Security

0xshe Skill

PHP Web 源码会话与 Cookie 安全审计工具。识别 session 固定、Cookie flags 不安全、JWT 验证缺陷与记住登录风险，输出分级、PoC 与修复建议（禁止省略）。

0xshe Skill

PHP Web 归档解压（Zip Slip/路径穿越）审计工具。识别解压条目名如何与目标目录拼接、是否存在 base dir 约束缺失，输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。

bhangeef16 Skill

Use when a delivery run dispatches a diff-review action: the correctness/simplification/convention pass (diff_review, code-reviewer persona) or the security-pattern pass (security_pattern_review, security-reviewer persona) over an implementation diff. One shared procedure — findings tied to specific files/lines with concrete failure or exploit scenarios, or an explicit no-findings record — parameterized by the action id passed as the first skill argument and the persona dispatched. Replaces the retired diff-review and security-pattern-review skills.

bhangeef16 Skill

Use when a delivery run dispatches a verification-stretch evidence-judging action: test evidence (test_evidence_review, qa-engineer), security evidence (security_evidence_review, security-reviewer), runtime evidence (runtime_evidence_review, devops-ops), or documentation evidence (documentation_evidence_review, documentation-steward). One shared procedure — judge recorded evidence against what it claims, prove existing work without expanding scope, record residual findings explicitly even when empty — parameterized by the action id passed as the first skill argument and the persona dispatched. Replaces the retired test-evidence-review, security-evidence-review, runtime-evidence-review, and documentation-evidence-review skills.

chloevpin Skill

Review an AI-generated coding change for application security risks at trust boundaries, including input handling, authorization, secrets, data exposure, injection, and unsafe failure behavior. Use before accepting security-relevant features, bug fixes, or refactors.

chloevpin Skill

Review dependency and supply-chain changes for provenance, vulnerabilities, integrity, execution behavior, and residual risk. Use when manifests, lockfiles, build scripts, or external artifacts change.

chloevpin Skill

Use linters, type checkers, security analyzers, and other static checks as evidence while changing a codebase. Use when fixing diagnostics, introducing types, changing analyzer configuration, or deciding whether a warning is real, irrelevant, or dangerous to suppress.

aojdevstudio Bundle

Structured, opinionated deep-dive analysis and investigation for any technical, operational, or strategic topic, delivering one clear recommendation instead of a menu of options. USE WHEN deep dive into, break this down for me, audit my approach to, thorough breakdown of, how should I manage X, create a policy for, expert rundown on, investigate X, best practice for X. NOT FOR simple factual questions, quick how-tos, or code-only requests.

aojdevstudio Bundle

Repository organization expert — structure, audit, and refactor via 8 framework archetypes. USE WHEN creating a new project, auditing repo structure, or planning refactors.

aojdevstudio Bundle

USE WHEN: audit my SaaS app, set up auth, add route guards, pick a backend, which ORM should I use, review my onboarding flow, state management best practices. Enforces SaaS standards across auth, onboarding, DB, and state.

asdfgh1445 Skill

Strix XSS 测试手册,覆盖反射型、存储型、DOM 型向量与 CSP 绕过;触发名:strix-xss

mickzijdel Bundle

Whole-repository review/audit of an existing or inherited codebase. Use when the user says "review this repository", "audit this codebase", "do a full code review of the repo", "what's wrong with this app", "I just inherited this project", or asks for a multi-axis sweep (e.g. "review for 1. performance 2. code smells 3. structure"). NOT for reviewing a single diff/PR (use the /code-review command) or a one-file change.

mickzijdel Bundle

Audit a repo against an opinionated dev-environment standard (mise pinning tools, an hk pre-commit hook running linters/tests + gitleaks, a GitHub Actions workflow that mirrors those checks, and project docs — README.md + CLAUDE.md recording pinned package versions) and set it up or upgrade it. Use when a repo is missing the standard setup, when the dev-env-reminder hook flags a gap, when the user mentions hk/mise/gitleaks/"my dev setup", when starting a new repo, or to backfill every standard-tracking repo after a version bump (fleet mode). Tracks a standard version via DEV_ENV_VERSION in mise.toml and upgrades behind repos using references/upgrade-guide.md.

mickzijdel Bundle

Write, review, and harden GitHub Actions workflows against supply-chain attacks, and bump a whole fleet of repos' action pins to the latest versions. Use when writing or editing a workflow YAML (.github/workflows/*.yml, ci.yml), when asked to review a CI workflow or audit GitHub Actions security, when the ci-action-ref-reminder hook fires, or when the user wants to "bump my actions", "update the fleet", "pin actions to SHAs", run zizmor, or close supply-chain / pull_request_target / script-injection / GITHUB_TOKEN-permissions gaps. Pairs with references/security-checklist.md (the full checklist) and dev-env-setup's CI templates.

mrilikecoding Skill

Map and audit the logical structure of an academic paper's argument. Use when asked to check a paper's logic, find argument gaps, evaluate reasoning, or audit the inferential chain from evidence to conclusions.

mrilikecoding Skill

Comprehensive audit of a paper's citations. Verifies every reference exists, checks claim-source alignment, identifies missing seminal works, and analyzes citation patterns for bias. Use when asked to check references, verify citations, or audit a bibliography.

mrilikecoding Bundle

Comprehensive multi-lens codebase architectural analysis with pedagogical stewardship framing. Evaluates architecture, patterns, code health, test quality, documentation accuracy, and system invariants. Use when approaching a new or poorly-understood codebase, or when you need to understand a codebase's actual architecture vs. its intended architecture.

poorvith-mp Bundle

Pace the paper, triage questions by marks-per-minute, exploit the marking scheme, and decide when to guess. Use when mastering test pacing, elimination tactics, or time allocation.

kenlck Skill

Review changed code for bugs, simplicity, security, and convention adherence using parallel reviewer agents. Use when the user asks to review code, review a PR, check quality, or wants a second pair of eyes before merging.

kenlck Bundle

Operability review for logs, metrics, traces, correlation, health signals, configuration, diagnostics, alertability, deployment safety, rollback signals, and runbooks. Use for observability, production-readiness, or operations questions.

kenlck Bundle

Test quality review for meaningful assertions, isolation, determinism, negative cases, and unit, integration, contract, and end-to-end balance. Use for test-strategy, flaky-test, or coverage-confidence questions.

kenlck Bundle

Technology lifecycle review for runtime, framework, build-tool, plugin, dependency, and API support status, deprecation, compatibility, and migration pressure. Use for end-of-life, upgrade-readiness, or obsolete-technology questions.

kenlck Bundle

Codebase design review for internal module boundaries, dependency direction, coupling, cohesion, domain modelling, layering, complexity, duplication, and observed patterns. Use for maintainability, modularity, or within-repository architecture questions.

kenlck Bundle

System integration review for cross-repository contracts, versioning, shared data, service boundaries, dependency direction, synchronous and messaging chains, failure propagation, cycles, and coordinated-release risk. Use for system maps, integration, or fleet-architecture questions.

kenlck Bundle

Application security review for attack paths and controls around identity, untrusted data, secrets, cryptography, injection, exposure, sensitive data, and exploitable dependencies. Use for secure-code, OWASP, or vulnerability-risk questions.

kenlck Bundle

Software reliability review for failure handling, timeouts, retries, idempotency, concurrency, resource safety, transactions, consistency, degradation, and recovery. Use for resilience or fault-tolerance questions.

kenlck Bundle

Engineering governance review for ownership, standards, repository hygiene, documentation, dependency policy, exceptions, release discipline, change controls, maintainership, and policy consistency. Use for stewardship, governance, or engineering-control questions.

yesterday-ai Bundle

Audit this repo's skills + plugins on three axes -- (1) leaks of personal info or Yesterday-internal references in user-facing artifacts, (2) catalog consistency (folder/name/dep/install-target alignment), (3) plugin-spec compliance (Claude Code + Cursor manifest schemas, layout rules). Reports findings as a triage list; does not auto-fix. Use before publishing, before merging skill PRs, or as a periodic hygiene pass.

epam Bundle

Pull REAL Snyk SAST findings from EPAM Jira (Data Center) via the search-export API using a Personal Access Token, and emit them as a stage-output.json artifact for a downstream triage stage. Use when you want the actual Jira-tracked Snyk findings (the same set a human gets by clicking Export on the security filter) rather than a synthetic fixture.

epam Skill

Skeptical second-opinion review of proactive-security-monitor output. For each OSV advisory it re-verifies version-match and reachability against this repo's actual code, and re-judges the news pass's RELEVANT/TANGENTIAL/IGNORE calls. Emits per-item verdicts (CONFIRMED / OVERSTATED / FALSE_POSITIVE / NEEDS_REVIEW). Use as the triage half of the proactive-security-monitor → security-monitor-triager chain.

epam Bundle

Proactive supply-chain watch for this repo. Resolves the npm SBOM and batch-queries OSV.dev for freshly-modified advisories (committed fetch.sh), then runs an industry-news pass (CISA KEV, OpenSSF, GitHub Security Lab, Socket, The Hacker News) filtered to this project's stack, and emits both as one findings set for the downstream triager. Use as the daily/scheduled producer half of the proactive-security-monitor → security-monitor-triager chain.

kentoje Skill

Perform an exceptionally strict maintainability and architecture review that looks for structural regressions and simpler designs. Use when asked for a thermo-nuclear or thermonuclear review, deep code-quality audit, or especially demanding review of a change.

sylphxai Skill

Application security - OWASP, validation, secrets. Use when securing the app.

sylphxai Skill

Find all problems in the project - design, code, UX - and open issues

sylphxai Skill

Browser-based audit for business logic and product correctness

ultimatile Bundle

Audit code comments and docstrings for prose already carried by the code they annotate, taking a delete-or-keep verdict per comment block and applying only what the user approves. Optional scope argument (file path, directory, or module); without arguments, audits every tracked file of the workspace.