Security

quangpl Bundle

Audit Chrome extensions for security issues, best practice violations, performance problems, and CWS compliance. Scans manifest, code, CSP, message handlers, storage, and dependencies.

revenantworks Bundle

Directs pixel art that must read at several zoom scales at once — palette and silhouette rules per scale, a per-band "reads" checklist, terrain-versus-unit contrast, a one-scene look test, and briefs for an artist or an image generator. Trigger when a game renders one world through zoom bands or levels of detail (people, formations, territories) and the art must hold at every band; when a sprite, hut, unit, or icon vanishes against terrain or reads wrong zoomed out; to write or run a cross-band art look test; to build a pixel-art style guide or art bible for a strategy or colony game; to brief a pixel artist or a sprite generator; or say pixelsmith (pixelsmith test — the look test on one scene, pixelsmith brief, pixelsmith audit — score existing art without redrawing). Works from a described scene when it cannot view the image. Drawing the sprite is an art tool's job; engine rendering, crossfade, and LOD code belong to the game's engineering; a brand palette is brandwright's.

revenantworks Bundle

Shapes any message to its channel and audience. Drafts human by default in a neutral professional voice; a specific brand voice applies only when named or handed in — voice definitions live in brandwright, and defining or saving one, even as "commwright voice", routes there. Trigger to write, rewrite, reshape, or shorten an email, text, Slack or Teams message, release notes, YouTube title, social post, or Discord announcement; to make it more formal or casual; to humanize a message that reads like AI or ChatGPT, stripping em dashes and emoji — a README, CLAUDE.md, or reference doc is skillwright’s prose, not commwright’s; for release comms or a comms plan; or when they name "commwright" for message or channel work ("commwright formats", "commwright audit", "commwright humanize"). It never sends.

srid Skill

Audit code for correctness and rigor — logic errors, silent error swallowing, wishful thinking, and unjustified fallbacks. This is not a style review; it's a logic review. Use when you want a focused correctness audit separate from the full code-police pass.

static-web-server Skill

Review or implement security measures for the Static Web Server (SWS) project — path traversal prevention, TLS, security headers, CORS, and input validation

superplanehq Skill

When generating a SuperPlane changelog from merged commits. Use for "what's new" summaries with new integrations, new components/triggers, improvements, security updates, and bug fixes. Output is user-focused markdown in tmp/.

suryast Skill

STARTER_CHARACTER = 🔍

svyatov Bundle

Harden the security posture of an open source repository: pin CI actions to full commit SHAs, restrict workflow permissions, keep untrusted input out of shell commands, enable automated dependency updates, lock dependency resolution, run static analysis on pull requests, detect committed secrets before they reach the default branch, watch every shipped dependency ecosystem for known vulnerabilities, configure branch protection, enforce code owner review, and sign tags. Use when the user asks to harden a repo, improve supply chain security, fix an OpenSSF Scorecard finding, pin actions, fix a workflow script injection, enable secret scanning or push protection, turn on dependency vulnerability alerts, or lock down CI. Covers GitHub and GitLab. Publishing belongs to oss-publish.

svyatov Bundle

Write clear technical prose for anything that lives in a repository or on a forge: commit messages, PR titles and descriptions, PR and code review comments, issue text, READMEs, documentation, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, changelogs, ADRs. Use it when someone says commit this, open a PR, reply to a review comment, or file an issue. Use this whenever you are about to write or edit any of them, including short ones. A one-line commit message or a two-sentence review comment looks too small to need a skill, and that is exactly where the tells show up. Not for prose that needs a personal voice, such as blog posts, essays, or launch announcements.

svyatov Bundle

Create the community and governance files an open source project needs: CONTRIBUTING, CODE_OF_CONDUCT, SECURITY.md, issue forms and pull request templates, CODEOWNERS, FUNDING, and the license file, and set the forge project's description, topics, and homepage. Use when starting a new open source project, opening a private repo to the public, when a repo is missing its community health files, or when its issue templates collect reports that still cannot be triaged. Covers GitHub and GitLab. README structure belongs to oss-readme.

theepan Bundle

Review OpenAPI (Swagger) specification files for compliance with the OpenAPI 3.1 standard, security scheme design, naming conventions, schema quality, and API design best practices. Use when a user asks to review an API spec, check an OpenAPI file, audit a Swagger definition, validate an OAS document, or improve API design. Accepts YAML or JSON files, file paths, or inline spec content.

theepan Bundle

Review Java source code for bugs, security vulnerabilities, performance problems, concurrency issues, AI-generated code quality issues, dependency licensing risks, and best practice violations. Use when a user asks to review Java code, audit Java files, find bugs in Java, check Java code quality, detect AI slop, check library licenses, or perform a code review on .java files. Accepts code provided directly, as local file paths, as directory paths, or as unified diff output.

nvidia Skill

Use when reviewing AICR's Markdown documentation for duplication, drift, bloat, and gaps — to keep docs high-value as the project evolves. Triggers on "audit the docs", "review documentation", "docs cleanup", "/aicr-auditing-docs", or any request to find redundant/stale/missing docs across README, docs/, demos/, and the root governance files. Produces a prioritized findings report (research, not edits) grouped by the five audit dimensions, anchored to the project's canonical sources of truth.

ofoxai Bundle

Securely store, search, and use secrets (API keys, tokens, passwords, SSH keys) with hal-vault, an SSH-key encrypted local secret store. Use when the user shares a credential that should be saved, asks what secrets are stored or where a key is, or when a command/workflow needs a secret injected. Core discipline - never print raw secret values into chat, logs, or files; reference secrets only by their masked form, and use --reveal exclusively inside command substitution.

opsmill Bundle

Audit an Infrahub repository against all best practices and rules. Use when reviewing a project for compliance, onboarding to an existing repo, or before deployment to catch issues early.

papanito Skill

specialized protocol for GHEC on ghe.com with EU Data Residency. Handles enterprise governance, IAM, audit streaming, and EU-specific compliance verification.

parcadei Skill

Extend the ouros sandbox with new external functions (bridge functions, security policy, tests)

patrickjaja Skill

Full review of the claude-desktop-extra project - patches vs the official Linux .deb (still needed? new ones needed? did the surrounding code change?), docs accuracy, Linux compatibility across the distro/session matrix, and runtime logs. Orchestrates a team of sub-agents and produces a consolidated report with solution approaches.

patrickking67 Skill

Review uncommitted (or specified) changes for bugs, security, and convention drift.

rawgroundbeef Bundle

Review a branch, pull request, commit range, working-tree diff, or selected files for correctness, architecture, security, performance, maintainability, and testing risks. Use when asked for a code review, final review, merge-readiness check, quality pass, risk assessment, or "anything else before merge?". Report findings without implementing fixes.

richard-kim-79 Skill

Detects statistical errors, logical fallacies, and methodological issues in research content. Checks for p-hacking, correlation/causation confusion, underpowered samples, multiple comparisons problems, overgeneralization, and other common fallacies. Use when the user asks to validate statistics, audit quantitative claims, check methodology, or find logical errors. Returns minimal output on purely theoretical content — most useful after empirical data is present.

robustmq Bundle

Audit and update the HTTP API documentation under docs/zh/Api/ and docs/en/Api/ against the actual route definitions in src/admin-server/src/. Uses path.rs as the single source of truth. Fixes wrong URI prefixes, non-existent routes, wrong request/response fields, and syncs the English docs to match the Chinese ones.

mozilla-services Skill

Runs clippy, cargo audit, and all relevant multi-backend Makefile targets for files changed in the current branch. Detects code smells, anti-patterns specific to this codebase, and surfaces issues across every affected backend before CI catches them. Also handles dependency-update verification (Cargo.toml / Cargo.lock changes from dependabot or manual bumps) via the `deps` mode.

muqian2026-rgb Bundle

Test whether a Cursor skill triggers correctly: 5 positive prompts, 3 negative, metadata audit. Use after writing or updating any SKILL.md. Pairs with book-learn-distill.

nicolasflores9 Bundle

Master modern plugin development in Joomla 5/6. Learn to create robust extensions using SubscriberInterface, Event Classes, dependency injection, and PSR-4. Covers manifest.xml, service providers, system/content/user events, namespaces, and security best practices.

workos Skill

Audit an emitter's coverage of IR fields and produce a structured gap analysis. Use when checking if an emitter handles all IR types, after updating oagen, or verifying emitter completeness. Also triggers for "IR coverage", "emitter audit", "field coverage", "parity check".

xenonbyte Skill

Turn plain-language needs into a grounded requirement document in .xsk/requirements/, with a self-audit gate before it is finalized.

xiaolai Bundle

Use when the user asks to grill, roast, audit, interrogate, deep-review, or do a multi-angle architecture review of a codebase or directory. Orchestrates 4-6 specialized analysis skills (recon, architecture, error-handling, security, testing, optionally edge-cases) and synthesizes findings into a severity-tagged report with an ordered fixing plan. Saves the report as a markdown file in the target codebase.

xiaolai Skill

Use to analyze the security surface of a codebase — authentication, authorization, input validation, secrets handling, and dependency vulnerabilities. Part of the grill deep-dive phase. Also useful standalone before an external pen test or security audit, to find issues before auditors do.

xiaolai Skill

Produce findings-first code review with severity ordering, test-gap findings, and test-quality audit.

y-a-v-a Bundle

Use this skill when the user asks for a rigorous, blunt, senior-level code review focused on correctness, maintainability, production risk, unnecessary abstraction, weak tests, security issues, and operational failure modes. Do not use it for brainstorming, greenfield implementation, or purely stylistic feedback.

yan-labs Bundle

Audit project and global .agents/skills and .claude/skills layouts. Verify that .agents/skills contains the real source and .claude/skills mirrors it through a parent or per-skill symlink. Use whenever a skill or slash command is missing, not loading, duplicated, inconsistent, or described as "skill 没生效", "skill 不一致", "为什么 skill 没识别到", "检查 skill 链接", ghost skill, broken skill link, or missing skill. Also use when a skill exists in one directory but not the other.

yaxeen Skill

Use when diagnosing why a published video underperformed — reading a YouTube retention graph, comparing a weak video against a winner, or mapping audience drop-off points to script beats. For writing the next script, use storytelling-hooks or long-form-youtube.

yujie-jason-zhang Bundle

Polish, translate, or faithfully revise Chinese or English TeX academic manuscripts; verify source-to-output TeX, math, citation, numerical, and claim preservation; audit cross-section terminology, mathematical notation, and numerical consistency; or apply an author-approved notation mapping. Use for sentence-level through full-manuscript engineering-journal language work when technical truth and protected TeX must remain fixed. For full manuscripts, run terminology, notation, and numerical-consistency audits by default. Do not use as the main skill for novelty review, literature selection, or argument redesign.

yujie-jason-zhang Bundle

Audit and constrain a paper's experiment section — experiment and ablation design, plus results narration — without leading the design. Use when the user is building or revising experiments, ablations, or results writeup and wants a check that (1) every experiment and ablation maps to a main claim, (2) the set is the minimal one that argues that line under the user's real equipment, data, and time, and (3) results are narrated as claim-tied argument rather than a flat report of numbers. This skill audits the user's plan or draft and proposes only minimal additions needed to close gaps; it does not invent experiments, assume feasibility it cannot verify, fabricate results, or explain away anomalies. It assesses feasibility only against resources the user states. Defer abstract/introduction contribution framing to paper-argument-reconstructor, novelty and claim boundaries to idea-novelty-auditor, and language polishing to paper-polisher.

yujie-jason-zhang Bundle

Draft, plan, or diagnose a point-by-point response to reviewers (response letter / rebuttal) for a journal or conference revision, especially IEEE Transactions and control, robotics, automation, aerospace, and intelligent-systems venues. Use to audit the manuscript's claims, decode each comment's hidden concern, grade severity and required evidence, produce a revision plan before claiming any edit, revise and mark the manuscript, reconcile conflicting reviewers, handle multi-round revisions, and write the response letter with exact locations. Reuses the real revisions the authors made; defers final language polishing to paper-polisher.