Security

dppdppd Skill

Explain the rpm plugin and list its commands. Use when the user asks what rpm is, how /rpm works, which rpm commands are available, or needs an overview of the session-lifecycle / audit / research surface.

dy Bundle

Run "Questions That See" against a product, repo, or idea to extract crucial findings: the real value proposition and the minimal change that makes it obvious, proven strengths to reinforce, the canonical shape the product converges to, quality state, unseen limits, unreleased possibilities, and the one question the author is dodging. An evidence-grounded product contemplation — value maximization, audit, blindspot hunt, hidden-gold search, pre-mortem of a plan, weekly review. Use when the user wants to assess or maximize product value/potential, find what they're not seeing, decide what to build or cut, run a deep product review, stress a plan or launch before committing to it, or invokes contemplate by name. Stages: explore | project | execute | revise | blindspots | wonder | meta | feedback | premortem.

erom Skill

Audit code complet Cruchot — typecheck, lint, tests, patterns dangereux, coherence IPC. A lancer IMPERATIVEMENT apres chaque feature, fix, ou avant un commit. Ne pas skipper. Triggers: /cruchot-audit-code

erom Skill

Audit le README.md du projet contre les standards GitHub 2026 (piliers du notebook f082fb0c). Verifie la coherence cross-channels entre README, landing page, package.json, registry.ts et .memory/. Triggers: /cruchot-readme-check. Invocable seul OU automatiquement via cruchot-push-main / cruchot-release.

erom Skill

Use when Romain wants to review project's security. Triggers: /cruchot-security-review.

stellar Bundle

Cross-chain interoperability for Stellar. Entry point with a rail-selection decision table and shared pitfalls, routing to three companion files — cctp.md (Circle CCTP V2, native USDC burn-and-mint between Stellar and EVM/Solana chains, domain 27, the CctpForwarder requirement for Stellar recipients), axelar.md (Axelar GMP for Soroban contracts calling contracts on other chains, and the Interchain Token Service for multichain tokens), and layerzero.md (LayerZero V2 OApp messaging with configurable DVN security, OFT omnichain tokens, and USDT0 — native USDT on Stellar). Also covers NEAR Intents (intent-based cross-chain swaps into XLM or Stellar USDC) at the routing level. Use when bridging USDC or USDT to or from Stellar, sending messages between a Stellar contract and another blockchain, making a token exist on multiple chains, or adding cross-chain swaps to an app.

steveclarke Skill

Audit all documentation for staleness after code changes. Checks docs site, CLAUDE.md, skills references, contributing skill, agents, and project/ files. Use after completing a feature, merging a PR, or when asked to check docs.

switch-dimension Skill

Reviews project changes and updates relevant documentation to match current behavior, setup, configuration, security, operations, and usage. Use when the user asks to update docs, audit documentation, check docs drift, prepare a handoff, document recent changes, or ensure project docs are current.

sysprog21 Bundle

The guest as an attacker - where the trust boundary runs, the rules a handler on it obeys, what the gates already catch, and what is out of scope. Use when a change parses a guest-chosen length, translates a guest address, resolves a guest path, allocates on the guest's behalf, or blocks holding shared state, and when auditing a diff or writing a finding up.

theyahia Bundle

ЭПОС-аудит уже-задеплоенного сайта через YaGEO scorer (Экспертность/Полезность/Оригинальность/Содержательность). Используй ПОСЛЕ деплоя — оценивает попадание страниц в ответы Алисы и Yandex AI Search. НЕ путать с /wordstat-sweep (тот — pre-content market scan). Триггеры — "/yageo-audit", "yageo audit", "ЭПОС-проверка", "ЭПОС audit", "проверить сайт на ЭПОС", "yageo gate", "audit сайта Yandex AI".

themattberman Skill

Write mechanism-preserving, proof-disciplined landing page copy from strategy, brand profile, and extract language bank. Includes mandatory sharpness audit and claim control.

thomasrohde Bundle

Validate, audit, and repair an existing OKF bundle for conformance, citations, indexes, logs, links, metadata quality, and graph usefulness.

joshua-zyy Bundle

Self-review, audit, or verify CS/AI/ML paper drafts as a critical peer reviewer. Three-round review (evidence→argument→style) with Verification Status and debt tracking. Use when: reviewing a paper draft before submission, checking evidence compliance of claims, simulating peer reviewer feedback, verifying citation closure and evidence debts, performing cross-section consistency checks. Triggers on: self review, 自查, verification, 审稿, evidence compliance, peer review, 论文审查, draft audit, 验证论文, 检查引用, cross-section review, 审修, draft verification.

joshua-zyy Bundle

Polish academic prose, de-AI-ify text, control claim strength, or rewrite method sections for CS/AI/ML papers. Executes Prose Quality Gate, Claim Strength Audit, and de-AI pass. Use when: removing AI writing patterns from paper text, adjusting claim strength to match evidence level, rewriting method sections with proper narrative flow, improving academic writing quality, checking for overclaiming. Triggers on: 润色, polish, improve writing, 去AI, de-AI, claim strength, 改写, rewrite method, prose quality, 降级表述, remove AI patterns, academic writing polish, 学术润色, 去AI化, 降级结论, improve prose.

joshua-zyy Bundle

Audit, run, or verify experimental evidence for CS/AI/ML papers. Produces Evidence Inventory with evidence_type annotations (newly_run/preexisting_artifact/user_claim) and Protocol Risk assessments. Use when: checking if experiment results are reproducible, auditing existing experiment artifacts, running minimal reproducible commands, evaluating checkpoints without full retraining, documenting protocol risks like data leakage or missing baselines. Triggers on: 复核实验, run experiments, 实验结果, experiment evidence, verify results, 实验验证, evidence inventory, protocol risk, 跑实验, check results, reproduce experiments, 实验审计.

juspay Skill

Reviews pull requests in the hyperswitch-prism (UCS) Rust codebase using a strict, fail-closed, scenario-aware review system. Classifies PRs into connector, core-flow, proto, server, SDK, CI/security, and GRACE-generated scenarios, then dispatches specialist subagents per scenario. Use when reviewing any PR, batch-reviewing open GRACE PRs, or re-reviewing after author updates.

karanb192 Skill

CLAUDE.md compliance scorecard

zerodeng01 Bundle

Security review checklist for authentication, authorization, and sensitive data handling. Use when changing auth, MFA, secrets, input validation, or security-critical features. Not for general code review.

skillmedev Skill

Produces a risk-ranked list of untested critical paths and branches from a real branch-coverage report crossed with git churn, naming the specific missing cases and the smallest test that buys the most safety. Use when someone says "we have 85% coverage but I don't trust it", "what should we test next", "audit the suite before this release", or "which coverage gaps actually matter". Do NOT use to prove existing assertions are strong - covered-but-unasserted lines are mutation-test-runner's job; do NOT use to pin the current behavior of legacy code before a refactor - use characterization-test-writer instead. This skill decides what to test and in what order, not how well a test asserts or how to lock down legacy.

wheakerd Bundle

Review an Axiom-guided task's routing, scope, authorization, actions, evidence, stops, and outcome. Use when the user asks what Axiom did; why it selected, allowed, or refused something; or to audit, criticize, appeal, or narrow that decision. Do not use for ordinary summaries, code review, execution, or retry.

xirothedev Bundle

Highest-priority for all NestJS-related tasks involving API engineering. Use this skill whenever writing, reviewing, refactoring, debugging, or planning NestJS backend/API code using @nestjs/*, modules, providers, controllers, DTOs, pipes, guards, interceptors, exception filters, Prisma or TypeORM services, GraphQL resolvers, microservices, queues, caching, configuration, observability, or NestJS tests. Prefer this skill over generic Node.js or backend advice for NestJS code.

youkistudios Skill

Audit source-attributed Session Save records across Claude Code and Codex, grouped by project, into one local weekly report. Use when the user asks what happened this week, what remains open, or what to do next.

youkistudios Skill

Review source-attributed Session Save records across installed clients. Public lifecycle alias for session-audit.

yumaitau Skill

Use this skill when auditing a Laravel application for authorization gate and policy usage, especially requests like "find missing gates", "audit Gate::allows", "check @can permissions", "verify policies", or "find undefined abilities". It traces ability usage across controllers, models, Blade, Livewire, routes, jobs, tests, and middleware, then compares each usage against Gate::define declarations, policy methods, policy mappings, and before/after hooks to report missing or suspicious definitions.

naykel76 Skill

Use this skill whenever the user asks for a code review, package review, or architectural audit. Delivers severity-ranked findings with evidence and fixes, not general advice. Always saves the review as a markdown file and returns a concise summary in chat.

nexiouscaliver Skill

Use when reviewing a GitHub pull request (OmniForge). Dispatches 3 parallel adversarial agents for code, security, and process review with confidence-scored findings

nexiouscaliver Bundle

Use when reviewing a GitLab merge request (OmniForge). Dispatches 3 parallel adversarial agents for code, security, and process review with confidence-scored findings

oimiragieo Bundle

Compresses a git diff before review so noise (lockfile bumps, generated files, whitespace churn) doesn't crowd out the actual logic changes. Use this skill whenever the user asks you to review a pull request, explain a diff, summarize changes, or comment on recent commits. Trigger phrases include "review this PR", "what changed", "explain this diff", "summarize the changes", "look at my diff", "check this branch against main". Uses gotcontext's code-aware compression at fidelity=detailed — detailed because a character dropped in a security fix matters more than a character dropped in prose.

oimiragieo Bundle

Runs the Sol/Codex frozen-tip audit protocol for REVENG Wave closeout and honesty PRs (L47). Use when Sol or Codex must audit a closeout PR before merge, when writing or pinning a Sol verdict file, or when tempted to merge on self-PASS / amend after Sol / pin Sol to a parent SHA while HEAD moved.

onlinesourdough Skill

Validate PBIP/PBIR/TMDL edits or audit project structure, bindings, field references, rename cascades, and available native checks.

onlinesourdough Skill

Run a strictly read-only periodic audit of accumulated Agentic Power BI System repository or workspace health.

onlyterp Skill

Scan a diff, branch, or working tree for leaked secrets, API keys, tokens, private keys, and PII before commit. Blocks the operation on CRITICAL findings, warns on MEDIUM. Pairs with the pre_commit hook.

mo-hawary Bundle

Audit project docs for stale, duplicate, contradictory, or missing workflow artifacts before cleanup or handoff.

mo-hawary Bundle

Audit dependency CVEs across Node, Python, Flutter/Dart, and mixed repos; design OSV/native audit hooks for pre-push and CI.

prof18 Skill

Audit FeedFlow localization, store listing, live App Store/Play Store listing state, and screenshot-copy changes. Use when checking whether new app translations were added or completed, whether store copy/localized listings changed, whether live store metadata is stale, or whether screenshots need to be regenerated or uploaded.

rlespinasse Bundle

Migrates GitHub Actions workflows to use pinned commit SHAs instead of tags, resolves the latest release versions, flags major version jumps, and configures Dependabot with grouped updates. Use when user mentions pin actions, pinned versions, SHA pinning, GitHub Actions security, dependabot setup, or supply-chain security.