Security

clinical-quality-artifical-intelligence Skill

Clinical safety code review against DCB0129/DCB0160 and NHS Digital standards. This is NOT a general code review — it is a clinical safety audit for tools handling clinical data, calculations, decision support, or patient-facing information. Produces a hazard register, required mitigations, and a release recommendation.

sparkdevnetwork Skill

Author or update technical documentation in the repo's `docs/` directory. Docs are the living "as built" reference for how Rock currently works, organized by Rock domain (`docs/core/`, `docs/lava/`, `docs/group/`, etc.). Audience is core developers and quasi-technical community members. Use when the user says "write docs for X", "document this feature", "update the docs", "how is X documented", "audit the docs", or describes a feature/subsystem they want a written reference for. Also use when the spec skill hands off after completing a spec, or when the commit skill detects that changed files are referenced in some doc's frontmatter. Do NOT use for: writing end-user tutorials or how-to guides (different audience), generating API reference (separate tool), writing release notes, drafting RFCs or proposals (those are specs).

sparkdevnetwork Bundle

Audit the current session for things worth saving to auto-memory and present them as a plan-mode draft for explicit user approval before writing. Also identifies bubble-up candidates — rules that arguably belong in team-shared memory (CLAUDE.md or .claude/rules/) instead of private auto-memory — and surfaces them as suggestions without writing them. Use when the user says "remember", "/remember", "save what we learned", "capture this session", or wants a deliberate retrospective pass on a long session before context fades. Reads MEMORY.md plus every individual memory file first to dedupe; classifies each candidate as user / feedback / project / reference; drafts full bodies; awaits ExitPlanMode approval before writing anything. Do NOT use for: editing CLAUDE.md (that is the /memory slash command's job), saving session-specific task state (memory is for cross-session learning), or recording git history or code patterns that are derivable from the repo.

sparkdevnetwork Bundle

Reviews a completed Rock RMS Obsidian block conversion for bugs, missing logic, redundant code, and pattern violations by comparing against the original WebForms block. Use when the user says "review conversion", "review block", "review obsidian block", "check the conversion", "compare to webforms", "audit the block", or asks to verify a converted block before merging. Use after all conversion files are written. Do NOT use for: incomplete conversions, non-conversion code review, or general Rock RMS questions.

generative-computing Bundle

Melleafy Step 2.5: Dependency Audit and Elicitation

decebals Bundle

Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding. Works with Spring, Quarkus, Jakarta EE, and plain Java. Use when reviewing code security, before releases, or when user asks about vulnerabilities.

decebals Bundle

Audit Maven dependencies for outdated versions, security vulnerabilities, and conflicts. Use when user says "check dependencies", "audit dependencies", "outdated deps", or before releases.

commercetools Bundle

Review Orca security alerts from a JSON export, clone affected repos, and cross-reference with open Renovate PRs to identify fixes.

incu-tech Bundle

Use for bug, regression, broken behavior, or production issue reports that need expected behavior, reproduction evidence, root cause analysis, or a fix plan before code changes. Trigger when the report is incomplete, high-impact, user-facing, or likely tied to recent changes. Do not trigger for new feature work, security scan remediation, documentation-only requests, or tiny direct fixes where the user explicitly asks to patch now.

incu-tech Bundle

Use for Snyk-driven security work: run Snyk SAST/SCA scans, review findings, triage scope, or produce an approved remediation plan before fixing vulnerabilities. Trigger only when the user mentions Snyk, scanner findings, dependency/source vulnerabilities from Snyk, or remediation of Snyk results. Do not trigger for general security architecture reviews, threat models, manual OWASP validation, or non-Snyk bug fixes.

incu-tech Bundle

Use to assess the software architecture of a codebase, a module, or the current branch's changes against quality attributes and design principles (coupling/cohesion, layering/hexagonal adherence, separation of concerns, scalability, maintainability, testability). Produces a traceable assessment report with rated findings and prioritized recommendations. Invoke standalone to audit a system or design, or from another flow (incu-way-development at planning, incu-way-docs, incu-way-init) to evaluate a proposed or existing design before committing to it. Especially important before a large change, a refactor decision, or when tech debt and structural risk need to be made explicit.

incu-tech Bundle

Use to validate code against common security rulesets and standards (OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, CWE Top 25) by reviewing the code, a module, or the current branch's changes control-by-control. Produces a traceable compliance report marking each control pass/fail/N-A with evidence, plus prioritized remediation pointers. Invoke standalone to audit against a standard, or from another flow (incu-way-development at validation, incu-way-bugs) to check new code before merge. This is a standards-driven manual review — it complements snyk-remediation (automated SAST/SCA scanning), it does not replace it.

jazz1x Bundle

Meta-gate that audits the current session's own actions before any commit — philosophy, scope, convention, and token-budget violations. Read-only on session state; emits a single inline table verdict. Use as the final step of any multi-edit / multi-cycle task. Triggers: "self-audit", "audit yourself", "self-check", "셀프 점검", "셀프 감사", "내 행동 점검", "before commit"

jazz1x Bundle

SKILL.md SSL (Scheduling-Structural-Logical) auditor. Decomposes a target SKILL.md (or a directory of skills) into the 3-layer frame, surfaces missing / ambiguous / risky declarations, and emits a diagnostic report. Read-only — never modifies originals. Use for self-review before PR, refactor regression checks, or bulk repo audits. Triggers: "skill-audit", "skill audit", "ssl audit", "audit skill", "ssl 분해", "skill auditor", "audit-skill"

cfircoo Skill

Health check - counts notes, finds orphans, checks consistency. Use when the user says "vault audit", "health check", "check vault", "find orphans", "vault stats", "audit", or wants to understand the state of their vault.

charpup Bundle

Skill Security Auditor

commercetools Skill

Perform comprehensive security audit of a repository with detailed findings and step-by-step PoCs. Use when assessing a repo's security posture or investigating potential vulnerabilities.

conorluddy Bundle

Generate a paste-ready English (U.S.) App Store Optimization metadata file (ASO.md) for an iOS app by scanning its Swift/SwiftUI codebase. Produces App Name (30), Subtitle (30), Keywords (100), Promotional Text, Description, category recommendations, screenshot caption suggestions, IAP names, and a research-notes appendix grounded in the codebase. Use this skill whenever the user mentions ASO, App Store Optimization, App Store metadata, app store listing, app name, app subtitle, keywords field, App Store Connect copy, App Store keywords, app store description, promotional text, custom product pages, or wants help writing/auditing/improving the metadata for an iOS App Store submission — even if they don't say "ASO" explicitly. Also trigger when the user asks to prepare an app for submission, audit a listing for rejection risk, pick a category, or extract keywords from a codebase.

crazymarky Bundle

本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf 等工具测试 LFI 漏洞，支持路径遍历、PHP 伪协议利用、日志投毒 RCE、敏感文件读取。当用户需要检测 LFI 漏洞、利用文件包含漏洞读取服务器文件时使用此技能。

crazymarky Bundle

Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use this skill when user mentions XSS, cross-site scripting, script injection, or needs to test JavaScript injection in parameters, forms, headers, or DOM sources.

crazymarky Bundle

任意文件下载与本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf、wget 等工具测试文件下载漏洞，支持路径遍历、伪协议利用、敏感文件读取。当用户需要测试文件下载功能、检测 LFI 漏洞、读取服务器敏感文件时使用此技能。

irsdl Bundle

Audit or repair ysonet gadget metadata for one gadget or the whole catalog, checking broad categories, accepted input, requirements, formatters, variants, help, documentation, and tests. Use for consistency checks, suspected misinformation, incomplete metadata, or category drift. Do not use for plugins.

jcosta33 Skill

Resolve technical or procedural ambiguity through direct evidence. ALWAYS use when implementation would otherwise stop for a technical question, evidence conflicts, or a consequential reversible choice lacks a proven answer. Do not use for product intent, public behavior, material security or cost tradeoffs, waivers, irreversible actions, or acceptance.

joyco-studio Bundle

Analyze a Chrome DevTools Performance trace JSON file for performance anomalies, producing a structured audit report with critical issues, warnings, metrics, timeline hotspots, and actionable recommendations.

jsas-xviii Skill

Development Cycle: Refactor — Security

atuljha23 Skill

OWASP-style quick reference — authn/authz, injection, secrets, sessions, crypto, dependencies. Use during code review and before committing security-sensitive changes.

az9713 Bundle

Audits a codebase for dark code risk: code that was generated, passed automated checks, and shipped without anyone understanding it. Produces a structured audit report with a hotspot map, comprehension debt scorecard (spec coverage %, context layer coverage %, review depth), ownership gap analysis, top failure scenarios, and a prioritized action plan. Use this skill before a security review, compliance review, or major refactor; when new engineers join and the codebase feels opaque; after a period of high AI-assisted development velocity; quarterly as a health check; or any time you hear "audit for dark code", "comprehension debt", "dark code risk", "what do we not understand about this codebase", "knowledge gap analysis", "who owns what", or "we've been shipping AI code really fast lately". This skill does not recommend "add more monitoring" — it identifies where human comprehension is missing and prescribes structural fixes.

az9713 Skill

Generates a draft GDPR Article 30 Record of Processing Activities (ROPA) from MODULE_MANIFEST.md and BEHAVIORAL_CONTRACTS.md context files. Use when preparing for a GDPR audit, when a dark-code-audit flags PII-handling services with incomplete documentation, or when building a compliance package. Reads context layers across the codebase, groups them into logical processing activities, auto-populates what it can, and interviews the user for fields that require human judgment (legal basis, purpose, international transfers). Writes docs/compliance/gdpr-ropa-YYYY-MM-DD.md. Invoke as /generate-gdpr-ropa or /generate-gdpr-ropa --module path/to/module for a single module entry.

az9713 Skill

Sets up a project to use the full dark code prevention suite in one step: creates the .claude/comprehension/ directory for comprehension artifacts, adds a ## Dark Code Prevention section to CLAUDE.md (or creates CLAUDE.md if missing), creates docs/dark-code-audit/ for audit reports, and runs an initial dark-code-audit to baseline the project's current comprehension debt. Use this skill when starting to use the dark code suite on a new project, when onboarding a codebase to dark code prevention practices, or any time you hear "set up dark code prevention", "initialize the dark code suite", "add comprehension gate to this project", or "how do I start with dark code practices here".

az9713 Skill

Assembles a data flow narrative from MODULE_MANIFEST.md and BEHAVIORAL_CONTRACTS.md context files, answering the explainability question: "What does the system do with [data type] for [user journey]?" Use before a compliance or security review, when a dark-code-audit flags "Explainability: Partial", when onboarding a new engineer who needs to understand data flows, or when preparing for GDPR, EU AI Act, or SOC 2 review. Reads context layers across the codebase, interviews for gaps, and writes docs/data-lineage/YYYY-MM-DD-<name>.md with a confidence rating. Invoke as: /generate-data-lineage (all PII-touching flows in the codebase) /generate-data-lineage --journey user-signup (specific user journey) /generate-data-lineage --module path/to/mod (flows for a specific module) /generate-data-lineage --type payment (specific data type)

az9713 Skill

Aggregates COMPREHENSION_ARTIFACT.md files into a SOC 2 CC8 Change Management evidence package. Use when preparing for a SOC 2 Type II audit, when a SOC 2 auditor asks for Change Management evidence, or quarterly to maintain an ongoing evidence package. Scans .claude/comprehension/ for all artifacts, correlates with git history, identifies control gaps (significant changes with no gate review), interviews the user about gap context, and writes docs/compliance/soc2-cc8-evidence-YYYY-MM-DD.md. Invoke as /generate-soc2-evidence, optionally with --period YYYY-MM-DD YYYY-MM-DD or --control CC8.

az9713 Skill

Generates a per-service EU AI Act system card documenting AI tool usage, risk classification, human oversight mechanisms, and limitations. Use for any service where AI tools contribute to code generation, decision support, or automated processing — especially before the August 2026 EU AI Act deadline. Use when dark-code-audit flags AI-heavy services, when preparing a compliance package for a regulator or enterprise customer, or when the organization needs to document its AI practices. Reads MODULE_MANIFEST.md and BEHAVIORAL_CONTRACTS.md, conducts a structured interview, and writes docs/compliance/eu-ai-act-system-card-<service>-YYYY-MM-DD.md. Invoke as /generate-eu-ai-act-system-card path/to/service or with --risk-level limited|general|high.

blakecyze Skill

Use when the user asks for a code review, audit, pre-PR check, quality sweep, or pattern analysis of a diff, branch, module, or codebase. Also use when the user asks to "check" or "look over" their code for issues.

blakecyze Skill

Use when the user asks for a nuclear review, a thermonuclear audit, a deep maintainability sweep, a structural audit of the whole codebase, or a "harsh" pass on a branch. Stricter and more structural than /kanso-audit.

blakecyze Skill

Use when the user asks to clean up, tighten, simplify, de-bloat, de-slop, or refactor code. Also use when acting on findings from /kanso-audit or /kanso-nuclear. Behaviour-preserving only.

bmad-code-org Skill

Audit BMAD source files for file-reference convention violations using parallel Haiku subagents. Use when users requests an "audit file references" for a skill, workflow or task.