Security

itechdev-mx Bundle

When the user wants to research, profile, or analyze competitors from their URLs. Also use when the user mentions 'competitor profile,' 'competitor research,' 'competitor analysis,' 'profile this competitor,' 'analyze competitor,' 'competitive intelligence,' 'competitor deep dive,' 'who are my competitors,' 'competitor landscape,' 'competitor dossier,' 'competitive audit,' or 'research these competitors.' Input is a list of competitor URLs. Output is structured competitor profile markdown files. For creating comparison/alternative pages from profiles, see competitor-alternatives. For sales-specific battle cards, see sales-enablement.

mr-fang-vlsi Bundle

Audit whether the local BSPDN physical contract is coherent across paper assumptions, GT3 tech collateral, layer/via topology, and current flow policy before promotion or expensive attribution experiments.

mr-fang-vlsi Bundle

Audit and refine academic manuscripts for structure, terminology consistency, LaTeX hygiene, and high-signal grammar fixes. Use this skill for theses, papers, proposals, and technical reports when the task is manuscript writing rather than experiment execution.

paultyng Bundle

Use when the user asks for a deep review, full review, comprehensive review, production readiness assessment, full audit, multi-domain audit, "security and reliability and code review", or "review everything". Also use when the user explicitly requests performance review alongside the comprehensive request (e.g. "include perf", "review including performance", "deep review with perf"); without that explicit phrasing, performance is excluded. Do NOT use for narrow single-domain reviews (use the matching review-* skill directly).

paultyng Bundle

Use when the user asks for an API compatibility review, breaking change review, proto breaking change review, buf breaking review, OpenAPI compatibility check, gRPC backwards compatibility audit, "are these API changes breaking", "did we break the wire", contract evolution review, or backwards-compatibility audit on an API surface.

paultyng Bundle

Use when the user explicitly asks for a performance review, benchmark review, profiling review, perf audit, pprof analysis, allocation review, latency regression check, hot-path review, throughput review, "is this fast enough", or "review perf". This skill is opt-in only — never run automatically as part of review-all unless the user explicitly requests it.

paultyng Bundle

Perform a reliability review covering graceful shutdown, gRPC production patterns, stability patterns (timeouts, circuit breakers, bulkheads), and stability anti-patterns. Use when the user asks for a reliability review, production readiness assessment, stability analysis, or graceful shutdown audit.

paultyng Bundle

Use when adding or evaluating a project dependency in any language, phrases like "should I use X library", "evaluate <package>", "what library for Y", or when reviewing a PR that touches a manifest (go.mod, package.json, requirements.txt, pyproject.toml, Cargo.toml, Gemfile, mix.exs, composer.json). Also use when comparing alternatives, choosing between major versions of the same package, or when review-security / review-code encounters a new dep in scope. Produces a GO/CAUTION/NO-GO verdict with the canonical package coordinate to use. Language-specific quirks (Go's semantic import versioning /v2 paths, npm scoping, etc.) live in references/.

paultyng Bundle

Review documentation quality and sync with implementation across Go doc comments, proto comments, OpenAPI specs, markdown files, and example tests. Use when the user asks for a documentation review, doc audit, or wants to check that docs are in sync with code.

paultyng Bundle

Use when the user asks for an observability review, telemetry review, logging review, metrics review, tracing review, OpenTelemetry review, OTel review, Prometheus review, "are we observable", logging audit, structured logging audit, trace coverage check, span coverage check, metrics cardinality review, or production observability assessment.

quantipixels Bundle

Investigate one substantial, reusable, audit-worthy, or unusually hard-to-resolve question against the strongest practical claim-appropriate evidence. Persist a sourced research record when the conclusion deserves independent life; for peculiar version-specific technical questions, escalate to exact upstream source/tests only when ordinary research cannot resolve a materially decision-changing claim. Exclude routine facts that can be consumed immediately.

quantipixels Bundle

Review a bounded code candidate, assess an existing codebase's engineering quality, or audit behavior parity for one stateful refactor or rewrite. Focus on exact identities, credible failure mechanisms, adversarial validation, maintainability evidence, and an evidence-backed result.

go-musicfox Bundle

Review a diff, branch, or PR against correctness, security, breaking-change, and quality standards — runs the validation gate, applies the built-in checklist plus any repo-local one, and produces severity-ranked findings with an approve/request-changes verdict. The review engine behind om-auto-review-pr and om-review-prs.

agentproto Skill

Walk through authoring a SECRETS.md inventory — slugs, access grants, audit metadata — for a workspace whose tools and workflows need third-party credentials. Values stay in the vault; the manifest is metadata only.

agentproto Skill

Walk through writing an agency.workspace/v2 manifest — either the canonical root for a new commercial agency or a per-context view that extends a parent — using the defineAgencyWorkspace canonical signature, with explicit one-way-switch checks across signing, audit, scope, and contract before validation.

agentproto Skill

Walk through writing a governance.workspace/v1 manifest — either the canonical root for a new governance scope or a per-context view that extends a parent manifest — using the defineGovernanceWorkspace canonical signature. Enforces the one-way switches (audit.appendOnly, signing.required) that no descendant view may relax.

egorfedorov Bundle

Design, implement, and audit provably fair RNG and cryptographic seed workflows for casino games. Use when defining commit-reveal architecture, server/client seed lifecycle, nonce progression, hash/HMAC outcome derivation, bias-free range mapping, fairness transcript verification, or cryptographic release sign-off evidence.

egorfedorov Bundle

Design, audit, and tune casino game math for Stake-style game pipelines. Use when defining mode math, paytables, reel strips, feature frequencies, RTP/volatility/hit-rate targets, book weights, max-win controls, simulation plans, or release sign-off evidence.

gcwing Skill

Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site. (gstack)

greenpau Bundle

Create or revise repo-local skills connected by actionable routing statements from AGENTS.md through broad and increasingly specialized skills. Use when documenting AgentX engineering knowledge, adding or routing a skill, reorganizing the skill hierarchy, or auditing that every skill is reachable and useful to contributors.

greenpau Bundle

Go coding standards and implementation directives for the terminal-first AgentX client. Use when creating, modifying, or reviewing Go code, runtime architecture, conformance status, package boundaries, configuration, constructors, errors, concurrency, security, persistence, protocol types, adapters, or tests.

greenpau Bundle

Create, review, or revise repository-compliant commit messages and commit-message files. Use when summarizing source changes for version control, choosing a change indicator, checking commit-message structure, or when the user asks to create a commit message for changes in this repository.

greenpau Bundle

Develop, review, or extend AgentX across its complete application architecture. Use when tracing a requirement across runtime domains, deciding which implementation subskill owns a behavior, changing cross-domain boundaries, or auditing project coverage.

greenpau Bundle

Audit or refresh AgentX implementation coverage, route reachability, contract traceability, diagram validity, and conformance evidence. Use after changing application source, AGENTS.md, an implementation skill, a Draw.io diagram, or a runtime boundary that changes documented behavior.

herchila Skill

Defines and protects brand consistency across voice, visuals, and messaging. Use when you need to establish a brand identity from scratch, audit existing content for brand consistency, define tone of voice guidelines, create a brand style guide, or ensure new content matches the brand. Triggers on: "define our brand", "does this match our brand?", "create brand guidelines", "what's our tone of voice?", "audit our messaging", "we need a brand identity"

herchila Skill

Keeps servers, databases, and infrastructure healthy with minimal ongoing effort. Use when you need to set up maintenance routines, respond to an infrastructure incident, update dependencies, audit security, configure backups, optimize server costs, or establish operational health checks. Triggers on: "server is down", "update dependencies", "security audit", "database backup", "reduce hosting costs", "infrastructure health check", "incident response", "certificate expired"

jackneil Skill

Use when auditing or hardening a repository against software supply-chain attacks — including dependency lockfile integrity, CVE scanning, malware/typosquat detection, GitHub Actions SHA pinning, secrets scanning, provenance/signing, and SLSA/HIPAA control mapping. Triggers on phrases like "lock down dependencies", "supply chain audit", "is this repo secure", "dependency poisoning", "typosquat", "harden actions", "pin actions", "audit deps", or any concern about consuming or shipping third-party code safely.

jackneil Bundle

Use when the user wants a product continuously driven forward without them steering each step — an autonomous session (overnight or daytime) that discovers, builds, verifies, and lands improvements across every lens (user types, UX, security, compliance, reliability, DX, product strategy). Triggers on "night shift", "run the night shift", "drive this product forward", "keep improving this while I'm away", "work the queue overnight", "make this best-in-class across the board", "put the army on it". Accepts a steer argument ("night-shift focus security", "night-shift billing UX") which prioritizes that lens or area. Accepts an auto-merge argument ("night-shift auto-merge") which lands each verified improvement to main behind green checks on pre-production repos. NOT for a single decided feature (/goal-maker), a one-off QA pass (/qa), read-only scoring (coverage-matrix), or driving the coverage matrix cell-by-cell (/bhag).

jackneil Bundle

Use to dogfood and evaluate the SHIT out of a running web app end-to-end — drive it in a browser as EACH real user persona through EVERY workflow (login → core jobs → the nitty-gritty), catching both how it WORKS and how it LOOKS. Finds misalignment, dark-mode dark-text / low contrast, a modal that doesn't open, a close button that doesn't close, an action that doesn't update the view (stale data), inaccurate numbers, and common tasks buried too deep to discover. Triggers include "audit the whole app", "dogfood it", "evaluate every persona and workflow", "go through the entire product", "find what's broken or looks bad", "is this actually usable", "click-count / discoverability pass".

evan-daruwalla Bundle

Windows scheduled-task auditor — READ-ONLY, only ever runs `schtasks /query`. Flags Last Result != 0, Disabled, and enabled tasks whose Next Run Time is N/A or already past. plan mode PRINTS the `schtasks /create` line and NEVER runs create/delete/change. --fixture parses a saved capture offline. Use when: "audit my scheduled tasks", "did the scheduled task run", "why did the rebalance task fail", "is that task disabled", "cron-task-manage". Zero deps.

evan-daruwalla Bundle

Read-only tree scan for Windows corruption traps: any non-ASCII byte in .bat/.cmd (one byte corrupts the whole parse — reports the offset), CRLF in .sh, BOM/invalid UTF-8 in .json, root files shadowing cmd builtins or purely numeric names, NTFS case collisions. Use when: "path-quirk-audit", "scan for windows file quirks", "check for bat/encoding landmines", before shipping a Windows-run repo. Symptom-side runbook = winfix. Zero deps.

evan-daruwalla Bundle

Deterministic secret scanner for git repos — full history (--history) or staged diff (--staged): 15 provider-key rules, private-key blocks, JWTs, sensitive filenames (.env, .pem, id_rsa, *_keys.env), high-entropy + weak-password heuristics. Backs commit-gate in staged mode. Use when: "scan for secrets", "leak scan", "did I commit a secret", after any repo goes public or any suspected exposure. Reads .claude/secrets-inventory.md. No deps, no API key.

evan-daruwalla Bundle

Read-only syntax scanner for cross-shell traps, reporting file:line + why + the PS-5.1-safe fix: && and || (PS 5.1 parser error), ternary / ?. / ?? (PS7-only), Read-Host/pause/Out-GridView (block non-interactive runs), Set-Content/Add-Content/Out-File without -Encoding, bash-isms in .ps1 and PowerShell-isms in .sh. Use when: "will this run on PowerShell 5.1", "lint my shell scripts", "shell-portability", before scheduling a script — and `check "<command>"` for ONE command string before handing it to someone to run, the surface a file scan cannot reach. Syntax only — encoding/filename quirks are path-quirk-audit. Zero deps.

evan-daruwalla Bundle

The coding rules that drift without a trigger: surgical changes, root cause over symptom, simplicity-first rungs with marked shortcuts, verify before claiming done with one runnable check. hooks/postwrite-check.js injects this body after every Edit/Write of a CODE file (docs/config excluded, debounced so a burst nudges once) so the rules land where code is being written. Also "check this", "verify that code", "did that actually run". Not an audit (/audit), not a bug hunt (/code-review).

evan-daruwalla Bundle

Read-only SQLite integrity audit — opens mode=ro, never writes. Three checks: PRAGMA integrity_check, PRAGMA foreign_key_check, and explicit orphan detection counting child rows whose FK value has no parent (catches inserts made with enforcement OFF). Per-check PASS/FAIL with counts + first 5 rowids; exit 1 on any failure. Use when: "audit the database", "check DB integrity", "find orphaned rows", "is the SQLite file corrupt". Zero deps.

evan-daruwalla Bundle

Read-only hygiene audit of secret-bearing FILES by NAME (.env*, *.pem, *.key, id_rsa*, *_keys.env, credentials*.json, secrets.*): per-file verdict TRACKED-SECRET (already in the index — worst) / UNIGNORED (one `git add` from leaking) / OK. --fix-print proposes .gitignore lines, NEVER applies them. Names only — content/history scanning is history-leak-scan. Use when: "is my .env ignored", "audit secret files", "local-secrets", before a repo goes public. Zero deps.