Security

dfinity Skill

Persist canister state across upgrades. Covers StableBTreeMap and MemoryManager in Rust, persistent actor in Motoko, and upgrade hook patterns. Use when dealing with canister upgrades, data persistence, data lost after upgrade, stable storage, StableBTreeMap, pre_upgrade traps, or heap vs stable memory. Do NOT use for inter-canister calls or access control — use multi-canister or canister-security instead.

dfinity Bundle

Motoko language pitfalls, modern syntax, and architecture patterns for the Internet Computer. Covers persistent actors, stable types, mo:core standard library, dot notation, mixins, and common compilation errors. Use when writing Motoko canister code, fixing Motoko compiler errors, or generating Motoko actors. Do NOT use for deployment, icp.yaml, or CLI commands; for design review or audit of existing Motoko code, load reviewing-motoko instead.

dfinity Skill

IC-specific security patterns for canister development in Motoko and Rust. Covers access control, anonymous principal rejection, reentrancy prevention (CallerGuard pattern), async safety (saga pattern), callback trap handling, cycle drain protection, and safe upgrade patterns. Use when writing or modifying any canister that modifies state, handles tokens, makes inter-canister calls, or implements access control.

dfinity Skill

Improve an existing skill in the IC Skills repo (skills.internetcomputer.org). Load this skill whenever asked to improve, fix, update, enhance, review, or add content to an existing skill at skills/<skill-name>/SKILL.md — including adding pitfalls, updating canister IDs, fixing code examples, strengthening the description, or updating evals. Do NOT use for creating a brand-new skill (use skill-creator for that). Trigger examples: "the motoko skill is missing a pitfall", "update icp-cli for the new recipe format", "the ckbtc description is weak", "add an eval for the canister-security skill".

marcmarti9 Skill

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

oleg494 Bundle

A step-by-step problem-solving loop (classify the ask, define done, gather evidence, decide, act surgically, verify by observation, report outcome-first). Use when the user says "/fable-method", "use the fable method", or "approach this like Fable", or proactively when starting any multi-step task that no task-specific skill covers. Subcommands - plan (stop after the plan), audit (grade finished work against the loop), report (rewrite an answer outcome-first).

oleg494 Bundle

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

insight68 Bundle

Comprehensive financial audit tool for balance sheets and income statements. Use when Claude needs to verify balance sheet equilibrium, validate income statement items against detail records, track account changes with opening/closing balance reconciliation, verify cross-statement relationships, or generate audit reports with account analysis and transaction tracing.

insight68 Bundle

Skill Security Auditor

destynova2 Bundle

Continuous improvement cycle — orchestrates all cli-* skills on the current project, synthesizes results, and proposes prioritized improvements. Use when the user wants a full project review, a health check, a weekly cycle, or says 'audit everything', 'review the project', 'health check', 'what should I improve', 'run all audits', 'cycle', 'improvement cycle'. Designed for recurring use with '/loop 7d /cli-cycle'.

destynova2 Bundle

Generate and audit comprehensive project documentation from a Git repository. Produces standard documentation (CONTRIBUTING.md, architecture, troubleshooting) in Diataxis structure with zero AI markers by default. Use this skill whenever someone asks to document a project, generate docs, create a README, write API docs, or improve existing documentation. Also trigger when someone mentions "doc", "documentation", "readme", "explain this codebase", "onboard developers", or "make this project understandable".

destynova2 Bundle

Audit code quality with weighted scoring across 12 dimensions (naming, complexity, module design, DRY, errors, security, tests, architecture). Detects named anti-patterns (Fowler/Mantyla taxonomy). Use when reviewing code quality, auditing clean code compliance, checking for code smells, or saying 'audit code', 'code quality', 'code review', 'tech debt'. Invoke with an optional file or directory path.

destynova2 Bundle

Audit PostgreSQL database safety in Rust/SQLx applications. Use for schemas, migrations, constraints, indexes, transactions, repositories, state transitions, idempotency, concurrency, queues, multi-tenancy, soft deletion, ledgers, auditability, repair, database incidents, or whenever SQLx and PostgreSQL changes could violate business invariants under retries, failures, mixed versions, or concurrent execution.

destynova2 Bundle

Verify documentation-code coherence: detect stale references, broken links, terminology drift, outdated diagrams, and non-working examples. Use when the user wants to check if docs match reality, detect doc drift, verify README accuracy, find stale documentation, or says 'is my doc up to date', 'check coherence', 'sync docs', 'doc drift', 'stale docs', 'verify documentation'. Also triggers on 'broken links', 'outdated references', 'docs match code'.

destynova2 Bundle

Audit test plan quality and maturity. Scores coverage, techniques, pyramid balance, negative testing, NFR, automation, CI integration. Use when reviewing a test plan, test strategy, test suite structure, or saying 'audit tests', 'test quality', 'test plan review', 'test maturity', 'are my tests good enough', 'test scoring', 'test pyramid'. Also triggers on 'test coverage', 'test gaps', 'missing tests'.

destynova2 Skill

Design and implement safe PostgreSQL database changes for Rust/SQLx applications. Use for new schemas, migrations, constraints, indexes, repositories, transaction boundaries, state machines, idempotency, concurrency control, queues, multi-tenancy, soft deletion, ledgers, outbox/inbox, repair jobs, or corrections handed off by cli-audit-data.

destynova2 Bundle

Use this skill whenever the user wants to visualize, generate, audit, or scaffold a project directory structure. Triggers include: 'project structure', 'folder structure', 'directory layout', 'tree', 'arborescence', 'scaffold', 'init project', 'organize my files', 'naming conventions', or any request to understand or create how files and folders should be organized in a codebase. Also triggers when someone says 'create a new project', 'bootstrap', 'init', or asks 'where should I put this file'. Use for any language or framework. Do NOT use for file system operations unrelated to project organization (like disk cleanup or backup scripts).

destynova2 Bundle

Detect silent semantic drift between intended behavior (CONTRACTS.md) and actual implementation. Scans code against functional contracts, invariants, and known drift history to catch behavioral changes that compile and run but violate the original intention. Use when reviewing code changes, before commits, auditing behavioral conformity, or saying 'check drift', 'contract check', 'intention vs implementation', 'semantic drift', 'is this still correct', 'does this match the spec', 'behavioral regression', 'silent bug', 'autophagy scan'. Also triggers on 'CONTRACTS.md', 'invariant check', 'intention audit', 'contract violation'.

destynova2 Bundle

Audit shell scripts against Google Shell Style Guide + ops best practices. Scores 12 dimensions: strict mode coherence, error surfaces, logging, stderr hygiene, variable discipline, quoting, control flow, naming, CLI ergonomics, idempotency, namespace, and security. Goes beyond shellcheck — detects semantic anti-patterns invisible to linters (dead fallbacks under set -e, custom loggers vs logger(1), redundant package checks, env var injection in heredocs, missing getopts). Use when reviewing shell scripts, auditing bash code, checking deployment scripts, or saying 'audit shell', 'bash review', 'script quality', 'shell style', 'shellcheck not enough', 'review my script'. Also triggers on 'set -euo pipefail', 'getopts', 'shell injection', 'logger', 'bash best practices', 'google shell style'.

destynova2 Bundle

Ghostwrite, rewrite, and audit everyday professional exchanges in the user's voice: emails, replies, chat messages (Slack/Teams/Discord), LinkedIn DMs, client and recruiter answers, follow-ups, refusals, bad-news notes, and short announcements. Enforces zero AI tells (no em-dash reflex, no AI vocabulary, no assistant structure), front-loaded asks, one message = one ask, and target-language proofreading with correct diacritics. USE BY DEFAULT — even without a trigger word — whenever creating, editing, rewriting, translating, or auditing ANY text the user will send or publish in their name: message, mail, réponse, annonce, post, commentaire, DM, description produit. Also triggers on 'écris un mail', 'réponds à', 'relance', 'follow up', 'reformule', 'humanize this', 'sounds like AI', 'trop formel', or 'ghostwrite'. Do not use for CV/LinkedIn profiles (cli-forge-profile), commit/PR/release text (cli-git-conventional), or project documentation (cli-forge-doc, cli-forge-readme).

destynova2 Bundle

Audit and fix GitHub repository health: rulesets vs CI alignment, branch hygiene, PR lifecycle, release automation flow, permission issues, and transient CI failures. Detects misconfigurations that cause PRs to hang, CI to fail silently, branches to accumulate, and releases to stall. Use when the user says 'PR stuck', 'CI pending forever', 'branch cleanup', 'ruleset', 'release blocked', 'merge conflicts on sync-main', 'stale PRs', 'orphan branches', 'GitHub health', 'repo hygiene', 'required checks', 'path pruning', 'release-plz stuck', 'auto-merge not working', 'workflow scope', 'token permission'. Also triggers on 'gh api', 'rulesets', 'branch protection', 'status checks'.

destynova2 Bundle

Use this skill whenever the user wants to create, improve, audit, or rewrite a README.md file for any project. Triggers include: 'readme', 'README', 'documentation for my project', 'write a readme', 'improve my readme', 'project landing page', or any request to document a codebase, library, CLI tool, infrastructure project, or research repo. Also triggers when the user asks to 'make my project more accessible', 'add a getting started guide', or wants badges, installation instructions, or contributing guidelines. Use this skill even when the user just says 'document this' or 'make this repo presentable'. Do NOT use for API reference docs generation, full documentation sites (mdbook, docusaurus), or man pages.

destynova2 Bundle

Enforce Conventional Commits v1.0.0, SemVer 2.0.0, branch naming, commit guard, full-directory AI marker audits, and human ghostwriter style on all git/jj operations. Zero AI markers. Use on 'commit', 'branch', 'tag', 'release', 'changelog', 'semver', 'bump version', 'next version', 'CHANGELOG.md', 'audit markers', 'scan AI files', '/ghost', 'not an AI', or 'I'm not an AI'. Also trigger proactively when the user shares code changes without mentioning commit.

technickai Bundle

Use when a health check, audit, or monitor says something is BROKEN, before repeating that to anyone. Re-runs the check from the same context the failure came from and separates real failure from unknown, since a timeout, an HTTP 000, or a permission error means the test could not answer — not that the thing is down. Prevents reporting an outage that is actually a broken probe.

smk-labs Skill

End-to-end art-direction photo pass over a whole site: audit where photos earn their place, set one visual language, source, integrate, verify both themes, record credits. Triggers: "photo pass", "add photos to the site", «به سایت عکس بده». For one image use getpix.

viniciusjsdev Bundle

Design or refine an executable project change Spec with a human-readable SPEC.md and a resolved machine-readable SPEC.execution.json. Use for features, bugs, refactors, architecture changes, experiments, research, infrastructure, automation, or other bounded work that must be executable by a clean Codex thread. Do not implement the change or silently resolve consequential product, domain, security, billing, or compliance decisions.

viniciusjsdev Bundle

Audit a project's durable AI operating harness by reconciling documentation, decisions, AGENTS.md, Specs, local skills, runtime policy, thread state, completion evidence, validation, and implementation reality. Use for periodic harness health checks or final independent review. Do not implement product changes, approve missing evidence, infer unseen chat knowledge, or replace richer domain-specific auditors.

viniciusjsdev Bundle

Execute an explicitly approved, bounded commercial action through a connected platform in Manus and return a verifiable receipt. Use only for final publishing, scheduling, approved one-to-one contact, metrics reads, or CRM updates. Do not perform strategy, create accounts, change copy, expand recipients, bypass security, or start paid activity without exact approval.

viniciusjsdev Bundle

Audit and prepare a new or existing project to work durably with AI through sources of truth, domain-appropriate documentation, AGENTS.md, Codex context, local skills, Specs, runtime policy, thread policy, validation, evidence, and audit. Use when explicitly asked to bootstrap or evolve a project's AI operating harness. Do not build the project's product, conduct market research, launch commercially, or replace richer domain-specific contracts.

viniciusjsdev Bundle

Add, organize, run, and assess Django backend tests and architecture validation for an approved implementation. Use for DTO, Mapper, Service, Repository, Controller/API, permission, security, migration, integration, and boundary-scanner coverage. Do not use to weaken assertions, conceal failures, or change approved behavior merely to make tests pass.

wix Skill

Store Analysis - Comprehensive Store Audit

cspulse Bundle

Audits an account health score rather than reporting it, so the number can be trusted or discounted deliberately. Trigger whenever the user says "health score", "account health", "is this account healthy", "the score says green but", "health check", "why is this account red", "our health scores are wrong", "audit the health score", or asks what an account's health actually is. Also trigger when a green account has just churned, or when someone is deciding whether to act on a score. It separates what is measured from what is inferred, finds the inputs that are proxies wearing the clothes of evidence, checks whether the composite is averaging a growing signal against a dying one, and asks the question nobody asks: has this score ever been tested against accounts that actually left. Runs on whatever the user can describe about their scoring, and says plainly which parts of the read are unsupported.

mickpletcher Bundle

Rewrite and enhance resumes using a persistent library of principles harvested from real recruiters, hiring managers, and HR professionals. Always trigger immediately when the user's message starts with "rw". Also trigger on "resume writer", "rewrite my resume", "enhance my resume", "fix my resume", "review my resume", or any request to improve, audit, or critique a resume. Also trigger when the user pastes a recruiter or hiring manager post (LinkedIn, blog, Reddit) and says "add to my library", "add insight", "rw add", or indicates they want to capture it as a resume principle. Also trigger on "two page", "two-page", "trim to two pages", "fit on two pages", "two page audit", or "page trim" to run the two-page audit mode. Handles paste, .docx, .pdf, and screenshot inputs. Produces a full rewrite plus a condensed audit by default, with full forensic line by line audit only when requested. General-purpose skill that works for any user's resume, not just the skill owner.

myrgic Skill

Enumerate, classify, and summarize open pull requests across the myrgic GitHub org. Use when asked to triage PRs, check what needs review, audit open work, or surface stale or blocked PRs across repos.

myrgic Bundle

Manage and troubleshoot the zsh shell environment on macOS with Oh My Zsh. Use this skill when the user asks about PATH problems, missing commands, shell configuration, oh-my-zsh plugins, shell startup performance, environment variables, exposed secrets in dotfiles, terminal application settings (VS Code, iTerm2, Ghostty), or any zsh/shell troubleshooting. Triggers on requests like "fix my PATH", "why is my shell slow", "add a plugin", "audit my shell config", "check for secrets", "configure my terminal", "what's in my PATH", "command not found".

nafeeur Skill

Audit code and dependencies for concrete exploitable weaknesses while preserving MaskShift’s intentionally permissive local execution philosophy.