Security

solana-foundation Bundle

Explain, plan, and prototype tokenization workflows on Solana Developer Platform using the supported public docs and API surface. Use when a consumer wants to issue a stablecoin, tokenized security, loyalty token, or other asset with SDP.

stiggio Bundle

Use when receiving, verifying, or handling webhook events from Stigg — subscription lifecycle (`subscription.created`, `subscription.canceled`, `trial.expired`, `trial.ends_soon`, etc.), entitlement events (`entitlement_usage_exceeded`), credit events (`credit.balance.low`, `credit.balance.depleted`, `automatic_recharge.*`), and others. Triggers include "Stigg webhook handler", "verify Stigg webhook", "Stigg webhook signature", "credit.balance.low", "trial.expired webhook", "Stigg webhook payload shape", "Stigg webhook retry", "messageId", "Stigg-Webhooks-Secret". Skip for inbound API calls TO Stigg (use stigg-api / stigg-entitlements).

clawic Skill

Work on macOS control, permissions, native execution, audit, or Clawix host integration through the Mac Control Plane contracts.

catcatcatstudio Skill

Thorough codebase investigation that finds and fixes real problems. Maps architecture, scans every layer (structural, correctness, security, reliability, performance, hygiene), prioritized report with evidence, fix plan, executes collaboratively. A senior engineer doing a full review with authority to fix. Use when user says '/vet', 'vet this project', 'check this codebase', 'find all the problems', 'what's broken', 'audit this code', or wants to clean up AI-generated code. NOT for: UI review (/eye), test writing (/fortify), pre-build research (/recon).

ai-business-tools Bundle

Skill Audit

cleanslice Bundle

GitHub workflow automation via the per-user secret vault. Create and optimize repositories for discoverability, monitor Actions and deployments, review PRs with inline comments, and ship new releases. Exposed to agents as GITHUB_TOKEN.

cleanslice Skill

OpenAI API access via the per-user secret store. Stores the user's API key once, exposes it to agents at tool-call time as OPENAI_API_KEY.

cleanslice Skill

Stripe API access via a restricted or secret key stored in the per-user secret vault. Exposed to agents as STRIPE_API_KEY.

dominiktobureto Skill

Use for security review, auth/permission changes, secrets, dependency risk, injection, SSRF, XSS, CSRF, data exposure, unsafe hooks, or supply-chain concerns.

dominiktobureto Bundle

Use when reviewing a diff, pull request, branch, or AI-generated code for correctness, security, regression, test, performance, and maintainability risks before merge.

neonwatty Bundle

Analyzes web apps for free-value trust-building opportunities — features, tools, and offerings that demonstrate genuine utility before asking for commitment. Use this when the user says "trust builder", "trust audit", "find free offerings", "free value analysis", "trust building opportunities", or "how can I build trust with users". Explores the codebase and live app, interviews the user about audience and goals, then generates a prioritized report with full mini-specs for the top trust-building features.

neonwatty Bundle

Audits web apps for resilience against unexpected user behavior — accidental, edge-case, and chaotic. Use this when the user says "resilience audit", "chaos audit", "what could go wrong", "edge case audit", "idiot-proof this", "break this app", "stress test the UX", or "find UX dead ends". Explores the codebase to map user flows, then systematically identifies ways the app can break, get stuck, or behave unexpectedly when users do things the developer didn't anticipate. Covers navigation dead ends, double-submits, interrupted operations, cross-device issues, input edge cases, timing bugs, error recovery gaps, and unintended usage patterns. Produces a prioritized report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.

neonwatty Bundle

Audits SaaS and usage-based web apps for adversarial usage patterns — accidental, opportunistic, and deliberate. Use this when the user says "adversarial audit", "abuse case audit", "idiot-proof this app", "find usage exploits", "business logic audit", or "how could users break this". Explores the codebase to map the economic surface area (pricing tiers, usage limits, free trials, costly resources), then generates abuse cases where user behavior — intentional or not — could break assumptions, bypass limits, amplify costs, or corrupt state. Produces a prioritized markdown report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.

netresearch Bundle

Use when configuring OroCommerce v6.1 ACL, permissions, and access control — setting up entity permissions (acls.yml), ownership types, Acl/AclAncestor PHP attributes on controllers, custom permissions, field-level ACL, access rules for query filtering, or debugging permission issues. Relevant when the user mentions 'ACL', 'permissions', 'access control', 'ownership', 'security', 'acls.yml', 'field ACL', 'access rules', or any OroCommerce authorization task.

netresearch Bundle

Use when running Behat against a DEPLOYED Oro Commerce 6.1 application (staging, QA, prod-clone, prod) rather than a local dev/CI stack: --skip-isolators and --skip-isolators-but-load-fixtures, ORO_DB_DSN placement (.app-env.local vs .env-app.test.local), matching local migrations to the deployed tag, oro/e2e-tests, .behat-secrets.yml and <Secret:>, ChromeDriver url-base/port and Mink 404s, watch mode, Reload Page and OpenAI Healers, HealerInterface with the oro_test.behat.healer tag. Skip for local-only Behat, PHPUnit, k6, or CI on ephemeral containers.

nextaltair Bundle

Establish QA testing processes: test strategies, Google Testing Standards, P0-P4 bug tracking, OWASP security, quality metrics, 90% coverage targets. Includes master prompts for autonomous execution and third-party QA team handoff documentation.

nextaltair Skill

Periodically audit a repository's docs for staleness against the implementation: run a cheap mechanical scan (dead source-path references, dead links, leftover DEPRECATED/TBD banners, doc-vs-code freshness gap, git-invisible ignored leftovers, completed-but-undeleted plan files), then dispatch parallel read-only agents to verify only the suspicious docs against source, and finally propose update / delete / migrate-to-ADR dispositions for user approval. Use on a monthly or quarterly docs review, after large refactors or renames, or when asked whether docs are stale.

openaev-platform Skill

Security review checklist for OpenAEV code: RBAC, tenant isolation, data exposure, authentication. Use when reviewing PRs or auditing security of a feature.

openaev-platform Skill

Step-by-step tenant isolation audit for OpenAEV pull requests. Use when reviewing PRs that touch entities, repositories, native queries, or migrations.

openshift Skill

Triage a CVE: assess impact against this repo's dependencies, then bump, document not-affected, or plan a code fix. Use when the user mentions a CVE, Jira vulnerability issue, or security advisory for a dependency.

openwpm Skill

Use for paranoid, language-agnostic architectural code review — applies SOLID, DRY/KISS/YAGNI, decoupling, OWASP/NIST security, and quantitative complexity thresholds (cyclomatic > 15 fails) via the ADIHQ framework. Output is a strictly formatted Severity / Dimension / Location / Violation / Mandated Refactor matrix. Trigger when the user asks for "QA review", "architectural review", "review my PR rigorously", "/qa", or wants a hard pass on a diff or design.

openwpm Skill

Use when stuck, confused, or disoriented in a crosslink-tracked project — dumps the full context (session state, active issue, locks, blockers, hook config, git state, project rules) so you can re-orient and decide a next action. Trigger when the user says "I'm stuck", "audit", "what's going on", or asks for a context dump.

openwpm Skill

Use to create a jj commit AND auto-document the result on the active crosslink issue. Writes a conventional-style message with the issue ref, and adds a `--kind result` comment so the audit trail closes. Trigger whenever the user asks to "commit", "commit changes", "commit and push", or finishes a unit of work in a crosslink-tracked repo.

openwpm Skill

Use to run a periodic codebase-health pass — dependency audit, lint, test suite, dead code / TODO scan, doc freshness, crosslink issue hygiene, and build artifacts. Conservative by default (small fixes inline, larger work files a `maintenance`-labelled issue). Trigger when the user says "maintenance", "health check", "audit dependencies", "/maintain", or asks for a periodic project tidy-up.

openwpm Skill

Use to walk the user through a guided policy review of the project's crosslink configuration — tracking mode, security policies, language rules, hook implementations, and workflow conventions. Identifies drift from defaults via `crosslink workflow diff` and offers targeted fixes or a `crosslink init --force` reset. Trigger when the user says "review the crosslink config", "audit the workflow policies", "/workflow", or asks whether the hook/rules setup is right.

paulnsorensen Bundle

Scan a codebase for custom code that duplicates what open-source libraries already do, then recommend which libraries to adopt. Detects hand-rolled utility functions, custom retry logic, manual validation, DIY date handling, home-grown argument parsers, and other reinvented wheels. Cross-checks against installed dependencies and open specs. Returns scored migration recommendations with effort estimates. Use when the user mentions reinventing the wheel, asks if there is a library for something they built, wants a build-vs-buy audit, asks "should we just use lodash for this", or wants to find dependency opportunities.

onshoreoutsourcing Bundle

Core development principles including anti-hallucination, anti-hardcoding, error handling, logging, testing, and security standards. Use during feature design, implementation, and code review to ensure code quality and maintainability. Applies universally to all code regardless of technology or feature.

sjunepark Bundle

Integrate Git branches deliberately: plan or dry-run merges, transplant work, resolve conflicts, or audit completed or in-progress merges.

theodoread Bundle

Use when an existing Python module has grown and the question is how to restructure it safely, not what to write — auditing a file nobody has reviewed as a whole, planning the change as a sequence of small commits each verified on its own, deciding which tests may be edited to follow a rename and which must not change at a character, proving an edited test still fails when the production change is reverted, finding a second oracle when the suite cannot see the change (a field's type changing under a name every caller already uses), measuring the shape you are trying to remove before and after so a large diff that moves nothing is caught, and deciding when not to restructure at all. For what a given piece of Python should look like — data modeling, dates, settings, modularity and singleton defaults — see the Python conventions skill; for what a test should cover, the Python testing skill.

voxpelli Skill

This skill should be used when the user asks about 'schema drift', 'schema evolution', 'evolve schema', 'schema sync', 'sync schemas', 'update schema fields', 'schema field frequency', 'missing schema fields', 'unused schema fields', 'schema proposal', 'schema cardinality', 'check schema', 'schema audit', 'schema changes', 'declare a relation verb', 'add a field to the schema', 'force-add schema field', 'prescribed schema vocabulary'. Detects drift between Basic Memory schema definitions and actual note usage, proposes field additions/removals based on frequency analysis, and dual-syncs BM notes + local schema files after approval.

wimi321 Bundle

Use when the user wants a local review of a GitHub pull request based on its diff, risks, quality, performance, tests, and security implications.

wimi321 Bundle

Use when the current branch or PR needs a focused security review that minimizes false positives and only reports concrete, exploit-relevant issues.

bholmesdev Skill

Review a pull request or local branch diff for correctness, security, lifecycle, error handling, tests, and meaningful performance risks. Use when asked to review PR changes, a branch, a commit range, or the current working tree and return a structured review.

bholmesdev Bundle

Audits Convex performance for reads, subscriptions, write contention, and function limits. Use for slow features, insights findings, OCC conflicts, or read amplification.

ninthless Bundle

Use this skill by default for every user request: search the web before answering, explaining, planning, reviewing, coding, editing local files, running commands, or making recommendations. Search authoritative sources for current facts, unfamiliar domains, APIs, libraries, versions, standards, policies, security, prices, platform behavior, and implementation choices, and still perform a brief relevance search for simple local tasks. Trigger for 先联网搜索, 先查资料, 先搜索, web search, browse first, do research first, or webserach. Reconcile web evidence with local repository, runtime, and user-provided facts; cite sources that affect the result. Skip only when the user explicitly forbids network access or the search capability is unavailable, and report the exception.

saikaaco Skill

Use when Hermes may create, move, clean up, or audit transient and generated files. Keeps artifacts in predictable workspace folders and requires manifests, approval, and rollback planning before cleanup.