Security

stoica-mihai Bundle

Reverse-engineer a game or software backend from its compiled client and reconstruct an authoritative server emulator. Use this whenever the user is reversing a client-server protocol, analyzing netcode or packet formats, decompiling a Unity / Unreal / Godot client to recover its network structures, decoding captured Protobuf / FlatBuffers / gRPC / TLV payloads, analyzing a Diffie-Hellman / RSA / ECDHE handshake, or standing up a private or emulated server for a defunct, offline, or owned game. Trigger on phrases like "reverse engineer the server", "emulate the backend", "private server", "figure out the packet format", "decode this protocol", "what serialization is this", "map the game's API", "il2cpp dump", "recover the .proto", or "the client talks to a server I no longer have". Scope is AUTHORIZED work only — game preservation, security research on software you own or are cleared to test, interoperability, and CTF. It pairs every offensive finding with the matching server-side hardening, so it doubles as

stoica-mihai Bundle

Line-level code audit skill. Surfaces concrete, actionable findings — perf hotspots, error-handling correctness bugs, durability / ordering bugs, memory-shape problems, function-level complexity, semantic coupling, concurrency-primitive scope mistakes, and unenforced or unfalsifiable invariants (gates that cannot reach the violation, assertions that cannot fail, rules that live only in a comment) — that file-level architectural analysis cannot see. Language-agnostic. **This skill owns the word "hotspots" when the user wants line-level findings inside files** — phrasings like "what are the hotspots", "where are the hotspots in X", "find hotspots in this file", "show me the hotspots", "any hotspots in commit.rs?" all trigger this skill; prefer this over `architectural-hotspots` whenever the user is pointing at code and asking what's wrong with it, rather than asking which files in the repo are structurally suspect. Also trigger on "audit this", "review this code", "audit X", "review X", "find bugs in X", "what'

stoica-mihai Bundle

Surfaces architectural hotspots in a codebase — high-coupling hub files, tangled high-fan-out modules, oversized god modules, and dependency cycles. Use this skill when the user asks where to refactor, which files are architecturally problematic, which modules are most tightly coupled, where the tech debt is concentrated, what should be split up, or how the dependency structure of a project looks. Also trigger on phrases like "find hotspots in this repo", "coupling problems", "god classes", "circular dependencies", "refactor candidates", or "which files do too much" — even if the user does not say the word "architecture". Do NOT trigger for runtime *performance* hotspots — "why is my app slow", "profile this", CPU/memory bottlenecks — this skill sees structure, not execution; for static perf findings use `code-audit-deep`, for real measurements suggest a profiler. This skill is **scope: whole repository**. If the user is pointing at a specific file or asking what is wrong *inside* a file ("hotspots in commit.

abhinavjp Bundle

Review merge requests and local diffs for code defects, regressions, security risks, unsafe scope, and implementation completeness. Use for initial reviews, read-only safety audits, issue-to-code verification, re-reviews after fixes, or validation of resolved review threads. Do not use to implement feedback, fix CI, summarize changes, explain code, or create review skills.

adamlinscott Skill

Alias for the seatbelt skill. Sets up the security foundation that lets you run Claude Code fast — auto mode, custom tools, minimal interruptions — without it doing something irreversible you never asked for. Two modes, one for developers and one for non-technical vibe coders. Use when setting up a project for AI-assisted development, when handing a repo to a non-technical builder, or when the user says they want Claude to stop breaking things, worries it will delete their work, or wants to run auto mode with confidence.

adamlinscott Bundle

Fresh-context audit of a finished diff against the conversation's stated intent. A subagent with zero conversation history reviews the diff blind — reporting what it believes the change does, its quality, and any oversights — then the main context reconciles that blind read against what the work was actually meant to do, and surfaces any assumption about real-world behaviour that the code cannot settle. Use when a chunk of work is complete and you want fresh eyes to confirm nothing was missed, scope is fully covered, and no oversights or bugs slipped through, before moving on or shipping.

adamlinscott Skill

You are running a memory audit for the user's per-user Claude memory in this project.

adamlinscott Skill

Audits a repository's Claude context-injection setup — CLAUDE.md, CONTEXT.md, docs/, .claude/agents/, and the per-project memory directory. Reports bloat, broken links, orphaned docs, security risks, missing rules in subagent prompts, and conflicts between memory and project instructions. Use when the user asks to audit their Claude setup, asks "what's wrong with my CLAUDE.md", wants to know if their agents/memory/docs are configured well, or wants to improve Claude's effectiveness in this repository.

alexsmedile Skill

Audit an offer to find weak points and get specific fixes. Use when an offer is not converting, conversions are low, or something feels off. Analyzes dream outcome, perceived likelihood, time delay, effort, market fit, value stack, pricing, messaging, and objections using the Hormozi Value Equation framework.

alirezarezvani Skill

Use when someone asks for an AIOS audit, asks to score their setup against the Four Cs, or says "is my AIOS working" / "audit my setup" / "find gaps in my AIOS". Produces a Four-Cs scoreboard with top-3 fixes ranked by leverage.

alirezarezvani Skill

Use for a weekly operating review (Friday wrap or Monday plan) — review progress against the 90-day priorities, surface stalled open loops, and set next week's focus. This is the PERSONAL operating review; distinct from /audit (checks the kit's connections/freshness) and /level-up (finds one automation to build). Trigger on "/weekly", "weekly review", "weekly planning", "how did this week go", "plan my week".

altafino Skill

Audit guardrails-kit compliance of the current session — run the transcript marker scorecard. Use when asked to audit compliance, check which guardrail rules fired or were missed, or score the session.

altafino Skill

Testing guardrails pack — test authorship quality, regression-proof discipline, expectation-change audit. Use when writing tests, adding coverage, or reviewing test quality.

altafino Skill

Security guardrails pack — injection, secrets, path traversal, auth defaults, deserialization, untrusted-content discipline. Use when asked for a security pass or when code touches user input, secrets, or auth.

mock-server Skill

Deep adversarial code review using the 8-lens review constitution. Examines diffs for correctness, security, completeness, and MockServer-specific concerns (ByteBuf leaks, module boundaries, javax/jakarta compatibility, ring buffer sizing). Use when performing pre-commit reviews, quality-loop iterations, or on-demand code audits. Loaded by review-cheap and review-final agents.

mock-server Skill

Deep adversarial specification review using the 8-lens review constitution. Evaluates design documents, plans, and specs for ambiguity, completeness, feasibility, security, and MockServer-specific concerns. Loaded by review-cheap and review-final agents.

mock-server Skill

Interact with Dependabot and Snyk pull requests for dependency upgrades and security fixes. Documents Dependabot commands, javax/jakarta compatibility checks, safe merge workflows, and troubleshooting. Use when managing dependency upgrade PRs or security fix PRs.

moorage Skill

Use after an ExecPlan exists and before implementation starts. Critique the plan from failure-oriented lenses such as security, UX, reliability, privacy, abuse, and eval coverage, then produce the minimum set of plan changes needed before coding.

moorage Skill

Update AGENTS, architecture, specs, reliability, security, and quality docs when code changes create documentation drift.

necatiarslan Skill

Manage and inspect Amazon RDS instances, clusters, snapshots, parameter groups, logs, proxies, events, engine versions, subnet groups, security groups, certificates, recommendations, and more using awsclaw.

necatiarslan Skill

Manage and inspect Amazon RDS instances, clusters, snapshots, parameter groups, logs, proxies, events, engine versions, subnet groups, security groups, certificates, recommendations, and more using awsflow.

nostrband Skill

Use whenever the user wants to find, shortlist, vet, or enrich US accounting and tax firms (CPA firms) — financial-statement audit, SOC 1/2 audit, corporate tax, bookkeeping for businesses, advisory/fractional CFO, M&A diligence, 409A valuations, R&D tax credits, IPO readiness, sales-and-use tax. Triggers on "find me a CPA firm for our delaware c-corp series A audit", "shortlist three audit firms with SaaS experience", "we need a tax advisor for our M&A", or "pull contact info for these 10 accounting firm domains", even when described indirectly (audit our books, fractional CFO support, file our 1120). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip personal/consumer tax preparation (1040, individual estate, retirement planning), in-house controller/CFO hires, "how do I file my taxes" DIY questions, accounting-software comparisons (QuickBooks vs Xero), non-US firms, individual freelance bookkeepers.

gigio1023 Bundle

Use when writing, refactoring, or reviewing Python application or library code, defining data models, splitting a large Python module, or setting up a Python project. Prefers straightforward Pydantic models, explicit Python 3.12+ annotations including locals, uv project management, and explanations close to code. Uses the official external pydantic skill for library guidance. NOT for docstring-only edits, a standalone formatting command, generated code unless explicitly in scope, or starting a plan or audit merely because Python files exist; gigio-review-results owns comparison of finished work against project intent.

idaibin Bundle

Use when Java source or Java-owned Maven/Gradle configuration must be implemented, migrated, or refactored across Spring services, HTTP/security boundaries, explicit code-first or contract-first OpenAPI, persistence, transactions, messaging, scheduling, caches, tests, or configuration; owns source edits and validation, not non-Java JVM work, audit-only, fixed-basis review, or Git delivery.

idaibin Bundle

Use when a Rust source change must be implemented, ported, or refactored across APIs, crates, services, CLIs, async, persistence, unsafe or FFI boundaries, tests, or docs; owns source edits and validation, not audit-only, review-only, or Git-delivery work.

idaibin Bundle

Use when a known Java source surface or Java-owned Spring/build configuration needs a scoped, read-only audit of selected architecture, API/security, transaction, persistence, concurrency, integration, performance, or migration risks; not for non-Java JVM semantics, and use repo-review when a Worktree or immutable change basis needs coordination.

idaibin Bundle

Use when a Rust workspace or known Rust surface needs a scoped, read-only audit of selected architecture, ownership, error, concurrency, performance, persistence, or unsafe-boundary risks; use repo-review when a Worktree or immutable change basis needs coordination.

idaibin Bundle

Use when Worktree changes or a fixed snapshot/range need coordinated read-only Standards and Spec findings, documentation-authority review, completed provider-evidence integration, or selected-source visual-completion review; use audit-* for bounded domain audits and a host security workflow for security-only review.

ihiteshgupta Skill

Expert in application security, OWASP Top 10, security best practices, penetration testing, and secure coding. Use for security audits and hardening.

instavm Skill

Generate a security vulnerability report. Use when user asks for a report, summary of findings, or formatted vulnerability documentation.

instavm Skill

Find OTP implementation vulnerabilities. Use when user asks about OTP security, verification bypass, SMS security, or two-factor authentication issues.

instavm Skill

Find authentication and session vulnerabilities. Use when user asks about auth bypass, session issues, login security, or token problems.

instavm Skill

Find payment callback and webhook vulnerabilities. Use when user asks about payment security, callback tampering, hash validation, or transaction manipulation.

instavm Skill

Find insecure configurations in HTTP traffic. Use when user asks about security headers, cookie security, CORS issues, or transport security.

instavm Skill

Comprehensive security audit of mitmproxy traffic. Use when user wants to analyze captured HTTP traffic for vulnerabilities, or mentions pentesting, security testing, or vulnerability assessment.

iwritec0de Skill

This skill should be used when the user asks to "run a quality gate", "check code quality", "run lint checks", "run pre-push security scan", "check for dead code", or mentions "quality gate", "quality check", "lint check", "run checks", "code quality", "pre-push scan", "security scan". Provides automated JavaScript/TypeScript code quality enforcement including type checking, linting, formatting, dead code detection, type coverage, circular dependency detection, tests, and security scanning before git push.