Security

rcarmo Skill

Design and audit Pi extensions safely (avoid workspace source imports).

jordanchoo Skill

Doodlestein Self-Releaser - fallback release infrastructure for when GitHub Actions is throttled. Local builds, cross-platform releases, supply chain security. Use when: GH Actions slow, local release, build hosts, dsr command.

jordanchoo Bundle

Run UBS (Ultimate Bug Scanner) on changed files before committing. Use when: pre-commit quality gate, the user mentions "ubs", "bug scan", "security scan", or when AGENTS.md / CLAUDE.md instructs agents to run UBS before committing. Handles scoping, output parsing, false-positive triage, .ubsignore management, and the fix-rerun loop.

benchflow-ai Bundle

SkillsBench task PR review — classifies the task track (standard / research / multimodal), runs static policy checks against the track-specific rubric, benchmarks the task across oracle plus Claude and Codex (with and without skills), audits trajectories for cheating and skill invocation, and produces a `pr-N-task-timestamp-run.txt` review report alongside a `prN.zip` bundle of trajectories. Use when reviewing a SkillsBench task PR (by number, branch, or local task path), when the user asks to review a task, run benchmarks on a PR, audit a submission, classify a task as research or multimodal track, or prepare a comment to post on a SkillsBench PR.

benchflow-ai Bundle

Operate, test, troubleshoot, and explain `bench traj upload` for public or trusted-direct trajectory contributions, including interactive and fully specified commands, dry runs, input validation, local secret masking, trajectory reports and previews, manifest metadata, upload progress, idempotency, and production promotion checks. Use this skill when a maintainer or operator wants to test, inspect, or debug a trajectory upload; validate a trajectory, report, or manifest; or verify the public upload path end to end. For helping a contributor submit their own session, use `benchflow-traj-upload` instead.

saturate Skill

Run parallel pre-launch review with code-reviewer, security-auditor, and test-engineer, then synthesize a go/no-go decision.

saturate Skill

Commits staged changes using Conventional Commits with auto-detected scope, work item linking, and secret scanning. Use when committing, making a commit, git commit, save changes, commit changes, commit my work, or when triggered by incremental-implementation.

saturate Bundle

Designs APIs with contract-first, consumer-driven approach including validation at boundaries, consistent error responses, and security focus. Generates types from OpenAPI/Swagger. Use when designing an API, creating endpoints, API architecture, REST design, building an API, defining contracts, new service, or when starting API work.

saturate Skill

Performs self-review during development by checking changed code for bugs, security issues, performance problems, and test gaps. Runs inline before committing or creating PRs. Use when reviewing own code, self-review, check my changes, review before commit, review my code, code review, quality check, or when triggered by incremental-implementation before a PR.

saturate Bundle

Runs code metric tools (scc for LOC, lizard for cyclomatic complexity, jscpd for duplicate detection) to produce triage signals for audits, cleanup, and refactoring prioritization. Use when asked for code health metrics, complexity hotspots, duplicate code, LOC breakdown, technical debt signals, what to clean up first, pre-audit analysis, or to feed metric context into other skills like codebase-audit or simplify. Not a fix-it tool — it surfaces flags, not mandates.

saturate Skill

Performs red team security analysis with threat modeling, attack surface mapping, auth flow analysis, and dependency chain audits. Goes beyond checklists to think like an attacker. Use when doing security audit, penetration testing, threat modeling, security review, attack surface analysis, red team assessment, or when codebase-audit flags serious security concerns.

saturate Skill

Evaluates packages before installation across npm, pnpm, yarn, bun, cargo, pip, uv, go, and nuget. Checks footprint, maintenance status, alternatives, license, and security. Use when adding dependencies, choosing between libraries, optimizing bundle size, or running npm install, pnpm add, yarn add, bun add, cargo add, pip install, uv add, go get, or dotnet add package.

saturate Skill

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

gsd-build Skill

Review code changes for security, performance, bugs, and quality. Reviews staged changes, unstaged changes, specific commits, or PR-ready diffs.

shimo4228 Bundle

Audit and fix project documentation — detect role overlaps between context files (CLAUDE.md, ADR, README, graph.jsonld), migrate misplaced content, check freshness against code, and create missing docs. One command to keep all project context healthy.

shimo4228 Skill

ローカル harness (~/.claude) の origin-filtered コンポーネントを公開 repo (claude-harness 集約 repo + 単独 skill repo 群) へ一方向同期する。Use when the user says 「ハーネスを公開 repo に同期して」「claude-harness を更新して」「スキルを公開して」「skill repo を同期して」 or invokes /harness-sync. 収集 → secret scan → subtree 置換は決定論的 script が行い、diff レビュー・README/llms.txt の整合・コミットは会話で行う。NOT for: 公開 repo から ~/.claude への逆方向取り込み、ECC 等外部 origin の公開判断、汎用化 fork を持つ curated skill repo (script 同期は汎用化を壊すため手動 curation)。

shimo4228 Skill

Consolidate a repo's pending-task tracking into its single task ledger (default .notes/TASKS.md) — bootstrap it if missing, sweep handoff / audit / remaining-issues files and auto-memory for stray task lines, verify pending entries against git log and actual code, archive detail files of completed tasks. Use when the user says 「残タスクを棚卸しして」「タスク台帳を作って/整理して」「残っているタスクは？」, "task stocktake", when task lines are scattered across notes files, or when a repo's ledger may be stale. NOT for — skills → skill-stocktake; rules → rules-stocktake; repo non-code assets → repo-asset-stocktake; in-session todos → harness task tools.

shimo4228 Skill

repo に機械ゲート（format / lint / type check / security / dependency audit / test）を立てる、または既存のゲートが古びていないか棚卸しする。Use when starting a new project, when a repo has no automated quality gate, when the user says 「lint を入れて」「この repo にゲートを立てて」「型チェックを入れたい」「静的解析を整備して」「ツールが古い」「verify を棚卸しして」, "set up linting", "add a quality gate", "bootstrap the toolchain", or invokes /verify-bootstrap. 使うツールは skill が知っているのではなく、その時点で search-first に調べさせる — repo のスタックが何であれ同じ手順で回る。NOT for — 既に立っているゲートを 1 回実行するだけ（それは repo の verify entrypoint を直接実行）、ハーネス自身の設定監査（→ config-gc）、コードの意味的レビュー（→ implementation-chain の Review 群）。

shimo4228 Skill

Audit a project repo's non-code assets — tool configs, CI/GitHub workflows, runbooks, other docs — for assets whose consumer has vanished, and assign Keep/Update/Retire/Merge verdicts. Use when the user says "audit my repo assets", "which configs/workflows/runbooks are dead", "repo asset stocktake", 「非コード資産を棚卸しして」「使われてない設定/workflow/runbook を洗い出して」. NOT for — dead code → refactor-clean; doc-role overlap across CLAUDE.md/graph.jsonld/ADR/README → context-sync; ~/.claude config GC → config-gc; skills or rules → skill-stocktake / rules-stocktake.

databricks Bundle

Unity Catalog system tables and volumes. Use when querying system tables (audit, lineage, billing) or working with volume file operations (upload, download, list files in /Volumes/).

xiaolai Skill

Audit a chapter or case file for narrative implication of mental state, motive, knowledge, causation, or chain responsibility that exceeds what cited evidence supports. Catches structural implication (sentence sequence, focalization, juxtaposition, named-then-named ladders) that verb-level overclaim scanning misses. Used by Stephen, Laura, and Nancy.

xiaolai Skill

Audit chapter prose for verbose inline `[CITE:]` markers that violate rule-13's slug-only invariant. Inline `[CITE:]` brackets must carry only card slugs (separated by `;` for multi-source claims); full citation apparatus lives in the source-ledger card and is compile-generated as Chicago NB endnote. Catches the failure mode where citation metadata leaks from card to prose. Cousin to `scan-cite-density.py` (the cheap pattern-level pass); this skill is the deeper read.

xiaolai Skill

Audit the book's cognitive arc — the discriminations and concepts the reader acquires chapter by chapter — against the actual prose. For each discrimination, verifies introduction, consolidation, and application in every required chapter. For each concept, verifies it is named and used. Reads `book/registries/cognitive-arc.yml`.

xiaolai Skill

Audit a chapter for voice-register distribution across three registers — R-primary (primary document quoted at full force), R-frame (newsroom-style paraphrase), R-analytic (the book's analytical voice). Verifies paragraph-level register tags exist, distribution falls within tunable thresholds, and register transitions are marked rather than silent. Used by Wayne and Stephen on `structural-polish` and `full-craft-rewrite` chapters.

xiaolai Skill

Manage versioned amendments to a chapter's per-chapter contract during a rewrite cycle. Diffs pre vs post contract, requires a reason for every changed field, flags amendments that would mask Gate B failure (e.g., a `feels:` slot weakened to match the rewrite rather than its promise), and snapshots both versions into the chapter's audit history. Used by Wayne, Bonnie, and jerry-crew-chief at Gate B.

xiaolai Skill

Audit chapter prose for rule-14 violations — meta-frame language ('this chapter', 'the book', 'the reader', 'readers', 'this section', 'the author'), author-voice 'you', modal-prescriptive forms ('you should', 'we must remember'), evasive-collective forms ('people tend to'). Catches violations the scanner can't see (judgment-level 'we' laundering, passive-voice attribution misses). Cousin of `scan-pronoun-discipline.py`. Used by Wayne during drafting and by Laura during red-team.

danielscholl Bundle

Maven dependency version checking and security vulnerability scanning. Check Maven artifact versions, find updates, scan for CVEs with Trivy, and analyze POM files. Use when the user asks about Maven dependency versions, needs to check for updates, wants to scan for vulnerabilities in a Java project, or needs POM file analysis. Not for: building or running Java tests (use build-runner or acceptance-test), or general Java project setup.

larsboes Bundle

Convenes four to five subagents that hold different positions on one decision, runs them over rounds, and reports a transcript, a recommendation and the minority position. Three rounds for a decision that is expensive to reverse, one round for a sanity check. Carries five domain presets — architecture, investment, travel, security, product — and a rule for composing a council when none of them fits. Use when the request asks for a council, a debate, several perspectives, a weighing of options, or the case for and against a choice. Do not use for a pure attack on one proposal (use red-team), and do not use for a question that has one factual answer.

larsboes Bundle

Deploys and backs up Home Assistant Lovelace dashboards over the WebSocket API — list existing dashboards, back up a dashboard's config to a file, push a config file to a dashboard, and create a new sidebar dashboard. Pure-Python-3 stdlib WebSocket client (no deps); the non-secret HA_URL comes from the committed overlay config and the secret HA_TOKEN from a Bitwarden item at runtime, never hardcoded. Use when deploying or backing up a Lovelace dashboard, saving or restoring dashboard config, listing dashboards, or creating a new dashboard. Do not use for querying or controlling entities or calling services (use ha-cli), router or network device listing (use fritz), DNS or ad-blocking (use pihole), or filling and deploying HA automation templates (use homectl).

larsboes Bundle

Configures the Home Assistant Energy Dashboard over the WebSocket API (energy/get_prefs, energy/save_prefs) — the REST API does not expose these prefs — wiring solar production/power, grid import/export, and battery charge/discharge sources, and reading the current sources back. Source entities are passed as flags or a raw JSON array, never hardcoded; existing grid price/cost config and the solar Forecast.Solar entry are preserved on write, so re-running is idempotent. The secret HA_TOKEN comes from a Bitwarden item at runtime and the non-secret HA_URL from the committed overlay config, never hardcoded. Use when wiring up or changing the Energy Dashboard sources, pointing the dashboard at solar/grid/battery sensors, or inspecting the current energy preferences. Do not use for general entity-state queries, service calls, or automation reloads (use ha-cli), or filling and deploying HA automation templates (use homectl).

michelve Skill

Write, validate, and commit Architecture Decision Records in MADR 4.0.0 format. Use when user says 'write an ADR', 'create an ADR', 'document this decision', 'ADR for X', 'architecture decision record for X', 'record this decision', 'document the decision to use X', or wants to formally capture an architectural choice. Do NOT trigger on 'what ADR covers X?', 'show me the ADR for Y', 'does this violate an ADR?', or 'check ADR compliance' - those are lookup/audit tasks.

odere-pro Skill

Read-only audit of vault/wiki/ for structural and provenance drift. Reports Errors, Warnings, and Info per the lint rules in vault/CLAUDE.md. Trigger when the user says "lint the vault", "audit the wiki", "check for broken links", "run a health check on the wiki", or invokes /claude-wiki-pages:lint directly. Does not repair anything — that is /claude-wiki-pages:fix.

gaintrace Bundle

When the user needs to plan, run, audit, or rescue a new customer's onboarding and implementation — from the sales handover through to first value and steady-state handoff. Also use when the user mentions 'implementation is behind', 'weeks behind', 'plan their onboarding', 'onboarding plan', 'implementation plan', 'we just closed Acme, what now', 'kickoff call', 'kickoff agenda', 'time to value', 'time to first value', 'go-live plan', 'first 90 days', 'onboarding checklist', 'sales to CS handoff', 'this implementation is stalled', 'they signed three months ago and still aren't live', or 'when will they actually be live'. Use this whenever a customer has signed but has not yet reached first value, even if they never say the word 'onboarding' — a question as small as 'what should I do with this new account' is this skill. For risk after onboarding, see churn-risk. For the kickoff brief, see pre-call-brief. For the review after handover, see qbr-builder. For the first renewal, see renewal-prep.

gaintrace Bundle

When the user needs to know whether the integrations wired into a customer account are actually working — per connector, per error class, and including the failures that raise no alert. Also use when the user mentions 'integration health', 'the sync is broken', 'my sync keeps failing', 'failing silently', 'connector errors', 'nothing is syncing', 'their data looks wrong', 'records are missing', 'we are dropping records', 'the token expired', 'credentials expired', 'schema changed and broke it', 'API version is being retired', 'webhook failures', 'why is their data out of date', or 'they say the numbers do not match'. Use this whenever data flow into or out of the product is in question for an account, even if they never say 'integration' and only report a number looking wrong. For the whole deployment, see fde-account-plan. For account-level risk, see churn-risk. For scoping a fix as a build, see fde-scoping. For the data the CS team runs on, see cs-data-audit.

howells Bundle

Build a Paper mockup from a written specification, or audit and repair an existing Paper file: tokens, fonts, artboard layout, crops, labels. Use only for work in app.paper.design. Not for coded UI implementation (`chiaroscuro`), browser QA (`fieldtest`), or design critique with no Paper file involved.

dills122 Bundle

Audit and revise existing prose so it reads naturally, specifically, and consistently with the author's voice while preserving every supported fact, number, citation, code block, link target, and intentional technical term. Use for a final editorial pass on blog posts, documentation, essays, announcements, or other prose that feels generic, repetitive, inflated, or recognizably machine-shaped; do not use as the primary research or drafting workflow or to evade disclosure requirements.