Security

soludevtech Bundle

Analyze a database schema by running SchemaCrawler lint and extracting the full schema via information_schema. Use this skill whenever the user wants to audit a database schema, check normalization, detect missing indexes, redundant indexes, nullable FK columns, inconsistent data types, design smells, or get improvement recommendations.

soludevtech Bundle

Use to review the code, Invoke when you finished the task asked by the user. Grades the code on a scale from 1 to 10 across 6 dimensions (correctness, security, performance, maintainability, testability, architecture) with a per-dimension breakdown and an overall score that gates merging.

soludevtech Bundle

Scrub AI tells from any text draft OR audit a finished post against the 2026 algorithm heuristic checklist. Tier-based rewriter (forensic / strict / aesthetic / all) plus `--mode audit` for detection-only pass-fail review covering length, hook, CTA, format penalties, AI vocab. Sub-tools: emoji-pattern detector, multi-detector spread tester (GPTZero, Originality.ai, ZeroGPT, Sapling, Copyleaks), rule explainer. Triggers on "humanize", "de-AI", "review this draft", "audit before posting", "is this ready".

soludevtech Bundle

Draft a new LinkedIn post from scratch using a 2026 hook formula (anaphora, R.I.P., year-pivot, time-anchor, self-proving, paid-vs-free, curiosity-gap, odd-money, contrarian). Runs the humanizer pass and schedules via Publora on approval. Use when the user asks to write a post, needs a hook, or wants a proven format. Not for reviewing existing drafts (use linkedin-humanizer --mode audit).

soludevtech Bundle

Test AI systems against the NIST AI Risk Management Framework (AI RMF) with promptfoo. Use when measuring AI risks across the four core functions (Govern, Map, Measure, Manage), testing specific MEASURE categories (safety, security, privacy, fairness, misuse), or demonstrating NIST AI RMF compliance for federal AI guidelines.

soludevtech Bundle

Test AI systems against the DoD AI Ethical Principles (Responsible, Equitable, Traceable, Reliable, Governable) with promptfoo. Use when measuring ethical and security risk for DoD-aligned AI systems, testing human accountability, bias minimization, auditability, safety, and governability.

outcomeengineering Skill

ALWAYS invoke this skill when auditing, reviewing, or evaluating SKILL.md files. NEVER audit skills without this skill.

outcomeengineering Skill

ALWAYS invoke this skill when auditing, reviewing, or evaluating slash command .md files. NEVER audit slash commands without this skill.

outcomeengineering Skill

ALWAYS invoke this skill when auditing, reviewing, or evaluating subagent configuration files. NEVER audit subagents without this skill.

outcomeengineering Bundle

ALWAYS invoke this skill when auditing PDRs or after writing a PDR. NEVER audit PDRs without this skill.

liujiayi3703 Skill

Use when asked to find the ideal path, map a codebase into feature-grouped flowcharts, identify duplicated concerns across features, unify duplicated systems, or audit architecture before a refactor.

bertbertov Skill

Audits all installed Claude Code skills for quality, redundancy, and dead weight. Use when the user asks to audit skills, find dead skills, evaluate skill coverage, compare skills, or identify the weakest skill in their library. Runs against ~/.claude/skills/ and surfaces which skills are stale, overlapping, or under-performing.

bertbertov Skill

Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, and Agentic AI security (2026).

hoatv2211 Bundle

Use when creating or revising a GameStudio-CodexKIT skill, resolving ambiguous skill triggers, auditing provenance or lifecycle maturity, or deriving reusable capabilities from session history.

hoatv2211 Bundle

Use when auditing Unity asset GUID and meta consistency, duplicate GUIDs, missing meta files, stale references, or import and prefab reference failures without editing assets.

hoatv2211 Bundle

Use when auditing localization source authority, generated copies, translation keys, missing or extra entries, mismatched text, encoding, mojibake, or client and server localization drift.

hoatv2211 Bundle

Use when character animation needs an audit across skeleton, rig, skin weights, avatar, retargeting, clips, events, root motion, compression, import settings, runtime blending, and platform budgets; not for general art preflight.

hoatv2211 Bundle

Use when normalized Lua client/server RPC contract copies or generated protocol tables disagree on opcode, request-response fields, types, ordering, or source authority.

hoatv2211 Bundle

Use when sensitive multiplayer or MMORPG client actions require static server-authority validation, trust-boundary, replay, abuse, or rate-limit analysis with no attack traffic.

mayarid Skill

Validate and sanitize all API inputs. Zod schemas, error responses, security considerations.

mayarid Skill

Implement rate limiting on APIs. Per-IP, per-user, sliding window patterns. Express and framework-agnostic.

mayarid Skill

Infrastructure-first security audit (OWASP, secrets, dependencies).

mpsuesser Skill

Build typed HTTP APIs with Effect's HttpApi — endpoints with schemas, handlers, security middleware, OpenAPI docs, derived clients, and handler unit tests. Use when building HTTP servers, REST APIs, or typed HTTP clients with Effect v4.

ootto-ai Skill

Reviews your last 30 posts to find what is worth doubling down on, what is dead weight, and the gaps to fill. Use when the user says "audit my content", "what is working on my account", "what should I stop posting", "review my last 30 posts".

echovic Skill

覆盖 Blade Code 跨测试、构建、资格验证、发布与双语文档的工程质量闭环。 Navigate when: 调整测试分层、CI 门禁、真实 API 准出、构建产物、npm 发布或文档同步。 Excludes: 具体运行时业务语义（转到对应功能域）；各门禁实现细节继续进入本节点的四个子节点。 Keywords: quality gate, qualification, Vitest, real API, performance, security, snapshot, build, release, npm, GitHub Actions, Docsify, changelog.

echovic Skill

覆盖 Bun/Vite/VS Code 构建、npm 包边界、版本与 tag 发布、GitHub Actions、vendor 资产、 双语用户文档和 changelog 生成链。 Navigate when: 修改构建输出、依赖分类、包内容、版本号、发布脚本/workflow、Docsify 导航、双语文档或发布后验证。 Excludes: 测试矩阵语义（见 ../real-api-qualification-and-e2e/）； 性能、安全和快照阈值（见 ../performance-security-and-snapshot-gates/）。 Keywords: Bun.build, Vite, dist, package files, release.js, publish.yml, npm OIDC, Trusted Publishing, tag, CHANGELOG.md, CHANGELOG.zh.md, Docsify, ripgrep, Playwright.

echovic Skill

覆盖性能预算、安全回归、依赖审计、输出快照与 coverage 的交叉门禁及其证据强度。 Navigate when: 调整启动或 bundle 预算、资源上限、安全边界、coverage 阈值、依赖审计， 或更新快照。 Excludes: 普通测试 harness（见 ../unit-integration-and-shared-test-harnesses/）； 真实 Provider 矩阵（见 ../real-api-qualification-and-e2e/）；构建和发布编排（见 ../build-release-and-documentation/）。 Keywords: performance, benchmark, startup, bundle size, security, audit, snapshot, coverage, BLADE_RUN_REAL_REPO_BENCHMARK, Chromium sandbox, V8.

echovic Skill

覆盖 CLI 与 Web 的 Vitest 分层、全局 mock、共享 fixture、临时存储和测试子进程所有权。 Navigate when: 新增或移动 unit/integration/CLI/E2E/Web 测试，调试并发差异、mock 污染、 超时、残留进程或临时目录清理。 Excludes: 付费 Provider 与发布矩阵（见 ../real-api-qualification-and-e2e/）； 性能、安全和快照专用门禁（见 ../performance-security-and-snapshot-gates/）。 Keywords: Vitest, setup.ts, test.js, test-config, test-runner, vi.mock, BLADE_STORAGE_ROOT, TMPDIR, process ownership, unit, integration, CLI, Web, E2E.

full-stack-skills Bundle

Guidance for Tauri v2 capabilities, scope configuration, and ACL-based permission control.

muratmirgun Bundle

Invoke this skill to systematically review a Go change against community style standards before merging. Walks the diff topic by topic — formatting, errors, naming, concurrency, interfaces, data structures, security, declarations, functions, style, logging, imports, generics, testing — flagging issues with line references and severity (must-fix / should-fix / nit). Apply proactively before any Go PR ships.

mgiovani Bundle

Scans a codebase for environment variable usage to generate or sync .env.example, validate .env completeness against what the code actually reads, and detect leaked secrets in .env or git history. Use for "/env-setup", "update .env.example", "sync .env.example with the codebase", "check if .env has everything it needs", "is .env in .gitignore", or "scan for leaked secrets in .env". Not a full security audit (use review-security for OWASP-level scanning) and not a generic secret-rotation or CI-secrets-injection tool.

mgiovani Bundle

Read-only audit of documentation against the current codebase, flags stale docs, missing sections, broken links, and hallucinated claims (wrong file references, wrong counts, diagram entities that don't exist in code). Use for "check the docs", "audit documentation", "are the docs stale", "find hallucinations in docs", "docs health check", "does this doc still match the code", or before onboarding/release. Reports only, never edits files, for actually fixing or regenerating docs use docs-update instead.

mgiovani Bundle

Audit project dependencies for vulnerabilities, license compliance risks, and staleness by running native audit tools (npm audit, pip-audit, cargo audit, etc.), querying Dependabot alerts, and dispatching parallel agents for CVE analysis, license risk, and upgrade complexity. Use when the user wants to check for vulnerable packages, audit licenses, plan dependency upgrades, assess supply chain risk, or asks "are our dependencies safe/up to date/license-compliant". Analysis only, no code or lock-file changes. Not for app-code vulnerability scanning (use review-security) or auto-applying upgrades (this skill only recommends, never runs installs).

mgiovani Bundle

Generate a Mermaid diagram (ER, architecture, deployment, or security) by reading the actual codebase and writing it to docs/. Use for requests like "draw an ER diagram of these tables", "show me the architecture", "diagram the deployment setup", "visualize the security data flow", or "generate a system diagram". Not for scaffolding a new docs directory structure (use docs-init), syncing existing prose docs with code changes (use docs-update), or recording a design decision's rationale (use docs-adr), this skill only produces diagrams generated from code.

shwetank Skill

Use when the user wants to systematically identify, categorize, and quantify "glue work" (non-core technical activities like onboarding, documentation, unblocking, cross-team alignment, process improvement) on themselves or their team. Trigger phrases include "what glue work am I doing", "audit my glue work", "what non-promotable work is our team doing", "catalog our glue tasks", "how much time do we spend on glue", "map our glue work". Produces a structured inventory with time estimates, promotion-value assessment, and fairness analysis. Especially useful before promotion cycles, workload rebalancing, or role-transition decisions.

shwetank Skill

Use when a PM or team wants to stress-test whether their work is actually connected to something the business cares about. Runs before strategy-doc or prioritization-frameworks — it answers "are we even pointed at the right thing?" Trigger phrases include "are we doing the right work?", "I'm worried my team isn't driving real impact", "help me check if my team is aligned", "I'm worried about layoffs", or any moment of doubt about whether the team's work would survive scrutiny.