Security

noobygains Skill

Use when writing code that processes user input, manages authentication or authorization, constructs database queries, handles file operations, interacts with external data, exposes API endpoints, or manages secrets - any code that crosses a trust boundary

noobygains Skill

Use when preparing code for commit, PR, or merge - covers linting, type safety, bundle budgets, coverage thresholds, complexity limits, dependency audit, and dead code detection

shakacode Bundle

Audit multiple Codex tasks and visible ChatGPT chats for archive and follow-up actions, or recover interrupted Codex tasks when explicitly requested. Use for machine-wide cleanup and recovery after quota exhaustion or app restarts; use close-session or close-batch for one task.

shakacode Bundle

Audit GitHub Actions workflows and composite actions for expression injection, broad reusable-workflow secret inheritance, mutable or undocumented external references, and actions outside a closed trusted allowlist. Use when assessing GitHub Actions trust boundaries.

jamestexas Skill

Use when asked whether a repo's architecture is still right — a counterfactual "how would this be designed today?" question, a suspicion of over/under-engineering or monolith-vs-split, recurring bug families that smell structural, or before committing to a major refactor. Read-only, evidence-first, multi-pass; "the current design is largely right" is a valid verdict. Works on any language/repo.

jamestexas Skill

Use when one interface/trait has multiple implementations that are assumed equivalent (storage backends, providers, transports), when several public surfaces (CLI/API/webhook/worker) expose the same verb, when bugs cluster as "works on X but not Y", or to scope a guardrail-parity fix before estimating it. Read-only behavioral-contract audit producing two matrices; narrower and cheaper than a full counterfactual-audit — often its follow-up.

btafoya Skill

Enforces PSR-12, PHP 8.4+ idioms, security, Laravel/Symfony patterns, and clean code in PHP projects. Activates on .php files.

forcedotcom Skill

Triage GitHub Dependabot security alerts into one-point GUS work items that bump the outermost consumer. User-invoked only.

delphicleancode Skill

Delphi code review checklist — quality, security, performance, SOLID, memory

hainrixz Skill

Coach the user on what to fix first — rank the audit findings into a single, ordered to-do list by score impact and effort, and explain why each item is where it is. Read-only; advises, does not change anything. Use when the user asks what to do next, what to fix first, what matters most, how to prioritize, or where to start after an audit.

hainrixz Skill

Audit primary-key strategy — missing PK (severity 5), surrogate vs natural keys, UUIDv4 index fragmentation vs time-ordered UUIDv7/ULID/bigint, and int4/serial exhaustion on high-volume tables. Module M2. Feeds both the Design & Integrity (Llaves) and Performance & Scale (Escala) scores.

hainrixz Skill

Render a production-readiness GO/NO-GO grid for a database — runs a read-only audit, then maps the findings onto a fixed launch checklist (PITR/backups, RLS on tenant tables, FK indexes, money-as-numeric, timestamptz/UTC, connection pooling sized, migration reversibility, secrets-not-in-schema, charset/utf8mb4). Each row is PASS/WARN/FAIL/NEEDS-LIVE with the finding id, topped by a plain-language verdict. Read-only. Use when the user asks if a database is production-ready, ready to launch/ship, a go/no-go, a pre-launch or readiness checklist, or what to fix before going live.

hainrixz Skill

Audit naming conventions — inconsistent table/column casing and pluralization, ambiguous or reserved-word identifiers, untyped/opaque columns, inconsistent FK and boolean naming, and identifiers that fight the engine's case-folding rules. Module M7. Feeds the Design & Integrity score (Naming category, low weight).

hainrixz Skill

Audit index coverage for the query workload — composite index column order (ESR), covering and partial indexes, specialized types (GIN/GiST/BRIN, FTS, geo, JSONB-GIN), and foreign keys with no covering index. Module M11. Feeds the Performance & Scale score.

hainrixz Skill

Audit concurrency correctness — transaction isolation level, lost-update / read-modify-write races, queue-worker contention (SKIP LOCKED), and idempotency for key-value / document / wide-column writes. Module M14. Feeds the Performance & Scale score.

hainrixz Skill

Audit data-integrity constraints — missing NOT NULL on required columns, absent CHECK constraints for domain rules, missing UNIQUE on natural keys, and the over-nullable UNIQUE trap where NULLs silently permit duplicates. Module M5. Feeds the Design & Integrity score (Constraints category).

hainrixz Skill

Orchestrates a full database audit — detects the stack(s), dispatches read-only auditor subagents in parallel by paradigm, merges and dedupes their findings, computes the two never-blended scores (Design & Integrity + Performance & Scale) via score.mjs, and renders the report. Invoked by the audit command; not usually called directly.

hainrixz Skill

Audit index bloat — exact-duplicate indexes, redundant indexes whose key is a prefix of another, and unused indexes that only cost write amplification and storage. Module M12. Feeds the Performance & Scale score.

hainrixz Skill

Audit storage operability — VACUUM / autovacuum health and table-and-index bloat, transaction-ID wraparound risk (sev-5), and tombstone accumulation on wide-column stores. Module M18. Feeds the Performance & Scale score.

hainrixz Skill

Audit query-shape anti-patterns — SELECT *, structural N+1 (directional), OFFSET pagination vs keyset, and non-SARGable predicates that defeat indexes. Module M13. Feeds the Performance & Scale score.

hainrixz Skill

Audit read-scaling correctness — read-your-writes consistency when reads are routed to replicas, and materialized-view staleness / refresh strategy. Module M17. Feeds the Performance & Scale score.

hainrixz Skill

Audit column types and precision — money stored as float/double (severity 5), naive timestamp vs timestamptz/UTC, jsonb used to evade schema, enum-vs-lookup-table choice, and charset/collation (utf8mb4, case-insensitive collation). Module M4. Feeds the Design & Integrity score (Tipos category).

hainrixz Skill

Engine selection (M0) — at design/start time, recommends a database paradigm and engine for a described workload (access patterns, consistency needs, scale, team, platform), and names the runner-up with the trade-off you're accepting. M0 is a RECOMMENDATION, not a scored audit module — it emits no findings and never contributes to the Design or Performance score. Walks the decision tree in references/engine-selection-tree.md and is honest about lock-in and operability instead of fabricating benchmarks.

hainrixz Skill

Audit temporal and lifecycle modeling — soft-delete consistency and its uniqueness/query traps, presence and integrity of an audit/history trail, and retention / GDPR right-to-erasure handling (hard delete vs anonymization, retention windows). Module M8. Feeds the Design & Integrity score (Temporal category).

hainrixz Skill

Audit column defaults and generated columns — application-side timestamps that should be DB defaults, non-deterministic or wrong defaults, derived values that should be GENERATED ALWAYS / computed columns instead of drift-prone duplicated data, and identity/sequence defaults. Module M6. Feeds the Design & Integrity score (Tipos category, shared with M4).

hainrixz Skill

Audit horizontal scaling topology — declarative partitioning fit for large/time-series tables, hot-partition / skewed partition-key risk, and premature sharding that adds complexity before it is justified. Module M16. Feeds the Performance & Scale score.

hainrixz Skill

Audit foreign-key integrity — missing FKs that allow orphan rows (financial/auth = severity 5), absent or unsafe ON DELETE/ON UPDATE actions, reference cycles, and composite-FK column/order mismatches. Module M3. Feeds both the Design & Integrity (Integridad referencial) and Performance & Scale (Query) scores.

fullrefit Bundle

Comprehensive skill creation, improvement, and packaging following the agentskills.io open standard. Produces deployment-ready .zip files for upload to Claude.ai, Claude Desktop, Claude Code, Cowork, or any agentskills.io-compatible platform. Use when building new skills from scratch, auditing or improving existing skills, authoring SKILL.md files, configuring frontmatter, structuring bundled resources, or packaging skills for distribution. Handles the full lifecycle: intent capture, resource planning, SKILL.md authoring, validation, packaging, and iteration. MANDATORY TRIGGERS: skill creation, SKILL.md, skill improvement, skill audit, frontmatter, skill packaging, agentskills.io, progressive disclosure, skill validation, skill architecture, bundled resources, create a skill, build a skill, package a skill, new skill, update skill, improve skill.

limonequantistico Skill

Audit environment variables, secrets hygiene, and production readiness. Use only when the user explicitly asks for an env or secrets review or runs /env.

limonequantistico Skill

Establish or audit application logging — what gets recorded, at what level, with what context — shaped to the project's architecture and existing stack. Use only when the user explicitly asks about logging or runs /logs.

limonequantistico Skill

Audit the codebase for modularity, structure, and separation of concerns, then refactor on approval. Use only when the user explicitly asks to clean up structure or runs /clean.

limonequantistico Skill

Deep whole-codebase audit for latent bugs, security holes, broken failure paths, and architectural risk — report first, fix only on approval. Use only when the user explicitly asks for a deep audit of the codebase, or runs /deep-audit.

mystenlabs Bundle

zkLogin on Sui — architecture, protocol flow, integration, and security. Use when explaining how zkLogin works, integrating zkLogin into a Sui application, choosing an OpenID provider, understanding the address derivation scheme, debugging session lifetime or proof issues, or answering questions about zkLogin security properties (salt, ephemeral keys, JWT privacy). Also use when the user asks about OAuth-based wallet-less login on Sui.

mystenlabs Bundle

Onchain randomness on Sui. Use when generating random values in Move smart contracts, working with the Random object (0x8) or RandomGenerator, securing randomness-consuming functions against composition attacks, PTB attacks, or state leakage, implementing commit-reveal patterns, balancing gas across execution paths, or integrating randomness from TypeScript. For general Move security patterns, see the `move-security` skill. For Move language fundamentals, see the `sui-move` skill. For TypeScript SDK patterns, see the `sui-sdks` skill.

olshansk Skill

Review RFCs for problem clarity, compliance, security, and performance using SCQA framework

mia-cx Bundle

Use when the user asks to review, audit, or QA a screen or page, check how it looks at desktop or phone width, verify a UI flow works end to end, or says the interface looks generic, off, or unprofessional. Stage 6 of ui-design.