Security

shwetank Skill

Use when the user wants to analyze whether non-promotable (glue) work is fairly distributed across their team, with attention to demographic and seniority patterns. Trigger phrases include "is our glue work fair", "who does the non-promotable work on our team", "audit workload distribution", "are women doing more glue work", "workload equity analysis", "non-promotable work allocation". Produces a fairness diagnosis with evidence, bias signals, and concrete redistribution recommendations. Manager-facing skill with sensitivity to privacy and psychological safety.

skydoves Skill

Use this skill to perform an end-to-end review of an existing Jetpack Compose UI test file or test suite. Sequences six audit phases (setup correctness, finder discipline, assertion strength, action correctness, time/idle correctness, debug output) and routes each finding to the precise sibling skill that fixes it. Produces a prioritized issue list — does NOT mutate code. Use when the user asks "review my Compose tests", "audit this test class", "is this test flaky", "why is this test slow on CI", "which Compose tests should I rewrite", or pastes a `*Test.kt` file and asks for feedback.

channel47 Skill

This skill should be used when the user asks about "Performance Max", "PMax", "PMax search terms", "what is PMax doing", "PMax placements", "PMax asset performance", "decode my PMax", "is PMax stealing brand traffic", "PMax channel breakdown", "where is PMax spending", "what channels is PMax using", "asset group performance", "PMax negative keywords", or mentions Performance Max analysis, PMax audit, PMax brand exclusions, or PMax cannibalization.

channel47 Skill

This skill should be used when the user asks to "review profile", "clean up profile", "profile maintenance", "stale watch items", "profile audit", "check my profile", "tidy up the account profile", "my profile is messy", "old watch items", "clean up decision log", "profile hygiene", "outdated targets", or mentions profile cleanup, stale watch items, decision log maintenance, or account profile audit for Meta Ads.

channel47 Skill

This skill should be used when the user asks to "find Meta waste", "audit my Facebook account", "where am I wasting Meta budget", "Meta ads audit", "Facebook spend leaks", "Instagram waste", "social ads optimization", "Meta budget efficiency", "find wasted spend", "am I wasting money on Facebook", "where's my Meta budget going", "which ad sets are bleeding money", "find the waste on Meta", "Facebook ROAS check", "why is my Meta CPA so high", "what's eating my Facebook budget", or mentions Meta Ads waste analysis, Facebook budget efficiency, social ad spend optimization, or Meta spend leaks.

channel47 Skill

This skill should be used when the user asks for an "account scorecard", "account health score", "Meta account grade", "Facebook ads grade", "how healthy is my account", "account audit score", "rate my Meta account", "account assessment", "quarterly review", "grade my Meta account", "monthly checkup", "how good is my Meta account", or mentions account scoring, health dimensions, account grading, optimization readiness, or performance grading for Meta Ads.

channel47 Skill

This skill should be used when the user asks to "analyze my ads", "review RSAs", "check ad copy", "ad strength review", "which ads need work", "headline analysis", "ad copy audit", "RSA performance", "asset performance", "are my ads any good", "ad quality check", "which headlines are working", "improve my ad copy", "ad strength is poor", "pinning problems", "messaging diversity", "how are my RSAs doing", "best performing headlines", or mentions ad copy optimization, responsive search ad analysis, headline/description review, or asset label performance.

channel47 Skill

This skill should be used when the user asks to "audit my Google import", "check import settings", "post-import cleanup", "review Bing import", "what did Google import break", "import audit", "check auto-import", "fix import defaults", "import drift", "are my imports synced", "Google to Bing import", "import health check", "did the import mess anything up", "compare Google vs Bing settings", "MSAN got auto-enabled", "import brought wrong bid strategy", or mentions Google Ads import, auto-import cleanup, import verification, import drift detection, or post-import review for Microsoft Advertising.

channel47 Skill

This skill should be used when the user asks to "clean up placements", "review MSAN placements", "publisher URL report", "exclude bad placements", "Bing placement audit", "MSAN cleanup", "website exclusions", "Audience Network placement review", "where are my MSAN ads showing", "junk placements", "low quality publisher sites", "block bad websites on Bing", "MSAN spending on garbage sites", "placement quality check", "exclude low quality sites", or mentions Microsoft Audience Network placement quality, publisher URL analysis, website exclusion recommendations, or MSAN placement cleanup.

frankxai Bundle

Security Auditor Skill

phuc-nt Bundle

Git operations with conventional commits. Use for staging, committing, pushing, PRs, merges. Auto-splits commits by type/scope. Security scans for secrets.

phuc-nt Skill

Research technical solutions, analyze architectures, gather requirements thoroughly. Use for technology evaluation, best practices research, solution design, scalability/security/maintainability analysis.

phuc-nt Skill

5 expert personas debate proposed changes before implementation. Catches architectural, security, performance, and UX issues early. Use before major features or risky changes.

phuc-nt Bundle

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using ck:autoresearch pattern.

phuc-nt Bundle

Scan codebase for security vulnerabilities, hardcoded secrets, dependency issues, and OWASP patterns. Use when asked to 'security scan', 'check for secrets', 'audit security', or before major releases.

yigitkonur Bundle

Use if building or auditing UI against the 30 Laws of UX (Fitts, Hick, Gestalt, cognitive load).

yigitkonur Bundle

Use if verifying claimed-done work or auditing session/plan/branch completion with evidence.

yigitkonur Bundle

Use if auditing a running web app UI across pages/viewports, saving per-bug findings to a tree.

yigitkonur Bundle

Use if auditing a running app's usability via persona journeys, saving per-issue findings to a tree.

yigitkonur Bundle

Use if hardening a SKILL.md by running a fresh subagent on a real task and fixing where it snags.

poorvith-mp Skill

Moved to productivity-audit in skills-personal. Removed in v4.1.

thejefflarson Skill

Maps security-sensitive code locations in a codebase to focus review effort. Use when the user asks to identify security-sensitive areas in a codebase, map the attack surface, or find where a security review should focus. Also invoke when asked to triage or prioritize security effort across a repository.

thejefflarson Skill

Detects IPC receivers that accept input without verifying caller identity. Use when writing URL scheme handlers, Android intent receivers or exported activities, named pipe or socket listeners, XPC service handlers, or any IPC endpoint that processes caller-supplied input without validating the caller's identity or origin.

thejefflarson Skill

Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor confusion, predicate misnaming.

thejefflarson Skill

Detects missing security controls — rate limits, MFA, re-auth — that should have been designed in from the start. Use when designing authentication flows, implementing rate limiting, building business logic for financial or access-sensitive operations, or writing code that enforces security requirements at the application layer.

thejefflarson Skill

Runs a full OWASP/CWE security audit via isolated subagents. Use when the user types /security-review or explicitly requests a full security audit of the current code.

thejefflarson Skill

Detects GraphQL schemas without depth limits, cost analysis, or introspection controls. Use when writing GraphQL schemas, resolvers, or server configuration. Also invoke when setting up Apollo Server, graphql-yoga, Strawberry, gqlgen, or any GraphQL framework without explicit depth limiting, cost analysis, or introspection controls.

thejefflarson Skill

Detects missing security event logs, logged secrets, and log injection through user input. Use when writing logging code, audit trails, error handlers that log, authentication event recording, or any code that writes security- relevant events. Also invoke when logging user inputs, API responses, or system actions that touch sensitive data.

thejefflarson Skill

Applies fixes for security findings produced by /security-review. Use when the user wants to fix security issues found by /security-review or when they ask to clean up, remediate, or apply fixes for security findings.

thejefflarson Skill

Detects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD nonce reuse, ECDSA k-value reuse, length-extension on bare hashes, padding-oracle exception distinguishability, and branching on secret material. Use when writing code that calls a crypto primitive directly (AEAD encrypt/decrypt, ECDSA/DSA sign, raw hash, RSA decrypt). Distinct from cryptographic-failures, which covers application-layer choices like MD5 for passwords; this skill is about how primitives are wired up.

thejefflarson Skill

Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive data. Use when writing code that encrypts or decrypts data, hashes passwords or tokens, generates random values for security purposes, manages cryptographic keys, or configures TLS/SSL settings. Also invoke when storing sensitive data at rest.

thejefflarson Skill

Detects insecure defaults, overly permissive CORS, exposed debug endpoints, and missing security headers. Use when writing server configuration, setting environment variables, configuring CORS policies, enabling debug modes, setting up default credentials, or deploying application infrastructure. Also invoke when writing security headers middleware.

zio Skill

Audit a documentation file against a rule skill. Checks each rule, fixes violations with separate commits, then compiles with mdoc. Reusable across any rule skill and doc file.

zio Bundle

Scans merged GitHub PRs (from latest commit back to an upstream base ref) and produces a documentation-coverage audit report. Processes 20 PRs per batch and asks before continuing to the next batch. Skips PRs already checked in previous runs using a persistent state file. For each new PR, determines whether documentation is required based on labels, changed files, and content signals, then checks whether docs exist and grades coverage using four rubric levels: Well Documented, Partially Documented, Stub, or Not Documented. Outputs a focused report showing only PRs that require docs, sorted by coverage gap severity. Use this skill whenever the user wants to know which merged PRs are missing documentation, wants a documentation debt audit, or asks "what needs to be documented?", "which PRs have no docs?", or similar coverage questions. Invoke it even if the user just says "doc audit" or "show me undocumented changes."

zebbern Skill

This skill should be used when the user asks to "test for LDAP injection vulnerabilities", "exploit LDAP queries", "perform blind LDAP injection attacks", "bypass authentication using LDAP injection", "extract data from LDAP directories", or "assess LDAP-based application security". It provides comprehensive techniques for identifying and exploiting LDAP injection flaws in web applications.

zebbern Skill

This skill should be used when the user asks to "run Linux commands", "manage users and permissions", "configure file systems", "work with LVM", "set up networking", "manage services with systemd", "configure firewalls", "implement SELinux or AppArmor", or "automate tasks with cron". It provides comprehensive Linux command reference for security professionals.