Security

data-ai-xyz Skill

Advisory artefact quality review for planning artefacts (Epic, Feature, Story, Testplan). Use when the user asks to critique, review quality, check a planning artefact, audit a story or epic, or run a pre-refinement quality pass. Detects artefact type and runs the matching check set. Never rewrites the file.

data-ai-xyz Skill

On-demand code peer review of an explicitly-scoped target. Use when the user asks for a peer review, a code review, or to review a source/code file, diff, branch, or PR. Reviews across correctness, security, performance, maintainability, test coverage, and error paths, then returns severity-ranked findings (blocker / major / minor) each with a suggested fix.

data-ai-xyz Skill

Rank installed AI tools (Skills, Agents, Commands, Plugins) by fit for this project and write relevance overlays under _00-Project-Management/97-AI-Reference/. Reads PROJECT-CONTEXT.md (project type / tech stack) plus the installed inventory and ranks each item HIGH / MED / LOW with a one-line rationale keyed to project type. Use when the user wants to rank or audit which installed tools are relevant vs. off-stack, or invokes /tandem:curate-toolkit.

data-ai-xyz Skill

Fill in or trim a CLAUDE.md so only non-discoverable, project-specific, broadly-relevant lines remain — the judgement layer applying the three content-economics tests over `pm:claude-scaffold`'s stubs. Use when a CLAUDE.md stub created by `pm:claude-scaffold` still carries `[auto — verify]` or `<fill in>` markers, when `pm:claude-audit` reports `incomplete`, or when an existing CLAUDE.md needs trimming.

firzus Bundle

Audit a codebase for dead code and AI slop, clear each suspect against the legitimate reason it exists, and remove only what the evidence carries.

firzus Bundle

Gamification design for products, apps, and game meta-layers: design an engagement, habit, or retention system; choose or audit mechanics (points, badges, leaderboards, streaks, progress bars, variable rewards); diagnose mechanics that backfire (novelty decay, demotivated users, streak churn); or run an ethics / dark-pattern check.

mia-cx Skill

Audit and slim always-loaded guidance: AGENTS.md, CLAUDE.md, Cursor rules.

mia-cx Skill

Audit and slim a SKILL.md: invocation mode, description, body, references.

mia-cx Skill

Use when the user asks to audit, check, or upgrade dependencies, or mentions vulnerabilities, outdated packages, or dependency bloat.

flagrare Skill

Post-commit gate. Invoke after every commit (right after /flagrare:staleness-audit). Checks whether a release is due, and if so, proposes a semver bump and a value-focused CHANGELOG entry modeled on Valve's Dota 2 patch notes, describing what the user gains, never what was refactored. Acts on approval.

flagrare Skill

Focused security review of a change. Finds HIGH-CONFIDENCE, concretely exploitable vulnerabilities in the staged diff (injection, broken authn/authz, secrets and data exposure, unsafe deserialization, crypto misuse, SSRF) and audits dependencies when a lockfile moved, using the repo's own package manager. Runs as Check 7 of /flagrare:implementation-review, and standalone when the user says 'security review', 'security audit', 'check this for vulnerabilities', 'is this safe', 'any security holes', 'threat check', or before shipping anything that touches auth, user input, secrets, or untrusted data. Reports only findings with a concrete exploit path, never theoretical noise.

flagrare Skill

Pre-commit quality gate. Invoke before every git commit, after /flagrare:staleness-audit. Seven checks, plan gaps, use-case coverage gaps, missing test scenarios, test philosophy violations (Kent Dodds Testing Trophy), SOLID violations, Clean Code violations, and security vulnerabilities. Each check is delegated to a parallel subagent. Surfaces findings before they land in history. Also invoke when the user says review this, am I done, did I miss anything, or check the quality.

fernandoartalf Bundle

Reviews Business Central AL extension code against a prioritized convention stack: AppSource validation requirements, CodeCop/PerTenantExtensionCop analyzer rules, alguidelines.dev community standards, and al-copilot-skills catalogue patterns. Audits five categories that the AL compiler does not catch: naming and structure, performance anti-patterns, extensibility contract, SaaS readiness, and AppSource blockers. Produces a structured review report with severity-classified findings and a prioritized fix list. Use this skill whenever you want to review AL code before a PR, before AppSource submission, before deploying to a customer, when onboarding a new developer, when inheriting legacy AL code, or when a senior developer needs to audit an extension. Also trigger when the user says 'review my code', 'check this extension', 'is this AppSource ready', 'code quality', 'AL best practices', or 'what is wrong with this'.

fernandoartalf Bundle

Generate Isolated Storage implementations for Business Central with security best practices. Creates a setup table (Access = Internal), a management codeunit (Access = Internal), and optionally a setup page — wired to IsolatedStorage.Set/Get/Delete with user-chosen DataScope and a GUID secret key in a locked Label. Supports encryption via CryptographyManagement. Use when: create isolated storage, generate secret storage, store password securely, store API key, store client secret, store token, store credential, replace Service Password table, encrypted storage, DataScope, secure storage, credential vault, OAuth secret, bearer token storage, personal access token.

jasonkneen Skill

Add, translate, or audit TinyWorld UI strings across English/French/Chinese/Spanish. Use when adding user-facing gameplay text, when `npm run i18n:check` fails, when a string shows up in English in a non-English locale, or when adding a new language. No translation API — Codex does the translating directly, using the established glossary for consistency.

jasonkneen Skill

Use when changing the in-world CCTV / "Truman Show" surveillance cameras in Tiny World Builder — render-to-texture security feeds, the black-and-white CRT/VHS monitor shader, camera placement (lobby side-cams, pumpkincam, treecams), subject tracking, or the lobby screen cutting to live feeds.

kina2711 Bundle

Protect data through classification, threat modeling, least privilege, encryption, masking, audit, privacy workflows and incident response. Use for Data Security, Privacy, DSR or sensitive-data risk work.

felixgeelhaar Skill

Senior security partner. Use for threat modeling (STRIDE, PASTA), AppSec (OWASP, ASVS), Zero Trust, supply chain (SLSA, SBOM), compliance (SOC2, GDPR, HIPAA, PCI), incident response, SDLC review.

gannonh Bundle

Verify milestone achievement against its definition of done, checking requirements coverage, cross-phase integration, and end-to-end flows. Triggers include "audit milestone", "verify milestone", "check milestone", and "milestone audit". This skill reads existing phase verification files, aggregates technical debt and gaps, and spawns an integration checker for cross-phase wiring.

gannonh Bundle

Create phases to close all gaps identified by milestone audit. Triggers include "plan milestone gaps", "plan gaps".

gologo13 Skill

Perform a thorough code review that verifies functionality, maintainability, and security be...; keywords: security, pr, performance, architecture. Use only on explicit request; skip in routine implementation discussions.

gologo13 Skill

Comprehensive security review to identify and fix vulnerabilities in the codebase; keywords: security, review, fix. Use only on explicit request; before execution, review diffs and list impact scope.

gologo13 Skill

Perform a comprehensive security review of the current code and provide specific remediation...; keywords: security, api, review, error. Use only on explicit request; before execution, review diffs and list impact scope.

jorgemenadev Skill

Reclaim disk on Jorge's Mac mini with scripts/storage-hygiene.sh — worktrees, build and dependency caches, T3 Code thread history, Xcode data, tool caches. Use when free space is low, Jorge asks to clean up space, or the storage-hygiene cron needs diagnosis.

allblueuk Skill

编译 paper/main.tex 到 paper/paper.pdf。pdflatex + bibtex 两遍循环，处理引用与交叉引用。前置：所有 sections/ 已写、references.bib 通过 audit。当用户说"编译论文"、"render paper"、"出 PDF"时调用。

allblueuk Skill

反方拷问：质疑模型机制、识别策略、数值结果。当用户说"挑刺"、"反驳一下"、"devils advocate"、"audit"时调用。

chann Bundle

Use when packaged skills must be checked against the repository's skill contract before a merge or release, including "스킬 규칙 검사해줘", "스킬 패키지 점검", "스킬 카탈로그 동기화 확인", "audit my skills", "check every skill against the contract", "which skills are missing evals", "/skill-audit", or "$skill-audit". Reports every violation with its rule, file, and fix, and exits non-zero so it works as a gate. Read-only by default; use skill-forge to author or repair a package.

chann Bundle

Use when a skill package must be created, renamed, split, extended, or brought back into line with the repository's skill contract, including "스킬 새로 만들어줘", "스킬 패키지 만들어", "이 스킬 규칙에 맞게 고쳐줘", "add a new skill", "scaffold a skill package", "make this skill follow the contract", "/skill-forge", or "$skill-forge". Writes SKILL.md, the Codex descriptor, the slash command, evals, catalog and locale entries, published counts, and focused tests, then proves the result with skill-audit. Use skill-audit alone to inspect without changing anything.

lucking7 Bundle

Refresh stale learning and pattern docs under docs/solutions/ by reviewing them against the current codebase, then updating, consolidating, or deleting drifted ones. Use when the user asks to "refresh my learnings", "audit docs/solutions/", "clean up stale learnings", or "consolidate overlapping docs", or when ce-compound flags an older doc as superseded. Do not trigger for general refactor, debugging, or code-review work unless the user has explicitly pointed at docs/solutions/.

focus-gts Bundle

Validate product data integration between Adobe Commerce and an AEM Edge Delivery Services storefront. Checks Catalog Service API connectivity, product data rendering accuracy, pricing consistency, image loading, category navigation, and Live Search results. Identifies mismatches between the catalog source and the storefront display. Use when product pages show incorrect data, images fail to load, or after catalog updates to verify storefront accuracy.

focus-gts Bundle

Audit and optimize the AEM Edge Delivery Services query index configuration. Analyzes indexed properties against actual usage, identifies missing or stale pages, checks index size and pagination, and generates recommendations for helix-query.yaml changes. Use when the query index feels bloated, pages are missing from block-driven lists, or you need to verify index health before launch.

louisbrulenaudet Skill

pnpm workspace review (pnpm-workspace.yaml catalog, security policies, allowBuilds, lockfile health) against current official pnpm best practices. USE WHEN: user runs /review-pnpm or explicitly asks for this review. DO NOT USE WHEN: reviewing app code, other dev dependencies, or implementing features.

louisbrulenaudet Skill

Security-focused review. USE WHEN: user runs /review-security or explicitly asks for this review. DO NOT USE WHEN: implementing features or fixing bugs unless the user asked for a review.

nahisaho Bundle

6フェーズ検証ループ（Build→Type→Lint→Test→Security→Diff）でPRレディネスを判定。

kennguyen887 Skill

When to use

makigjuro Skill

Review code changes for security, architecture, and quality issues. Use for deep PR-level review -- checks OWASP vulnerabilities, hexagonal architecture violations, code smells, and test gaps. For a quick architecture-only check, use /check-architecture instead.