Security

aidotnet Bundle

Internal prototype QA helper. Use only after a Product Design prototype, URL-to-code build, or image-to-code build has a source visual target and a rendered implementation to compare before handoff. Do not use for broad UX critique, design critique, product audits, or flow reviews; route those user-facing requests to audit.

carlitose Bundle

End-to-end, self-contained Python/TypeScript workflow that maps and audits a whole repo, then recursively deepens modules. Use to improve or modernize a codebase, reduce technical debt, make this more testable, find refactoring opportunities, deepen shallow modules, consolidate tightly-coupled modules, make codebase AI-navigable, or run a full-repo audit. Worker delegation is optional and human-gated.

carlitose Bundle

Produce, validate, and reduce the canonical Verification Record for a frozen candidate without fabricating evidence or authorization.

giostriquer Skill

Use for a requested investigation or audit; routine checks and known fixes stay in their ordinary workflow. Not for work that starts from an idea to build (that path grounds against the codebase and goes to brainstorming).

giostriquer Bundle

Run a proactive audit of the project documentation surface. Surfaces gaps that diff-driven wiki-maintainer passes miss by construction, such as missing pages, broken links, undefined terms, missing decision records, orphaned files. Report-only; never edits docs directly. Use when the user asks for a doc audit, a coverage check, a drift sweep, or "what's missing in our docs."

giostriquer Skill

Use when running a broad QA or verification pass over a release, branch, feature, or app surface that splits into independent slices and deserves team-scale coverage against the real running artifact, on the user's ask (directly or as audit's team-sweep pick), never by default. NOT for a single code change (that is empirical-proof) or a single premise, ticket, or hunch (that is claim-check).

giostriquer Skill

Use when the session should look back at how the workbench process itself ran, rather than at the code it produced or the user's choices. User-invoked only.

giostriquer Skill

Use when running a multi-ticket epic whose implementation you delegate to other sessions the operator dispatches by hand, and when closing such an epic on a blind re-audit rather than an empty ticket list. This session owns the epic and never implements, commits, or opens the PR itself. Not for implementing a change yourself, and not for a single ticket.

lazyfroglol Skill

This skill provides guidance for cracking 7z archive password hashes. It should be used when tasks involve extracting hashes from password-protected 7z archives, selecting appropriate cracking tools, and recovering passwords through dictionary or brute-force attacks. Applicable to password recovery, security testing, and CTF challenges involving encrypted 7z files.

lazyfroglol Skill

This skill provides guidance for extracting secrets from vulnerable executables. It should be used when tasks involve binary analysis, reverse engineering executables to find hidden flags/secrets, or exploiting buffer overflows and other vulnerabilities to extract protected data. Applicable to CTF challenges, security research, and authorized penetration testing scenarios.

vahagn-madatyan Bundle

Network-security-focused SIEM log analysis across Splunk, ELK, and QRadar platforms. Guides forensic timeline construction from network device syslog events — firewall denies, authentication failures, configuration changes, interface events, VPN tunnel state, and lateral movement indicators. Provides platform-independent diagnostic reasoning with platform-specific query syntax using [Splunk]/[ELK]/[QRadar] inline labels.

vahagn-madatyan Bundle

CIS benchmark compliance assessment for network infrastructure devices. Maps device configuration against CIS benchmark controls organized by Management Plane, Control Plane, and Data Plane categories across Cisco IOS, PAN-OS, JunOS, and Check Point platforms. References control IDs for traceability without reproducing copyrighted benchmark content.

vahagn-madatyan Bundle

Dual-platform Cisco ASA and Firepower Threat Defense (FTD) firewall audit with ACL analysis, NAT policy validation, Modular Policy Framework / Access Control Policy evaluation, Snort IPS assessment, VPN configuration review, and logging completeness verification.

vahagn-madatyan Bundle

Wireless network security audit covering SSID policy, 802.1X/EAP validation, WPA3 encryption assessment, rogue AP detection, and RF security posture across Cisco WLC, Aruba, and Meraki wireless controllers. Systematic audit from SSID inventory through authentication, rogue AP, and RF assessment to final report.

vahagn-madatyan Bundle

FortiOS VDOM segmentation audit with UTM profile binding validation, FortiGuard service health assessment, SD-WAN security evaluation, and HA cluster posture check. Systematic per-VDOM policy analysis for FortiGate appliances and FortiGate-VM instances.

vahagn-madatyan Bundle

PAN-OS zone-based security policy audit with App-ID/Content-ID analysis, Security Profile Group validation, zone protection assessment, and decryption policy review. Systematic rule-by-rule evaluation for Palo Alto Networks PA-series and VM-series firewalls.

vahagn-madatyan Bundle

CVE assessment and CVSS v3.1 scoring for network infrastructure devices. Maps running software versions to known vulnerabilities via NVD and vendor advisories, classifies risk by severity, network exposure, and exploit availability, and generates prioritized remediation plans with SLA-driven timelines.

vahagn-madatyan Bundle

Check Point R80+/R81.x rulebase layer analysis with blade activation audit, SmartConsole management plane validation, NAT policy review, identity awareness assessment, and compliance verification. Systematic layer-by-layer evaluation for Check Point Security Gateways managed via Management Server or Multi-Domain Server (MDS).

vahagn-madatyan Bundle

Network forensics evidence collection and analysis during security incidents. Guides volatile evidence preservation, lateral movement detection via flow records and ARP/MAC/CAM table analysis, and read-only containment verification across Cisco IOS-XE/NX-OS, Juniper JunOS, and Arista EOS. Scoped to network artifacts only — packet captures, flow data (NetFlow/sFlow/IPFIX), forwarding tables, routing state, and device logs. Not general incident response, endpoint forensics, or malware analysis.

vahagn-madatyan Bundle

Monitoring infrastructure assessment covering Grafana dashboard analysis, PromQL query validation, alert rule evaluation, SLA/SLO reporting review, and Prometheus data source health checks for network operations environments.

vahagn-madatyan Bundle

NIST Cybersecurity Framework (CSF) and SP 800-53 Rev 5 compliance assessment for network infrastructure. Maps device configuration against 6 control families with direct network device relevance — Access Control (AC), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), System and Communications Protection (SC), and System and Information Integrity (SI). Focuses on CSF Protect (PR) and Detect (DE) functions for network security posture assessment.

edloidas Bundle

Audit an existing test suite for anti-patterns — tautological mock round-trips, weak assertions (toBeDefined / assertNotNull), implementation coupling, flaky timing, snapshot rubber-stamping, and tests claiming guarantees they cannot provide — and report a keep / tighten / rewrite / delete verdict per test.

edloidas Bundle

Audit package.json scripts for naming, composition, lifecycle hooks, consistency, and performance.

edloidas Bundle

Audit a repository for security risks — supply chain, CI, release, runtime, secrets, repository settings, and package-manager install-time controls for pnpm and bun. Reads and reports only; never mutates the repo or its GitHub settings. Aggregates findings from focused subagents across whichever areas the repo exposes.

edloidas Bundle

Audit tsconfig.json against TypeScript 7 and report which compilerOptions are hard errors, which are redundant and safe to drop, and which must now be added.

edloidas Bundle

End-to-end GitHub issue workflow: analyze the issue, plan and implement, verify with available tests/build/lint and an optional live observation, simplify, audit the tests it added, attack the change with parallel adversarial reviewers and fix what they find, trim comments and artifacts, then choose a push / PR / merge endgame — holding the merge while Copilot and other automated reviewers report, and answering and resolving their threads. The lifecycle's git and GitHub writes are delegated to `issue-flow`, the review threads to `pr-review`.

edloidas Bundle

Audit a pnpm 10+ workspace for configuration and monorepo problems: dependency placement, workspace protocol usage, hoisting, catalog configuration, build order and build hooks, dependency rules, and .npmrc settings that are now defaults. Reads and reports only.

the-artificer-of-ciphers-llc Skill

Apply Kerckhoffs's Principle when reviewing security designs, authentication systems, encryption implementations, or any situation where someone relies on keeping an algorithm, method, or system architecture secret for security. Trigger on phrases like "security through obscurity", "we keep the algorithm secret", "don't publish how this works", "our system is secure because nobody knows about it", or any security discussion where the secrecy of the design—rather than the secrecy of a key—is the security mechanism. This is a foundational principle of modern cryptography and security engineering.

adobe Skill

Defines when and how to run a consistency and validity self-audit on changed files and the migration plan. Apply before declaring any migration phase or significant implementation task complete.

bronc-x Bundle

执行明确要求的安全审查，或调查具体漏洞与信任边界风险。

bronc-x Bundle

诊断 SwiftUI 卡顿、过度更新、主线程负载或渲染性能问题。

ccoalm Bundle

现状盘点 / 当前能力梳理 / 按当前代码说明现状（某状态·数据怎么产生和消费）/ 现有流程、页面、API、数据、运营规则盘点 / as-is audit / current state inventory —— 交付物是**现状清单本身**：现在怎么运作、已有哪些能力与例外、事实来源与 freshness、缺口和冲突，含按 commit 固定的代码现状取证。Skip 要的是意图、用户故事、验收标准、问题池（「到底要什么」）→ requirement-intent；要的是本轮改哪些、不改哪些、切几版（变更边界）→ requirement-scope；问线上是否已启用 → platform-observability；代码/项目质量评估 → product-rd-workflow；bug 根因 → defect-diagnosis。

designgrappler Bundle

The "Safety Firewall" that ensures the implementation team’s output is secure and adheres to project-specific privacy standards.

designgrappler Skill

The "Structural Critic" that audits specialist output and issues a binary PASS or BLOCKED verdict. No track is complete until the Quality Gate approves. Read-only — never fixes, only judges.

sprngr Bundle

Read-only deferred-work ledger from TODO/FIXME/HACK/XXX comments. Use when: "duck debt", "what did we defer", "audit deferred work".

sprngr Bundle

Stale/outdated comment and doc cleanup audit. Flags comments contradicting current code, removed behavior, or worktree-only add/remove never merged. Audit-first, patch handoff. Use when: "tidy comments", "clean up stale comments", "outdated docs audit", "duck-tidy".