Security

tserentserenov Bundle

Audit repository documentation: detect drift between code and docs, report coverage by category. Run manually or on triggered drift critical.

tserentserenov Skill

Восстановление памяти агента из exocortex-бэкапа при переезде на новое устройство. Находит DS-strategy/exocortex/, показывает что будет восстановлено, спрашивает подтверждение, копирует memory/ + CLAUDE.md + AGENTS.md, финализирует /audit-installation.

tserentserenov Bundle

Check a text fragment for potential secrets (API keys, tokens, passwords) BEFORE sending to chat / committing / publishing. Second protection layer on top of the pre-commit hook — manual gate, user explicitly calls on potentially sensitive text.

jasonkneen Skill

Use when the user asks OpenClicky to inspect, audit, improve, consolidate, or optimize bundled or learned skills.

pngdeity Skill

Audit, update, and modernize software configuration files (dotfiles) with a focus on technical accuracy and system compatibility. Use when reviewing terminal emulator configs, shell rc files, editor settings, or any program configuration.

npow Bundle

Scans a codebase and config for 24 production readiness items and produces a scored report. Use when the user asks to check production readiness, audit for prod, review operational concerns, scan for health checks, verify deployment readiness, or assess if code is ready for production.

npow Skill

Use when auditing dependencies, checking for outdated packages, reviewing security vulnerabilities, scanning for CVEs, or checking dependabot/renovate PR status. Trigger phrases: dependency audit, security audit, outdated dependencies, CVE check.

hebertzhu Skill

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

patinaproject Bundle

Set up a new repository with the Patina Project standard files, or compare and update an existing repository. Use when the user asks to scaffold a repository, audit its conventions, align it with Patina Project, or configure commitlint and Husky.

patinaproject Skill

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".

nesnilnehc Skill

Store, look up, rotate, or delete a personal credential — passwords, API keys, tokens, certificate passphrases — in the macOS Keychain under a <project>-<env>-<kind> naming scheme. Use it even when the user does not say "Keychain". Not for team vaults, CI secret injection, or cross-machine sync.

nesnilnehc Bundle

Review code for security: injection, sensitive data, auth, dependencies, config, and crypto. Atomic skill; output is a findings list.

nesnilnehc Bundle

GitHub Actions YAML with embedded output contract: security-first, minimal permissions, version pinning. For CI, release, PR checks. Differs from generic templates by spec compliance and auditability.

neuron-one Skill

Deep code review like a senior engineer. Checks SOLID violations, security vulnerabilities (XSS, injections, race conditions), performance issues (N+1, missing cache), error handling and edge cases. Don't use for formatting or style-only reviews.

neuron-one Skill

PostgreSQL and MongoDB database design. Schema design, migrations, indexing, query optimization, RLS security policies. Don't use for application logic or API development.

neuron-one Skill

Checks npm/pip dependencies for known vulnerabilities, typosquatting, and malicious packages. Use before adding new dependencies or during security audits. Don't use for runtime monitoring.

neuron-one Skill

DNS configuration and SSL certificates. Domain setup, Cloudflare CDN, Let's Encrypt, HTTPS enforcement. Don't use for application-level security.

neuron-one Bundle

GPT as security advisor and architectural critic. Sends code or decisions to GPT for independent second opinion. Strong in security audits, code review, and finding logical flaws. Don't use for routine coding or simple tasks.

neuron-one Skill

Implements secure authentication patterns. JWT with refresh tokens, OAuth 2.0, RBAC, session management. Use when building auth for any project. Don't use for social login setup.

neuron-one Skill

Security audit for application code. Scans for OWASP Top 10, authentication flaws, data exposure, injection attacks. Don't use for infrastructure or network security.

neuron-one Skill

Finds exposed secrets, API keys, tokens, and credentials in codebase. Checks .env files, git history, hardcoded values. Don't use for runtime security monitoring.

neuron-one Skill

Soft rules for Claude to avoid dangerous git commands (force-push, hard reset, branch -D). Always-active behavioral guardrail. Don't use for hook setup — use git-guardrails-external instead.

neuron-one Bundle

Gemini as design advisor and visual analyst. Sends UI screenshots, designs, or visual content to Gemini for expert review. Strong in UI/UX critique, visual analysis, document understanding. Don't use for backend code or security.

dashed Bundle

Datadog CLI (pup) for observability, monitoring, logs, APM, security, and infrastructure. Use when querying Datadog metrics, searching logs, managing monitors, investigating incidents, checking SLOs, running APM traces, managing dashboards, or performing any Datadog API operation via CLI. Triggers on mentions of pup, Datadog CLI, DD_API_KEY, DD_APP_KEY, or Datadog platform commands.

xyva-yuangui Bundle

Manage API keys securely via system keyring (macOS Keychain / GNOME Keyring) and inject them into OpenClaw config.

ndesv21 Bundle

Secret Scanner

christopherlouet Skill

Modern web auth implementation (better-auth, Lucia, NextAuth/Auth.js, Clerk, Supabase Auth). Trigger when the user wants to add login, signup, sessions, OAuth, magic links, 2FA, or when existing auth code is detected to audit or migrate.

christopherlouet Bundle

UI/UX design audit and verification of web best practices, including responsive/mobile-first breakpoints. Trigger when the user wants to audit the design, verify the UI/UX, check responsive behaviour, or improve the user interface.

christopherlouet Skill

Quick workflow for trivial changes (single-file fix, rename, typo). Skip the full Explore-Plan-TDD-Audit cycle. Trigger when the user wants a quick fix, a simple change, or mentions "quick", "fast", "rapid".

christopherlouet Bundle

Perform a security audit based on OWASP. Use when the user wants to verify security, look for vulnerabilities, or before a production deployment.

alebgl77 Skill

Runs 14 numbered engineering protocols in one pack — brainstorm, spec, plan, scaffold, TDD red-green-refactor, systematic debugging, refactoring, code review, performance, security, docs, git hygiene, release checklist, postmortem. Use when the user says "build this feature properly", "debug this systematically", "review my diff", "run a security pass", "ship the release", "write the postmortem", or names any engineering phase from idea to retrospective.

alebgl77 Skill

Vendor agreement status check — inventories what exists versus what is needed (MSA, DPA, SOW, SLA, insurance certs, security review), builds a gap analysis table, runs an expiration and renewal radar with dates and notice windows, notes surviving obligations, and delivers an onboarding go/no-go checklist. Use when the user says 'are we set up with this vendor', 'what do we have signed with them', 'can we onboard them', or ahead of a renewal or offboarding.

alebgl77 Skill

AppSec Review — Application Security Reviewer

alebgl77 Skill

Gets the books audit-ready: builds the PBC (prepared-by-client) list by area, drafts walkthrough narratives for key cycles (revenue, purchases, payroll), matches auditor samples to support, prepares tie-out schedules, tracks open items with owners and due dates, and drafts responses to findings. Use when the user says 'auditors start next month', 'build our PBC list', 'they sampled 25 invoices — check our support', or 'draft a response to this finding'.

alebgl77 Skill

Generates 20-hook batches for any topic across eight proven patterns — curiosity gap, contrarian, specific number, mistake/warning, transformation, insider secret, question, call-out-the-reader — each tagged with pattern and platform fit, plus a top-3 pick with rationale. Refuses clickbait the content can't cash. Use when the user says "give me hooks for...", "punch up this opening line", "my posts get no traction", or "title options for this video".

bertbertov Skill

Router for all UI/UX/visual design work. Invoke when user types "design conductor", "/design", "design:", or "redesign:". Reads the task, picks the right stages (PLAN → STYLE → BUILD → REFINE → AUDIT), and dispatches the matching sub-skills in order. Don't merge the sub-skills — chain them.