Security

roodlicht Skill

Web vulnerability triage — JWT flaws (alg confusion, none alg, kid injection), deserialization (Java/Python/PHP/Ruby/Node), prototype pollution, OAuth misconfigs (redirect_uri, PKCE, scope), CSRF, DOM XSS, SSRF. Classification, impact assessment at pattern level, and handoff to remediation.

roodlicht Skill

Vendor security questionnaire workflow — vendor tiering, standardized questionnaires (CAIQ, SIG-Lite/Core, VSA), custom authoring, evidence reuse against existing attestations (SOC 2, ISO 27001), and ongoing vendor-risk monitoring.

thinkyou0714 Skill

「誰が・いつ・何をしたか」を後から追跡できる監査ログを設計する。重要操作・権限変更・データアクセスを記録する仕組みを決める前に使う。

thinkyou0714 Skill

設計・仕様・計画に埋め込まれた前提を洗い出し、未検証の前提が判断を歪めていないかを確認する。設計レビュー前、ADR作成前、重要な技術選定前に使う。

msewell Bundle

Reviews GitHub pull requests end-to-end using gh CLI. Gathers PR metadata, diff, linked issues, and CI status. Analyzes code for bugs, security risks, performance issues, and goal alignment against repo conventions. Runs available lint, type-check, and test commands locally. Produces a prioritized report with severity-classified feedback (blocking, suggestion, nit, praise) and an approve/request-changes verdict. Optionally posts the review to GitHub after user confirmation. Use when asked to review a PR, check a pull request, audit code changes, evaluate if a PR is ready to merge, provide code review feedback, assess PR quality, or when the user says review PR #N, is this PR ready, look at this pull request, or code review.

hyperlane-xyz Skill

Trail of Bits security skills analysis for Solidity contracts. Use for deep smart contract security review with invariant suggestions.

hyperlane-xyz Skill

Security-focused review for Hyperlane protocol code. Use for Solidity contracts, Rust agents, and infrastructure changes.

netalertx Skill

Write or review a NetAlertX plugin's README.md (server/plugins/<code_name>/README.md). Use this when asked to create, enhance, audit, or clean up a plugin README, or plugin docs generally.

netalertx Skill

Read before writing or editing any SKILL.md, or any research/audit doc in .gemini/internal-docs/research/. Covers the two standing rules for living-reference prose - state current behavior only, and prefer plain, short wording - plus the grep sweep to run before calling a doc clean. PRDs are the deliberate exception (they keep a correction trail).

netalertx Skill

Write or review a NetAlertX plugin's README.md (server/plugins/<code_name>/README.md). Use this when asked to create, enhance, audit, or clean up a plugin README, or plugin docs generally.

netalertx Skill

Read before designing a feature that writes to the Devices table, adding audit/history logging, or choosing between a SQLite trigger and a Python hook. Covers the full Devices write-path inventory, the FIELD_SOURCE_MAP *Source attribution system, and event-sourced vs snapshot audit logging tradeoffs.

airmile Bundle

Use with /core-audit to analyze and refine a skill from this conversation.

airmile Bundle

Use when a security audit of the codebase is needed. Use with /dev-security.

calle-ai Bundle

Audit what your own branches tell callers by phone, judge each answer against written policy, and return a branch-level gap register that is deliberately unusable as a staff performance record.

g-bastianelli Skill

Scan all skills, agents, personas, and banner prompts in this nuthouse repo against the _templates/ source of truth. Reports missing

g-bastianelli Skill

Use when the user wants to review the quality of existing nuthouse skills — runs a structural audit then queues selected skills for testing and description optimization via skill-creator. Use when the user says "are my skills good?", "review all skills", "check my skills", "audit quality".

g-bastianelli Skill

Review an existing spec for contradictory behavior, unverifiable acceptance, unsupported decisions, and repository conflicts. Returns concrete blockers and a readiness verdict; use before ratification or when a spec's quality is in doubt.

g-bastianelli Skill

Turn a feature or project request into a codebase-grounded spec with observable acceptance criteria and an independent audit. Use when a written spec is wanted before planning or Linear issue breakdown.

g-bastianelli Skill

Use when a project needs immutable governing principles that every spec / audit / drift check is held against — runs a one-question-at-a-time interview to extract project-specific articles (test-first, anti-abstraction, library boundaries, etc.), writes them to docs/acid-prophet/constitution.md, and commits. The spec-auditor reads this file on every audit and treats each article as an extra gate.

hallucinaut Skill

Analyze code quality, security vulnerabilities, performance issues, and best practices. Use when reviewing code, performing security audits, or identifying bugs and improvements.

hallucinaut Skill

Implement authentication and authorization systems. Use when adding login, registration, sessions, JWT tokens, OAuth, or security auth features.

hallucinaut Skill

Perform security assessments, vulnerability scanning, and penetration testing for codebases, APIs, and infrastructure. Use when conducting security reviews, penetration tests, or compliance assessments.

hallucinaut Skill

Implement authentication, authorization, and security auditing. Protect applications against common vulnerabilities and ensure data integrity through validation.

hallucinaut Skill

Build secure, production-ready FastAPI backends with Alembic migrations, SQLite for dev, PostgreSQL for prod, and industry-leading security practices.

cristoslc Skill

One-time project onboarding for swain. Migrates existing CLAUDE.md content to AGENTS.md (with the @AGENTS.md include pattern), verifies vendored tk (ticket) for task tracking, configures pre-commit security hooks (gitleaks default), and offers to add swain governance rules. Run once when adopting swain in a new project — use swain-doctor for ongoing per-session health checks.

dirnbauer Bundle

Build and audit TYPO3 backend editor rights after an explicit choice between one user-facing main group with simple internal leaves or preserving distinct existing roles. Covers CTypes, fields, page ACLs, languages, modules, mounts, MFA, Forms/Powermail, Workspaces, User TSconfig, Visual Editor, Redirects, safe membership cutover, and customer login/backend branding with the Application Context. Use when permissions are missing/read-only, be_groups is incomplete, or legacy roles may be consolidated. Always preserve a separate working administrator.

dirnbauer Bundle

Audit one or more past or incomplete TYPO3 upgrade runs, project repositories, Codex tasks/threads, and evidence directories to determine what was requested, asked, changed, solved, left open, slow, good, bad, risky, or unverifiable. Use when reviewing several projects, when Git claims completion but run status is stale or the update folder is missing, when improving typo3-upgrade-run from real failures, or before claiming an old upgrade complete. Produces a problem→cause→solution→control matrix and proposed skill/eval changes. Read-only by default; never reconstructs a pass from Git history or edits skills unless explicitly requested.

krzysztofsurdy Bundle

Composer dependency management playbook for safe, systematic package updates. Use when the user asks to update Composer dependencies, audit packages for security vulnerabilities, manage composer.lock, configure Dependabot or Renovate for automated updates, replace abandoned packages, or resolve version conflicts. Covers patch/minor/major update strategies, composer audit, semantic versioning constraints, lock file hygiene, and the changelog-first update workflow.

lovstudio Bundle

Review and improve an existing BP outline, PPTX, PDF, or rendered slide set across investment logic, evidence, copy, charts, and visual quality. Produces a scored report, page-level revisions, and targeted regeneration instructions while keeping facts separate from assumptions. Trigger on "润色 BP", "审稿商业计划书", "PPT 不专业", "逐页检查", "改图表", "BP review", "polish pitch deck", or "audit investor deck".

mike-diff Skill

Code review patterns for spec compliance, quality verification, and reference integrity. Use when reviewing code changes, verifying implementation against requirements, or assessing code quality. Covers three-pass review method, severity levels, scope creep detection, security checks, and stale reference detection.

d-o-hub Bundle

Maintain high code quality through formatting, linting, static analysis, and clean code principles. Use for rustfmt, clippy, cargo audit, code reviews, refactoring, and quality gates.

fellowship-dev Skill

Use when triaging Dependabot/Snyk security alerts by severity and exploitability before running security-runner.

fellowship-dev Skill

Use when preparing a PR for review — applies body templates, attaches the deployment and visual evidence the repo playbook requires, and runs the self-audit checklist.

thinkyou0714 Skill

シークレット（APIキー・トークン・認証情報・暗号鍵）の保管・配布・スコープ・ローテーション・漏洩対策をレビューする。外部連携・デプロイ設定・公開の前に使う。

viknesh20-20 Skill

Generates a changelog from git history following Keep a Changelog format. Categorizes commits into Added, Changed, Fixed, Removed, Security, and Breaking Changes. Use before releases or to document recent work.

viknesh20-20 Skill

Performs a comprehensive pull request code review covering correctness, security, performance, test coverage, and coding standards. Use when reviewing any code changes before merge.