Security

bytelandtechnology Bundle

Phase skill for import-only Frida dynamic evidence normalization, replay expectations, and audit of generated planning artifacts.

bytelandtechnology Bundle

Phase skill for Stage 6 selected decompilation, incremental compare, and audit of generated planning artifacts.

cb23333 Bundle

Comprehensive Kali Linux security testing skill for authorized penetration testing, CTF challenges, security education, and defensive audits. Covers full workflow from reconnaissance to reporting. Use this skill whenever the user mentions Kali Linux, penetration testing, pentest, CTF, security audit, vulnerability assessment, network scanning, web security testing, password cracking, wireless testing, digital forensics, or any offensive security task. Also trigger when the user asks about tools like nmap, metasploit, burpsuite, sqlmap, hashcat, aircrack-ng, john, hydra, nikto, gobuster, searchsploit, volatility, or similar security tools, even if they don't explicitly mention Kali Linux. This skill enforces authorized-use-only principles and will refuse any request lacking clear authorization context.

cb23333 Bundle

Helps security professionals properly frame and communicate authorized penetration testing context when working with AI assistants. Provides structured authorization templates, context-framing guidance, and request phrasing strategies so AI can correctly identify legitimate security testing and provide appropriate assistance. Use this skill whenever the user mentions penetration testing authorization, pentest scope, rules of engagement, security testing context, engagement letter, authorized testing, or wants help structuring their security testing requests. Also trigger when the user says AI refused their security testing request, or asks how to properly describe their pentest engagement. This skill does NOT bypass safety measures — it teaches proper professional communication for authorized contexts.

chmouel Skill

Validate all themes for completeness and correct usage

ckorhonen Skill

Checks that test method and function names read as complete sentences describing behavior. Flags cryptic names like test1, testFoo, or abbreviated names that do not describe what is being tested. Designed to run on every PR. Do NOT use for test coverage, test structure, or non-test code.

ckorhonen Skill

Detects entropy signals in a codebase: stale TODOs, disabled tests, lint suppressions, commented-out code, dead imports, empty catch blocks, and deprecated API usage. Designed for daily runs to catch quality erosion early. Do NOT use for feature work, refactoring planning, or security audits.

ckorhonen Skill

Finds code that obscures its intent: unclear variable names, nested ternaries, boolean parameters without names, overly clever one-liners, and comments that restate code instead of explaining why. Focuses on recently changed files. Do NOT use for method length, duplication, or test naming concerns.

ckorhonen Skill

Scans a codebase for methods and functions that exceed configurable length thresholds. Reports a ranked list of the longest methods with file:line, language, and surrounding complexity signals. Designed for scheduled weekly runs. Do NOT use for style formatting, indentation, or naming concerns.

ckorhonen Skill

Flags classes, modules, and functions with vague generic names like Manager, Handler, Processor, Helper, Utils, Service, Base, Common, and Misc. Suggests more specific alternatives based on what the code actually does. Use weekly to prevent naming drift. Do NOT use for variable-level naming or style enforcement.

horizonrobotics Skill

Reviews code for bugs, logic errors, security vulnerabilities, code quality issues, and adherence to project conventions, using confidence-based filtering to report only high-priority issues that truly matter.

hypnguyen1209 Skill

Use when a task needs one specific expert lens rather than a full workflow stage. Specialist role cards (planner, executor, verifier, reviewer, security-reviewer, test-engineer, architect, critic, researcher) to adopt for focused sub-tasks. Part of codex-goat.

hypnguyen1209 Skill

Use when the user says review this, check my changes, look at this PR or diff, or before merging. Reviews a concrete change across correctness, security, performance, and test coverage, then adversarially verifies each finding before reporting it. Part of codex-goat.

iamladi Skill

Comprehensive landing page audit against 5 proven persuasion frameworks - Schwartz, Cialdini, Milligan, Warren, and behavioral psychology research. Use when your landing page isn't converting or you want to optimize for higher conversion.

ideola-ai Bundle

Comprehensive ads audit system with platform-specific subcommands. Use /ads audit for full multi-platform audit. Platform-specific commands available - /ads google (Google Ads), /ads meta (Facebook/Instagram), /ads youtube (YouTube Ads), /ads linkedin (LinkedIn Ads), /ads tiktok (TikTok Ads), /ads microsoft (Microsoft/Bing Ads), /ads creative (creative audit), /ads landing (landing page audit), /ads budget (budget and bidding review). Also triggers on audit ads, ad review, performance audit, analyze my ads, why are my ads underperforming.

j4rk0r Bundle

Use when tracking multi-session development work, resuming context from previous conversations, planning phased features, or capturing architectural decisions. Triggers: 'milestone', 'retomar', 'dónde lo dejé', 'seguimos con', 'estado del proyecto', 'qué falta', 'siguiente tarea', 'qué hicimos la última vez', 'pendientes', 'resume where we left off', 'what's left', 'mark as done', 'close milestone', 'sync milestones', 'audit the project', phased feature planning, subtask tracking, work-in-progress recovery. Portable across projects — no external dependencies. Commands: /milestone, /milestone <name>, /milestone init, /milestone sync, /milestone start, /milestone done, /milestone update.

j4rk0r Bundle

Track and report local Claude Code usage per request: tokens consumed, estimated cost in €, sessions, projects, and tool breakdown. Use when the user asks about consumption, credits, usage, cost per request, wants to see a report, asks why a specific request was expensive, suspects a process is consuming tokens, wants to optimize their Claude Code usage, or wants to audit tool usage by request. Also triggers on Spanish phrases: 'cuánto me está costando', 'cuántos tokens', 'consumo de hoy', 'qué petición fue cara', 'está consumiendo mucho', 'optimizar consumo', 'reporte de uso', 'ver uso', 'instalar tracker', 'hook no registra'. Commands: /usage-tracker report [hoy|semana|mes|all] [proyecto], /usage-tracker top-requests [hoy|semana], /usage-tracker install, /usage-tracker status

j4rk0r Bundle

Lint review completo de un módulo Drupal 11 combinando 4 fuentes en paralelo — PHPStan level 5 + phpstan-drupal, PHPCS Drupal/DrupalPractice, agente drupal-qa (estándares) y agente drupal-security (OWASP). Dos modos — completo (todo el módulo) y diff (solo archivos cambiados vs develop). Genera informe markdown estructurado en la carpeta del IDE con resumen ejecutivo, hallazgos clasificados por severidad, acciones P0/P1/P2 y comandos de verificación. Úsalo siempre que el usuario quiera auditar calidad o seguridad de un módulo Drupal custom, aunque no diga "lint". Triggers — "lint review", "lint del módulo", "auditar módulo Drupal", "revisar módulo custom", "phpstan del módulo", "validar módulo", "qa del módulo", o cuando el usuario pregunta "¿está bien este módulo?", "¿hay errores?", "¿es seguro?". También antes de un release, antes de un PR a develop, o al validar un módulo recién creado.

udapy Skill

Auditing for unsafe code and secrets.

uwe-schwarz Skill

Comprehensive code review guidelines for ensuring code quality, security, and maintainability. Use when reviewing pull requests, refactoring code, or ensuring best practices.

webrenew Bundle

Write and audit clear user-facing copy with ASD-STE100 Simplified Technical English. Lead with the reader's benefit. Use this skill for landing pages, headlines, onboarding, messages, tooltips, docs, release notes, emails, and product copy.

whaojie797-design Bundle

This skill audits a codebase for common performance anti-patterns (N+1 queries, SELECT *, nested loops, missing LIMIT, sync/blocking calls inside loops) and proposes prioritized fixes. Use it when the user says "性能审计", "perf-doctor", "检查性能", "为什么慢", "performance audit", or "帮我看性能".

whaojie797-design Bundle

This skill should be used when the user requests a code review, security audit, or pre-merge inspection of a change. Trigger phrases include "review 代码", "代码审查", "安全审计", "审查这个 PR", "review this PR", "security audit", "code review". It applies a five-axis review framework (correctness, readability, architecture, security, performance) with severity classification and a standardized output template.

mkgp-dev Bundle

Best-practice guidance for creating, reviewing, and maintaining high-signal `CHANGELOG.md` entries for versioned software projects. Use this skill whenever the user wants to add or rewrite changelog entries, organize release history, turn completed work into structured version notes, decide what belongs in `Added`/`Changed`/`Fixed`/`Deprecated`/`Removed`/`Security`, or improve noisy release notes into maintainable repository changelogs.

mlava Skill

Audit a whole bibliography (BibTeX, RIS, or CSL-JSON) in one call — per-entry fabrication verdict and retraction status, plus a corpus summary.

mohitagw15856 Skill

Teaches you to audit a skill before installing it.

motiful Skill

Converges many scattered sources — dated research notes, subagent outputs, audit reports, revision cycles — into one living source of truth without silently dropping or distorting anything, routing each conclusion to exactly one home via a visible disposition ledger and surfacing conflicts as choices for a human. Use when merging or consolidating notes/reports into a ctx source of truth, integrating subagent research, synthesizing multiple audit reports, closing a decision cycle where alternatives existed, or rolling a corpus too large for one context through successive batches. Not for writing a single fresh doc from scratch — use ctx-spec.

denysfast Bundle

Audit code against the rules that actually exist in this repo (CLAUDE.md, .claude/rules, configs, CI) plus the deterministic checks that can run safely — architecture boundaries, tests, typecheck, lint, build, security-sensitive changes. report-only by default. Use for PR/commit readiness and rule-compliance checks; complements /code-review, which is rule-agnostic.

detro Skill

Manage project runtime dependencies, tool versions, and plugins using asdf-vm. Proposes asdf to resolve missing script runtimes (e.g. Python, Perl) and handle tool updates with strict security checks for custom plugins.

dgu-stallion Skill

Integrity audit — use when the user wants to verify citations, check that numbers in the paper match analysis output, detect AI writing patterns, or audit data-to-paper traceability. Looks for paper file at paper/main.tex; asks user for path if absent.

dinaf2026-web Skill

Sets up (or edits) a book project's editorial profile for the Manuscript Editorial Suite. Every other pass auto-detects this profile from the working folder; this skill is what creates it. Use when there is no profile yet, when a pass reports "no profile found", or when the author says "set up my book", "create a profile", "edit my profile", "change my genre/shelf/comps", "onboard this manuscript", or "configure the editorial suite". It writes `<project>/.manuscript/profile.md` and seeds an empty canon ledger. It does not critique, score, or audit — it only configures.

dinaf2026-web Bundle

Mystery-mechanics auditor for any mystery, crime, or thriller manuscript. Maps the clues, tests whether the solution is fair and re-readable, tracks plant-and- payoff, judges red herrings, and flags any place a coincidence — not deduction — solves the plot. Use when the author says "is the mystery fair", "clue audit", "does the solution hold up", "check the plot logic", "fair-play check", "did I plant the clues", "is the ending earned", "track plant and payoff", or "would a reader feel cheated". It judges mystery construction only — not prose, canon, or marketability. For non-mystery genres, this pass does not apply.

dinaf2026-web Bundle

Continuity and canon-integrity auditor for any novel, series, or manuscript. Cross-checks a chapter, scene, outline, or full draft against the book's own bible (set in the project profile) plus its internal logic, and produces a defect list — every contradiction of established canon, every drifted detail, every broken series rule, every internal inconsistency. Use when the author says "continuity check", "canon audit", "does this break canon", "check this against the bible", "did I get the details right", "find inconsistencies", or "continuity pass". It only diagnoses continuity — it does not rewrite prose or grade craft/marketability (those are the other passes).

dinaf2026-web Skill

Routes a broad or ambiguous editorial request to the right pass(es) in the Manuscript Editorial Suite. Use when the ask spans more than one kind of feedback or it's unclear which is wanted — "review my book", "give me editorial feedback", "is this ready", "go over this chapter", "full editorial pass", "what should I check". Picks among manuscript-publisher-critique, manuscript- continuity-audit, manuscript-fair-play-audit, manuscript-prose-immersion-audit, and manuscript-listing-critique, runs them in the right order for the book's genre, and hands off. Does not itself critique, score, or rewrite — it only dispatches.

dinaf2026-web Bundle

The publisher's read for any manuscript — an acquisitions verdict plus a developmental craft breakdown, delivered as a scored report card graded against the markers of a great book in its genre (set by the project profile). Use for a single craft/acquisitions read of a scene, chapter, outline, full manuscript, or query: "publisher's read", "acquisitions verdict", "critique this", "score this", "grade this", "editor's letter", "would a publisher take this", "what's weak here", "read this like an editor". For a broad "review my book / full editorial pass" that may need several checks, use manuscript-editorial-router. NOT for canon checking (continuity-audit), mystery-fairness logic (fair-play-audit), line-level immersion (prose-immersion-audit), or blurb/listing copy (listing-critique). Diagnoses and scores; does not rewrite prose.

dinaf2026-web Bundle

Line-level prose and scene-immersion auditor for any narrative manuscript — the deep craft pass beneath the publisher's read. Diagnoses scenes for the failures that keep prose at draft level: information dialogue, talking-heads, filter words, furniture-inventory description, missing micro-reactions, weak environmental presence, and emotion stated instead of threaded. Use when the author says "line audit", "prose immersion audit", "prose pass", "diagnose this scene", "is this immersive", "does this read like a draft", "craft pass", or "kill the info-dumping". It diagnoses at the line level — it does NOT rewrite prose, grade marketability, check canon, or judge mystery logic. For rewritten prose, route to the author's writing/voice skill.