Security

opendatadiscovery Skill

Run an audit scanner against ODD repositories. Reads scanner definition, picks unscanned items from coverage manifest, writes findings, updates navigation.

openjiuwen-ai Bundle

Security Review

piyushverma0 Skill

Android app security for AI agents. Use this skill whenever implementing secure data storage, EncryptedSharedPreferences, EncryptedFile, Android Keystore, ProGuard/R8 code obfuscation, certificate pinning, network security config, root detection, SSL/TLS, token storage, preventing reverse engineering, securing API keys, BuildConfig secrets, environment variables, cleartext traffic, backup rules, screenshot prevention, overlay attack prevention, or any Android security hardening. Always apply when handling user credentials, payments, or PII.

piyushverma0 Bundle

Supabase Kotlin SDK for Android AI agents. Use this skill whenever integrating Supabase in Android apps: supabase-kt setup, Auth (email/password, Google, phone OTP), UnauthorizedRestException fix, persistSession configuration, getUser(jwt) pattern, FunctionsHttpException, Edge Functions invocation, Realtime subscriptions, Postgres queries, Row Level Security, Supabase Storage file upload, sessionStatus Flow, verify_jwt in config.toml, @Serializable DTOs, decodeList, or any supabase-kt usage in Kotlin/Android.

syncable-dev Skill

Orient at the start of a coding session, review what recently changed in a repository, and self-audit after completing work. Use when the user wants the daily briefing (what changed in the last 24h with complexity deltas), hotspots (complexity × churn refactor priorities), or a session review (clean/review/risky verdicts per editing session). For catching up after time away or resuming a prior session, use memtrace-session-continuity; daily is the last-24h briefing + hotspots + self-audit. Do not reconstruct recent activity from git log; Memtrace diffs the graph at save granularity.

fei2-labs Bundle

Triage and persist work outside the explicit active objective. Use at message intake when a message contains multiple requests, an item is unrelated or deferred, the user asks to remember, track, log, or handle something later, or invokes dev-inbox. After resume or context compaction, audit requested-but-unrecorded items before continuing.

fei2-labs Bundle

Publish an NPM package to the registry, handling authentication via browser-based login with 2FA/security key support.

fei2-labs Bundle

High-confidence code security review workflow for changed code, using modern threat-informed methodologies with strict false-positive filtering and exploit-focused findings.

jarrydadaens Bundle

Use this skill when the user explicitly asks for evidence capture, provenance, validation evidence, source-grounded proof, or an evidence.md file during an agentic task. It maintains an opt-in evidence record — by default the `## Evidence / References` section inside the active plan.md, or a standalone evidence.md when explicitly requested or genuinely required for audit — that indexes changed files, commits, checks, planning inputs, and unverified claims.

jarrydadaens Bundle

Use this skill when the user asks for a deep project appraisal, project audit, architecture review, viability review, strategic review, or "is this project worth continuing?" analysis of an Agentic Rails project. It reads repository and context-tier material, validates the codebase by building, testing, and (where a UI exists) launching it, inspects git history, performs external grounding via web research, and writes a frank, evidence-led markdown report under context/reports/ that grades the project and recommends a course of action — continue, refine, harden, pivot, split, rebuild, freeze, or abandon. Reserved for deep, deliberate use on projects that matter, not a lightweight orientation pass, a code-execution skill, or a normal planning/implementation workflow.

jdinkla Skill

Audit an AI/ML or data-driven user story for algorithmic bias and discrimination — identify bias types, proxy variables, protected groups affected, fairness metrics, regulatory requirements (EU AI Act, NYC LL144, EEOC, etc.), and testing recommendations. Use when the user asks about algorithmic fairness, bias audit, AI ethics review, or discrimination risk on a feature.

jdinkla Skill

Identify 6–10 failure modes for a user story across infrastructure, data, integration, user error, business logic, security, and performance — with triggers, impact, detection, recovery, and prevention. Use when the user asks "how could this fail?", wants resilience/SRE thinking, or is planning graceful-degradation behavior.

khangpqvn Skill

Kiểm định Constitution, Clean Architecture, EARS trace và binding theo Architecture Profile

khangpqvn Skill

Audit API theo OWASP, Clean Architecture và Architecture Profile

latuconsinafr Skill

Use when you want a dedicated security review of staged or recently changed files — deeper than the security section in /review. Covers OWASP Top 10, secrets exposure, dependency vulnerabilities, and auth gaps. Run before opening a PR on security-sensitive changes.

latuconsinafr Skill

Use when you want to audit project dependencies — scans all lockfiles for CVEs, outdated major versions, and license violations. Run before releases or periodically as a health check.

launch52-ai Bundle

Audit Flutter code for hardcoded strings, write clear user-friendly text following UX guidelines, and migrate strings to i18n files. Use when checking localization, finding hardcoded text, improving string clarity, writing error messages, button labels, or any user-facing text.

launch52-ai Bundle

Write, review, and audit tests for Flutter projects using Clean Architecture + Riverpod. Use when writing unit tests, widget tests, golden tests, reviewing test quality, checking test coverage, creating mocks/spies, or testing Riverpod providers.

launch52-ai Bundle

Google Sign-In and Apple Sign-In with Supabase or custom backend. OAuth setup, platform config, PKCE/nonce security, sealed Failures, mock repository. Use when adding social login or troubleshooting OAuth.

leoluyi Bundle

Audit or rewrite finished Traditional Chinese, English, or mixed zh/en prose to remove AI-isms while preserving facts, voice, and technical level. Trigger on 「去 AI 味」, 「改成人話」, 「先標出來就好，不用改」, "clean up the AI-isms", detect-only, edit-in-place, or humanizer-zh/preflight requests. With no draft, mode, or file, prepare the pre-draft handoff. Route blank-page composition to writing skills and audience simplification to plain-speak.

leoluyi Bundle

Audit or rewrite mainland-China usage in Traditional Chinese into Taiwan 正體中文, including 陸用語, 簡體殘留, 職場／互聯網黑話, and Taiwan transliterations. Trigger on 「去除陸用語」「改成台灣用語」「抓簡體殘留」「把互聯網黑話改成正常中文」, "remove mainland Chinese wording", or "localize this to Taiwan Traditional Chinese". Not for AI-ism cleanup, document restructuring, plain-language explanation, creative writing, or code comments.

lichtblick-suite Skill

Deep Electron implementation knowledge: main/renderer process communication, contextBridge patterns, BrowserWindow lifecycle, native menu integration, and security considerations.

tenstorrent Skill

Noc Sync Audit

tenstorrent Skill

Run all nine LLK hazard audits (mmio-race, reconfig-stall, cfg-word-overlap, semaphore-handshake, mailbox-sync, dataflow-cb-sync, srcreg-bank-sync, noc-sync, instruction-latency) across four synchronization surfaces, and add a cross-class JOIN pass that catches emergent races no single audit can see — where one audit's verdict is "safe because <invariant owned by another audit>". Use for a full hazard sweep of an LLK change, or before merging anything touching config writes, reconfig/uninit, inter-thread/cross-core sync, the SrcA/SrcB-Dst data path, or hand-written instruction sequences.

tenstorrent Skill

Audit LLK code for races between a RISC MMIO write to a config/GPR register and a Tensix instruction/MOP/replay that consumes it. Use after touching any raw cfg[...]=/reg_write/cfg_rmw/regfile[]= write near an UNPACR/PACR/MOP/CFGSHIFTMASK, or when adding addressing/stride/format register writes.

tenstorrent Skill

Audit LLK/compute-API use of the RISC↔RISC hardware mailboxes (mailbox_write/mailbox_read/mailbox_not_empty, TENSIX_MAILBOX*) for races/deadlock — push/pop balance per directed channel, call-count symmetry across threads, correct write-dest/read-src addressing, FIFO overflow, and the fence ordering caveat. Use after touching any mailbox_write/mailbox_read, the CB tile-address/value broadcast (circular_buffer.h / cb_api.h get_tile_address/read_tile_value), unpack-to-dest dst_index passing, or the debug halt/unhalt handshake.

tenstorrent Skill

Audit LLK reconfig/uninit/config-write functions for a MISSING stall that drains the execution unit before its config registers are rewritten (packer→PACK, unpacker→UNPACK, math→MATH|WAIT_SFPU). Use after touching cpack/cunpack/cmath, *_reconfig_*, *_uninit, set_packer_strides, or any function that writes ALU/THCON/ADDR_MOD/stride config.

tenstorrent Skill

Audit LLK code for races on the backend CONFIG register file where differently-named fields share the SAME 32-bit config word — both cross-thread (unpack/math/pack write the same word) and intra-thread (a full-word write clobbers a sibling field the same thread set elsewhere). Use after adding/changing any ALU_FORMAT_SPEC / ALU_ACC_CTRL / ALU_ROUNDING_MODE / STACC_RELU / THCON_SEC* write, any WRCFG_32b/cfg[]= full-word write to a multi-field word, or any cfg_reg_rmw_tensix on a word another thread also touches.

tenstorrent Skill

Audit circular-buffer (CB) producer/consumer flow control between data-movement (reader/writer) and compute kernels — cb_reserve_back/cb_push_back/cb_wait_front/cb_pop_front credit balance, data-write-before-credit ordering (NOC flush), reserve/wait-before-access, capacity vs num_pages, single-producer/consumer, counter cache-coherency, and remote/sharded CB credits. Use after touching any cb_* call, a reader/writer/compute kernel, fifo_rd_ptr/fifo_wr_ptr/pages_received/pages_acked, or RemoteSender/ReceiverCBInterface. Scope reaches beyond tt-llk into tt_metal/hw/inc/api/dataflow and ttnn/models kernels.

tenstorrent Skill

Audit the shared backend DATA registers — SrcA/SrcB bank-valid (AllowedClient) + bank-flip handshake between unpacker and Matrix Unit, and the shared-once Dst/LReg overwrite hazards not already carried by the MATH_PACK semaphore or mutex::SFPU. Use after touching unpack→math dataflow, SETDVALID/CLEARDVALID, bank-flip bookkeeping, MOVD2A/MOVA2D/MOVB2D, or any cross-thread Dst/LReg access.

tenstorrent Bundle

Audit Tensix/SFPU LLK compute kernels for PERFORMANCE — unfilled latency shadows/bubbles and redundant NOPs, redundant Dst/LReg store-load traffic, loop-invariant work, predication that should be branchless arithmetic (min/max/abs/setsgn), un-fused mul+add, ignored APPROXIMATION_MODE, and unroll/register-pressure mistakes. Use after touching any ckernel_sfpu_*.h, hand-written TTI_SFP*/TTI_* sequence, or the compute inner loop. This is a PERF audit (wasted cycles), NOT a correctness/race audit — pair it with instruction-latency-audit.

tenstorrent Skill

Audit LLK inter-thread synchronization (Tensix semaphores + ATGETM/ATRELM mutexes) for races/deadlock — SEMINIT correctness vs usage, post/get balance, wait-direction, RISC-MMIO-vs-Tensix ordering, and mutex acquire/release balance. Use after touching any t6_semaphore_*/semaphore_post/semaphore_get/SEMINIT/SEMWAIT/SEMPOST/SEMGET/t6_mutex_* or any math↔pack / unpack↔math handshake (MATH_PACK, UNPACK_TO_DEST, UNPACK_SYNC, MATH_DONE, FPU_SFPU).

jlugagne Bundle

Orchestrates dual code review with consensus — two Sonnet reviewers (architecture+performance and security+data) run in parallel, Opus arbitrates only when they diverge. Creates fix/test task files.

alexanderop Skill

Manage and consolidate tags. Use when asked to "clean up tags", "consolidate tags", "tag audit", "merge tags", or "rename tag".

alexanderop Skill

Audit notes for quality issues. Use when asked to "review notes", "check content quality", "audit my knowledge base", or "find broken links".

justinmchoi Bundle

Scaffold a new personal project folder under a-projects/ with a standardized skeleton (master index, business/domain glossary, external-documentation folder, a stable home for design-decision sessions), or audit an existing organically-evolved project folder against that same convention and propose a migration plan for approval. Use this whenever the user wants to start a new project folder for ongoing multi-session work (a new client, initiative, or investigation), says things like "set up a project structure," "scaffold a project," "apply the project structure to X," or is about to create a new top-level folder/file in an existing a-projects/ folder without first checking whether an established convention already covers it. Also trigger proactively when a project folder has clearly grown ad hoc — multiple sessions each inventing new top-level folders with inconsistent naming (numbered vs. not, PascalCase vs. spaces vs. underscores) — even if the user hasn't explicitly asked to fix it.