Security

treasoni Bundle

Audit a Git repository for exposed API keys, tokens, passwords, private keys, and other credentials without printing their values. Use when asked to check repository security, scan for leaked secrets, review files before committing or pushing, investigate a credential leak, or check Git history after a possible exposure.

managedcode Bundle

Use the open-source CodeQL ecosystem for .NET security analysis. Use when a repo needs CodeQL query packs, CLI-based analysis on open source codebases, or GitHub Action setup with explicit licensing caveats for private repositories.

managedcode Bundle

Apply baseline engineering security guidance: secrets handling, secure defaults, threat modelling references, and review checkpoints for auth, data flow, pipelines, and external integrations. Use when a change has security impact but does not require a full standalone AppSec engagement.

managedcode Bundle

Use the open-source free `Meziantou.Analyzer` package for design, usage, security, performance, and style rules in .NET. Use when a repo wants broader analyzer coverage with a single NuGet package.

martinholovsky Bundle

Master router for the SOTA engineering skills library. Use this skill whenever the user asks to build, design, implement, refactor, harden, optimize, review, or audit an application, service, or codebase and the request spans more than one domain — or when you are unsure which specific sota-* skill applies. Also use when working on a codebase you do not own: reviewing a pull request or diff, responding to code review, evaluating someone else's patch, or preparing an upstream contribution — including mid-session, once you are already reading source, a diff, or CI config. It maps the task (build or audit mode) to the right domain and language skills (Rust, Go, C/C++, JVM, Python, JS/TS, .NET/C#, PHP, Ruby). Trigger keywords: SOTA, best practices, audit my code, security review, compliance, hardening, prod readiness, code quality, pull request, PR review, review comment, maintainer feedback, patch, diff, upstream, contribute, merge request.

martinholovsky Bundle

State-of-the-art JVM engineering rules (2026 baseline) for Java and Kotlin that Claude applies when writing or auditing JVM code. Baseline Java 25 LTS (virtual threads final since 21; structured concurrency still preview), Kotlin 2.x. Covers modern idioms (records, sealed types, pattern matching, Kotlin null-safety/coroutines), API/null/immutability design, concurrency (virtual threads, JMM, java.util.concurrent, coroutines), security (deserialization/gadget chains, XXE, JNDI/Log4Shell-class, injection, JCA crypto; SEI CERT Oracle Java + OWASP), performance (G1/ZGC, JFR, GraalVM), and build/tooling/CI (Maven/Gradle, dependency-check, Error Prone/NullAway, SpotBugs, ktlint/detekt). Trigger keywords - Java, Kotlin, JVM, JDK, Spring, record, sealed, virtual thread, Loom, coroutine, suspend, ObjectInputStream, deserialization, XXE, JNDI, Log4Shell, Maven, Gradle, G1, ZGC, GraalVM, JMH, Optional, null-safety. Use for BOTH building JVM services/libraries and reviewing or auditing them.

martinholovsky Bundle

State-of-the-art Rust engineering (2026) for writing and auditing Rust code. Covers idiomatic ownership and API design, error handling and panic policy, unsafe discipline with Miri, async/tokio (cancellation safety, structured concurrency, graceful shutdown), security and supply chain (cargo audit/deny/vet, integer overflow, serde hardening, zeroize), performance (profiling, allocation reduction, release profiles), and tooling/CI (clippy policy, nextest, MSRV, feature hygiene, edition 2024). Use when writing new Rust code, reviewing or auditing existing Rust, designing crate APIs, debugging borrow checker or Send/Sync errors, or hardening Rust services. Triggers: Rust, cargo, crate, tokio, unsafe, lifetime, borrow checker, clippy, async Rust, Cargo.toml, thiserror, anyhow, serde, Miri, MSRV, std::process::Command, subprocess, spawn a process.

martinholovsky Bundle

State-of-the-art CLI and developer-tool UX guidance (2026) covering command and flag design, output and interaction (stdout/stderr, --json, TTY detection, exit codes, prompts), runtime behavior and lifecycle (signals, dry-run, idempotency, XDG paths, completions, telemetry), and distribution (packaging, checksums, docs). Use when designing or building any command line tool, subcommand, TUI, or developer tool — in any framework (argparse, click, typer, clap, cobra, oclif, commander) — AND when auditing an existing CLI for usability, scriptability, and compatibility. Not for shell-script correctness or security — use sota-shell-scripting. Trigger keywords: CLI, command line tool, flags, subcommands, terminal output, TUI, developer tool, argparse, clap, cobra, exit code, shell completion, man page, stdin, stdout.

martinholovsky Bundle

State-of-the-art Python engineering (2026 baseline) for both writing new Python and auditing existing Python code. Covers uv-based tooling and project setup, strict typing, idioms and pitfalls, asyncio structured concurrency, security (injection, deserialization, supply chain), performance, and FastAPI/Django/pytest practice. Use whenever the task involves Python source, pyproject.toml, requirements files, or Python tooling — building features, scaffolding projects, reviewing PRs, or hunting bugs/vulnerabilities. Trigger keywords: Python, pip, uv, pyproject, asyncio, Django, FastAPI, pytest, type hints, mypy, ruff, pydantic, SQLAlchemy, venv.

martinholovsky Bundle

State-of-the-art software testing strategy and practice (2026) for designing test strategy, writing unit/integration/e2e tests, or auditing test suites. Covers suite shape (pyramid/trophy/honeycomb), test design quality (behavior-first, AAA, determinism, smells), test doubles (mocks/fakes/stubs), test data (builders over fixtures), real-dependency integration (Testcontainers-style), contract testing (Pact/consumer-driven), e2e/UI strategy (selectors, auto-waiting, flake economics), property-based testing, fuzzing, mutation testing, approval testing, and suite health/CI (flaky-test policy, coverage philosophy, sharding). Trigger keywords - testing, test strategy, unit test, integration test, e2e, end-to-end, coverage, flaky tests, TDD, contract testing, property-based, mocking, fixtures, snapshot test, mutation testing, fuzzing, BDD, Gherkin, given-when-then, acceptance criteria, security testing, WSTG, IDOR test, authz test, abuse case, DAST. Use for BOTH building and auditing test suites.

martinholovsky Bundle

State-of-the-art observability and reliability engineering (2026). Use when instrumenting code (structured logging, metrics, distributed tracing with OpenTelemetry, SLOs, alerting, health endpoints) or auditing an existing codebase's observability posture (can on-call answer "why is this request slow?" and "what broke at 3am?"). Not for security detections, SIEM, or threat hunting — use sota-detection-engineering. Triggers: logging, metrics, tracing, monitoring, alerting, SLO, SLI, error budget, OpenTelemetry, OTel, Prometheus, Grafana, debugging production, incident, on-call, telemetry, instrumentation, health check, runbook, Sentry, crash reporting, profiling.

martinholovsky Bundle

State-of-the-art identity and access management engineering (2026) for BUILDING/configuring identity infrastructure AND AUDITING it — federation, IdPs, authorization models, the joiner-mover-leaver lifecycle, privileged/break-glass access, workload identity, MFA/passkeys, and assurance levels; audits cover orphaned accounts, over-privileged roles, weak MFA, long-lived tokens, and SAML misconfig. Owns identity INFRASTRUCTURE and access-management DESIGN, not app-level login/session/JWT mechanics (sota-code-security owns those). Trigger keywords: IAM, IdP, OIDC, OAuth 2.1, PKCE, DPoP, PAR, RAR, JAR, FAPI, SAML, SCIM, provisioning, deprovisioning, RBAC, ABAC, ReBAC, Zanzibar, OpenFGA, SpiceDB, OPA, Cedar, Kanidm, Keycloak, Authentik, Zitadel, Entra, Okta, SSO, single logout, MFA, passkey, FIDO2, WebAuthn, step-up, conditional access, CAEP, PAM, break-glass, just-in-time, SPIFFE, access review, NIST 800-63, IAL, AAL, FAL, Active Directory, Kerberos, Kerberoasting, ADCS, RBCD, gMSA, dMSA, LAPS, krbtgt.

martinholovsky Bundle

State-of-the-art privacy and compliance engineering guidance for building privacy-respecting systems and auditing existing code for privacy/compliance gaps. Use when work involves privacy, GDPR, PII, personal data, consent, data retention, deletion, DSAR (data subject access requests), SOC 2, ISO 27001, HIPAA, PCI DSS, compliance evidence, data residency/sovereignty, data classification, anonymization/pseudonymization, breach notification, or EU AI Act obligations — whether designing new data flows, implementing user-rights features (export/delete), preparing for an audit, or reviewing a codebase for places personal data is over-collected, under-protected, retained forever, or impossible to delete.

martinholovsky Bundle

State-of-the-art security & compliance engineering (2026) for the cybersecurity control frameworks and product-security regulations that drive architecture, code, and CI gates — not the organizational policy binder. Use when work must satisfy or be audited against NIST CSF 2.0, SP 800-53, SP 800-171 / CMMC, the Secure Software Development Framework (SSDF, SP 800-218), FedRAMP, the EU Cyber Resilience Act (CRA), or ISA/IEC 62443 (OT/ICS/embedded). Covers control-framework-as-code crosswalks (control → engineering mechanism → evidence), CUI boundaries, FIPS-validated crypto, SBOM + coordinated vulnerability disclosure + security-update obligations, secure-SDLC gates, and OT zones/conduits & security levels. Complements sota-privacy-compliance (personal data, GDPR, SOC 2, ISO 27001). Trigger keywords: compliance, NIST, CSF, 800-53, 800-171, CMMC, CUI, SSDF, FedRAMP, CRA, Cyber Resilience Act, SBOM, VEX, CVD, IEC 62443, OT security, ICS, security levels, zones and conduits, FIPS 140.

postplusai Bundle

Design, recommend, or audit creator-led short-form product ads built around direct address, believable product interaction, observable proof, and a natural personal verdict. Use for UGC ads, creator ads, selfie testimonials, product reviews, misconception-led or skeptic-to-believer ads, problem-reframe-proof ads, problem-solution demos, tutorials, unboxings, ASMR unboxings, try-ons, before-and-after ads, social validation, POV concepts, UGC briefs, UGC shot scripts, reviewing existing UGC videos, and approved UGC scripts that should proceed into image or video production.

postplusai Bundle

Design and audit visual-argument-led animated ads that turn user pressure, offer interaction, mechanism, and proof into readable characters, props, actions, visual systems, and state changes. Use for Cartoon Ads, animated direct-response ads, stylized 3D or tactile ads, personified problems, category exposes, founder stories, B2B case-character ads, animated software or service ads, product-mechanism visualization, 卡通广告, 动画广告, 3D动画广告, 拟人化广告, B2B动画广告, 把痛点动画化, reviewing an existing animated ad against this grammar, and approved scripts that should proceed into image or video production.

postplusai Bundle

Design or audit evidence-led short-form Authority Ads that use a credible operator, expert, insider, skeptical dialogue, case narrator, or demonstrator to expose a hidden problem mechanism and connect it to approved proof and a product solution. Use for educational ads, expert ads, authority ads, doctor-style or specialist-style ads, podcast ads, interview ads, insider reveals, case-story explainers, problem-mechanism ads, evidence-led VSLs, 专家广告, 权威广告, 科普广告, 采访广告, reviewing an existing authority-led ad, and approved scripts that should proceed to image-batch-runner or video-batch-runner.

postplusai Bundle

Design, recommend, or audit short-form product commercials built around one controlled visual mechanism, clear product behavior, designed sound, observable or explicitly metaphorical proof, and a resolved payoff. Use for product commercials, studio product ads, stress tests, CGI ingredient worlds, mystery reveals, satisfying restocks, mini TV spots, editorial try-ons, surreal product ads, commercial briefs, commercial shot scripts, reviewing existing product ads, and approved commercial scripts that should proceed into image or video production.

postplusai Bundle

Design and audit evidence-led educational short-form ads that turn a viewer problem, question, contradiction, or comparison into a clear explanation, clause-matched visual proof, an earned product or offer entry, and a practical changed state. Use for Educational Ads, explainer ads, expert or spokesperson ads, authority-led ads, ranked or tier-list ads, interview demonstrations, product education, mechanism-led direct-response ads, B2B explainers, animated educational ads, reviewing an existing educational ad, and approved educational scripts that should proceed into image or video production.

postplusai Bundle

Create, revise, validate, or audit reusable video-production workflows on the PostPlus workflow platform - the node canvas that turns scripts, reference assets, and per-clip prompts into approved, quoted, human-launched video runs. Use for workflow creation requests, 创建工作流, 搭建工作流, multi-clip UGC workflow design, converting a product idea, hook, script, or reference analysis into generation-node workflows, revising an existing workflow, and pre-launch workflow audits.

postplusai Bundle

Design and audit street-interview advertising concepts and shot scripts built around a public conversation, visible microphone, candid respondent state, question-led persuasion, product interaction, and grounded proof. Use for street interview ads, vox-pop ads, man-on-the-street ads, sidewalk interview ads, public reaction ads, interview-style direct-response ads, converting an offer or approved brief into a street-interview script, reviewing an existing street-interview ad, or handing an approved street-interview concept to image or video production.

preetamnath Skill

The deep-module primitive: a small interface hiding lots of behaviour. Apply the lens to judge or shape one interface, or audit a codebase for shallow modules (returns a ranked table). TRIGGER when: user says 'deep modules', 'is this a deep module', 'find shallow modules', 'audit from the deep-module lens'; a skill needs the deep-module vocabulary.

preetamnath Skill

Audit past Claude Code transcripts in a chosen scope and date window to extract reusable patterns, then walk each one to promote it into a slash command, CLAUDE.md rule, memory entry, or new skill. TRIGGER when: user wants to mine past sessions for reusable workflow patterns, recurring corrections, or validated approaches worth capturing; user asks how often a skill ran across sessions.

nguyenthienthanh Skill

Token-efficient git operations with security scanning and auto-split commits, plus auto-creating git worktrees to isolate workflow changes — merge on success, discard on failure.

nguyenthienthanh Skill

6-aspect structured code review (security, architecture, error handling, test gaps, type safety, simplification) with calibrated scoring and per-aspect breakdown. Use when the user asks to review code, check a PR, review a pull request, audit changes before merge, or give code feedback.

nguyenthienthanh Skill

Draft → generate verification questions → answer independently via tools → revise. Catches hallucinated facts in reports and reviews. MANDATORY for Phase 4 security/test claims. Paper: Dhuliawala et al. 2023.

seroneyemmanuel4-afk Skill

Audit API contracts, boundary validation, authorization, consistency, pagination, errors, and idempotency. Use for http, graphql, rpc, or event-consumed application interfaces.

posit-dev Bundle

Audit old container images in the posit-dev GHCR registry and delete them in a reviewed batch. Produces a review list of every positron-<os>* / positron-postgres-* image version older than a cutoff (default 90 days), excluding anything a live tag or multi-arch manifest still points at; the human deletes rows they want to keep, then this drives the batch delete. Use when asked to clean up, prune, or garbage-collect old GHCR packages/images.

j5ik2o Bundle

Systematically inventory and organize GitHub Issues. Classify open issues, group related work, identify close candidates, prioritize remaining work, and propose useful batches. This includes separating CodeRabbit-generated issues from human-reported issues, grouping by root cause, and finding completed issues that can be closed. Trigger on GitHub Issue organization requests such as "organize issues", "triage GitHub issues", "audit open issues", "close stale issues", or "prioritize issues".

aspectrr Skill

Release engineering — sync main, run tests, audit coverage, push branch, open PR. Bootstraps test frameworks if needed. One command from "code complete" to "PR ready for review".

aspectrr Skill

Design audit of existing code. Same methodology as plan-design-review, but applies fixes directly with atomic commits and before/after evidence. Use when asked to audit the visual design of implemented code.

ethanyoq Bundle

Build, rebuild, audit, and compare QQ mailbox invoice ground truth datasets for this repository using the existing truth-building scripts and evidence artifacts. Use when the task is to generate a QQ mailbox ground truth set, validate QQ batch output against truth, review QQ mailbox invoice evidence, or investigate QQ-specific invoice extraction pitfalls in this project.

motormetrics Skill

Perform automated code reviews checking for security vulnerabilities, performance issues, and code quality. Use before creating PRs, when reviewing complex changes, checking for security issues, or identifying performance problems.

motormetrics Skill

Audit PostHog survey SDK features and version requirements

motormetrics Skill

Upgrade dependencies safely using pnpm catalog, checking for breaking changes, and testing upgrades. Use when updating packages, applying security patches, upgrading major versions, resolving dependency conflicts, or modernizing tech stack.

motormetrics Bundle

Guides Stripe integration decisions — API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, Treasury financial accounts, integration surfaces (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, restricted keys, webhooks, OAuth). Use when building, modifying, or reviewing any Stripe integration — including accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, creating connected accounts, or implementing secure key handling.