Security

floomhq Skill

Plan, audit, and score startup launch videos using YC-grade production standards. Use when: creating product launch teasers, scoring video quality for social distribution, planning narrative structure for LinkedIn/X autoplay, reviewing cold-audience effectiveness. Triggers: "launch video", "yc video", "score the video", "plan the teaser", "audit launch video", "cold audience test", "video narrative", "teaser structure".

floomhq Skill

Comprehensive codebase or system audit. Use when asked to "audit the codebase", "review everything", "find all issues", "security audit", "performance audit", "code quality review", or "find tech debt". Produces a structured report with findings prioritized by severity.

archieindian Bundle

Reviews a ClawHub skill's source code for security risks before installation. Use before installing any new skill.

archieindian Bundle

Weekly audit of all installed third-party and community skills for malicious patterns, stale credentials, and drift from last-known-good state.

harness Skill

Approve pending Harness STO security exemptions (waivers) at their current scope or elevate them to Project, Org, or Account scope. Users say "approve" for both in-scope approval and higher-scope elevation — do not require the word "promote". Supports approving one exemption or a mixed list where each row has a different approval scope. Default workflow lists pending exemptions in chat (paginated preview) so the user picks by row number — no copying from the Harness UI. Use when a user wants to approve, sign off on, or clear pending exemptions, waive approvals, org-wide approval, or account-wide approval. Trigger phrases: approve exempt, approve exemption, approve waiver, sign off exemption, clear pending exemption, approve for org, approve for account, org-wide approval, account-wide approval, pending exemptions.

azanir Bundle

Generate security tests based on OWASP Top 10 and WSTG covering injection, XSS, CSRF, authentication bypass, and DAST using ZAP and custom scripts.

mattjaikaran Skill

Use when you need Meridian to uat — Cross-Phase Verification Debt Audit.

mattjaikaran Skill

Use when you need Meridian to phase — Security Phase Type.

mattjaikaran Skill

Use when you need Meridian to milestone — Audit Milestone Readiness.

anton-abyzov Bundle

End-to-end corporate and personal tax preparation: data gathering from Xero/bank statements/Gmail/Obsidian/Google Drive, P&L generation, IRS compliance analysis, tax calculation, document staging, and payment guidance. Use this skill when the user mentions tax filing, tax preparation, P&L report, Form 1120, Form 1040, corporate tax, personal tax return, Sorsher, accountant meeting, tax deadline, estimated tax payment, IRS payment, extension filing, 1099, W-2, bank statement analysis for taxes, constructive dividends, home office deduction, or any tax-year financial preparation. Also activate when the user wants to analyze business expenses, calculate tax liability, prepare audit documentation, or generate invoices for foreign contractors. This skill handles both C-Corp (Form 1120) and personal MFJ (Form 1040) returns.

anton-abyzov Bundle

Audits Stripe refunds over a date range to surface anomalies (refund-rate spikes, missing reasons, duplicate refunds). Activates when the user asks to "audit refunds", "check Stripe refund anomalies", or "review refund activity".

greglas75 Bundle

Structured code review with parallel audit agents, confidence-scored triage, and optional auto-fix. Examines uncommitted changes, staged diffs, commit ranges, or specific paths. Produces a tiered report (MUST-FIX / RECOMMENDED / NIT) backed by evidence, then optionally applies fixes with verification.

greglas75 Skill

Hybrid white-box + black-box penetration testing across 7 dimensions (PT1-PT7). Stack-aware source-to-sink tracing, exploit verification, CMS overlay, and deterministic finding aggregation. Uses explicit candidate schemas, canonical-key deduplication, score caps, and MUST-GATE enforcement. Flags: zuvo:pentest [path] | --url <url> | --from-audit <dir> | --cms <type> | --quick | --scope <path> | --dimensions PT1,PT2 | --verify-live | --rate <N> | --source | --runtime

greglas75 Skill

Database performance and safety audit. 70+ checks across 13 dimensions (DB1-DB13): query patterns, indexes, schema design, connections, transactions, migrations, caching, query optimization, ORM anti-patterns, observability, data lifecycle, DB security, and migration deployment safety. Code-level checks for all ORMs. Optional live analysis via PostgreSQL or MySQL connection. Switches: zuvo:db-audit full | [path] | [file] | --schema | --queries | --connections | --live <conn>

greglas75 Bundle

GEO (Generative Engine Optimization) readiness audit. Scans source code for AI citation signals across 12 dimensions: AI crawler access, schema graph connectivity, llms.txt, SSR rendering, freshness, chunkability, canonicalization, sitemap, BLUF structure, heading quality, citation signals, and anti-patterns. Produces tiered report (A/B/C/D) with evidence-backed findings and JSON output for geo-fix consumption.

greglas75 Skill

Batch audit of production files against CQ1-CQ40 quality gates and CAP1-CAP29 anti-patterns. Tiered output (A/B/C/D), critical gate enforcement, evidence-backed scoring, cross-file pattern analysis, and prioritized execution plan. Flags: zuvo:code-audit all | [path] | [file] | --deep | --quick | --services | --controllers

greglas75 Skill

Batch audit of test files against Q1-Q25 quality gates and AP1-AP32 anti-patterns. Detects orphan tests, phantom mocks, untested public methods. Tiered output (A/B/C/D) with critical gate enforcement and optional post-audit fix workflow. Flags: zuvo:test-audit all | [path] | [file] | --deep | --quick | --include-e2e | --details | --commit=ask|auto|off

greglas75 Skill

Context health monitoring. Analyzes include loading trends from context-metrics.log, audits CLAUDE.md/rules/settings for bloat, scores setup health. Modes: trend (default), full (with /context data), baseline (save snapshot).

greglas75 Skill

Codebase structure and organization audit across 13 dimensions (SA1-SA13): directory consistency, naming conventions, folder depth, colocation, barrel exports, separation of concerns, file size distribution, dead code, complexity distribution, duplication, root organization, documentation, hotspots. Tool-driven with CodeSift primary and CLI fallbacks (cloc, knip, dep-cruiser, jscpd, eslint, git mining). Flags: full (default), [path], --naming, --size, --dead-code, --duplication, --hotspots, --quick, --fix.

greglas75 Skill

Dependency health and internal coupling audit for Node.js/TypeScript projects. 11 dimensions: supply chain CVEs, supply-chain integrity (typosquat/dependency-confusion/malicious-package/SBOM), freshness, dead dependencies, license compliance, bundle weight, circular dependencies, coupling metrics, architecture boundary violations, barrel file health, and change coupling. Tiered tooling with graceful degradation. Switches: zuvo:dependency-audit full | [path] | --supply-chain | --coupling | --dead | --bundle | --lock-in

greglas75 Skill

Test suite performance audit and optimization. Measures baseline timing, audits runner configuration against TP1-TP17 checklist, identifies the slowest tests, and produces an impact-ranked action plan. Modes: full audit (default), baseline (measure only), verify (compare to saved baseline), --no-run (config audit only), --path <dir> (monorepo scope).

wedabro Skill

Security Auditor - Audit application security using OWASP guidance, secret scanning, dependency analysis, and threat modeling.

5dive-ai Bundle

Follow the money crumbs through statements, invoices and subscriptions and find the charge that does not belong — the quiet renewal, the price that crept, the vendor billing under two names, the trial that converted, the seat count that never went down. Use this for "check my statements", "what is this charge", "audit our subscriptions", "why did this bill go up", duplicate-vendor hunting, card-statement review, or a suspected fraudulent charge. Also use when a total is right but nobody can say what it is made of.

genfeedai Bundle

Write and audit non-ad conversion copy that matches project brand voice: landing pages, CTAs, value propositions, pricing copy, onboarding text, and microcopy. Triggers on landing page copy, CTA rewrites, copy audits, UX writing, and value propositions.

genfeedai Bundle

Audit competitors' content strategy across platforms, formats, topics, engagement patterns, and content gaps. Triggers on competitor content audits, social/content gap analysis, posting analysis, and competitive content reports.

sananthanarayan Bundle

Run a Sonar scan against the just-changed code on the current branch and produce a structured compliance report — quality-gate verdict (PASS / FAIL), then severity-tagged findings (🟥 blocker / 🟧 critical / 🟨 major / ⚪ minor / ⚪ info) scoped to changed files, each with file:line, the Sonar rule ID, the category (bug / vulnerability / security hotspot / code smell), why it matters, and a concrete fix. Works against both **SonarQube server** (self-hosted) and **SonarCloud** (SaaS) — mode is detected from `sonar-project.properties`. Sister skill to `devils-advocate`, but enforces Sonar's rule catalog and the project's quality gate rather than a hand-rolled lens sweep. Use after writing code, before pushing or opening a PR, when the user says "is this Sonar-compliant?", "run Sonar on this", "will the quality gate pass?", or any pre-merge compliance check.

sananthanarayan Bundle

Gate an existing change for merge — run one skill that fires the whole production-readiness pass. First a deterministic mechanical gate (lint + typecheck + tests, via a script whose exit code decides), then the three-reviewer panel dispatched in parallel — devils-advocate (correctness), security-reviewer (exploitability), code-quality (craft) — then a single READY / NOT READY verdict. Use before opening a PR or merging, when you want the full review fleet run on a diff you already have. Do NOT use to implement a feature from a spec (that's feature-implement-loop) or to review a document (that's doc-critique).

swiftpostlabs Skill

Portable database-security guidance for threats, access control, views, auditing, encryption, integrity, and secure recovery. Use when: protecting database-backed systems, designing authorization models, reviewing confidentiality, integrity, or availability risks, or securing backups, logs, and administrative access.

swiftpostlabs Bundle

Portable Dependabot guidance for dependabot.yml configuration, ecosystem selection, schedules, grouping, ignore or allow rules, private registries, and GitHub Actions updates. Use when: creating or reviewing .github/dependabot.yml, tuning update volume, or deciding how version and security updates should be grouped and scoped.

dyoshikawa Skill

Review a PR for code quality and security issues, then post review comments on it. Runs review-pr followed by post-review-comments sequentially.

kitfunso Bundle

Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site.

marcioaltoe Skill

Use when reviewing whether code has enough operational evidence: structured logs, correlation IDs, metrics, traces, run summaries, error normalization, and safe redaction. Trigger for production readiness reviews, sync/job reviews, incident-prone code, or before delivery of backend workflows. Do not use for visual UI-only review.

bradygaster Skill

How to review PRs for security — credentials, injection, workflow permissions, supply chain, git operation safety

bradygaster Skill

Never read .env files or write secrets to .squad/ committed files

tserentserenov Bundle

ВДВ-скилл — генератор и аудитор описания стадийного процесса по 6 принципам Вход·Действие·Выход. Используй для построения описания нового процесса (/vdv build) или проверки готового описания (/vdv audit).

tserentserenov Skill

ADI-cycle structured reasoning (Abduction-Deduction-Induction-Audit-Decide). Use for complex decisions when multiple hypotheses need to be considered.