Security

allyoushawn Skill

Orchestrates a knowledge base housekeeping sweep: checks KB size and git log to scope the work, then delegates to one or more knowledge-base-house-keeper agents. Use when the user wants to audit the KB for duplicates, conflicts, stale content, or broken references.

allyoushawn Skill

Reviews deep learning code (.py files and Jupyter notebooks) to ensure GPU is used when available. Identifies anti-patterns like missing device detection, hardcoded CPU usage, tensors not on GPU, and performance issues. Supports PyTorch, TensorFlow/Keras, and JAX. Triggers: "review code for GPU usage", "check GPU utilization", "audit device placement", "ensure DL training runs on GPU".

allyoushawn Skill

Security-reviewed git commit for the ~/.claude backup repo — scans staged changes for secrets before committing. Use when committing only the ~/.claude config repo on its own; for the multi-repo "save state" checkpoint that scans and commits the knowledge base, paper-reading, agent_skills, and ~/.claude repos together, use save-to-github instead.

steven65026502 Bundle

Convert the user's manuscript draft, figures, and available Zotero metadata into .paper/claims.yml and .paper/figures.yml for later writing and audit work. Use when the user explicitly asks to build paper memory or extract claims. Do not edit the manuscript, invent missing evidence, or use this for cited-paper cluster summaries.

steven65026502 Bundle

Produce a read-only Zotero cleanup audit for duplicate DOIs, missing tags, collection placement, and tag hygiene. Use only when the user explicitly asks for a Zotero audit or preview cleanup plan. Never perform CRUD; hand approved changes to zotero-skills and report when Zotero connectivity is unavailable.

kalyvask Skill

Cuts opening sentences that recap what the recipient already knows about themselves, their company, or their own work. Implements Konrad's rule 2 ("begin with something they don't know — tell me a secret about the future") and Kramon's rule 4. Use when a draft opens with flattery, a summary of the reader's accomplishments, restating their stated thesis, or reciting biographical facts they already have. Triggers on "they already know," "rewrite the opener," "stop with the flattery," "first sentence is weak," "secret about the future," "tell them something new."

rabbit-ivan Bundle

Produces 3-5 candidate names with one recommended final name, the three-stage reasoning trail behind it (research-stage / top-of-head / final-after-reading), and — for reviews — a priority-ordered rename list with old->new and migration scope. Use when the user asks how to name or rename anything (concept, variable, function, prop, module, type, file, domain entity, event, or abstraction), wants a naming review or audit, or says a name feels vague, stiff, misleading, inconsistent, too long, too generic, or hard to choose — even if they only mention it in passing while reviewing code. Be pushy: trigger on "what should I call this", "better name for X", "this name sucks", "rename this var", "whats a good name", "review my naming". Chinese triggers: 起名, 命名, 取名, 改名, 名字不好, 这个叫什么好, 取个名字, 换个名, 这名字怎么样, 名字太长, 命名规范, 命名审查, 变量名/函数名怎么取.

rabbit-ivan Bundle

Audits documentation against the actual code, config, schemas, and API contracts and produces a severity-ranked (P0-P3 + needs-evidence) report of every stale or mismatched claim, each with a doc location, a code/contract reference, the impact, and a minimal suggested fix. Use whenever the user wants to verify README/docs/API docs against the implementation, check whether docs fell behind, or confirm setup steps / env vars / endpoints / examples still match the code after a rename or refactor — even on casual asks like "是不是过时了", "README 和代码对不上", "readme 还准吗", "我们改了接口文档忘了更新吧", "audit our docs", or "do the docs still match". Trigger on 文档和代码一致性, 文档是否过时, 文档跟实现不一致, 这个 API 文档还准不准, openapi 和文档对得上吗, verify docs against code, docs vs implementation. For doc-vs-doc internal contradictions with no code comparison, use hai-audit-docs-internally instead.

vodailocz Skill

Comprehensive code review checklist and methodology. Use when reviewing PRs, conducting code audits, or assessing code quality. Keywords: review, PR, code review, audit, assess, quality, check

dongduong2001 Skill

Threat modeling, compliance, and secure by design architecture

jsuvic Skill

Use to review a proposed change for correctness, security-sensitive behavior, readability, tests, performance when relevant, architecture and contract impact, and generated-file drift.

jsuvic Skill

Review exploit paths, secret exposure, unsafe permissions, injection, authentication and authorization, supply-chain risk, and data leakage.

jsuvic Skill

Use to run a bounded security-review, patch, and retest loop that stops on green, on no diff, or on a repeated identical finding.

ccdawn Bundle

Use when the user explicitly requests a repository/subsystem simplification audit, dependency-bloat review, or ranked removal plan, or when concrete evidence makes structural complexity the primary investigation; do not substitute it for ordinary project health review.

docat0209 Skill

Visual and UX quality audit using Playwright. Triggers ONLY when: PR has passed pre-pr and is ready to merge with UI/UX changes, or user explicitly asks for UX audit. Do NOT trigger for backend-only changes or during development.

docat0209 Skill

Scores product quality from user perspective (/100) and auto-iterates if below threshold. Triggers ONLY when: user explicitly asks to evaluate the product, after ux-audit completes, or score is below 70 and iteration is needed. Do NOT trigger during development or when discussing product quality conceptually.

doris-labs Skill

Build a mutual action plan (MAP) with the buyer — backward-planned milestones from go-live, owners on both sides, and the decision/procurement/legal/security steps that actually gate close. Use when a deal needs a joint close plan. Triggers on: mutual action plan, MAP, close plan with buyer, joint plan, success plan.

lu1sdv Bundle

Use when auditing OAuth 2.0 / OIDC implementations against RFC 9700 (OAuth Security BCP), reviewing client or authorization-server code, evaluating PKCE / state / redirect-URI handling, hardening token exchange and refresh flows, or triaging suspected OAuth vulnerabilities (CWE-352 CSRF, CWE-287 broken auth).

timctfl Bundle

Validates a Google Merchant Center feed against Shopify product data and produces a prioritized error report with Shopify-native fix instructions.

v8 Skill

Guides the initial analysis and impact assessment of a V8 security report, strictly excluding implementation or fixing.

benknightdark Bundle

Use this skill when a request involves RabbitMQ message-topology design, reliability analysis, Broker operations, cluster or security configuration, monitoring, troubleshooting, or performance optimization. Use stable RabbitMQ 4.3 by default and keep development guidance language-neutral. Do not use this skill for language-specific Client APIs, website implementation, or Blog content.

benknightdark Bundle

Use this skill when the user needs to establish, review, or improve an ISO/IEC 27701 PIMS, inventory PII processing, analyze controller and processor responsibilities, create a privacy risk or evidence matrix, conduct a gap analysis, prepare for an audit, or create an improvement plan. Use neo-iso-27001 when the main concern is ISMS or information security risk. Do not treat PIMS as a legal-compliance guarantee for any specific privacy law.

lu1sdv Bundle

Use when escaping a Python sandbox or pyjail, bypassing import/builtins/attribute or character/byte blacklists, recovering builtins after __builtins__ is stripped, exploiting pickle/marshal/PyYAML/multiprocessing deserialization, Python-template SSTI (Jinja2/RestrictedPython/str.format), bypassing PEP 578 audit hooks, crafting or abusing CPython bytecode and code objects, exfiltrating with no stdout, or reversing .pyc files. CTF / security-research focused; covers CPython 3.8–3.13.

lu1sdv Bundle

Designs a one-command, triager-friendly live security PoC video runner with staged evidence, expected-versus-actual output, a negative control, optional UI pause, and cleanup proof.

lu1sdv Skill

Use when starting research, audit, or investigation tasks needing multi-source coverage — security/sink research, codebase audits, framework deep-dives, market comparison, or any "exhaustive / most complete / long horizon" request. Triggers on "audit", "investigate", "research", "find vulns", "exhaustive", "long horizon", "deep dive", "most complete".

afadtc Bundle

DTC 数据仪表盘与体检引擎——全链路数据分析、KPI 追踪、行业基准对标、数据健康度评估、市场趋势监控。Use when user mentions: 数据体检, data audit, KPI, 仪表盘, dashboard, 指标追踪, metrics, 基准线, benchmark, 数据分析, data analysis, 营收报表, revenue report, 渠道数据, 广告数据, ROAS跟踪.

ahmedhamadto Skill

Scan any software project against a 15-domain, 7-layer taxonomy to produce a coverage report showing what exists, what's missing, and what's immature. Use before major architecture decisions, onboarding to a new codebase, or planning tech debt work. Focuses on technology coverage and infrastructure maturity, not on understanding application logic or business intent (use brownfield-greenfield for that).

ahmedhamadto Skill

Audit security configurations - CSP, RLS, auth, dependencies, and OWASP vulnerabilities. Use before deployments or after adding integrations.

ahmedhamadto Skill

Use when testing a web application for security vulnerabilities, before deployment or during security review — guides through a structured 10-phase penetration testing methodology covering mapping, authentication, session management, access controls, injection, logic flaws, and server configuration.

handsontable Skill

Use when a source code change needs a changelog entry, or before committing and pushing any bug fix, feature, or behavior change to source code - detecting when entries are required, categorizing changes correctly (added/changed/fixed/deprecated/removed/security), writing user-facing titles, and creating the JSON entry in .changelogs/

hosaypeng Bundle

Run comprehensive system diagnostics including hardware, network, and security. Use when user says 'diagnose my system', 'system health check', 'security audit', 'check performance', 'full diagnostics', 'am I secure', or 'scan for malware'.

hosaypeng Bundle

Scan CLAUDE.md, MEMORY.md, memory files, and LaunchAgent plists for dead file/directory paths. Use when user says 'audit paths', 'check for dead paths', 'stale references', or after restructuring files/directories.

hosaypeng Bundle

Audit Obsidian vault for broken wikilinks, invalid tags, missing frontmatter, orphan notes, and empty files. Use when user says 'audit vault', 'vault health', 'check my notes', or periodically for hygiene.

hosaypeng Bundle

Expert code review with senior engineer lens. Detects SOLID violations, security risks, test gaps, dependency issues, and proposes actionable improvements. Use when user says 'review my code', 'code review', 'check this PR', 'review these changes', or 'audit this diff'.

hosaypeng Bundle

Detect nation-state spyware (Pegasus, Candiru/DevilsTongue), credential theft, and verify physical-security mitigations on macOS. Use when user says 'threat hunt', 'check for pegasus', 'spyware scan', 'am I being surveilled', 'nation-state', 'advanced threat', 'APT scan', 'check for spyware', or 'credential exposure'.

hosaypeng Bundle

Audit all iCloud containers for files, artifacts, caches, and metadata. Scans every app container in ~/Library/Mobile Documents/. Use when user says 'audit icloud', 'check icloud', 'what's in my icloud', or 'icloud cleanup'.