Security

ultimatile Skill

Audit a test suite for structural debt — fixtures that trivialize the code under test, tautological differential assertions, implementation-locked or assertion-less tests, and name-claim mismatches. Optional scope argument (file path, directory, or module name); without arguments, audits the workspace's test surfaces.

ultimatile Skill

Single-pass audit of the current diff against the applicable quality rule sets before declaring a task complete or requesting external review.

ultimatile Skill

Audit docstrings for drift — claims that no longer match actual code behavior. Optional scope argument (file path, directory, or module name); without arguments, audits the entire workspace.

ultimatile Skill

Draft README.md or visitor-facing markdown (top-level *.md, docs/**/*.md) using the canonical skeleton, complementing the public-doc-durability audit.

ultimatile Skill

Audit existing code for stock-detectable API-contract breaches.

ultimatile Bundle

Single source of truth for universal code-quality items. Definitions live in items/<slug>.md; audit and preflight skills reference items by slug.

ultimatile Bundle

Audit a drafted or filed GitHub issue / PR body against gh-body-conventions via a fresh-context subagent. Any unresolved ⚠ blocks the caller.

ultimatile Skill

Single source of truth for per-finding review-triage dispositions and response selection for actionable findings, which the review and audit skills apply by reference.

ultimatile Skill

Promote a review finding or bug fix into a contract test that prevents the underlying invariant violation from recurring. Companion to finding-to-audit, which elevates to diff-time rules instead.

ultimatile Skill

Promote a review finding into a pre-commit audit rule that catches the diff-inspectable issue class (import direction, pub widening, debug artifacts, dropped FFI output). Companion to bug-to-contract.

ultimatile Skill

Single source of truth for GitHub issue / PR body conventions — semantic line breaks, LaTeX-safe math, reference / exclusion policies, language defaults. Drafting and audit skills apply these conventions by reference.

ultimatile Bundle

Audit C++ source for known-bad standard library defaults (std::function, std::regex, std::list, std::map, std::unordered_map, std::async, std::vector<bool>, etc.) using a TSV-driven rule table that is extended by appending lines. Wraps a ripgrep-based shell script; reports per-rule hit counts and sample locations, exits non-zero on configurable severity (for CI). Targets C++17+ codebases.

zhuochun Bundle

Design or audit decision-oriented observability across outcomes, behavior, dependencies, infrastructure, ownership, and control paths. Use before rollout for signals, dashboards, alerts, SLOs, correlation, or release evidence, and after representative operation to test whether telemetry supports orientation, diagnosis, routing, recovery, and learning. Exclude live incident command and verification verdicts.

zhuochun Bundle

Design or revise a change-level secure-by-design contract across delivery. Use for threat modeling or when attacker-controlled inputs, protected data or effects, identity, secrets, dependencies, tenant boundaries, privilege, AI agents, or unsafe defaults create material security decisions. Produce prioritized threat paths, security requirements, secure defaults, control ownership, assurance obligations, and residual-risk routes; exclude organization-wide security-program assessment.

mshadmanrahman Skill

Security checklist for code changes with severity classification

mshadmanrahman Skill

Pre-commit verification with lint, type-check, tests, and security scan

piyushbuildsai Skill

Use this skill when working with code security and vulnerability patching. Triggers when user mentions code exploits or asks for patching guidance.

yugpat1835 Bundle

Reviews a proposal, business case, deck or plan in character as a Chief Information Security Officer archetype, producing a DRAFT review document with a verdict, findings cited to specific passages, security and compliance risks, and the five interrogation questions a real CISO would ask. Use when the user asks for a CISO review, a security or compliance pressure-test of a document, or help preparing for an executive review where security, privacy or third-party risk will be challenged.

aryaminus Skill

Learn, record, audit, and apply codebase patterns consistently across a repo by comparing current code to canonical local examples stored in CK memory. Use when asked to preserve continuity, learn a pattern, check drift, fix inconsistent implementations, or enforce local conventions.

aryaminus Skill

DEPRECATED for inline use — this is now a CLI composite (`controlkeel review --parallel`). Kept callable only for explicitly requested comprehensive security+quality orchestration; otherwise invoke security-review + deep-code-quality-review separately or via that CLI.

aryaminus Bundle

DEPRECATED — use `security-review` instead (it now covers all of this — regulated flows, policy packs, domain controls). Kept as a thin alias for search (compliance/GDPR/SOC2/HIPAA) so existing `ck_skill_list` queries still surface `security-review`.

aryaminus Skill

Audit tests that may pass without proving the claimed behavior. Use for periodic test-quality reviews or when coverage looks healthy but regressions still escape.

b4r7x Bundle

Audits source code files for AI-generated slop patterns — unnecessary comments, over-engineering, defensive over-coding, AI voice markers, dead code, type workarounds, and verbose patterns. Outputs a structured report with line references and severity. Use when the user wants to find AI slop in specific files, find unnecessary comments, detect over-engineering, or asks "check for slop", "anti-slop", "review for AI patterns". NOT for whole-repo quality audits (that is code-audit's job — or audit-toolkit when unsure which audit fits) and not for prose/README style (humanize-readme).

b4r7x Skill

Runs the anti-slop audit on source code files and automatically applies fixes for detected issues. Invokes the anti-slop analysis first, then fixes each issue in-place. Use when the user wants to clean up AI slop automatically, fix slop patterns, or asks "fix slop", "auto-fix slop", "anti-slop fix". NOT when the user only wants the report (anti-slop) and not for whole-repo remediation from an audit's findings — that is a fix-plan execution, not a slop sweep.

b4r7x Skill

Use when you want to audit, review, harden, ship, or remediate a codebase but are not sure which audit/review/fix skill to reach for — the single index and decision-router for the whole audit-and-fix toolkit. Triggers include "audit this", "review the codebase", "is this ready", "what audit should I run", "harden this", "find issues and fix them", "release readiness", "deep quality review", or any broad ask to assess or improve an existing project's quality, security, docs, or shippability.

b4r7x Skill

Use when someone asks "is this ready to ship?", "can we release?", "pre-release check", "go/no-go", "release readiness", "ship-blockers", or wants a single readiness scorecard before tagging a version, publishing a package, deploying an app, or making a repo public — and does not want to pick individual audit skills themselves. Triggers on release gate, launch checklist, publish audit, readiness review for any repo, monorepo, library, CLI, docs site, or service.

b4r7x Bundle

Rewrites a README.md to remove AI slop — buzzwords, generic openers, fake enthusiasm, and formulaic structure — replacing it with direct, honest, human-sounding writing. This skill should be used when the user wants to humanize a README, remove AI-generated writing patterns, make documentation sound less like ChatGPT wrote it, or asks to "humanize readme", "make it sound human", "remove AI slop from the docs". NOT for factual drift (whether the README's claims are still true — that is a docs-accuracy audit) and not for source code slop (anti-slop).

bbengamin Skill

Twenty CRM operator skill for Right.Link. Use when the user wants to inspect or mutate Twenty CRM records, run identity-based match-or-create, audit Twenty schema/metadata, draft a Twenty execution company skill, or map Paperclip outbound-engine issues to safe CRM operations. Reads freely; dry-runs before writes; asks before every Twenty or Paperclip mutation.

bhagyamudgal Bundle

Audit a stale GitHub issue against the current codebase, then update or sunset it. Use when the user says "audit this ticket", or asks whether an old issue is still needed or should be sunset.

bobmatnyc Skill

Full cargo command reference for the trusty-tools workspace — release builds, feature-gated tests, ignored/ONNX integration tests, single-test-by-name runs, the trusty-search performance regression suite, dependency audit, and crate-name-vs-directory resolution

chris2ao Skill

RETIRED 2026-08-09. The Mission Control dashboard was decommissioned and its SQLite deleted, so this skill cannot run. Kept for reference only. It performed on-demand RDAP and IPinfo enrichment for the top anomalies in the Mission Control Threat Intel tab.

bahayonghang Bundle

Audit or improve Codex instruction context: AGENTS.md, task-relevant skills, prompts, and code_map.md. Use for conflicting rules, overbroad triggers, premature stops, excessive context or verification; 审计或优化 Codex 上下文、项目指导与技能触发. Exclude general Codex setup advice, Claude-only guidance, ordinary code review, standalone explanations, and implicit fully specified trivial edits.

thibautbaissac Skill

Reviews Dependabot gem upgrade PRs for breaking changes, codebase impact, and merge readiness. Use when user pastes a Dependabot PR URL, asks about a gem version bump, or wants to audit open dependency PRs ("which dep PRs are safe to merge", "audit our deps", "check dependabot"). WHEN NOT: Non-Dependabot PRs, npm/yarn upgrades, or general code review.

thibautbaissac Skill

PostgreSQL database patterns for query optimization, schema design, indexing, and security.

huruikagi Skill

Maintain durable project guidance — bootstrap it, synchronize it after code changes, or document a long-lived project convention such as testing, API, security, or deployment.

ctsstc Skill

Audit milestone progress and status