Security

justinmchoi Skill

Audit a drafted conclusion, report, review, or plan for load-bearing claims that were never actually checked — classify each as verified/inferred/assumed, run the cheap falsifying command for the unverified ones, correct what turns out wrong, and report a coverage figure. Use before delivering an output someone will act on, or when asked "how do we know this is right?", "how confident are you?", "check your claims", or "did you verify that?".

mjcreativelab Bundle

脅威モデル・認可・データフロー・設計リスクの観点からセキュリティ監査を行う。新機能の設計時、外部接点を変更するとき、認証・認可・データ扱いに触れるときに使う。

caomeiyouren Bundle

使用 GitHub CLI（gh）处理仓库、issue、pull request、workflow、project、release、codespace、gist、search、api、auth、config、alias、secret、variable、extension、ruleset 和 status 等命令行操作时使用。用户提到 gh、gh cli、GitHub CLI、gh auth、gh repo、gh issue、gh pr、gh workflow、gh project、gh release、gh api、gh search、gh codespace、gh secret、gh variable、gh alias 时都应触发。

caomeiyouren Skill

对鉴权、权限、输入处理、数据写入、依赖配置、密钥、日志和外部调用进行安全审计时使用。用户提到 security、auth、permission、vulnerability、secret、injection、审计登录逻辑、权限合规时都应触发。

caomeiyouren Bundle

自动处理 GitHub security alerts 的依赖修复工作流。用户提到 auto fix security alerts、Dependabot alerts、code scanning、pnpm audit、frozen-lockfile、修复依赖漏洞、升级有安全告警的包、按 severity 过滤或优先处理 critical/high 告警时使用。支持从 GITHUB_TOKEN 读取 GitHub alerts，或在无 token 时回退到 pnpm audit；会先检查 Git 仓库是否干净、拉取远端更新、按严重级别和可修复性排序，再逐个依赖升级、修复 frozen-lockfile、执行 lint/test/build 并汇报未解决的 high+ 风险。用户显式要求时，也可启用更严格的过时 pnpm overrides 清理流程。

digitaldreams Skill

Vertical Slice Architecture guardian, two modes. PLACE mode: decide where a new class, event, DTO, or module belongs under VSA rules, or design a new module/slice map from scratch. AUDIT mode: scan for slice-isolation violations (cross-slice imports, cross-module coupling, misplaced events) and prescribe the move that fixes each. Use whenever the user says "VSA", "which slice", "where does this class go", "slice isolation", "organize the slices", "cross-slice import", "should this move to module root", or asks how to structure a feature in a slice-based codebase.

digitaldreams Skill

Pre-release adversarial QA pass by a brutal critic, two modes. AUDIT mode (default): ranked findings report split into mandatory-fix vs optional, with evidence and repro for every finding, written to tasks/qa_report_{date}.md; may write failing tests to prove top findings. VALIDATE mode: fresh persona verifies a previous report's findings and fixes. Use whenever the user says "quality audit", "brutal critic", "test the software in various ways", "release readiness", "find gaps between features and tests", "invent edge cases", "rockstar tester", "veteran tester", "find bugs before production", or "validate the QA fixes". Fans out subagents for coverage on large scopes.

digitaldreams Skill

Security audit of the user's own codebase, two modes. FIND mode: adversary persona hunts every real security hole in scope and writes them to tasks/security_risks_{date}.md. VALIDATE mode: a fresh security-specialist persona verifies each reported finding was real and each implemented fix is correct. Use whenever the user says "security audit", "red team", "find security issues", "security holes", "act as a bad guy", "attack the app", "validate the security fixes", or "verify the security report". Authorization context: the user owns this codebase and is auditing it for defensive hardening.

ducpm2303 Skill

Runs a holistic code health check scoring Security, Tests, Performance and Quality with A-F grades. Use when user asks to "check health", "score this project", "health check", "how good is this code", "overall assessment", or "code quality score".

ducpm2303 Bundle

Reviews or implements Spring Security configuration — JWT authentication, OAuth2, method-level security, CORS, and CSRF. Use when user asks to "add authentication", "secure this API", "implement JWT", "configure Spring Security", "add OAuth2 login", "protect endpoints", or "review security config".

ducpm2303 Skill

Quick OWASP security scan for injection risks, hardcoded secrets, weak crypto, and Spring Security misconfigs. Use when user asks to "security scan", "check for vulnerabilities", "any security issues", "OWASP check", "hardcoded secrets", or "is this secure".

rube-de Bundle

Dev Life Cycle quality gates: run security scans, code quality checks, performance analysis, test coverage, and PR review compliance. Routes to domain-specific sub-skills or runs all checks in sequence.

rube-de Skill

Security scan: dependency audits, SAST analysis, and secret detection. Detects project type, runs available security tools, classifies findings by severity, and creates a structured GitHub issue.

rube-de Skill

Validate plugin SKILL.md frontmatter and audit hook scripts for silent failures. Run validation to check all plugins pass schema, source path, and frontmatter checks. Run hook audit to detect unhandled errors in shell and Python scripts.

rube-de Bundle

Audit review checklist for a repo: cluster recurring review-comment themes across merged PRs in a window, diff against docs/code-review-checklist.md, and open a PR proposing new entries with PR traceability. Designed for /schedule monthly cadence. Pass --dry-run to print clusters without opening a PR. Trigger phrases: audit review checklist, update review checklist, cluster PR findings.

sallaapp Bundle

Salla webhooks end to end — registering/subscribing, choosing a security strategy (signature = HMAC of the raw body; token = plain equality of the Authorization header; or none) and verifying each correctly, the payload envelope, idempotency, fast 200, conditional rules, and versions (v1/v2). Use when building a webhook server (Node/Express `@salla.sa/webhooks-actions` or Laravel/PHP / Salla CLI), subscribing events, or debugging delivery. Prefer an App Function (salla-app-functions) when a trigger exists. Lifecycle → salla-app-lifecycle; tokens → salla-app-auth.

seangsisg Bundle

Audit Claude Code rules and CLAUDE.md/AGENTS.md files for staleness, quality, and drift. Use when asked to audit rules, check stale CLAUDE.md, check stale AGENTS.md, review rules freshness, assess rules quality, improve my rules, find dead globs in rules, check if rules are up to date, review progressive disclosure setup, find contradictory rules, or optimize Claude Code memory files.

seangsisg Skill

Run comprehensive health checks on the Obsidian vault — orphan notes, stale drafts, broken links, type mismatches. Triggers: "vault maintenance", "check vault health", "find orphan notes", "audit my vault", "what needs fixing". Only runs when explicitly requested.

skillatlas Bundle

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

blogic-cz Bundle

Effective-change-set review with repository baseline, mechanical and structural passes, validation, bounded fixes, and terminal result contract.

blogic-cz Skill

This skill should be used when auditing Effect TypeScript compliance, or when users mention effect scan, effect audit, effect best-practices checks, or scan-effect-solutions. It provides a structured compliance checklist for TypeScript configuration, services/layers, data modeling, error handling, config, testing, runtime execution, and Option/Either anti-patterns.

paralleldrive Bundle

Conduct a thorough code review focusing on code quality, best practices, security, test coverage, and adherence to project standards and functional requirements. Use when reviewing code, pull requests, or completed epics.

paralleldrive Bundle

JWT security review patterns. Use when reviewing or implementing authentication code, token handling, session management, or when JWT is mentioned.

paralleldrive Bundle

Security rule for timing-safe secret comparison. Use SHA3-256 hashing instead of timing-safe compare functions. Use when reviewing or implementing secret comparisons, token validation, CSRF tokens, or API key checks.

jinning6 Skill

Audit and repair readers for fixed-length binary credentials and their text encodings without mutating raw bytes. Use when code loads Ed25519/X25519 keys, nonces, digests, MAC keys, signatures, tokens, or other opaque bytes from files or environment values; when `.strip()`, decoding, newline handling, or format auto-detection occurs before length/type validation; or when cryptographic tests fail intermittently for otherwise valid generated material.

shiwenbin1617 Bundle

Keep a reviewable decision log for a requested audit or a long-running task that needs a durable handoff.

shiwenbin1617 Skill

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".

mane087 Skill

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying. Triggers: When the user asks to build a Node.js application, API, backend, or any server-side JavaScript project.

yousefnabil-soc Bundle

Pre-landing PR review - gstack staff-engineer code review army. CARL TRIGGERS: review the code, audit this branch, check this PR, find bugs, code review, review my changes. SOURCE: garrytan/gstack/review, integrated as gs-review on 2026-05-29.

microsoft Bundle

In-depth code review that fans out parallel subagents across review areas — CRITICAL after non-trivial development. USE FOR: "in-depth review of a pull request", "code quality check or bug hunt", "review correctness, tests, security, performance and product areas", "review after any non-trivial development phase". DO NOT USE FOR: "plan a new implementation", "explain how existing code works".

tituskirch Bundle

Finds comments made redundant by the code beneath them — plain restatements, name echoes, banners, signature echoes — and reports them as removal candidates with each one's code line. Comments that carry what the code cannot state are protected — the why behind a decision, workarounds and invariants, TODO/FIXME/HACK, license headers and tool directives like eslint-disable or noqa. Defaults to the working diff, takes a whole path when named, never scanning a repo unasked. Presents candidates first, removing nothing without confirmation; edits comments only, never code, never commits or pushes. Use when the user wants to prune, clean up, audit or remove redundant, obvious, noisy or superfluous comments, asks which comments a file no longer needs, or says things like "clean up the comments", "remove the pointless comments", "Kommentare aufräumen", "überflüssige Kommentare entfernen".

tituskirch Bundle

Maintains a repo's .gitignore by driving the gitignore-sync CLI and supplying the judgement the CLI deliberately leaves open — which stacks a repo declares, which leftover lines are genuine project rules, which point at a missing stack, and which are ballast copied out of a generated block. Adopts a repo, migrates a grown hand-written file with the result verified against what git actually ignores rather than by a text diff, triages the free zone, fixes smothered "!" exceptions, and reports template candidates across a whole estate. The CLI owns every measurement and every write; the managed region is never hand-edited. Use when the user wants to write, fix, clean up, adopt or migrate a .gitignore, run gitignore-sync, audit repos for missing stacks, or says things like "sort out the gitignore", "migrate this gitignore", "which stacks does this repo need", ".gitignore aufräumen", "gitignore einrichten".

get-bb Bundle

Audit an existing verification skill and feature map against source and the running app, then repair proven documentation or harness drift. Use for "maintain the verification skill", "audit the verify skill", or "refresh the verification feature map".

guerrilla2799 Skill

Use when the user says "audit our stack", "too many tools", "martech spend", "tool consolidation", "what should we cut", "renewal coming up", "our stack is too expensive", "do we need this tool", "CFO wants cuts". Inventories the stack, computes spend against revenue, finds redundancy and dead weight, and returns a KEEP / CONSOLIDATE / CUT / ADD verdict per tool with a defensible savings number. Writes workspace/stack/stack-audit.md.

impertio-studio Bundle

Use when reviewing or validating generated pdfium-render code before accepting it: checking for removed 0.8.x API names, binding mistakes, byte-order bugs, lifetime errors, and version inconsistency. Prevents shipping code that uses PdfBitmapConfig, get_bitmap, as_bytes or other removed names, binds the library per request, swaps red and blue channels, or mixes 0.8.x and 0.9.x names in one file. Covers the removed-name scan, binding correctness, API-usage correctness, cross-skill consistency, and a deterministic review output format. Keywords: pdfium-render code review, validate pdfium code, check pdfium-render code, PdfBitmapConfig removed, get_bitmap removed, as_bytes removed, load_pdf_from_bytes removed, 0.8 0.9 version trap, deprecated pdfium API, review checklist, BGRA RGBA swap, bind once, Pdfium::default panic, lifetime error pdfium, is this pdfium code correct, audit generated pdfium code

jfrog Bundle

Use when helping users set up JFrog Platform architectures, best practices, or workflows. Covers 22 recommended patterns across CI integration, repositories, security, release lifecycle, multi-site, and AppTrust. Also covers 5 user journeys (Modernize Delivery, Secure SDLC, Accelerate Productivity, Enterprise Complexity, Trusted AI). Triggers on mentions of pattern, best practice, architecture, get started, CI integration, multi-site, release lifecycle, AppTrust, or how to set up JFrog.