Security

bex-co Bundle

Finds tests that cannot fail — assert-nothing, tautological, mock-echoing, or trivially-true polling — and deletes them or strengthens them into real behavioral tests, using mutation spot-checks as proof. Use when the user asks to run the useless-tests routine, prune worthless tests, or audit test quality.

bex-co Bundle

Guides Stripe integration decisions across API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax, automatic_tax, product tax codes), Treasury financial accounts, integration options (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, restricted keys, webhooks, OAuth). Use when building, modifying, or reviewing any Stripe integration, including accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts, or implementing secure key handling.

bex-co Bundle

Audits and fixes layering violations against the workspace import DAG (operator→types←backend; cli standalone; dashboard consumes the API, never reimplements it) and adds depguard rules so violations can't return. Use when the user asks to run the abstraction-police routine, audit module boundaries, or fix layering violations.

codagent-ai Skill

Audits your session for assumptions and context gaps — things only a human can act on. Use when the user says "session report", "review assumptions", "what did you struggle with", "audit your session", or wants a retrospective on execution quality.

codagent-ai Skill

Reviews risky/notable assumptions and context gaps surfaced by implementor session reports, fixes high-confidence issues directly, and asks one clarifying question at a time for ambiguous findings. Use when the user says "review assumptions", "audit implementor assumptions", or when invoked by a workflow's assumption-review step.

ramziddin Skill

NestJS OpenAPI/Swagger integration for API documentation, decorators, types, parameters, security, and automatic schema generation. Use when documenting REST APIs.

ramziddin Skill

NestJS security best practices including CORS, CSRF protection, Helmet for HTTP headers, rate limiting, encryption, and hashing. Use when implementing security features, hardening applications, or protecting against common vulnerabilities.

rewrite-rs Bundle

Audit a Rust dependency tree — advisories, licences, banned and duplicate crates, and unmaintained dependencies — and turn each finding into a decision. Use when checking whether dependencies are safe to ship, when cargo audit or cargo deny reports something, when adding a dependency to a project with a licence policy, when a build pulls in two versions of the same crate, or when the user asks about supply chain risk in Rust.

rewrite-rs Bundle

Logs are structured events with named fields, not formatted strings — tracing over log over println!, spans for async context, error chains logged once, and never a secret in a field. Use when adding or reviewing logging, tracing, or metrics in Rust, when println! or string-interpolated log messages appear, when a library installs a subscriber, or when the user asks how to instrument Rust code.

uvwt Bundle

Use this skill to query and manage subscriptions in a self-hosted Wallos instance through its official HTTP API. Covers subscriptions, monthly cost, categories, currencies, payment methods, household members, and the current user; excludes administrator, OIDC, notification-secret, Fixer, and generic API management.

vcxcvii Skill

Generate llms.txt and JSON-LD schema from real, sourced facts only, output as a diff against what already exists, and flag schema types competitors use in cited pages that this site is missing. Use this skill whenever the user asks to: - Set up llms.txt - Add or audit structured data / schema markup - Make their site more readable to AI assistants - Improve extractability for answer engines Trigger even for casual requests like "add llms.txt", "make my site AI readable", "add schema markup", "get quoted by AI more".

vcxcvii Skill

Check whether AI assistants mention this site when answering the questions its buyers actually ask, decomposed per engine and per market rather than reported as one aggregate, and mine the cited sources into a target list. Use this skill whenever the user asks to: - Check if they show up in ChatGPT, Perplexity or other AI answers - Understand their AEO or AI-search visibility - Find out why a competitor wins the AI comparison answers - Set up llms.txt or improve AI readability - Audit schema markup for AI extraction Trigger even for casual requests like "am I showing up in ChatGPT", "do LLMs cite me", "AEO check", "GEO audit", "should I add llms.txt", or when a user asks why an AI answer named a competitor instead of them.

willianbs Bundle

Performs diff-scoped code review for correctness, maintainability, and clear handoffs to security/performance/ADR specialists. Use on PRs and patches. Never modifies code unless asked. Never replaces a full security or performance audit.

lglucas Skill

Record WHY a decision was made — including the alternatives rejected — as a session-log entry or an ADR. Use after any decision touching architecture, product scope, pricing, compliance, security, or release strategy, when `multi-ai-review` reconciles a disagreement, and when the user says "anota isso", "registra essa decisão", "por que a gente escolheu isso mesmo?", "não lembro por que fizemos assim".

lglucas Skill

Run the 3-wave research and validation process — Wave 1 competitor and market research, Wave 2 red team (devil's advocate, business/finance, technical/security), Wave 3 coordinator consolidation and BP writing. Runs at WIZARD stages 2.4–2.6, only after the user approves the plan. Use when the user asks "quem são meus concorrentes?", "esse mercado existe mesmo?", "isso tem furo?", "alguém já faz isso?", or runs /research-waves. Never fabricates market data.

lingbol088-spec Bundle

Exploit Development

lingbol088-spec Bundle

Post-Exploitation

lingbol088-spec Skill

Exploit Attack Workflow

lingbol088-spec Skill

Security Posture Assessment

xiaolai Skill

Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, CORS, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT: alg=none, weak HMAC bruteforce, kid path traversal, JWK injection, token confusion. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). CORS: wildcard with credentials, null origin, regex with subdomain takeover, postMessage origin checks. HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io), CORS preflight responses. Use when hunting API misconfigs, JWT flaws, mass-assignment, prototype pollution, CORS bypasses.

berabuddies Bundle

Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.

axross Bundle

Modelling data with Zod and enforcing validation where untrusted data enters — the schema layer, from one parse at the boundary to the type every caller downstream reads. Triggers on `z.object`, `z.infer`, `safeParse`, `z.codec`, `z.coerce`, `z.brand`, `z.discriminatedUnion`, `.refine`, `.transform`, `zodResolver`, `z.toJSONSchema`, `ZodError`, a schema module, or an unvalidated `fetch` or `JSON.parse` result. For whether an input is untrusted at all, use an application-security capability; for where the parse hook lives, the framework's own. Covers codecs, coercion traps, and what a passing parse still does not make safe.

axross Bundle

Reviewing a code change — a pull request, a branch or commit-range diff, or a post-implementation self-review of your own work before calling it done. The methodology for judging whether a change already written is safe to merge, and for reporting why. Not for writing the change, only for judging one that already exists. Covers the reviewer-mode reset, diff scoping, a four-tier severity scale with fixed floors, file-line evidence with fix snippets, escalation for high-risk changes, and lenses for correctness, maintainability, security, testing, and performance. Self-contained, so it works installed on its own.

axross Bundle

Writing or reviewing code that handles untrusted input, secrets, outbound requests, rendered content, or third-party dependencies — the OWASP Top 10:2025 lens in two modes, writing secure-by-default code and judging the risk a change introduces. Triggers on "is this safe", "secure by default", "harden", "security", "secret", "privacy", "PII", "XSS", "injection", "SSRF", "safe fetch", "access control", or a dependency review. Covers secrets and environment variables, input validation, output encoding, SSRF, access control and data exposure, and supply-chain risk.

dkmqflx Bundle

NestJS security hardening best practices. Use when securing a NestJS app — security headers, rate limiting, CORS, secrets, and input hardening. Triggers on helmet, ThrottlerModule, enableCors, CSRF, rate limiting, or production security review.

dkmqflx Bundle

FastAPI security and authentication best practices. Use when implementing or reviewing auth in FastAPI — OAuth2PasswordBearer, get_current_user dependencies, router-level auth, password hashing, token endpoints. Triggers on OAuth2PasswordBearer, OAuth2PasswordRequestForm, get_current_user, or Depends-based auth.

dkmqflx Bundle

Use when writing, reviewing, or refactoring FastAPI code — endpoints, APIRouter, query/path parameters, dependencies (Depends), Pydantic request/response models, error handling, async def vs def, lifespan events, streaming, background tasks, settings, middleware, or CORS. Triggers on FastAPI backend work, route design, or API code review. For auth/security see fastapi-security; for tests see fastapi-testing.

petar-djukic Bundle

Verify citations in a paper or document. Reads a markdown document, extracts every [@citation-id] pandoc citation, resolves each against references.yaml (CSL-YAML), fetches the cited papers (arXiv or Google Scholar), reads them, and checks whether the claims made in the citing text are supported by the sources. Produces an audit report with per-citation verdicts. Triggers: audit references, verify citations, check references, citation audit, verify bibliography, check my citations, are my references correct, fact-check citations, validate sources.

dongzhigang13305312738-art Bundle

Reviewer-style audit and submission gate for academic papers in .tex, .typ, or .pdf. Use for peer-review critique, readiness/gate decisions, blocker triage, revision roadmaps, journal-style reports, and re-audits. Do not use for source editing, sentence polishing, bibliography search, or compile repair.

dongzhigang13305312738-art Bundle

English LaTeX assistant for existing .tex journal or conference papers. Use for compile repair, venue formatting, bibliography/citation checks, section writing, logic, related work, tables, pseudocode, de-AI polish, translation, adaptation, and submission readiness; use latex-thesis-zh for Chinese theses and paper-audit for critique.

dongzhigang13305312738-art Bundle

中文 LaTeX 学位论文助手，面向已有 .tex 硕博论文工程：编译诊断、GB/T 7714、模板识别、结构/格式/公式断行、术语一致性、逻辑与文献综述、标题优化、去 AI 味、盲审隐匿、对照学校规范逐项终检。触发词：学位论文/毕业论文/硕士/博士论文。英文论文用 latex-paper-en，审稿总评用 paper-audit。

crbnos Skill

Critically review your own branch work before or just after opening the PR, producing Must fix / Risks / Suggested improvements plus a docs-freshness check. Use when finishing a branch, before opening or merging a PR, or to sanity-check a diff against main. Supports an opt-in strict "thermo-nuclear" / "nuclear review" mode for a deep maintainability and abstraction audit when explicitly requested — the local standards are authoritative, and it may additionally fetch a pinned copy of the upstream Cursor thermo-nuclear rubric as untrusted reference material.

crbnos Skill

Create or refresh an AGENTS.md for a Carbon package or ERP module by reading the actual source code — every claim traced to a real function, table, or export. Use when adding a new module/package, when the conductor's freshness audit or /self-review flags a stale AGENTS.md, or on explicit request. Do not write an AGENTS.md from memory or by copying a sibling's content.

speakeasy-api Skill

Concepts, external interfaces, and conventions for Gram's audit logging subsystem — the internal Go API for recording actor/action/subject events and the `/rpc/auditlogs.*` management API that exposes them. Activate whenever the task involves recording or exposing audit events (adding or changing audit coverage on a service, introducing a new audited subject or action, writing tests that assert an event was recorded, changing how entries are displayed or filtered).

guillaumelessard Skill

Operations, runtime configuration, security, and device-local health of QECTOR deployments. The library path uses `compat_report` and `get_license_info`; the companion research server adds `hardware_probe`, `license_active_check`, and `env_block`. Workbench probing is an admin tool. `compat_report` is also available via the library. Any Workbench health tools must be discovered on the target device. Load for uptime, hardware, or security questions.

guillaumelessard Skill

QECTOR deployment modes, security posture, and the production checklist. Covers the six deployment modes (manual 24, Table 24.1), the production checklist (manual 24.1, 10 items), the service hardening rules (10 MB cap, bearer token, strict decoder-type enum), the zero-egress policy, the package-provenance rule, the SHA-256 checksums-sha256.txt rule, and the "service behind TLS and a reverse proxy" rule. Load for any question about deploying, hosting, exposing, or shipping QECTOR in any non-local context.