Security

davidlee Skill

Use after a slice's phases are implemented, when the task is now evidence, conformance, and reconciliation against the design — disposition every finding on a reconciliation review ledger (the RV kind) before closure.

davidlee Skill

Use when receiving feedback on your work — review findings, user corrections, audit results, external reviewer notes — to triage by authority, adjudicate each point on evidence, integrate without regressions, and close the loop with the source. Evidence flips positions; assertions don't.

davidlee Skill

Use after /audit resolved the RV ledger and wrote the reconciliation brief — you are the sole explicit writer of reconciled truth. Consume the RV + brief, write changes through two surfaces (direct edit for per-slice artefacts, REV for governance/spec), and hand off a resolved outcome to /close. Routed to from /audit.

denchhq Skill

Release engineering — sync main, run tests, audit coverage, push branch, open PR. Bootstraps test frameworks if needed. One command from "code complete" to "PR ready for review".

denchhq Skill

Design audit of existing code. Same methodology as plan-design-review, but applies fixes directly with atomic commits and before/after evidence. Use when asked to audit the visual design of implemented code.

easyinplay Bundle

Stage ④.e verify sub-workflow — gstack /cso 安全审查 OWASP/auth/secrets (has_auth_or_secrets 触发, 可选 conditional; bundled verify-stage optional /cso step). schema_version: harnessed.workflow.v3 with disciplines_applied (6 default) + tools_available (gstack-cso) + 1 phase (gate ref has_auth_or_secrets conditional)。 Triggered by slash command `/verify-security` after `harnessed setup`.

emaarco Bundle

Release & supply-chain readiness audit: gathers evidence from real workflows, manifests, and repo settings, compares against a gold-standard reference stack, has an adversarial subagent try to refute the draft, and returns a prioritized action plan (P1–P3) whose fixes are delegated to the sibling setup skills. Use when asked to audit release automation, publishing security, CI or supply-chain maturity, or whether a repo is ready to release. For a whole-repo health check (docs, tests, code quality) use maturity-analysis instead.

emaarco Bundle

Sets up, audits, or optimizes GitHub PR auto-merge — the single source of truth for the auto-merge workflow, its safety preconditions (native 'Allow auto-merge' setting + a required-status-check ruleset), and its scope gate. Grades the CI signal (what a green check actually proves — lint vs build vs unit vs integration/E2E, weighed against what the repo ships) and caps the scope recommendation to it. Covers Dependabot (fetch-metadata, patch/minor auto), Renovate (native platformAutomerge), and generic bot PRs (actor + label). Use when asked to set up, audit, fix, or optimize auto-merge / automerge / merge Dependabot or Renovate PRs automatically.

emaarco Bundle

Audits and sets up .github/dependabot.yml: recommends a grouping mode (low-noise, balanced, fine-grained) from the repo's use-case, gates setup on pinned dependency versions, wires CODEOWNERS over the deprecated reviewers key, groups security updates. Use when asked to set up, review, fix, or audit Dependabot / automated dependency updates / dependency grouping.

emaarco Bundle

Introduces and maintains machine-checkable guardrails (fitness functions) so AI agents can work safely in a repo: architecture & pattern gates, ratchet metrics (raise-only coverage/mutation, shrink-only debt lists), a self-protecting ratchet diff gate, behavior gates (contract snapshots, error paths, anti-erosion), and a single verify command — right-sized to the repo, phased, one PR per phase, every gate negative-tested. Use when asked to set up guardrails or fitness functions, make a repo safe for AI agents, stop quality erosion, protect coverage thresholds, or audit existing guardrails. For release automation, publishing, or supply-chain audits use release-audit; for a whole-repo health check use maturity-analysis.

emaarco Bundle

Analyzes a repo's contributor experience and creates or updates what's missing: GitHub issue-form templates (bug/feature/refactor), an open-source target-group-focused README, CONTRIBUTING.md, and the remaining community-health files (PR template, CODE_OF_CONDUCT, SECURITY, LICENSE, CODEOWNERS). Use when asked to make a repo contributor-friendly, open-source ready, or to set up issue templates / README / CONTRIBUTING.

emaarco Skill

End-to-end repo analysis: project overview, key files, maturity assessment with expert subagents per dimension, and real issues found. Use when asked how mature a repo is, to assess or audit a codebase, or for a project health check.

emaarco Skill

Supply-chain audit: verifies every GitHub Actions reference is pinned to a full commit SHA (not a mutable tag or branch), reports unpinned uses with evidence, and optionally rewrites them to SHA + version comment.

emaarco Bundle

Sets up, audits, or migrates release-please (Conventional-Commit versioning, changelogs, GitHub releases). Use to set up release automation, automated versioning/changelogs, or release-please; to audit, review, fix, or question an existing setup; or to switch release forms (single ↔ per-module) without breaking changelog/tag history.

emaarco Bundle

Sets up tokenless npm publishing via OIDC trusted publishing: no NPM_TOKEN secret, automatic provenance attestations, an idempotent skip-if-already-published step, a reusable workflow_call structure, GitHub Environments for any unavoidable long-lived secrets, and a bundled one-time check that verifies each package's repository field at setup so provenance can't fail with E422. Use when asked to publish npm packages securely, remove or replace NPM_TOKEN, or set up trusted publishing / provenance.

emaarco Skill

Supply-chain audit for Node.js (js/ts) repos: verifies every package.json dependency is pinned to an exact version (no ^ ~ >= * latest or mutable git refs), checks the lockfile is committed, reports drift with evidence, optionally rewrites to exact pins, and wires up the Miragon/pin-npm-dependencies CI guardrail + save-exact.

emaarco Skill

CI run-efficiency audit for GitHub Actions: detects duplicate PR runs (push + pull_request double-trigger), job explosion via matrix expansion, missing/miswired concurrency, noisy PR triggers, and merge-gate traps (paths-filtered required checks) — reports with live evidence from gh, then fixes trigger scoping safely without breaking required status checks. Use when checks run twice, a PR shows too many jobs, or CI minutes are too high.

eszxcvfd Bundle

Writing, exploit — assemble raw material into a journey of beats, grounding each term before a beat leans on it.

eszxcvfd Bundle

Writing, exploit — shape raw material into an article, paragraph by paragraph.

timctfl Bundle

Audit a PDP from screenshots and a brand voice guide. Produces a prioritized report split into content/merchandising and dev/design changes.

grafana Skill

Draft a CHANGELOG.md entry from merged PRs since the last release tag. Categorizes by conventional-commit prefix (Added / Fixed / Chore / Security / Changed / Removed), rewrites PR titles into sentence-case narrative bullets with PR refs, and commits to the current branch without pushing. Use when preparing a release, or call this skill from `/release-prep`.

kdcllc Skill

Never read .env files or write secrets to .squad/ committed files

lee-to Bundle

Perform code review on staged changes or a pull request. Checks for bugs, security issues, performance problems, and best practices. Use when user says "review code", "check my code", "review PR", or "is this code okay". Optional +check flag validates findings via a fresh-context subagent.

openclaw Bundle

Read-only Google Drive sharing and permission audits with gog.

anothersava Bundle

Give a scheduled job a dead-man's switch, so its silence is noticed — derive the grace from the job's own cadence, create the check through the healthchecks.io API, put the ping URL where the job's other credentials live, wire the exit codes onto the right endpoints, and prove it by watching the alarm fire. Also audits which scheduled jobs have no check at all. TRIGGER when: a scheduled job (backup, self-check, sync, report) has nothing that would notice it stopping; a heartbeat or dead-man's switch is being added, moved or diagnosed; a healthchecks.io check must be created or its grace chosen; someone asks how a job's failure would be noticed, or which jobs are unmonitored. DO NOT TRIGGER when: the task is provisioning the backup itself (that is `backup`, which hands over here at its last step); alerting for a web service's uptime rather than a scheduled job; or choosing where a secret lives (that is `doppler`).

anothersava Bundle

Encrypt files in a git repo with transcrypt using the shared Doppler-stored passphrase, or unlock (decrypt) an already-encrypted repo after a fresh clone. Designated files stay plaintext in the working tree but are stored encrypted in git history. TRIGGER when: the user wants to commit a file encrypted, protect a sensitive committed doc, set up transcrypt in a repo, or decrypt/unlock secret files after cloning. DO NOT TRIGGER when: the secret is an env-style credential (API key, token, password) that belongs in Doppler/`.env`, not a committed file.

saitarrun Skill

This skill should be used when the user mentions keywords related to security-audit.

saitarrun Skill

This skill should be used when the user mentions keywords related to threat-modeling.

saitarrun Skill

Version updates (major/minor/patch), security patch application, transitive dependency resolution, monorepo dependency management, deprecation tracking, license compliance. Use when updating dependencies, managing versions, or addressing CVEs.

saitarrun Skill

Secrets management, environment-specific configs, safe defaults, feature flags, configuration-as-code, compliance and audit trails. Use when managing secrets, configuring deployments, or implementing feature flags.

trycompai Skill

Audit & fix hooks and API usage patterns — eliminate server actions, raw fetch, and stale patterns

trycompai Skill

Audit & fix unit tests for permission-gated components

trycompai Skill

Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.

timsmykov Bundle

Audit scientific claims, assumptions, causal language, bias, confounding, and evidence quality without drafting a formal referee report. Use for critical appraisal, evidence grading, or teaching claim evaluation; use peer-review for a manuscript review and statistical-analysis for new calculations.

timsmykov Bundle

Create and audit truthful, accessible, publication-ready scientific figures with Matplotlib, Seaborn, or Plotly. Use for figure design, multi-panel layouts, uncertainty and missing-data displays, color/contrast review, image metadata validation, and journal export planning.

armelhbobdad Bundle

Drift detection between skill and current source code. Use when the user requests to "audit a skill" or "audit skill" for drift.