Security

archive228 Skill

Check whether a README actually lets a stranger run the project. Use on any repo's README before publishing.

archive228 Skill

Decide whether to add, keep, or remove a dependency. Use before adding any package.

pramoddutta Bundle

Prepare an auditor-facing QA handoff by mapping a supplied audit request or control list to approved test deliverables and evidence IDs, custodians, access instructions, retention terms, and open gaps. Use for internal audit, customer assurance, regulatory evidence requests, due diligence, or transfer to an audit liaison. Builds the handoff index and chain-of-custody record without interpreting unstated controls, asserting compliance, transmitting artifacts, or signing on behalf of an owner.

pramoddutta Bundle

Review existing test plans, scenarios, cases, execution summaries, defect reports, coverage reports, and closure artifacts for quality before peer review, release, audit, or client handoff. Use when asked to quality-check a QA deliverable, find inconsistencies, verify its evidence and version, or decide whether it is ready for human review. Produces source-located findings without generating replacement tests, approving an artifact, or changing a source system.

pramoddutta Bundle

Inventory and validate existing test evidence such as logs, screenshots, traces, reports, recordings, and defect links into a versioned manifest for release, audit, incident, or client review. Use when asked to assemble an evidence pack, verify artifact provenance and freshness, identify missing proof, calculate file hashes, or prepare safe sharing. Does not generate evidence, assign test results, configure reporters, or claim that an artifact proves more than its source supports.

igmarin Skill

Sequenced PR/diff review workflow with hard gates and optional HITL on Critical fixes: integrity of PR text → load atomic review rules → walk Review Order → severity findings → handoff task list → re-review after Critical changes. Trigger: code review, PR review, review my diff, review before merge, self-review, code audit.

jh941213 Skill

Blameless postmortem workflow. Use after incidents, major tool failures, rollback events, security findings, data issues, monitoring failures, or repeated regression loops to capture impact, timeline, root causes, and corrective actions.

jh941213 Skill

Production incident and major-error response workflow. Use for outages, degraded service, repeated hook/tool failures, security incidents, data loss, rollback decisions, on-call triage, or when MAJOR_ERRORS.md shows blocking failures.

jh941213 Skill

Software supply-chain security workflow. Use when dependencies, lockfiles, packages, build scripts, CI, SBOM, provenance, release artifacts, licenses, vulnerability scans, or third-party tools change.

luongnv89 Bundle

Transform a project into a professional open-source repository by adding LICENSE, README, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, and GitHub issue/PR templates. Don't use for documentation overhauls, landing-page generation, or registry publishing.

luongnv89 Bundle

Review or improve code — one skill, four modes: bug/security review (default), performance, clean-code audit, slop cleanup. Pass mode:review|perf|clean|cleanup or infer. Don't use for writing features or generating tests (use test-coverage).

luongnv89 Bundle

Audit iOS/macOS apps against App Store Review Guidelines before submission, with evidence-backed verdicts and fixes. Don't use for Google Play, general code review, or rejection appeals.

mrzhangguoguo Skill

Run a comprehensive, severity-rated code review for quality, security, and maintainability, with a deterministic merge-readiness verdict

mrzhangguoguo Skill

Deprecated standalone security review skill. Use `code-review` when security concerns are in scope.

yarlson Skill

Audit CI workflow architecture and effectiveness without modifying it. Use when triggers, jobs, commands, quality gates, caches, artifacts, matrices, permissions, release paths, or deployment automation may be stale, redundant, unsafe, or unjustified.

yarlson Skill

Audit or improve general repository documentation against implemented behavior. Use for deliberate README or documentation-quality work not owned by a more specific documentation skill.

lukedj78 Bundle

Use to connect an Expo + RN app to a backend (auth, database, storage, realtime), agnostic of the provider. Teaches the shared patterns: secure-store for tokens, auth state via Zustand + TanStack Query, refresh-on-401 middleware, auth-gate routing via Expo Router (app)/_layout.tsx, row-level security vs API-auth concepts. Provider-specific details live in sub-references: Supabase (default, matches the course), Firebase, custom REST/JSON, tRPC. Triggers on: "setup backend", "setup auth with X", "connect Supabase/Firebase/my API", "secure token storage", "refresh token flow", "row level security". Not for: building the login UI (rn-add-screen — uses Form template), push notifications (rn-push-notifications), payments (rn-publishing-payments).

qa-aman Skill

Rate any product, feature, or experience on the 11-star scale (Brian Chesky's Airbnb thought experiment). Use when user says "rate this experience", "11-star", "star rating", "experience audit", "how good is this", "experience rating", "product audit", "quality assessment", or wants to evaluate product quality and identify improvement paths. Also trigger when user wants to benchmark a feature, assess where a product stands, or map out what "great" looks like - even if they don't explicitly say "11-star".

qa-aman Skill

Audit feature specs against India's Digital Personal Data Protection (DPDP) Act. Use this skill when: - Writing or reviewing any feature that handles user data (especially children's data) - Auditing a spec's Personal Information section for completeness - Checking a feature against DPDP Act 2023 requirements - Preparing compliance documentation before engineering review - Verifying masking, retention, and consent policies are defined for all PII

qa-aman Bundle

Audit your product page against a competitor's page and produce a visual scorecard where every gap comes with an exact, reasoned fix. Use whenever the user wants to compare their page to a competitor, says "teardown this page vs theirs", "why is my page losing to X", "audit my landing page against [competitor]", "compare my product page to the competition", "where is my page worse than theirs", or gets vague page-improvement suggestions from another tool and wants specifics. Also trigger when the user has two page URLs or screenshots and wants to know what to change, what's missing, or where users get stuck - even if they don't say "audit".

timharris707 Bundle

Once-per-repo binding interview for the team-workflow pack: records how the pack composes with this repo and seeds the binding doc the other skills read. Use when installing the pack into a repo, refreshing an existing installation's bindings, or auditing a consuming repo for drift after a pack release (audit mode).

timharris707 Bundle

Rank this catalog's skills by what each would have saved this specific adopter, every top pick citing a real incident from their own history, and for a team judge each skill against the incumbent stack as well. Use when someone is considering the catalog and has not run setup, when the user asks which skills would help them most, when recommending a starting subset to a new adopter, or when auditing the catalog for a team that already runs house skills, guidelines, or recorded review decisions.

mearman Bundle

Scan project dependencies for known vulnerabilities. Automatically detect and parse package files (package.json, requirements.txt, Gemfile, go.mod, pom.xml) and check all dependencies against the CVE database. Use when you want to audit a project for security vulnerabilities, check if dependencies have known CVEs, or generate a vulnerability report for compliance.

mearman Bundle

Search for Common Vulnerabilities and Exposures (CVEs) by ID (e.g., CVE-2024-1086) or by product name (e.g., OpenSSL, Apache Tomcat). Get detailed vulnerability information including severity scores, affected software versions, and references. Use when the user wants to look up CVE information, check if a product has known vulnerabilities, or research security issues.

dartsim Skill

DART Changelog: decide, draft, finalize, or audit DART changelog entries

dartsim Skill

DART Docs Update: update docs or AI instruction visibility without code changes, or audit the docs tree for stale, duplicated, and orphaned content

deanyou Skill

Audit a Claude Code skill file against the official skills specification. Use when the user asks to review, audit, or check a skill for spec compliance, or when a skill file may be too long, have wrong frontmatter, or needs structural improvement.

nomarj Bundle

OWASP Security Skill Framework for Enclave AI

nomarj Skill

Mandatory false positive gate review for security findings. Part of the Nomark Method Layer 2 verification. Use after security scans produce findings, when triaging vulnerability reports, or when someone asks 'is this a real issue', 'false positive check', 'triage these findings'.

nomarj Skill

Identify error-prone APIs, dangerous configurations, and footgun designs in code. Part of the Nomark Method Layer 1 security scanning. Use whenever reviewing code for safety, someone asks 'is this code safe', 'dangerous patterns', 'footgun check', or when analyzing code that uses complex or risky APIs.

nomarj Skill

Detect insecure default configurations, hardcoded credentials, fail-open security patterns, and dangerous defaults in code and config files. Part of the Nomark Method Layer 1 security scanning. Use whenever code is committed, config files change, or someone says 'check for secrets', 'credential scan', 'security defaults check', or 'are there any hardcoded keys'.

nomarj Skill

Audit the supply-chain threat landscape of project dependencies. Part of the Nomark Method Layer 1 security scanning. Use whenever dependency files change (package.json, requirements.txt, go.mod, Cargo.toml), someone adds a new dependency, or someone asks 'are our dependencies safe', 'dependency audit', 'supply chain risk'.

nomarj Skill

Security-focused differential code review analyzing git diffs in context of the broader codebase. Part of the Nomark Method Layer 2 security verification. Use whenever reviewing a PR, preparing to merge, or someone asks for a 'security review of this diff', 'review these changes for security', or 'is this PR safe to merge'.

intertwine Skill

Guidelines for performing thorough code reviews with security and quality focus

quick-brown-foxxx Skill

Hardens code against vulnerabilities with environment-aware guardrails. Use when handling user input, authentication, data storage, external integrations, sessions, third-party services, webhooks, file uploads, payment data, or PII.

revenuecat Skill

Use this skill when your backend needs to read or update RevenueCat state on Android. Covers the RevenueCat REST API (v1 subscribers endpoint, grant/revoke entitlements, attributes), secret vs public SDK API key usage, and why you do not build a receipt verification backend with RevenueCat.