Security

mte90 Skill

Comprehensive Django guide - security, ORM, PostgreSQL, GeoDjango, Django 6.0 features, admin extensions, middleware, authentication, sessions, and ecosystem tools

mte90 Bundle

Security standards for hardening Laravel applications.

mte90 Bundle

Secure coding practices for building safe TypeScript applications.

mte90 Bundle

Universal security protocols for building safe and resilient software.

mte90 Bundle

Expert standards for session drivers, security headers, and middleware logic.

christopheralphonse Skill

Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.

christopheralphonse Bundle

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides scoped security checklist and patterns.

iankiku Skill

(forwward) Aggressively audits and cleans a codebase — removes slop, dead code, and AI-generated noise; fixes DRY/SOLID violations; restructures toward the simplest correct implementation. One commit, no behavior changes. Use when the user says "audit the code", "clean up tech debt", "remove dead code", "deslop", "this codebase is a mess", or asks for a code-quality pass. Detects stack and applies idiomatic patterns. Works on full codebase or specific paths.

iankiku Skill

(forwward) Project-agnostic adversarial hardening pass — security red-team, end-to-end observability, bottleneck removal, and anti-over-engineering. Triggers on "harden this", "red team this", "adversarial review", "find security holes", "add logging/traces so we can debug", or "find where it hangs/fails". Works on any project or codebase.

iankiku Skill

(forwward) Performs paranoid code review checking trust boundaries, data integrity, performance, race conditions, error handling, and OWASP security. Triggers on code review, pre-merge checks, security audit, bug hunting, or any request to review, audit, or check code quality.

iankiku Skill

(forwward) Implements authentication, authorization, encryption, HIPAA compliance, SOC 2 controls, and security hardening with defense-in-depth defaults. Triggers on auth, encryption, compliance, penetration testing, privacy, or any security concern.

niekcandaele Skill

Comprehensive code reviewer combining design review, architecture, coherence, hardening, and security analysis

niekcandaele Bundle

Reconcile this repository toward the opinionated "golden state" for agentic local development — a per-repo dev CLI, a thin justfile surface, a generated port-offset env contract, a four-file engineer skill, thin CI, and a doctor invariant-enforcer. Run /setup-engineer whenever you want to set up, audit, or repair a repo's local-dev tooling: a fresh repo with nothing, a half-built repo with organic scripts that needs consolidating, or a finished repo you just want to verify still conforms.

the-hugin Skill

Skill: Security Baseline

the-hugin Bundle

Security-focused review of code changes (PRs, commits, diffs) with blast radius estimation and adversarial modeling. Seven-phase workflow from triage to final report. Adapted from Trail of Bits methodology.

thettwe Skill

Manage the fleet registry of local repos and show the cross-repo health dashboard (read-only). TRIGGER when the user says "show my fleet", "fleet dashboard", "health across all my repos", "org health view", "how are all my repos doing", "which of my repos are drifting", "audit all my repos", "run doctor on every repo", "add this repo to my fleet", "register my repos", "scan ~/Works for repos", "list my fleet", "remove <repo> from my fleet", "/nyann:fleet". Do NOT trigger on "watch all my repos" / "watch my PRs across repos" — that's `watch` (CI sentinel: remote PR/check state, not governance). Do NOT trigger on "fix drift across all my repos" / "retrofit the fleet" — that's `fleet-retrofit` (this skill never mutates a repo). Do NOT trigger on single-repo health ("is this repo healthy") — that's `doctor`.

thettwe Bundle

Run a read-only hygiene + documentation audit on the current repo. TRIGGER when the user says "is this repo healthy", "check hygiene", "audit this repo" (when they mean inspect, not remediate), "what's drifted", "run doctor", "run a health check", "audit docs", "check for doc drift", "what's broken in this project", "are the hooks still installed", "/nyann:doctor". Do NOT trigger on "fix this repo" / "remediate" / "bring it into compliance" — those are retrofit (audit + fix). doctor reports, never writes. Do NOT trigger on "what does this repo do" (that's a docs pointer, not a hygiene audit).

thettwe Skill

Analyze a repository and suggest profile updates. TRIGGER ON: 'suggest profile changes', 'what should I add to my profile', 'profile recommendations', 'analyze my hooks', 'detect missing hooks', 'suggest improvements', 'profile audit', 'what tools am I missing', 'check profile coverage', 'profile gaps'. Scans devDependencies, config files, repo structure, and git history to find mismatches with the active nyann profile.

thettwe Skill

Bundle a redacted, support-grade snapshot of the current nyann state for inclusion in a bug report or support request. Combines explain-state + doctor + git config (token-redacted) + installed hook contents + nyann user-config (token-redacted) + check-prereqs into a single JSON or human-readable summary. TRIGGER when the user says "nyann is broken", "nyann diagnose", "diagnose nyann", "diagnose this repo", "support bundle", "what's wrong with nyann", "help me file a bug report", "what should I include in a nyann bug report", "/nyann:diagnose". Do NOT trigger on "is this repo healthy" — that's `doctor` (read-only audit). Do NOT trigger on "what does nyann see here" — that's `explain-state` (lighter snapshot, no health, no hook contents). Do NOT trigger on "fix this repo" — that's `retrofit`.

thettwe Skill

Audit an existing repo against a profile and offer to fix what's drifted. TRIGGER when the user says "retrofit this repo", "fix this repo's hygiene", "bring this repo into compliance", "remediate drift", "fix what's drifted", "make this repo match the profile", "my repo is half set up, finish it", "I already have some hooks but they're incomplete", "fill in the gaps", "upgrade this repo to nyann standards", "apply the profile to this existing repo". ALSO trigger when doctor finishes with drift (exit 4 or 5) and the user says "fix it", "remediate", "yes fix those", "go ahead and fix". Do NOT trigger on "is this repo healthy" / "check hygiene" / "audit docs" — those are doctor (read-only). Do NOT trigger on "set up this project" from scratch — that's bootstrap-project.

thettwe Skill

Survey the machine and report which nyann features are usable right now. TRIGGER when the user says "is my machine ready for nyann", "what do I need to install", "check my setup", "do I have the right tools", "check prereqs", "audit my environment", "new machine, what's missing", "I'm on a new machine", "install nyann prereqs", "/nyann:check-prereqs". Do NOT trigger on general "what is nyann" questions — those want a docs pointer, not a machine survey. Do NOT trigger when the user is already mid-bootstrap — let the bootstrap-project skill handle that case and emit its own skip records for missing stack tools.

qaia-project Bundle

Ingest a user-provided HAR file (or equivalent captured HTTP traffic export) and derive non-regression test conditions -- observed status, response shape, significant headers, timing -- from real request/response pairs, with mandatory PII/secret masking before any write. Never captures live traffic, never runs a proxy, never sends a network request itself. Use when the user has a HAR export and wants what actually happened turned into regression conditions, not a coverage test book.

qaia-project Skill

Security Surface Checks

qaia-project Bundle

Generate and run risk-based passive security-surface checks (CT-SEC - assets and threats identified first, then auth boundaries, IDOR, error handling, user enumeration prioritized by risk) against an authorized self-hosted app, plus optional OWASP ZAP baseline. Use for security coverage. Authorized self-hosted targets only.

aka-kika Skill

Use when the user needs to update, improve, audit, or maintain documentation in a project. Covers READMEs, changelogs, API docs, inline comments, missing docs, and overall documentation quality. Works well before releases or when documentation has fallen behind the code.

arndvs Skill

Deep codebase exploration using parallel subagents. Use when asked to 'explore', 'understand', 'investigate', 'map out', 'how does X work', or 'audit' a part of the codebase.

arndvs Skill

Write, update, or audit documentation. Use when asked to 'document this', 'write docs', 'update the README', 'add JSDoc', 'write a changelog', or 'create an ADR'.

arndvs Bundle

Use when repeated Claude Code session errors need analysis; scans session transcripts for errors, clusters by root cause, and suggests remediations.

arndvs Skill

Exhaustive pre-PR audit that front-runs code review tools by catching the same issues Copilot/reviewers find iteratively, across any stack.

arndvs Skill

Ruthless codebase audit reporting only real problems. Use when asked to 'audit', 'code audit', 'codebase audit', 'review code', 'find bugs', or 'code review'.

arndvs Skill

Auto-invoke after any do-work, tdd, systematic-debugging, or review-pr-copilot task completes to review the diff against active rules and skills, flag violations, update the skill if a gap is found, and close the loop between 'rule was loaded' and 'rule was followed'.

arndvs Skill

Deep system and codebase performance audit — memory leaks, process bloat, network latency, and runtime profiling. Use when asked to 'performance audit', 'why is everything slow', 'find memory leaks', 'check system health', 'diagnose slowness', or 'perf check'.

arndvs Skill

Layered security audit on npm/pnpm/yarn projects before installing or running. Use to vet a GitHub repo, npm package, or local project before npm install/start/npx.

aws-samples Bundle

Compose a deployment from stack skills and generate executable artifacts (Makefiles, security disposition). Use when the user says 'compose', 'generate deployment', or invokes /ipa-compose.

aws-samples Skill

Provision or update centralized security infrastructure (IAM roles) for an IPA project. Use when the user says 'security', 'set up security', 'IAM roles', or invokes /ipa-security.

captainflasmr Skill

Review Emacs Lisp (elisp) packages for bugs, style/convention violations, and optimisation opportunities. Use this skill whenever the user asks to review, audit, check, or analyse an elisp or Emacs Lisp package, file, or set of files. Trigger on phrases like "review my package", "check my elisp", "audit this emacs package", "look for bugs in my lisp", "optimise my elisp", or any time the user shares .el files and wants feedback. Always use this skill when .el files are involved and improvement is the goal — even if the user just says "what do you think of this?" about an elisp file.