Security

omonuj Skill

Build a small, secure, reproducible container image — multi-stage, non-root, pinned, minimal attack surface. Use when writing or fixing a Dockerfile, when images are huge or slow to build, or when a scan flags container CVEs. Covers layer caching order, multi-stage builds, distroless/minimal bases, non-root runtime, and the .dockerignore/secret-leak traps.

rcarmo Skill

Navigate BIOS or UEFI screens through the native linkr tool one observed step at a time, preserving original values and avoiding unsafe assumptions about keys, tabs, save semantics, or security settings.

redisearch Skill

Review Rust code changes for unsafe correctness, security and robustness, documentation quality, and C-to-Rust porting fidelity. Use this when you want to review Rust changes before merging.

stardustai Bundle

Scan source code, configuration, deployment files, and project documents from a China MLPS 2.0 Level 3 / 等保三级 code-security perspective. Use when auditing internal or public-facing software systems for authentication, authorization, audit logging, data security, interface security, transport security, exposed operations surfaces, backup/recovery, release-change evidence, and missing compliance materials, then producing a Markdown security findings report and remediation plan.

stardustai Bundle

Generate application-side Stardust SSO OIDC integration code and, with explicit authorization, register the OIDC client in SSO and persist the returned secret.

stardustai Bundle

Use when a Startask/Stardust import, prelabel, export, return-flow, or delivery task has an unfrozen customer contract, conflicting specifications/samples/operator trees/platform records/adapter code/validators, mapping/coordinate/timeline/identity/point-order/lineage disagreement, or a delivery-readiness question. Do not use for routine implementation under a confirmed contract or unrelated file conversion.

dragoon0x Bundle

Architecture overview of the codebase. Reports total file/line/byte counts, top hot files (most imported), largest files by line count, orphan files (imported by nobody), and most-used external dependencies. Pure regex on import statements, no AST. Use to understand a new codebase, find dead code, or audit dependency surface. Run as `node ~/.claude/skills/dragoon/skills/map/scripts/map.js [root]`.

dragoon0x Bundle

Detect drift between markdown docs (README, docs/) and the actual codebase. Catches references to npm scripts that don't exist, scoped dependencies not in package.json, file paths in backticks that don't resolve on disk, and undocumented npm scripts. Use to audit documentation hygiene before a release or after a major refactor. Exits non-zero on findings. Run as `node ~/.claude/skills/dragoon/skills/docs/scripts/docs.js`.

dragoon0x Bundle

Static performance hints (large images, missing img dimensions, no loading=lazy, sync script tags) plus optional Lighthouse JSON report ingestion that surfaces failing audits ranked by potential ms savings. Use when the user wants to audit web performance or process a Lighthouse report. Dragoon does NOT run Lighthouse itself - generate the report with `npx lighthouse <url> --output json --output-path lh.json` and pass --lighthouse. Run as `node ~/.claude/skills/dragoon/skills/perf/scripts/perf.js [--lighthouse path]`.

darkroomengineering Bundle

Lighthouse audit of one page with an improvement loop until targets are met. Triggers "lighthouse", "page speed", "LCP", "CLS", "INP", "core web vitals". Repo-wide performance audits go to /audit performance.

devcxl Bundle

Writing, exploit ： 将原始素材组装成一段节拍之旅，在节拍使用每个术语之前先将其夯实。

devcxl Bundle

Writing, exploit ： 将原始素材逐段塑形为一篇文章。

nubjs Skill

Cut a Nub patch release end-to-end in one invocation. Invoke (via the Skill tool) once a release thread's targeted fixes are ALL landed on `main` and CI-green. Encodes the full runbook: pick the version (patch bump in the 0.0.x/0.1.x pre-release regime), audit `@nubjs/types`, run `make version` + `make version-check`, commit + tag + push (the `v*` tag triggers the 8-platform build → glibc and pre-publish native gates → immutable 32-asset prerelease → npm OIDC publish → stable GitHub Release presentation), then draft comprehensive FACTUAL + NEUTRAL release notes from the full changeset and comment the version + release link on every closed issue + merged PR the release ships (mandatory maintainer hygiene). Do NOT cut until all fixes are green.

nubjs Skill

Use when running a compatibility/parity AUDIT — enumerating where nub diverges from a reference it claims parity with (pnpm CLI grammar, a lockfile format, a Node behavior, a flag surface). Encodes the hard gates that stop an audit from surfacing false positives. Auto-triggers on "audit", "compat audit", "parity audit", "find all the gaps", "what are we missing vs <tool>".

nubjs Skill

Add, audit, or update @nubjs/types declarations for Nub runtime APIs. Use whenever Nub adds or changes a user-visible global, built-in method, module loader type, or TC39 proposal; when TypeScript or @types/node gains an overlapping declaration; and before every release to reconcile runtime changes since the previous tag. Covers conflict-safe global augmentation, compiler-version routing, fixture matrices, and package verification.

oldwinter Bundle

Writing, exploit — assemble raw material into a journey of beats, grounding each term before a beat leans on it.

oldwinter Bundle

Writing, exploit — shape raw material into an article, paragraph by paragraph.

widnyana Skill

Review TypeScript code for quality, security, and correctness. Use this skill when the user asks for a code review, wants feedback on a PR or diff, or says "review this". Covers architecture, security, error handling, database patterns, type safety, and code quality. Produces categorized findings: critical issues, improvements, suggestions, and positive notes. Also triggers on phrases like "check this code", "what do you think of this", or "any issues with".

yamcodes Bundle

Anti-AI-slop design skill for greenfield pages, audits, redesigns, and design extraction from URLs or screenshots. Use when the user asks to build a new app or landing page, wants to redesign something, invokes Hallmark by name, or uses audit/redesign/study.

coleam00 Skill

Performs a technical code review of recently changed files for bugs, security issues, and standards compliance, then writes a report. Use before committing, as a pre-commit quality gate.

jamestexas Skill

Before writing glue, a wrapper, or a "small helper", audit whether the capability already exists first-party — in the binary, the codebase, or the platform — and whether existing glue bypasses a better first-party implementation. Use when adding shell/Taskfile/CI glue, when a helper feels trivially writable, or when the same logic seems to exist twice. Produces an inventory with receipts, not vibes.

jabrena Bundle

Use when you need to design, review, or improve REST APIs with Spring Boot — including HTTP methods, resource URIs, status codes, DTOs, versioning, error handling, security, API documentation, controller advice, and problem details for errors. Part of the skills-for-java project

hmbown Skill

Review a change, module, or surface for exploitable defects — trust boundaries, authn/authz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork.

ucsandman Bundle

Remove AI-generated design tells and give an interface a distinct identity; /de-vibe.

imbue-ai Bundle

Run Claude programmatically against collections of files in the codebase. Use for batch analysis: scrubbing sensitive data, auditing style violations, security reviews.

omonuj Skill

Keep secrets out of code, logs, images, and state — and make them rotatable. Use when adding a credential/API key/token to any system, when a secret leaks, or when auditing how an app gets its secrets. Covers the injection hierarchy (short-lived > secret manager > env), git-history remediation, rotation, and the "removed but still in history" trap.

sensei-hacker Skill

Run PlatformIO tests for PrivacyLRS to validate code changes and security fixes

vignesh2027 Skill

Apply security controls, threat modeling, and hardening to code and infrastructure

vignesh2027 Skill

Conduct staff-engineer-level code reviews across correctness, security, performance, readability, and architecture

wellapp-ai Skill

Audit Value Delivery compliance after PR push

yipng05-max Bundle

Verify the authenticity of literature references and detect hallucinations in both English and Chinese (中文) sources. Use when users need to check if a citation is real, verify a DOI, confirm a paper/article/book exists, cross-check author-title-journal-year metadata, detect fabricated references, validate URLs of online articles, or audit a reference list for accuracy. Covers journal papers, conference papers, preprints, books, monographs, newspaper articles, magazine articles, web articles, dissertations, government documents, and any other published works. Supports Chinese academic databases including CNKI (知网), Wanfang (万方), CQVIP (维普), Baidu Scholar (百度学术), and core journal list verification (北大核心, CSSCI, CSCD).

enthrium Bundle

Run a health check on a remote Linux server via SSH. Use when you need to audit server resources, check running services, or review system logs.

enthrium Bundle

Query an LDAP directory to look up users, groups, and org structure. Use when you need to find employees, check group membership, or audit your directory.

shafthq Bundle

Use when designing measurable risk-based tests for performance, security, reliability, recovery, compatibility, scalability, usability, or operations.

simbajigege Bundle

Build LangChain (Python) tools using Claude Code's fail-closed design pattern — unified name/schema/security/execution in one class, with automatic three-layer execution (validate → permission → call). Use this skill whenever the user wants to define a new LangChain tool, add permission or validation logic to an existing tool, set up the ClaudeStyleTool base class in a project, or asks about "build_tool", "Claude Code style tool", "工具定义", or "langchain tool with permissions". Also trigger when the user says "create a tool for X" or "定义一个工具" in a LangChain Python project context, even without mentioning Claude Code explicitly.

b-m-capital-research Skill

Canonical Hone security-research skill covering company and ETF/fund analysis, valuation framing, and criteria-based screening