Security

mrbinnacle Bundle

Use when dispatching parallel agents to verify/adjudicate findings — adversarial verify, security disposition, design triage, council fires. Shared disposition schema so seat outputs join cleanly.

benjaminshoemaker Skill

Audit project alignment with VISION.md, identify SDLC gaps, and generate feature proposals. Use when reviewing strategic direction or planning new features.

benjaminshoemaker Bundle

Multi-source audit of a shipped feature against its original plans, product vision, UI/UX best practices, and live browser inspection. Produces consolidated findings with prioritized recommendations.

benjaminshoemaker Skill

Run dependency audits, secrets detection, and static analysis to find CVEs, leaked credentials, and insecure code patterns. Use at phase checkpoints or before releases.

benjaminshoemaker Skill

Validate EXECUTION_PLAN.md for verification metadata, manual reasons, and testability. Use when preparing Phase 1 or after editing EXECUTION_PLAN.md.

benjaminshoemaker Bundle

Detect split data source anti-patterns and scattered business rule duplication where the same logic is reimplemented across multiple files and languages. Catches semantic duplication that syntactic tools like jscpd miss. Use at phase checkpoints or when investigating data consistency issues.

jellydn Bundle

Use when reviewing code for security vulnerabilities, hardening an application, or deriving security requirements from OWASP/ASVS guidance.

jellydn Skill

Guides disciplined AI-assisted engineering that avoids cognitive surrender and keeps humans accountable. Use for non-trivial implementation, architecture, security, or operational tasks.

jellydn Skill

Review code for quality, security, and best practices — read-only analysis

davidortinau Skill

Activity Mode Audit Checklist

ravnhq Bundle

Generate, evaluate, audit, and normalize QA test cases to RAVN standards. Trigger on "generate/write/create test cases", "evaluate/score my test cases", "audit my test suite", "review test coverage", "normalize/reformat test cases", or when a user wants test design help. Also triggered by /testcases.

ravnhq Bundle

Adversarial QA tester that systematically tries to break an application's API. Tests security boundaries, input validation, race conditions, deduplication, and malformed requests. Reports bugs with full reproduction details. Trigger on "break the API", "chaos monkey", "adversarial testing", "security test the endpoints", "test edge cases", or when a test plan defines API endpoints.

ravnhq Bundle

Server-side architecture and security — API design, error handling, validation, logging. Use when building APIs, server logic, or reviewing backend security.

ravnhq Bundle

Audit a repository for type-system weaknesses using recent bug-fix commits as hard evidence. Produces prioritized findings tied to specific commits showing which types allowed real bugs. Use when: reviewing type safety, auditing types, analyzing type bugs. Triggers on: type audit, type system review, audit types, type safety audit.

chanw-research Bundle

Use when the user asks for citation-verification principles, reference-audit best practices, or guidance on preventing fake or inaccurate citations in academic writing.

sashamarchuk Skill

(beta) The `split` step. Runs SOURCE enumerate + extract_unit + extract_projects (+ unit_project_ref) to write one normalized unit per chat into units/pending/ and per-project artifacts into project/<PNN__slug>/; live-mode secret-strip; seeds the preflight_* counters. Called by the `run` controller at step `split`. Self-contained - no conversation history assumed.

caoronglin Bundle

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

caoronglin Skill

使用可视浏览器自动完成 CoPaw 的钉钉频道接入。适用于用户提到钉钉、DingTalk、开发者后台、Client ID、Client Secret、机器人、Stream 模式、绑定或配置 channel 的场景；支持遇到登录页时暂停，等待用户登录后继续。

devarispbrown Bundle

Sandbox Experience Audit

devarispbrown Bundle

Security Supply Chain

devarispbrown Bundle

Contributor Experience Audit and Repair

devarispbrown Bundle

Adversarially audit and release-gate developer documentation for correctness, drift, executable examples, API/SDK/CLI/config parity, onboarding friction, terminology, lifecycle coverage, and developer experience. Use for repo/PR/release docs audits, documentation CI, stale-doc detection, 15-minute quickstart validation, SDK parity reviews, and world-class documentation scoring. Prefer observed evidence and fail gates rather than smoothing over product defects. For whole-product developer-experience audits use developer-experience-auditor.

nevitonsantana Skill

Audit the consistency of a change across behavior, validation, handoffs, and operational risk.

nevitonsantana Skill

Audit an existing interface for usability failures, operational impact, and minimum defensible fixes.

nevitonsantana Bundle

Estimate the permanent cost of a feature — cognitive, technical, operational, and governance carry — before the build commitment, producing a complexity scorecard and a reduction recommendation.

catlog22 Skill

Intent-driven knowledge-store and Run knowledge lifecycle management — read-only audit/prune reports, stage candidates (with signal recording), review/resolve/promote candidates, harvest artifacts, or manage wiki/domain knowledge.

makerjackie Bundle

Postgres performance optimization and best practices from Supabase for schema, indexing, query tuning, security, and operations.

bnema Skill

Use when reviewing architecture boundaries, hexagonal architecture, clean architecture layers, dependency direction, trust boundaries, uploads, parsers, redirects, or web security risks.

bnema Skill

Use when scanning a repo for hexagonal architecture violations, reviewing code placement across layers, auditing dependency direction, or checking port hygiene. Triggers on "hex arch", "ports and adapters", "clean architecture layers", "domain imports infrastructure", "business logic in adapter", "wrong layer", "missing port".

bnema Bundle

Use when auditing, reviewing, or modifying web applications where untrusted data crosses trust boundaries — including request handlers, parsers, renderers, document importers, file uploads, redirects, API endpoints, webhooks, and multi-step feature chains. Also use when reviewing framework defaults, content-type handling, or feature composition that could chain into vulnerabilities.

bnema Skill

Use when configuring or running hexcheck in a Go repo for hexagonal architecture boundaries, adapter business-logic warnings, and mock discipline.

bnema Skill

Use when asked for a deep code review, thorough review, security audit, full review of changes, or pre-merge review. Triggers on "deep review", "thorough review", "audit my code", "review for security", "check for bugs", "review before merge".

bnema Bundle

Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.

tanstack Bundle

Sweep open (or listed) PRs with up to 100 parallel agents: security-scan outside contributors, rebase onto main when behind (push --force-with-lease), approve pending first-time-contributor CI when relevant, optionally rebase in-house PRs, and report who should review. Supports full, changed-only, behind-only, and conflict-only scopes for cheap daily runs. Use when the user runs /pr-sweep (or /pr-inbound-sweep), or asks to "sweep PRs", "sweep inbound PRs", "security-check outside PRs", "rebase outsider PRs", "rebase our PRs", "approve waiting CI on PRs", "daily PR sweep", or "prep external PRs for review".

yarlson Skill

Audit and conservatively maintain a configured Yarbrain vault for structural errors, stale knowledge, duplication, conflicts, unprocessed evidence, and skill drift. Use periodically or when recall quality declines; make deterministic checks first and require approval for semantic consolidation or archival.

zimoliao Skill

Use when the user wants to check paper-library data quality, diagnose missing metadata, filename issues, DOI duplicates, title mismatches, or repairable metadata problems.