For Cucumber/Gherkin basics see cucumber-gherkin. For .NET BDD see specflow-reqnroll. For Python BDD see behave.

aks-builds Bundle

When the user wants to design or audit how test data is generated, managed, masked, and reset between tests. Use when the user mentions "test data," "test data management," "TDM," "fixtures," "factories," "FactoryBot," "factory_bot," "Bogus," "faker," "synthetic data," "data masking," "PII scrubbing," "production snapshot," "test database seeding," "anonymization," or "transactional rollback in tests." For environments see test-environment-management. For pact tests see pact-contract-testing. For flaky tests caused by data leakage see flaky-test-management.

aks-builds Bundle

When the user wants to design or audit where tests run — local dev, CI runners, ephemeral preview environments, shared staging, prod-shadow, or production canaries. Use when the user mentions "test environment," "test envs," "preview environments," "ephemeral environments," "staging," "PR environments," "review apps," "dev environment," "Vercel previews," "Render preview," "Heroku review apps," or "where should tests run." For local in-process containers see testcontainers. For data scope see test-data-management. For overall strategy see test-strategy.

anton-abyzov Skill

Hand off your in-flight work to ANY other AI coding tool so you can continue exactly where you left off — works in 8+ tools (Claude Code, Codex, OpenCode, Gemini, Antigravity, Cursor, Aider, Cline/Roo, Windsurf). Writes one portable, secret-scrubbed handoff document plus a full diff of your uncommitted edits, then prints the absolute path, a clickable link, and a copy-paste resume prompt. Use this skill whenever the user is running out of subscription tokens, wants to switch tools mid-task, says 'handoff', 'continue elsewhere', 'continue on another machine', 'switch to Codex/OpenCode/Gemini/Cursor', or 'I'm out of tokens'. Self-contained: needs only git and a shell; uses 'specweave handoff' as an optional accelerator if it is on PATH.

matejformanek Skill

PostgreSQL's Row-Level Security (RLS) — `CREATE POLICY` / `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` / policy application in the rewriter — plus the related security-barrier machinery + leakproof qualification checks. Loads when the user asks about RLS policy semantics (USING vs WITH CHECK, PERMISSIVE vs RESTRICTIVE), how policies are applied to a query at rewrite time, why a qual can/cannot be pushed below a security barrier, the leakproof function attribute, ROLE mapping for BYPASSRLS / NOFORCERLS, `row_security` GUC, or debugging why an RLS policy is/isn't firing. Also covers security-barrier views (`WITH (security_barrier = true)`), which use the same qual-pushdown-prohibition machinery. Skip when the ask is about pg_hba.conf-level authentication, GRANT/REVOKE table-level privileges, SELinux (`sepgsql`), or database-level security features unrelated to per-row visibility.

kennyolofsson23-netizen Skill

Generate a professional, client-facing GEO report combining all audit results into a single deliverable with scores, findings, and prioritized actions

kennyolofsson23-netizen Bundle

Comprehensive security audit: detects insecure defaults, hardcoded secrets, sharp edges, supply chain risks, and OWASP vulnerabilities. Based on Trail of Bits methodology. Use when auditing security, reviewing config, or pre-deployment checks. For PR diffs, use /security-review instead.

kennyolofsson23-netizen Bundle

Security-focused differential code review for PRs, commits, and diffs. Calculates blast radius, checks test coverage, models attacks, and generates markdown reports. Based on Trail of Bits methodology. Use for PR reviews, commit audits, and pre-deployment diff checks. For full codebase audits, use /security-audit instead.

kennyolofsson23-netizen Skill

Comprehensive UX audit using IxDF's 7 factors, 5 usability characteristics, and 5 interaction dimensions. Holistic evaluation with redesign proposals based on user-centered design principles.

kennyolofsson23-netizen Skill

Evaluate UX/UI using Jakob Nielsen's 10 usability heuristics. Comprehensive audit of visibility, control, consistency, error prevention, recognition, flexibility, aesthetics, error recovery, and documentation.

opengitcode Skill

Host security hardening and risk-tolerance configuration for OpenShell deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenShell cron scheduling for periodic checks, or version status checks on a machine running OpenShell (laptop, workstation, Pi, VPS).

korchasa Bundle

Use when the user provides a source (URL, file path, or free text) to save into the project's memex — a long-term knowledge bank for AI agents. Stores the raw source, extracts entities into cross-linked pages, runs a backlink audit, and updates the index and activity log. Do NOT trigger on casual reads; only when the intent is to persist a source into the memex.

korchasa Bundle

Use when the user asks for a project health audit, maintenance sweep, or multi-category lead-engineer scan followed by interactive issue-by-issue resolution with user approval. Do NOT trigger on routine lint/test runs, single-file cleanups, or standard "check project" requests.

korchasa Bundle

Estimate total token usage and cost across conversation history, system prompts, and active rules. Use when the user asks how much context or how many tokens are in use, to audit context size, or to estimate session cost.

korchasa Bundle

Build AI-IDE plugin hook elements - shared policies plus Claude Code/Codex/OpenCode/Cursor adapters for lifecycle events, blocking, audit, and context injection. Use when adding or configuring plugin hooks.

aibangjuxin Skill

You are a detail-oriented and methodical API Tester. You are an expert at testing the functionality, reliability, performance, and security of APIs. You are proficient with tools like Postman, Insomnia, and automated testing frameworks like `pytest` or `jest` to write and execute API tests.

aibangjuxin Bundle

Use when reviewing or auditing a Bash / sh / zsh script (single file, PR diff, or whole scripts/ directory). Runs the 4-layer × 8-class methodology: syntax (bash -n), static (shellcheck + shfmt + custom regex sweeps), semantic (logic / secret / portability review), and runtime (dry-run / trace / bats). Outputs a structured findings report with severity-tagged blockers / logic_errors / suggestions.

matthewharwood Skill

Use when asked to propagate a dean-stack monorepo change through the five-phase pass: P1 apps/web, P2 generator template, P3 regenerated test-project plus gate, P4 docs/owning skill, and P5 cross-skill audit. Also use when the user asks for the old /five-phase-pass command or passes `--baseline` to run only the cumulative skill audit.

tamnguyendinh Bundle

Chuyển spec sản phẩm, tính năng, UI, backend, auth, sync, lifecycle, external contract, hoặc spec đa nhánh thành SVG flow map ngữ nghĩa có metadata máy đọc được, source coverage, render từng flow, gap detection, verification report, và trạng thái BLOCKED hoặc READY_FOR_OWNER_REVIEW. Dùng khi cần biến spec thành flow map, audit độ đầy đủ của spec trước khi code, so sánh với diagram tham chiếu, phơi bày hành vi chưa định nghĩa, hoặc xác định quyết định Owner trước implementation.

raphaelmansuy Bundle

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.

raphaelmansuy Bundle

Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.

lofcz Skill

Autonomously close the current Plate work tree through source sync, proof, review, checks, GitHub delivery, and final audit without expanding product scope.

lofcz Skill

Autogoal-backed planning, status, review, dashboard, apply, and tracking for upstream shadcn docs syncs into Plate docs. Use when the user asks for `sync-shadcn`, `sync-shadcn status`, `sync-shadcn review`, `sync-shadcn dashboard`, `sync-shadcn apply`, a scoped `sync-shadcn <feature>` lane, to sync shadcn docs, audit newer shadcn docs changes, compare `../shadcn/apps/v4` with `apps/www`, update the shadcn sync baseline, or decide what to adopt, fork, defer, or exclude from upstream shadcn.

cody-hutson Bundle

Measures skill trigger-compliance — whether the RIGHT skill actually fires for the requests it should serve — across the pmo-platform skill catalog, closing the coverage gap upstream of output-quality and structural audits. It runs template-seeded scenarios at three strictness levels (explicit / neutral / competing), classifies each tool-call trace deterministic-first, and reports a per-strictness compliance rate. Single Measure mode, plus a read-only re-render variant. A mandatory cost governor makes every run operator-gated, scenario-capped, and --dry-run-first. Distinct from eval-writer (which authors eval suites), pmo-qa-auditor (which grades output quality), and gate-evaluation-spec (which measures gate-decision judgment). Triggers: "measure skill trigger-rate", "audit skill compliance", "does the right skill fire", "is this skill's description drifting", "run the trigger-compliance pass", "check skill firing rate", "skill compliance report".

cody-hutson Bundle

Knowledge Manager Specialist — captures, structures, routes, and stewards project knowledge assets (lessons learned, runbooks, decision records, reference docs) so they land in their governed home, not as two disconnected generate-then-route steps. Composes artifact-generator (produces/stages the asset) + file-router (classifies + routes it to its governed home) — invokes them via the core/ registry skill-chain, never re-implements them (ADR-019). Modes: Capture · Structure/Steward · Route/File · Knowledge-Gap Audit. Use when you want the platform to act as the Knowledge Manager. Triggers: "act as knowledge manager", "capture this as a knowledge asset", "steward the knowledge base", "file this lesson learned", "build the runbook and file it", "where does this knowledge go", "what knowledge are we missing".

the-perfect-developer Bundle

This skill should be used when the user asks to "build a Capacitor app", "add Capacitor to a web project", "use Capacitor plugins", "configure Capacitor for iOS or Android", or needs guidance on Capacitor best practices, security, storage, deep links, or the development workflow.

the-perfect-developer Bundle

This skill should be used when the user asks to "scan Python code for security issues", "set up Bandit", "configure bandit security linting", "fix bandit warnings", or needs guidance on Python static security analysis with Bandit.

the-perfect-developer Bundle

This skill should be used when the user asks to "audit Python dependencies for vulnerabilities", "scan requirements.txt for CVEs", "set up pip-audit", "fix vulnerable Python packages", or needs guidance on Python dependency security scanning with pip-audit.

floomhq Skill

Geographic data validator for aviation and travel applications. Use when user says "geo audit", "check airports", "validate routes", "geo skill", "check geographic data", "verify iata codes", "check distances", or when reviewing any code/data that involves airport codes (IATA/ICAO), city-to-airport mappings, country codes (ISO 3166), flight distances, flight time estimates, flag URLs, or route feasibility. Also use for timezone validation, coordinate checks, and geopolitical accuracy (country names, disputed territories, naming conventions).

floomhq Skill

10-second audit of dev server system state. Use when: "health check", "system status", "check system", "what's running", "orphans", "disk space", "check containers", or any question about the current state of the server.

floomhq Skill

Independent UX Audit