Security

nixopus Skill

Generate ecosystem-specific .dockerignore files to reduce build context size and prevent secret leaks. Use when no .dockerignore exists, when the build context is large, or when secrets may be leaking into images.

nonlinear-xyz Skill

API conventions for both server actions and tRPC builds. Covers the decision between them, per-mutation Zod input schemas, central router composition, pagination shape, multi-field search via Drizzle `ilike` + `or()`, mutation lifecycle hooks, conditional query enabling, stale-time defaults, error response shape and custom error class taxonomy, mutation-boundary audit logging, fetch adapter for tRPC routes. Read when designing or implementing any data-mutation endpoint.

nonlinear-xyz Skill

Security conventions for builds that touch sensitive data, regulated industries, or AI-generated code paths. Covers KMS encryption at rest, BAA verification for PHI in email/SMS, safe URL redirects, admin-client bypass guardrails, in-memory rate-limiter caveats, the "read-only by default" stance for AI-generated code, mandatory-review-queue pattern, and request tracing for support workflows.

nonlinear-xyz Skill

Measure the factory-kit's token footprint — baseline vs on-demand, heaviest assets, trim candidates

nonlinear-xyz Skill

The operational discipline for running a destructive change against a production database — schema migrations, data backfills, one-shot RPCs, historical seed imports. Adjacent to `factory-data-layer.md` (schema design) and `factory-deployment.md` (where migrations execute in CI) — this skill is about the runbook around the act of mutating prod. Covers the three-stage write contract (preflight → mutate → verify → rollback), idempotency by natural key, layered backup independence (Layer C from `factory-security.md` / KAI-126 doctrine), human-gated execution, bidirectional update semantics, validation-at-parse-not-at-constraint, and the failure modes a senior DB engineer pattern-matches before opening a migration PR.

nonlinear-xyz Skill

Use to review a PR, diff, or recently-written code against the factory's conventions. Read-only — outputs structured review, not diffs. Carries the full factory-pitfalls digest as a PR checklist plus the conventions from every other factory-*.md skill. Flags anti-patterns, missing conventions, security risks, and inconsistencies with prior builds. Invoke after writing nontrivial code, before merge, or when on-boarding a contractor.

nonlinear-xyz Skill

Observability conventions across builds. PostHog + Sentry on day one (non-negotiable per the factory thesis — easiest to start early, most expensive to backfill). Request tracing with propagated trace IDs, structured logging, activity-log audit table, event tagging by tool/feature for per-tool usage queryability, PostHog ingest-URL rewrite to avoid ad-blocker breakage. What to log, what NOT to log (PII).

paulkinlan Skill

Review code for correctness, security, performance, and style

paulkinlan Skill

Audit project dependencies for known vulnerabilities and license issues

paulkinlan Skill

Scan source code for security vulnerabilities following OWASP methodology

oimiragieo Skill

Use when writing a gated test that must pass identically on the dev desktop AND the CI pytest env (which lacks optional engines), constructing a HOSTILE fixture (permission denial, junction/symlink swap, network partition, disk-full, killed process, corrupted file, missing binary) and proving it actually BITES before the probe runs, forcing a deterministic injectable seam instead of env-detecting, mutation-asserting that a red-arm control really applied, or adding a positive control so a zero cannot read as "clean". Triggers: "hermetic test", "hostile fixture", "fixture-BITES precheck", "STILL VACUOUS", "env-independent", "setup-not-assertion", "the fixture never applied", "mutation asserted-applied", "positive control", "Event-gated parent swap", "RED reason class", "platform arms". Sibling of tensor-grep-codex-gated-audit-loop (the loop) and tensor-grep-validation-and-qa (what counts as proof); this one is the CONSTRUCTION discipline for hermetic + hostile tests. Not for deciding what to test or for merge g

oimiragieo Skill

Use when packaging tensor-grep outputs for enterprise change review — review-bundle create/verify requires a rewrite audit --manifest (not a capsule); optionally attach scan JSON and checkpoint IDs; pair with evidence emit and audit-history.

oimiragieo Skill

Use when writing or reviewing any code that confines filesystem access to a root (checkpoint snapshot/undo, LSP documentChanges, index reuse, install/upgrade, scan-writer paths) and must behave CORRECTLY on BOTH Windows and POSIX — especially junctions vs symlinks vs hardlinks, the drive-absolute `/C:/...` escape that only exists on Windows, canonicalize-or-fail-closed, handle-anchored identity versus resolve-then-act (TOCTOU/A38/A48), or a path-shape transform that is platform-meaningful (A84). Triggers: "junction", "symlink", "drive-absolute", "reparse point", "path confinement", "within_root", "TOCTOU", "canonicalize", "opened identity", "CWE-59", "CWE-1386", "mklink /J", "out-of-root". Sibling of tensor-grep-hermetic-hostile-tests (the fixture that must BITE) and tensor-grep-index-fingerprint-freshness (identity of the tree being served); this one is the cross-platform path-security discipline itself.

stefan-stepzero Bundle

Use when auditing implemented UI for missing UX patterns. Triggers: 'audit UX', 'check UX', 'missing patterns', 'UX gaps'.

stefan-stepzero Bundle

Audit a codebase for dead code, orphaned modules, unused dependencies, and unwired seams. Quick tier runs knip-class checks ephemerally (no repo mutation); deep and exhaustive tiers add intent↔code reconciliation. Portable to any repo, including ones with no tooling installed.

gtrabanco Skill

Internal brand & copy review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Checks changed user-facing copy against the project's brand doc: voice, terminology, and honesty of claims — applies only to surfaces with user-facing text. Findings only; never edits code.

gtrabanco Bundle

Verify an issue, persisted audit finding, or unresolved review finding against current code, classify it, and write only the contracted forge/ledger outcome. Supports independent batches and an immediate-fix review-finding route. Triggers: "triage-issue", "triage issue N", "triage this finding", "is this trigger met".

gtrabanco Skill

Internal UI/UX design review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Checks the changed UI against the project's design doc: consistency, states, responsiveness, and reuse — applies only when the project has a UI and the change touches it. Findings only; never edits code.

gtrabanco Skill

Internal run-it verification review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Runs the project's gate and the changed behavior for real — commands, exit codes, observed output — instead of assuming; what cannot be executed goes to the manual checklist. Findings only; never edits code.

gtrabanco Skill

Internal security review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Checks secrets, input validation, injection, authn/authz, PII exposure, and dependency risk on the changed surface. Findings only; never edits code.

gtrabanco Bundle

Internal scope/classification engine composed by review-change (and reused by the audit skills): consumes the synthesized findings table, verifies every applicable axis is represented, and classifies each finding into a decision table (fix-now / replan-in-unit / decision-required / proposal / ignore). Findings only — never refactors.

faaz17 Skill

Audit and improve a CV using the vendored Career-Agents reviewer and strategist profiles — ATS parse safety, keyword alignment, impact rewrites, narrative and headline. Produces a prioritised report and a rewritten CV. Use when asked to improve, review, ATS-check or tailor a CV, or after /cv-intake surfaces weaknesses.

faaz17 Skill

Harvard referencing to Middlesex University standard for the MGT4897 DXB report — in-text citation forms, full reference formats for journal articles (DOI mandatory), books, industry-body reports (ICAO, IATA, ACI), corporate press releases and newsroom items, statistical databases, and websites. Also covers the minimum-five-journal-article requirement and how to audit a reference list. Use when adding, formatting, checking, or auditing any citation or reference list.

faaz17 Skill

Compute ERC-26's current expected qualification score against the rubric, identify the cheapest unclaimed point, and recommend what to build next in point order. Use when deciding priorities, when time is short, or before the 2026-09-06 grasp decision.

iamk77 Bundle

Attack your own system — under explicit authorization — to prove its defenses hold, before launch and continuously after: scope and authorize, recon, scan and enumerate, exploit and confirm real vulnerabilities (not scanner false positives), chain them into real impact, then report and re-test. The offensive half of the security pair (the spear) that proves what the `aegis` skill builds (the shield). Authorized, defensive penetration testing of systems you own or have written permission to test — never anything else. Use when the user wants to penetration-test their own application before launch, validate a fix actually closed a hole, stand up adversarial validation in CI or on a cadence, or learn to test for OWASP-class vulnerabilities on their own staging. Triggers on "pentest my app / attack my own system", "red-team my staging", "is this actually exploitable", "pre-launch security test".

lazyisefficient Bundle

Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.

lazyisefficient Bundle

Use when writing, reviewing, or architecting Rust code — systems programming, async services, CLI tooling, web backends, or any work in `.rs` files. Triggers on editing `.rs` or `Cargo.toml` files, or mentions of "Rust", "Tokio", "Axum", "cargo", "borrow checker", "lifetime", "trait object", "async Rust", "crate", "rustc", or explicit requests to "build this in Rust" / "rewrite X in Rust". For adversarial security review of Rust code see security-reviewer.

lazyisefficient Bundle

Design, analyze, and optimize cold outbound email campaigns on Instantly. Handles end-to-end ICP definition, expert panel scoring (recursive to 90+), sequence copywriting, infrastructure audit, capacity planning, and an implementation/strategy doc for human review. Use when asked to build cold outbound sequences, optimize cold email, audit an outbound motion, write sales sequences, or design cold email campaigns. Supports "start from scratch" and "optimize existing" modes. Execution skill — it produces copy, math, and a doc; it does not auto-send. Requires Instantly for audit/send features.

khaledsaeed18 Bundle

Scan code or a diff for hardcoded secrets (API keys, tokens, passwords, private keys, and other exposed credentials) before they get committed or shipped. Use before committing, during review, or when auditing a repository.

khaledsaeed18 Bundle

Review code being written or modified against the OWASP Top 10:2025 and ASVS secure-coding requirements, catching vulnerability classes before they ship. Works in any language or stack. Use when writing authentication or authorization logic, handling user input, adding API endpoints, choosing cryptographic operations, processing file uploads, or making any change that touches a trust boundary. Complements secret-scan (which finds credentials) and dependency-audit (which checks packages) with line-level vulnerability review.

khaledsaeed18 Bundle

Audit a project's dependencies for outdated and vulnerable packages and surface breaking-change notes for upgrades. Works with any ecosystem, including npm/pnpm/yarn, pip/Poetry/uv, Cargo, Go modules, Maven/Gradle, Bundler, Composer, and others. Use when checking a project's dependency health, planning upgrades, or responding to a vulnerability report.

khaledsaeed18 Bundle

Review code through three hostile personas - the Saboteur, the New Hire, and the Security Auditor - each required to find at least one issue. Use when a standard review feels too comfortable, when code is going into a critical path, when a previous review missed bugs that later surfaced, or when you want coverage across correctness, clarity, and security in a single pass.

byerlikaya Skill

Retrospective self-audit after nontrivial work: unverified assumptions, skipped items, is-this-the-right- approach — findings, not code. The step-back counterpart to iterate's refine-to-done loop.

byerlikaya Bundle

Stack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws. Severity-ranked report with fixes. Use when auth, input handling, secrets or dependencies change, and before a release.

byerlikaya Skill

Dependency risk assessment, read-only: known CVEs, deprecated packages, licence compliance, maintenance status, lockfile integrity, and a justification for every new dependency. Acting on it is dependency-upgrade.

dqtx760 Skill

Thorough code review covering bugs, security, performance, and maintainability. Use when reviewing code, checking for bugs, auditing quality, or getting feedback on implementations.