Security

yujie-jason-zhang Bundle

Diagnose, restructure, or rewrite academic manuscript arguments into a problem-driven paper storyline. Use for abstracts, introductions, methodology narratives, formula explanations, theory/proof exposition, experiments, results, discussion, conclusions, contribution statements, section outlines, and full-paper diagnosis when the main task is argument design rather than pure language polishing, literature-review construction, novelty-risk auditing, or audit-only experiment-section checking. Defer experiment-set minimality, ablation sufficiency, feasibility-against-resources, and results-narration audits to experiment-section-auditor.

yujie-jason-zhang Bundle

Write, diagnose, revise, or audit literature review, related work, introduction background, research-gap, and reference-selection sections using a problem-driven S-R-L-H-G-M-C-V protocol. Use for claim-first citation selection, literature-route organization, hidden-assumption analysis, direct competitor coverage, structural gap synthesis, review-baseline alignment, contribution mapping, and citation integrity in technical research papers.

7xmohamed Bundle

Reviews code diffs after implementation, auto-fixes safe issues, and runs specialist security and architecture reviewers on large diffs. Also triages issues and PRs when the user mentions them. Not for exploring ideas or debugging.

adscanpro Skill

The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning or driving an AD assessment and need to know what to run before what and why (map before you exploit; harvest easy credentials before spraying to avoid lockouts; collect the graph before you reason about paths). Covers phase sequencing with standard tooling: netexec/nxc, impacket, certipy, bloodyAD, kerbrute, BloodHound CE. Invoke it at the start of an engagement, when deciding the next phase, or when a step feels out of order.

al-janef Bundle

After any vulnerability or bug is found, hunt the entire codebase for every other instance of the same pattern — because one bug is almost never alone. Turns a single finding into a systematic sweep using ripgrep and custom Semgrep rules, so the whole class gets fixed, not just the reported case. Use this skill right after finding or fixing a security issue, when reviewing whether a fix is complete, or when a past incident's pattern must be proven eradicated. Defensive only: it finds and eradicates weaknesses, it does not exploit them.

al-janef Bundle

Prevent secrets from leaking into code, git history, logs, or client bundles — API keys, database credentials, tokens, private keys, and connection strings. Detects hardcoded secrets, guides correct secret management (env vars, secret managers), and sets up prevention (gitignore, pre-commit scanning). Use this skill whenever the user is handling API keys or credentials, setting up environment variables, connecting to external services, committing config, or asks about keeping secrets safe — even a casual "where do I put my API key?". Defensive only.

al-janef Bundle

Design and review security audit logging and monitoring — recording who did what and when, detecting suspicious activity (repeated failed logins, unusual access), and doing it without leaking sensitive data into the logs themselves. Use this skill whenever the user is building audit trails, adding logging to sensitive actions, setting up monitoring or alerting, investigating an incident, or asks "how do I track who did X?" — especially for auth events, data changes, and admin actions. Defensive only.

astarlab-s Skill

Use to audit and refresh the project-instructions file: find stale commands, missing conventions, and undocumented gotchas, then draft the minimal update.

avinava Bundle

Review MuleSoft Mule 4 working changes, commit ranges, branches, pull requests, whole repositories, or release readiness and return prioritized evidence-backed findings with remediation options. Use for code review, PR review, project health audits, architecture and contract consistency checks, incident-prevention reviews, and pre-release gates covering Mule XML, RAML/OAS, DataWeave, connectors, configuration, MUnit, deployment, operations, security, privacy, and documentation. Review and report by default; do not modify source, post comments, approve changes, or perform release actions unless the user explicitly requests them.

avinava Bundle

Design, author, revise, or assess consumer-facing MuleSoft HTTP API contracts in RAML 1.0 or OpenAPI 3.0 using explicit resource, method, URI, data, error, security, compatibility, and governance decisions. Use for API design workshops, URL and naming guidance, new RAML/OAS contracts, contract-first changes, and contract-only reviews. Maintain RAML 0.8 or OAS 2.0 when required, but do not use for AsyncAPI, event schemas, Mule implementation, MUnit authoring, or general project review.

emanueleminotto Skill

Use this skill to review test code — not what test to write, but whether a test already written is any good. Trigger on "review this test", "is this test any good", "review my test suite", "does this test actually test what it claims", "should this be a unit test instead", or when a code review (including the built-in code-review skill) touches test files and test-specific judgment is needed. Standalone — no prior audit is required, and it complements rather than replaces the built-in code-review skill by owning the test-specific half of the judgment. Primarily advisory — flags issues and proposes rewrites — but may apply an edit directly when the user explicitly authorizes it; it never edits on its own initiative.

emanueleminotto Skill

Use this skill when someone describes a specific code path, feature, or bug and asks what kind of test to write for it — or when an audit or strategy engagement surfaces a testing gap and needs a recommendation for where to start. Trigger on "what test should I write for this", "unit or integration test for X", "our E2E suite is too slow", or similar scenario-specific testing questions. Standalone from the audit and strategy skills — no prior audit is required to use it.

emanueleminotto Skill

Use this skill to help a developer keep day-to-day code simple, maintainable, and robust — through automatable prevention (linters, type checkers, static analysis, and — for what static analysis structurally can't catch — AI-assisted review skills) rather than after-the-fact fixes. Trigger on "how do I keep this codebase maintainable", "what linter should I use", "which linting rules should we enable", "set up static analysis for us", "reduce cognitive load in code review", "our code keeps rotting", or when the user wants day-to-day engineering hygiene rather than a full team assessment. Standalone — no prior audit is required. Primarily advisory — recommends tools, specific rule sets, and how to wire them into editor/pre-commit/CI, adapting first to whatever is already configured in the repo — but may run a linter/type-checker command when the user explicitly authorizes it; it never executes anything on its own initiative.

emanueleminotto Skill

Use this skill to help API producers and consumers find actual or potential breaking changes — REST/OpenAPI, GraphQL, gRPC/Protobuf, or consumer-driven contracts — and apply SemVer and deprecation discipline. Trigger on "will this change break our API consumers", "how do I detect breaking changes in our OpenAPI spec", "deprecate this field safely", "set up contract testing between services", "diff our GraphQL schema", or similar API-compatibility questions. Standalone — no prior audit is required. Primarily advisory — recommends which tool (oasdiff, Buf breaking, GraphQL Inspector, Pact) fits the API type and how to wire it into CI — but may run a diff/contract-test command when the user explicitly authorizes it; it never executes anything on its own initiative.

hanzephyr Skill

Review code changes for concrete correctness, lifecycle, security, and compatibility defects using the project's contracts and evidence from real callers.

earayu Skill

Produce a code-grounded audit report for any subsystem in this repository. Use when the user asks to audit a system, explain how it works in detail, review data flow or architecture, assess whether it is production-ready, compare implementation against docs, or generate a detailed report based on the current code rather than assumptions.

earayu Skill

Refresh an existing audit report against the latest code while preserving the parts of the report structure that are still useful. Use when the user asks to redo an audit, run a second or third audit pass, update a previous report, fix inaccuracies in an existing audit document, or keep a strong prior report structure while replacing stale conclusions with code-grounded findings.

ezos26 Skill

Comprehensive multi-domain codebase audit. Runs security, architecture, data, UI, integration, and performance audits in parallel with cross-examination. Usage /audit [scope]. Examples /audit full, /audit security, /audit tesla, /audit iterations 40-52

ezos26 Skill

Ralph Planning Audit

ipea Skill

Read-only R code review protocol for `.R` scripts. Checks code quality, error handling, spatial-data correctness, and package conventions; produces a report without editing. Use when user says "review this R script", "check the R code", "audit the analysis code", "code review on the R", or when R code is touched as part of a release. NOT for running the code — pair with `/r-package-check` for the CRAN gate.

ipea Skill

Deep consistency audit of the geobr repository — configuration, documentation, and the two packages. Launches parallel specialist agents to find factual errors, dead references, drift between the R and Python sides, and claims that no longer match disk. Then fixes what is genuinely broken and loops until clean. Use after broad changes, before a release, or when the user says "audit", "find inconsistencies", "check everything".

zubair-trabzada Skill

Full Agency Onboard — launches 5 parallel audit teams and produces a unified client-ready report with composite scoring

zubair-trabzada Skill

Unified Agency Proposal Generator — builds a three-tier service proposal with ROI projections from all available audit data

zubair-trabzada Skill

Unified PDF report generator — combines all audit scores into a professional client-ready PDF

basiclines Skill

Audit and update all rampa project documentation after code changes. Use when adding features, changing defaults, modifying APIs, or before a release.

bgutschke Skill

Audit skills

smith-horn Bundle

Enforces engineering standards and code quality policies. Use during code reviews, before commits, when discussing standards or compliance, for quality audits, and when running retrospectives. Trigger phrases include 'run a retro', 'retrospective', 'code review', 'run review', or 'audit standards'.

arenukvern Bundle

Run a Mixture of Experts (MoE) audit on any topic, plan, codebase, evidence archive, or process. Dynamically spawns specialized subagents with different critical lenses to cross-reference findings and detect flaws, overlap, retention issues, or drift. Use when designing architectures, analyzing complex code, verifying multi-step plans, classifying evidence artifacts, or looking for duplicated intent in a repo.

garden-co Skill

Use this skill when designing data schemas, implementing sharing workflows, or auditing access control in Jazz applications. It covers the hierarchy of Groups, Accounts, and CoValues, ensuring data is private by default and shared securely through cascading permissions and invitations.

subinium Bundle

Opinionated defaults and full lifecycle playbook for secrets and environment variables. Decides where a secret or env-specific value lives (constant, .env, CI secret, env var), scaffolds .env.example and .gitignore, and manages the lifecycle end to end — add, update, rotate, remove, migrate between buckets, audit cross-environment drift, provision new environments. High-stakes companion to project-conventions. Language-agnostic.

thtskaran Bundle

Audit and harden existing codebases (especially AI-generated / vibe-coded ones) for production readiness. Use when the user asks to review, audit, clean up, harden, deslop, refactor, or fix quality issues across an existing codebase. Works in two phases — first a thorough multi-pass audit written to a structured file, then systematic fixes applied in safety-tiered order. Language-agnostic. Does NOT change business logic — only hardens, cleans, and robustifies.

web-infra-dev Bundle

Audit or update the Rspack webpack-compatibility tracker, including feature gaps, completed features, and missing tests.

extrovert-dot-dev Skill

Read Extrovert writing rules before composing and turn reusable human feedback into governed rules. Use for get_rules, category matching, saving or superseding a preference, promotion, retirement, audit, undo, risk-dial inspection, or proposing graduation without confusing one reviewer's edit with a universal rule.

jasonkneen Skill

Debug OpenWork sidecars, config, and audit trail

mmthebest Bundle

Use when reviewing, revising, or deciding whether to complete a Research Architect draft, especially when its reference adaptation, design, evidence, citations, claim boundaries, copying risk, or missing upstream artifacts need an auditable diagnosis.

langgenius Skill

Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging. Use when reviewing auth security, brute-force protection, token handling, or deployment safety.