Security

trustycap-technologies Skill

Audit an application for what it still needs before real customers use it: durable storage, data that survives a restart, work that happens later, incoming events that are not lost, mail that arrives, credentials that are not in the repository, and a way to know it is working. Produces a findings list ranked by what breaks first, and names which gaps the codebase already covers so nothing is recommended twice. Read-only: it installs nothing and changes nothing. Use when someone asks whether an app is production ready, what is missing before launch, or asks for a pre-launch or infrastructure review.

viachaslaustrelnikau Bundle

Risk-focused Java test design, implementation, review, and CI planning. Use when Codex needs to add, improve, review, debug, organize, or plan automated tests for Java applications, including unit tests, integration tests, Spring Boot tests, Spring Security authorization tests, REST/API tests, contract tests, Testcontainers-backed tests, database seeding and cleanup, Mockito-based collaborator tests, regression tests, flaky-test investigation, CI test strategy, or test-pyramid decisions.

viachaslaustrelnikau Bundle

Audit, plan, add, improve, or review production logging and observability for a selected class, package, migrated operation, module, migration stage, or complete application. Use when Codex needs to preserve meaningful legacy logs, add diagnostic context to business operations and integrations, remove duplicate or unsafe logging, or perform a logging and observability audit without changing business behavior.

viachaslaustrelnikau Bundle

Verify that functionality migrated from Struts 2 to Spring works correctly in the running application from the API, client, and user perspective. Use after a migration step to gate a migrated action, route, workflow, form, grid, report, or state change through focused project-rule review, targeted build/tests, HTTP verification, browser E2E when UI integration matters, persistence checks for mutations, and optional old-versus-new comparison. Return PASS, FAIL, or INCOMPLETE. Do not use as a generic repository-wide Java, Spring, architecture, security, performance, or clean-code review.

vincenzoimp Bundle

Use when reviewing the survey, a contribution, or a paper draft as a severe but fair reviewer — claim audit, methodology critique, and venue-reviewer simulation before submission.

wrathza Bundle

Export the current Claude Code session as a markdown transcript and post it as a comment on a GitHub PR or issue. Reads the session JSONL file from ~/.claude/projects/, uploads a full transcript as a secret Gist, and posts a structured summary comment with deep-link anchors. Use when: posting session context to a PR after merge, saving conversation history, uploading a session transcript to GitHub, documenting what we did, or when the user says 'export context', 'post context to PR/issue', 'export the session', or 'post session to GitHub'.

a16z Skill

Deep code review of a pull request using parallel analysis agents (semantic consistency, bugs, tech debt, security). USE FOR: - Reviewing PRs for bugs, security issues, and code quality - Analyzing new abstractions for consistency and correctness - Identifying tech debt and architectural concerns - Posting review comments to specific lines on GitHub TRIGGERS: - "review PR", "code review", "review changes" - "diff review", "PR feedback", "check PR" - "analyze diff", "critique code", "review code" - "pull request review", "GitHub PR review"

across-protocol Skill

Security Checklist

afu-it Skill

Scan an entire codebase to detect and safely remove dead code such as unused functions, orphaned modules, unreferenced exports, stale configs, dead routes, and leftover workflow artifacts. Use when asked to clean up dead code, remove unused code, prune stale files, find orphaned modules, audit codebase bloat, or delete code left behind after a workflow or architecture change.

thinkingwithagents Skill

Adversarial econometrics review — catches specification errors, clustering mistakes, bad controls, and silent analytical failures in Stata, R, or Python code

try-works Bundle

Use when recursive-mode needs to route delegated audit, review, or bounded implementation work through external transports, CLIs, and models while preserving controller verification and fallback behavior.

try-works Bundle

Use when recursive-mode work may benefit from delegated audit, review, or bounded implementation support. This skill prioritizes analyst, planner, code-reviewer, memory-auditor, tester, and implementer roles, with mandatory self-audit fallback when subagents are unavailable.

try-works Bundle

Use when recursive-mode work needs a canonical delegated-review or audit handoff. Generates reproducible review bundles for Phase 3.5 code review, test review, or other delegated checks using the repo review-bundle scripts.

vetr0s Skill

Explain how a subsystem works, at the level of an engineer being onboarded onto it. Use for "how does X work", "walk me through X", "explain this subsystem", a code walkthrough before changing something, and placement questions like "where should this live" or "which layer owns this". Can also critique the architecture on request. Use `audit` for whole-project health and `blast-radius` for what a change breaks.

willmusubi Skill

本项目治理流程：要审查一份计划或一段 diff 时使用。检查正确性、安全性、隐私、可维护性、架构偏移与一致性风险（含原 code review 范畴）。

peterhdd Bundle

Secure applications, infrastructure, and pipelines through threat modeling, vulnerability assessment, and security architecture. Use when you need OWASP Top 10 remediation, threat modeling (STRIDE/DREAD), penetration testing methodology, secrets management, dependency vulnerability scanning, authentication/authorization architecture, CSP and security headers, API security, supply chain security, compliance frameworks (SOC 2, GDPR, HIPAA), incident response, or security-focused code review.

phuhao00 Skill

Authentication and authorization for real_deal platform including third-party login (WeChat, Apple, Google, GitHub, LinkedIn), OAuth/OIDC flows, account merging, session management, and security best practices. Use when implementing login systems, handling OAuth callbacks, managing user sessions, or working with identity providers.

phuongnz Bundle

Discover high-impact, personally-relevant AI use cases for a knowledge worker through a guided interview, producing a dated, prioritized report. Use when someone asks what they could actually use AI for in their job, feels their AI use is stuck on Q&A/summaries/images and wants real impact, or wants to audit their workday for automation and augmentation opportunities.

prilk-consulting Bundle

Full audit of a Frappe app with parallel specialist delegation. Reviews security (permissions, injection, guest endpoints), schema quality (DocType JSON), and code conventions (hooks, patches, client scripts). Use when the user says audit my app, review this Frappe app, app health check, or pre-release review.

propiter Bundle

Trigger: web animation, motion design, micro-interactions, transitions, hover/press/scroll effects, page reveals, route/view transitions, Framer Motion / Motion, GSAP + ScrollTrigger, Lottie, easing curves, spring physics, prefers-reduced-motion, 60fps. Two modes — BUILD motion (pick the right tool and ship it with craft) and REVIEW motion (audit existing animation against a checklist).

pydantic Skill

Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses. Use when reviewing changes for security risk, or before merging anything touching heap.rs, path_security.rs, the wire protocol or the pool.

qmertesdorf Skill

Use to empirically verify a playable Godot game is actually WINNABLE, FAIR, and PROGRESSABLE — by driving the REAL game loop with a headless competent-player bot that asserts playability invariants (can earn/progress/clear, the first goal is reachable, no death-spiral) and reports balance metrics. The gate the logic/UI self-tests structurally cannot be.

saleor Skill

Triage OSV and `pnpm audit` security findings and propose batched, accept-first dependency fixes. Use when asked to run a security audit, fix security vulnerabilities, update vulnerable packages, or analyze dependency audit output.

sccn Bundle

Run an unusually strict EEGPrep code-quality review for architecture, maintainability, abstraction quality, file sprawl, spaghetti branching, and missed simplification. Use for thermo-nuclear review, thermonuclear review, deep maintainability audit, strict architecture review, or when code technically works but may make EEGPrep harder to ship.

secapi-ai Bundle

Researches factor rotation in a stated country's macro regime. Use when you need dated leaders and laggards with regime context, not an individual-security recommendation.

slogsdon Skill

Use when /eod is invoked or when Shane wants to close out his day. Diffs Today's Focus vs Session Log, increments deferrals in patterns.md for unlogged tasks, flags items at 3+ deferrals, and writes an EOD Audit to today's daily note.

slogsdon Skill

Use when /eod-pro is invoked, or when Shane says "professional eod", "work eod", "close out my work day", "end of work day", or wants to run his end-of-day accountability audit against the PROFESSIONAL (Global Payments / WorldPay) vault and its GP OKRs. Diffs Today's Focus vs Session Log, increments deferrals in the Professional patterns.md, flags 3+ deferrals, and writes an EOD Audit to today's Professional daily note. For the Personal vault use /eod instead.

slogsdon Skill

Use when /plan-tomorrow is invoked or after /eod. Reads today's EOD audit and proposes tomorrow's focus (1 primary, 2 secondary) accounting for known patterns. Writes a Tomorrow block to today's daily note.

clay-good Skill

Security and code quality reviewer. Read-only deep review for vulnerabilities and quality issues.

clay-good Skill

Run all quality checks — tests, lint, format, security scan.

cogpros Skill

Token optimization audit of bootstrap files. Measure and reduce context weight of CLAUDE.md, MEMORY.md, skills registry, hooks, and plugins.

davidteren Bundle

Upgrade a Rails 7 app to Rails 8 safely, and catch the subtle test-suite flake it introduces. Use when bumping Rails 7.x to 8.x (or auditing readiness), when planning a Ruby/Rails version bump, or when Rails 8 tests fail intermittently with "undefined method 'login_path'/'root_path'" / pass on serial but flake on parallel runs. Provides a pre-flight audit, a detector + fix for the LazyRouteSet route-test flake, and a 7→8 checklist grounded in a real upgrade.

davidteren Bundle

Build secure DB-backed token session auth in Rails — one mechanism for web, Action Cable, and Hotwire Native, with Current attributes and secure-by-default controller concerns. Use when adding login/sessions to a Rails app, when web and native clients need to share authentication, when you need revocable server-side sessions (logout/kick a device) instead of stateless JWTs, or when auditing existing auth for user-enumeration, plaintext tokens, readable cookies, or opt-in-auth mistakes. Provides templates and a security audit.

dcs-soni Bundle

Identify source files that are never imported or referenced (orphan files) to help clean up technical debt and reduce build size. Use when user mentions dead code, unused files, cleaning up codebase, or dependency audit.

ddalcu Skill

PII and OWASP security filtering rules

aiperceivable Bundle

Apcore ecosystem management skill for Codex. Use only when the user explicitly asks for apcore-skills, apcore ecosystem sync, SDK bootstrap, framework integration scaffolding, ecosystem audit, spec-driven tester, coordinated release, or dashboard operations. Handles cross-language API, contract, and deep-chain consistency across apcore repos, documentation alignment, conformance testing, and multi-repo release coordination.