Security

gil-1 Bundle

Audits a codebase for removable legacy, unused, duplicate, stale, confusing, or overcomplicated pieces before cleanup. Use when the user asks to simplify a repo, remove dead code, find legacy or unused things, fix duplicate wording/files, or research cleanup opportunities; use codebase-design for module-depth checks and improve-codebase-architecture when cleanup becomes an architecture candidate.

juntoku9 Bundle

Audits a generated petition letter for factual accuracy, unsupported claims, legal errors, and USCIS compliance. Produces a line-by-line verification report so the attorney can review with confidence.

karotkriss Bundle

Incident-level root-cause internals of cwcli's lifecycle and destructive commands - init (Frappe/bench version gating, admin/db-root secret env-transport, existing-bench reuse flow), rm (what deletion actually removes, conf/-only archive, recache-under-spinner deadlock, the C1/H5/M11 backup+name+exit-code data-safety gates, multi-bench per-bench backup, the start-back-up-delete transient-start flow for a stopped project), and restore (receive-mode and normal-path data-safety, non-interactive selectors, secrets off the argv, streamed copies, shared site detection, default-site resolution, post-restore migrate+restart), and start/stop/status/logs/restart (the supervisord per-process supervision substrate: PID-keyed idempotency, config/launcher generation, per-process logs, the stdout-token-only status contract, single-program restart + auto-heal). Use this whenever you edit or debug core/init.py, commands/init.py, core/rm.py, commands/rm.py, core/restore.py, commands/restore.py, commands/start.py, commands/stat

kolyasya Bundle

Audit a Meteor + pnpm project for supply chain hygiene: lockfile drift, Npm.depends risk, and CI enforcement gaps. User-invoked; does not trigger automatically.

korya Bundle

Review a code change rigorously — a PR, branch, commit range, or the working tree. Confirm the problem is real, sketch the obvious solutions before reading the diff, then audit it for correctness, completeness, architecture, conventions, security, privacy, testing, reversibility, and dependencies, judge whether it is right-sized, and verify every significant finding independently. Returns a six-signal report: done well, gaps, issues rated Critical to Low with a separate confidence verdict, questions, suggestions, known limitations. Use when the user says "/examine", "examine this PR", "review this PR", "review pr #N", "review my branch", "look over my pull request", "check my PR before merge", or asks for a deep code review. Holistic where the host's built-in review is defect-first.

masumi-network Skill

Use when deciding what Citadel data may be quoted, committed, or shared; when onboarding agents to Masumi Citadel; or when the user asks what is public vs private, what goes in git, or whether vault content can be published. Triggers include "public or private", "what can I share", "citadel security boundary", "is the vault public", and /skills/boundary.

microsoft Bundle

Environment-level Dataverse administration — bulk delete, retention/archival, organization settings, OrgDB settings, recycle bin, audit, and the 37 allowlisted PPAC toggles. Use when the user wants to clean up data at scale, configure audit, change environment settings, manage retention policies, or list/cancel ERP batch jobs.

microsoft Skill

Security-role assignment, user access, application users, business units, and admin self-elevation in Dataverse environments. Use when the user wants to give someone access, grant a role, become an admin, or add a service principal.

microsoft Skill

Fetch all open security alerts from S360/ADO, Dependabot, and npm audit, apply all fixes, verify, commit, and create a PR.

microsoft Skill

Fix all vulnerabilities on the current branch using npm audit. Local branch only — no ADO/GitHub queries.

juliankerignard Skill

Auditer l'architecture d'un projet Unity. Utiliser quand l'utilisateur dit '/unity-review', 'review unity', 'audit architecture', 'verifier le projet unity', 'architecture review', ou veut analyser la qualite technique d'un projet Unity existant.

ledtorch Skill

Deep audit of named components — duplication, dead code, wrong-sized abstractions, logic bugs — ending in severity-labelled findings and a plan doc you approve before any code moves. Use when you want specific files scrutinized rather than a diff reviewed.

lvlup-sw Bundle

Run a comprehensive backend quality audit across all eight dimensions. Orchestrates scan, critique, harden, distill, verify, and humanize skills, deduplicates findings, and produces a unified report with verdict. Use when assessing overall codebase health. Triggers: 'audit backend', 'full quality check', 'run audit', or /axiom:audit. Do NOT use for targeted checks — use individual skills instead.

lvlup-sw Skill

Apply backend quality dimensions as design constraints during ideation. The design-mode counterpart to axiom:audit — surfaces DIM-1..DIM-8 as questions to ask while shaping a system, not as findings to report after. Pairs with project-specific invariants skills via the pairs-with frontmatter slot. Use when running /exarchos:ideate or any pre-implementation conversation. Triggers: 'apply axiom dimensions to design', 'constrain design space', 'design with quality in mind', or /axiom:design. Do NOT use for review of existing code — use axiom:audit instead.

matthiasn Skill

Act as a skeptical senior engineer performing a detailed code review of the latest changes on the current branch (or a given PR) — best practices, maintainability, performance, security, and readability. Objective and concise; only real issues, with a clear "no issues" verdict when the code is clean. Replaces CodeRabbit / Gemini Code Review.

matthiasn Bundle

Add, complete, or audit a locale across a Flutter application's ARB catalogs and a localized Docusaurus manual, including generated localization code, locale selectors, native platform declarations, translated MDX, screenshot fixtures, tests, and parity validation. Use when introducing a new language, finishing an incomplete app or manual translation, aligning manual terminology with UI strings, or reviewing whether a locale is production-ready end to end.

oxbshw Bundle

Use before opening a PR to audit the changes for stale comments, unused imports, missing tests, and inconsistencies with neighboring code.

pablopunk Skill

Use when reviewing Nevermind for security risk, threat modeling, secure-code review, dependency/config exposure, secrets, OWASP-style web/API issues, Electron attack surface, auth/session/token/billing abuse, or any request for a penetration-test/security report. Explore the repo before conclusions; this is for authorized review of this app only.

sayeediftekhar Skill

Security lane router and gate. Runs VibeSec over security-relevant code to catch vulnerabilities before they ship, and wires that check into keel-v2's security tripwire. Defers to keel-v2. Use when a change touches auth, input handling, secrets, uploads, queries, or any trust boundary — or when asked to review code for vulnerabilities.

index365usa Skill

Use when an index365 scan has findings and the user wants a plan before any code changes. Triggers: "what should I fix first", "prioritize the findings", "triage this audit", "turn the findings into a plan", "which of these matter". Produces a prioritized, file-mapped fix plan. It plans only, it does not edit code (use index365-apply-fix or index365-audit-and-fix to apply).

iot-forge Bundle

Chip-level ESP-IDF capability reference for the ESP32-C6 SoC (single-core RISC-V HP core + RISC-V LP core, WiFi 6 + BLE 5.3 + Thread/Zigbee) — what the chip can do, distinct from any board's wiring. Use when a user wants to exploit ESP32-C6 hardware — WiFi 6/BLE/802.15.4 radio coexistence (Thread Border Router, Zigbee gateway, Matter endpoints, why it's time-division not simultaneous), the LP core (a real always-available RISC-V coprocessor, not a restricted ULP-FSM), RMT/LEDC/I2S/ADC/PCNT/MCPWM/dual-TWAI peripherals, SD-SPI-only storage (no SDMMC host, no eMMC), deep sleep/wake sources, and why there's no PSRAM and no native USB OTG on this chip. Trigger on "how do I use WiFi 6/Thread/Zigbee/LP core/deep sleep on an ESP32-C6", radio-coexistence or Matter/Thread/Zigbee questions, or any M5Stack C6 board (NanoC6, Stamp C6LoRa, Tab5's C6 radio co-processor, Stamp-P4's AddOn C6) needing depth beyond its own SKILL.md. For pinouts/wiring use that board's skill — this is the shared chip layer it points into.

iot-forge Bundle

Chip-level ESP-IDF capability reference for the ESP32-P4 SoC (dual-core RISC-V HP cores + a RISC-V LP core) — what the chip can do, distinct from any board's wiring. Use when a user wants to exploit ESP32-P4 hardware — MIPI-CSI/DSI with the on-chip ISP, hardware JPEG encode/decode, hardware H.264 encode, PPA/2D-DMA image acceleration, the LP core and its own peripherals, USB HS OTG vs FS OTG vs USB-Serial-JTAG, TWAI/CAN, Ethernet MAC, SDIO host, in-package PSRAM up to 32MB, HP-core task pinning, and the PIE instruction extensions behind on-device AI/DSP. Trigger on MIPI-CSI/MIPI-DSI/camera/ISP/JPEG/H.264/PPA/LP-core/deep-sleep/PSRAM/USB-HS-OTG questions on an ESP32-P4, or any M5Stack P4 board (Tab5, Stamp-P4) needing depth beyond its own SKILL.md. For pinouts/wiring use that board's skill. Also relevant when a user asks why their ESP32-P4 board has no WiFi/Bluetooth and needs a companion radio chip.

iot-forge Bundle

Chip-level ESP-IDF capability reference for the ESP32-S3 SoC (Xtensa LX7 dual-core) — what the chip can do, distinct from any board's wiring. Use when a user wants to go beyond basic Arduino sketches and exploit ESP32-S3 hardware — RMT (IR/WS2812/custom protocols), LEDC (PWM), I2S (audio), ADC/touch sensing, PCNT (encoders), MCPWM (motor control), TWAI/CAN, SDMMC/SD-SPI, native USB OTG vs the USB-Serial-JTAG controller, sleep modes and wake sources, ULP-FSM/ULP-RISC-V coprocessors, octal/quad PSRAM config, dual-core FreeRTOS task pinning and IRAM/ISR placement, WiFi/BLE coexistence, and the SIMD instructions behind esp-dsp/ESP-DL/TFLite Micro. Trigger on "how do I use RMT/LEDC/I2S/ULP/deep sleep/dual core/PSRAM/USB OTG on an ESP32-S3", low-power/performance-tuned S3 firmware questions, or any M5Stack S3 board (Cardputer, Cardputer Adv, AtomS3, AtomS3R, CoreS3, StickS3, Stamp-S3) needing depth beyond its own SKILL.md. For pinouts/wiring use that board's skill — this is the shared chip layer it points into.

isc-projects Bundle

Review and refine ISC BIND 9 release notes for a new version — audit audience/action tags against the actual change substance, verify every covered issue is closed, and rewrite the auto-generated notes into the project's established prior-art style with correct Sphinx markup, verifying the docs still build. Use when preparing or tweaking BIND 9 release notes (doc/notes/notes-*.rst), reviewing a "prepare documentation"/release branch, producing the "Tweak and reword release notes" commit, or when the user mentions release notes, changelog/notes audience tags, or release-note markup.

itswendell Skill

Audit Palot's OpenCode 2 operation and event coverage, analyzer or baseline regressions, published contract-surface deltas, or reviewed baseline updates. Ordinary event-handler fixes do not need this audit. Use opencode-runtime for release selection and runtime version alignment.

javascript-mastery-pro Bundle

Run /audit on a greenfield project, an existing codebase with missing docs, or one area (/audit src/auth) to bootstrap the project's AI context — the AGENTS.md files every later skill reads. Writes tool-agnostic AGENTS.md plus thin CLAUDE.md pointers, adding only what is missing; never overwrites curated content.

lexbritvin Skill

Diagnose Obsidian Graph view health and clean up over-connection — identify render-only edges (dashboards as topics, log files), mega-categories, broken refs, and false categories that are inflating the graph. Use whenever the user reports the graph feels tangled, overconnected, hairball-like, or noisy, even if they don't explicitly say "audit". Triggers include "why is my graph a hairball", "audit my graph", "graph cleanup", "find graph noise", "too many connections", "graph feels tangled", "what shouldn't be on the graph", "my graph is overconnected", "graph is a mess", "what to exclude from the graph", "why are unrelated notes connected".

libreqoe Skill

Repo-local LibreQoS workflow for release security audit passes. Use when auditing LibreQoS with cargo audit, cargo machete, cargo tree, CVE triage, network control-plane exposure review, bridged-interface/eBPF malformed-traffic review, panic/error-handling/type-loss review, node_manager privacy/auth/XSS review, executive-summary/conclusion grading, and audit-file findings updates.

loft-sh Skill

Audit and fix drift between Platform docs UI tokens and the loft-enterprise UI source. Use when running the drift report, interpreting its output, verifying findings against loft-enterprise, or fixing stale nav paths, labels, and informal prose in platform docs.

luumenlabs Bundle

Use for Roblox multiplayer communication across the client-server boundary: designing RemoteEvent, UnreliableRemoteEvent, and RemoteFunction flows; validating client requests; handling replication-aware gameplay; applying rate limits and anti-exploit checks; reasoning about network ownership, server-authority patterns, Input Action System use in authoritative gameplay, and streaming-sensitive multiplayer correctness.

lyoneel Bundle

Audit AGENTS.md files for duplication and correct placement. Use when syncing user-level and project-level AGENTS.md files.

marroccofella Bundle

Publish a project to GitHub as its own repository with a live, in-browser GitHub Pages site — scaffolding 42.uk-themed docs (README, LICENSE, .nojekyll), running privacy and secret scans, creating or updating the repo under the authenticated account, enabling Pages, and verifying the live URL actually serves. Use when the user wants to publish, ship, release, or "make a repo" for a project so others can view or run it in a browser. Publishing needs an authenticated GitHub CLI; the safety self-test does not. Do not trigger for private scratch work the user has not asked to publish.

onflow Bundle

Generate production-ready Cadence smart contracts, transactions, and DeFi transactions from scratch following security-first standards. Scaffolds secure code with proper access control, entitlements, events, storage paths, and phase discipline. TRIGGER when: creating new Cadence contracts, generating transactions, scaffolding DeFi transactions, building smart contracts from scratch, "generate contract", "create transaction", "scaffold", "new contract", "new transaction", "build a contract for", "write me a contract", "help me create a", "template for", "boilerplate", "starter contract", "create an NFT contract", "generate a transfer transaction". DO NOT TRIGGER when: reviewing or auditing existing code (use cadence-audit), asking about Cadence syntax or language rules (use cadence-lang), configuring flow.json (use flow-project-setup).

openshift Skill

Audit all Claude Code skills for stale references, broken paths, and deprecated tool names

org2ai Skill

Systematic architecture audit and refactoring methodology for Rust + TypeScript codebases. Use when performing refactoring, cleanup, unification, code review, dead code removal, module reorganization, or tech debt elimination. Ensures no naming confusion, semantic overloading, hidden defaults, duplicate logic, or architectural inconsistencies are missed.

peteski22 Bundle

Check code changes for security vulnerabilities