Security

bertbertov Skill

Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".

lukk17 Bundle

Bash scripting standards covering strict mode, quoting and defensive patterns, argument parsing, exit codes, temp files, secret handling, and ShellCheck enforcement. Use when you say "write a bash script for this", "why does my script keep going after an error", "parse these flags properly", "this loop breaks on filenames with spaces", or "make ShellCheck pass". Not for PowerShell scripting on Windows, use `powershell`.

lukk17 Skill

Operating a GitHub repository with the gh CLI: issue triage, pull request and stale-item management, CI failure investigation, release preparation, and security alert review, read-only by default with state changes gated on approval. Use when you say "triage these issues", "which PRs are ready to merge", "CI is red, find out why", "prepare the 1.4.0 release", or "check our security alerts". Not for local branching and commits, use `git-workflow`.

lukk17 Bundle

PowerShell 7 scripting standards covering strict error handling, advanced functions and parameter validation, module layout, comment-based help, secret handling, PSScriptAnalyzer, Pester v5, and cross-platform rules. Use when you say "write a PowerShell script for this", "my script ignores when git fails", "turn this into a proper cmdlet", "add Pester tests for this module", or "make PSScriptAnalyzer clean". Not for POSIX shell scripting, use `bash`.

lukk17 Skill

Structured review of local changes or a remote pull request across correctness, maintainability, doc comments, efficiency, security, error handling and test coverage, with every finding led by a path:line reference. Use when you say "review my changes", "review PR

lukk17 Bundle

Human-facing markdown: README structure, an honest voice with no AI tells, Mermaid diagrams, badges, audit passes over stale docs, and translated copies. Use when you say "fix my README", "write a README for this repo", "this reads like AI wrote it", "add an architecture diagram to the docs", or "polish docs/INGESTION.md". Not for architecture decision records, which keep their own template, use `architecture-decision-records`.

lukk17 Bundle

Contract-first SOAP integration in Java, covering WSDL and XSD as the source of truth, JAXB binding files, CXF code generation, XXE prevention, WS-Security, fault taxonomy, PII-safe logging, Resilience4j retries, and MTOM. Use when you say "generate Java classes from this WSDL", "call a partner SOAP service", "add WS-Security UsernameToken", "stub a SOAP endpoint in tests", or "our SOAP client hangs". Not for REST contracts, use `api-design`.

lukk17 Bundle

Keycloak server administration and the Keycloak.AuthServices .NET client, covering realms and clients, authentication flows and MFA, RBAC and UMA authorization, LDAP federation, hardening and clustering, plus JWT Bearer and OIDC wiring, role policies, resource protection, and the Admin and Protection API SDKs. Use when you say "set up SSO with Keycloak", "create a realm and a confidential client", "enable MFA for admins", "connect Keycloak to Active Directory", "why does my token fail audience validation", "add Keycloak auth to my .NET API", "require a realm role on this endpoint", "call the Keycloak Admin API from C#", or "protect this resource with UMA". Not for Spring Security resource-server configuration, use `springboot-patterns`.

lukk17 Skill

PostgreSQL working reference for index selection, data types, row-level security, cursor pagination, queue processing, anti-pattern detection queries, server configuration, replica routing, alert thresholds, backups, and erasure. Use when you say "which index does this query need", "why is this query slow", "write an RLS policy for this table", "should this be numeric or float", or "find our unindexed foreign keys". Not for applying a schema change safely, use `database-migrations`.

ovid Bundle

EXPERIMENTAL. Use when code needs a security review against the OWASP Top 10:2025 — access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and mishandled exceptional conditions. Not for penetration testing a running system, not for infrastructure-only scanning, and not for fixing what it finds.

arcasilesgroup Skill

Proactive governance advisor — checks standards, decisions, and quality trends during development. Always advisory, NEVER blocks. Three modes: `advise` (post-edit), `gate` (pre-dispatch), `drift` (on-demand decision audit). Trigger for 'governance check', 'advise on this change', 'check for drift', 'is this aligned with active decisions', 'shift-left advisory'. Not for blocking gates — use /ai-verify. Not for narrative code review — use /ai-review.

arcasilesgroup Bundle

Audits an IDE end-to-end (instruction surface, hooks, skills, agents, installer wiring) using strict file-evidence — never assumptions. Trigger for 'audit IDE support', 'is Copilot wired up correctly', 'check Claude Code integration', 'are there orphaned hooks', 'verify IDE setup'. Accepts Claude Code, GitHub Copilot, Codex, Antigravity, or all. Not for code quality; use /ai-verify instead. Not for security scanning; use /ai-security instead.

arcasilesgroup Bundle

Validates framework compliance, ownership boundaries, risk acceptance lifecycle, and manifest integrity for regulated environments. Trigger for 'are quality gates enforced', 'who owns this file', 'formally accept a known risk', 'pre-release compliance check', 'governance report for auditors'. Not for code quality; use /ai-verify instead. Not for security scanning; use /ai-security instead — this validates governance process, not code content.

arcasilesgroup Bundle

Improves an existing skill based on real project pain (prior eval corpora under .ai-engineering/evals/, Engram cross-session observations, LESSONS.md, decision-store, instincts, proposals) by analysing the failure pattern, rewriting SKILL.md, and emitting the proposed delta as a PR comment only — no auto-merge. Trigger for 'improve this skill', 'improve /ai-plan', 'make /ai-review better', 'optimize all skills', 'batch improve skills'. Accepts a single skill name or 'all' for batch mode. Not for creating new skills from scratch; use /ai-scaffold instead. Not for platform audit; use /ai-ide-audit instead.

arcasilesgroup Skill

Sweeps stale code complexity on demand via an /ai-simplify wrapper, gates the diff, and opens a draft PR for human review. Trigger for 'run the simplify sweep', 'simplification sweep', 'simplify pass'. Never auto-merges, never runs unattended. Not for in-flight feature work; use /ai-simplify instead. Not for security cleanup; use /ai-security instead.

arcasilesgroup Skill

Files an upstream bug or improvement report against `arcasilesgroup/ai-engineering` (the framework repo) with strict seven-vector redaction, mandatory human confirmation, and an archived sanitized copy. Trigger for 'report this upstream', 'file an ai-engineering bug', 'this looks like a framework bug', 'tell anthropic / arcasiles about this'. Not for your own project's board (use /ai-issue); not for security disclosure (use the private channel listed in CONSTITUTION.md).

steffen025 Bundle

Security reconnaissance. USE WHEN recon, reconnaissance, bug bounty, attack surface. SkillSearch('recon') for docs.

steffen025 Bundle

System maintenance - integrity check, document session, secret scanning. USE WHEN integrity, audit, document session, secrets, security scan.

steffen025 Bundle

Security news aggregation. USE WHEN security news, security updates, breaches.

steffen025 Skill

AI-powered code review via roborev. USE WHEN review code, check code quality, roborev, audit changes, review before commit, review before PR, code quality check, lint review, architecture review.

steffen025 Bundle

Security report aggregation. USE WHEN annual reports, security reports, threat reports.

steffen025 Bundle

Web security assessment. USE WHEN web assessment, pentest, security testing, vulnerability scan. SkillSearch('webassessment') for docs.

24601 Bundle

Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site.

jasperpwang Skill

Verify academic citations, bibliography metadata, DOI/arXiv/OpenAlex/Semantic Scholar consistency, claim-reference alignment, retraction risk, and whether cited sources actually support manuscript claims. Use for Cite Verify, citation audit, reference checking, DOI validation, claim support, broken citations, or 引用核验.

jasperpwang Skill

Draft, revise, or audit research grant proposals, project narratives, specific aims, significance/innovation/approach sections, broader impacts, budgets, milestones, risk plans, and reviewer-facing proposal strategy. Use for Grant Writer, Research Grant Writer, NSF/NIH-style proposals, fellowship applications, or 基金申请.

jasperpwang Skill

Audit statistical consistency in manuscripts, reports, experiments, and result tables. Use for Stats Sanity, p-value checks, t/F/chi-square/r/z consistency, GRIM/GRIMMER/DEBIT-style checks, denominator consistency, effect sizes, confidence intervals, multiple comparisons, or graph/table numeric consistency.

jasperpwang Bundle

Draft, audit, or revise point-by-point reviewer response letters for Nature-family manuscript revisions. Use when the user provides reviewer comments, editor decision letters, revision notes, response drafts, or asks how to respond to major/minor revision requests, rebuttal letters, response to reviewers, peer-review reports, 审稿意见回复, 逐点回复, 修回信, 大修回复, 小修回复, or 如何回复 reviewer. Also trigger on general peer-review response needs during academic writing/revision even without the word "Nature", such as replying to reviewers for any journal, writing a rebuttal/response letter, handling revision comments, and Chinese phrasings like 回复审稿人、审稿回复、返修、 修改稿回复、写rebuttal、回应审稿意见、应对审稿.

jasperpwang Skill

Canonical single-paper deep-dive delivery standard, with Notion as the durable target. Use whenever the user mentions deep dive, 深读, 详细解析, detailed-read, dive into a paper, full paper reading, 原文中译稿, or asks to audit/repair a deep-dive package. Produces one self-contained Notion main page whose primary body is the complete 原文中译稿 and whose 精读部分 contains the Paper Card, editable 论文解析树, source-order close reading, and mechanism synthesis. English-manuscript and standalone close-reading child pages are optional only when explicitly requested.

ocean326 Bundle

评估 AI、深度学习和序列表征学习 idea 或 draft 的新颖性与竞争定位。当 Codex 需要对比 prior work、压力测试贡献主张、提前暴露 reviewer 质疑，或判断一个想法是否值得继续做实验时使用。

sir-chawakorn Bundle

AI-assisted code review for bugs, style, performance, and security issues. Use this skill when reviewing code changes, pull requests, or when asked to check code quality.

sir-chawakorn Bundle

Security best practices including CSP, XSS prevention, input validation, and secrets management. Use when reviewing security or hardening applications.

cleo-labs-ia Skill

Use when gathering all compliance evidence for a certification or audit, preparing documentation for retail buyers or marketplace listings, or bulk-collecting product compliance documents

cleo-labs-ia Skill

Use when dealing with conflict minerals 3TG reporting (EU 2017/821, Dodd-Frank 1502), cobalt or mica due diligence (EMRT), forced-labour screening (UFLPA, EU Forced Labour Regulation 2024/3015), EUDR deforestation due diligence for leather or timber, CITES permits for exotic animal-derived materials, supply-chain due diligence obligations under CSDDD (EU 2024/1760) or German LkSG, or preparing a CMRT or EMRT template for a customer or audit

cleo-labs-ia Skill

Use when running a pre-launch compliance sprint for a product, preparing for market entry across multiple countries, or conducting a full product compliance assessment before launch

cleo-labs-ia Skill

Use when selling connected products, IoT devices, smart home hardware, industrial control systems, or any product with digital elements in EU/UK/US/APAC markets; checking CRA (Cyber Resilience Act) conformity obligations; assessing RED cybersecurity delegated regulation (EU) 2022/30 and EN 18031 harmonised standards; determining SBOM requirements; setting up vulnerability disclosure policies; evaluating NIS2 obligations as a manufacturer; checking UK PSTI Act readiness; verifying IoT security labelling (US Cyber Trust Mark, Singapore CLS, UK IoT label); screening against ETSI EN 303 645 consumer IoT baseline; or mapping IEC 62443 obligations for industrial/OT products

soludevtech Skill

Trivy vulnerability remediation workflow. Use this skill when the user asks to fix Trivy vulnerabilities, run a security scan, or remediate CVE findings for a project. Runs trivy CLI scans, groups findings by severity and type, presents a fix plan, and implements fixes in batches with verification.