Security

helloggx Skill

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

helloggx Skill

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.

paldom Bundle

Audits a GitHub repository against a professional open-source checklist - README quality, metadata, community files, intake templates, protections, activity - and returns a scored gap report with prioritized fixes. Use when the user asks to audit, health-check or score their repo, whether the project is ready for outside contributors, or what is missing before going public. Not for fixing a single named file or code-level security audits.

paldom Bundle

Creates or completes GitHub community health files - CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, SUPPORT, GOVERNANCE, FUNDING.yml, CODEOWNERS, LICENSE - tailored to the repo, not boilerplate. Use when the user asks for these files, contributing guidelines, a code of conduct, whether to require a CLA or DCO, or to complete the community profile. Not for issue/PR templates or enabling security settings like scanning and rulesets.

paldom Bundle

Configures GitHub repository protections - rulesets (require PR, required checks, no force pushes), secret scanning and push protection, Dependabot, private vulnerability reporting, and Actions hardening. Use when the user asks to protect a branch, restrict who can merge to main, set up rulesets, enable security features, or harden a repo. Not for writing SECURITY.md or fixing code vulnerabilities.

paldom Bundle

Hardens the npm supply chain - lockfile discipline, Dependabot cooldown and groups, per-package-manager install-script policy, provenance verification, npm token hygiene, SHA-pinned Actions. Use when the user asks to secure dependencies, audit npm packages, respond to a compromised dependency, or pin actions. Not for repo settings like rulesets/secret scanning, or publishing.

abdul977 Skill

Agentic orchestrator for producing premium motion-graphics ads end-to-end with a fleet of specialist subagents and a MANDATORY self-QC loop. Use when the user wants to "create a video / motion ad" in the video-ad workspace and expects it built, reviewed frame-by-frame, and fixed automatically before hand-off. Spins up an orchestrator + concept + per-scene builder + keyer/compositor + parallel frame-audit QC + critical-creative reviewer + verifier agents, then loops fixes until the render is clean. Wraps the kinetic-motion-ad build skill with orchestration + verification.

eagerworks Bundle

Reviews a branch, PR, staged, or working-tree diff for correctness, security, repo-convention, test-coverage, and documentation gaps, returning severity-rated findings without editing code. Use when asked to "review my branch/PR", "is this ready to merge", "check this diff before I push", "does this need an ADR", or to apply fixes for findings from a previous review round. When the target is a GitHub PR, the same report is also posted to the PR — as inline comments on each finding's line plus a summary, by default — so the whole team can read it.

eagerworks Bundle

Designs and reviews REST APIs: resource naming, HTTP methods and status codes, payload and error formats, pagination, versioning, auth, rate limiting, and OpenAPI specs. Use when adding or renaming an endpoint, asked "is this endpoint RESTful", "what status code should I return", "design the API for X", or to audit an existing API for consistency or security (IDOR, mass assignment).

grade-ai-labs Bundle

Build and maintain project-specific review policy for `agentic-review` by combining repository docs (`AGENTS.md`, `ENGINEERING.md`, `CONTEXT.md`/`CONTEXT-MAP.md`, ADRs), repository-mined conventions, and structured user input, then writing machine-usable policy files under `<docs-dir>/review/policies/`, including audit-governance metadata consumed by `agentic-review`. Use when the user wants architecture integrity checks (onion/clean/hexagonal), module-specific review rules, dependency-direction policy, naming/inheritance convention enforcement, stricter project/domain review standards, or explicit auditability requirements for specialist review coverage.

security-phoenix-demo Bundle

Search for threat intelligence, CVEs, malware analysis, breach reports, and security research across 300+ curated security domains (BleepingComputer, Hacker News, Krebs, Unit42, Talos, CISA, Mandiant, Rapid7, Securelist, etc.). Use this skill whenever the user asks to: research a CVE or vulnerability, find what security vendors are saying about a threat actor or malware family, search security blogs, look up threat intelligence on a topic, find recent breach or ransomware reports, collect CTI for a MITRE technique, or push research into NotebookLM. Triggers for phrases like "search security sources", "find threat intel on X", "what are vendors saying about Y", "research CVE-XXXX", "look up malware Z", "collect CTI", "push to NotebookLM", or any domain-scoped web research request in a security context.

security-phoenix-demo Bundle

Use when the user wants to create opengrep/semgrep SAST rules, detect vulnerabilities in code, generate security scanning rules from CVEs or vulnerability descriptions, or asks about writing pattern-matching or taint-analysis rules for static analysis.

security-phoenix-demo Skill

0-Day Vulnerability Scanner Skill

security-phoenix-demo Skill

Comprehensive Security Assessment Skill

undertone0809 Bundle

Use when the user asks for Claude Code /insights-like reporting for Codex, wants to analyze recent Codex sessions, audit usage patterns, find repeated workflows, identify friction points, or decide which skills/automations should be created or improved from local Codex history. This skill builds evidence-backed reports from local Codex session files instead of guessing from memory.

pablo-lozano-gil Skill

Python Security Best Practices

percival-labs Bundle

Audit and compliance workflows for enterprise governance. USE WHEN audit OR compliance OR export OR soc2 OR eu ai act OR nist OR governance report OR audit trail.

postmodum37 Bundle

Smart router for all WoW questions — routes to the right data source automatically. Use for any general WoW question that could involve multiple data sources, for full character audits, or when the user says "check me", "audit my character", "wow check", or asks a broad WoW question without specifying a data source. Also catches questions that could go to raiderio, archon, murlok, sim, or warcraftlogs when the user doesn't invoke a specific skill. Think of this as the "I have a WoW question" catch-all.

rileycornelius Skill

Review code changes for correctness, regressions, security, maintainability, test coverage, and production readiness. Use when asked to review a PR, audit a diff, look for bugs or risks, assess merge readiness, or do a final pass after a substantial implementation.

rockarhymellc Skill

Performs thorough code review on git changes. Analyzes diffs for bugs, security issues, performance problems, and design concerns. Produces actionable feedback organized by severity. Use when reviewing code, checking a PR, or when the user says /smart-review.

sagargupta16 Skill

Use when setting up a new repo, auditing an existing one for hygiene issues, or before publishing a project. Covers .gitignore, .env.example, README, LICENSE, CONTRIBUTING, and detecting committed secrets.

sagargupta16 Skill

Use when making git operations, handling secrets, committing code, or dealing with credentials. Enforces git safety rules (no force-push to main, no amend of published commits), secret-handling discipline (never commit .env, use .env.example), and destructive-command caution.

sagargupta16 Skill

Use when reviewing code changes, examining PRs, or checking your own work before submitting. Covers what to look for (correctness, security, performance, style), how to review systematically, and how to give actionable feedback.

sean-michael Bundle

Autonomous unattended workflow with three modes. PLAN: decompose work into a risk-tagged task list agents can execute without you. RUN: headless loop that executes safe tasks, writes scratchpads, produces a DIGEST. AUDIT LOOP: auditor scores the codebase against a spec, executor implements findings, repeats until score threshold is met or a blocker is hit. Trigger on "queue up work", "night shift", "burn usage while I'm away", "audit and fix until done", "grind on this until it passes", or any unattended autonomous execution request.

sean-michael Skill

Audit Python source code for missing or incomplete docstrings and fill them in. Trigger when the user says "add docstrings", "document this", "write docs for this", or "check my docstrings". Do NOT trigger for routine Python code writing — pattern recognition from existing code handles that. This skill is for a deliberate documentation pass over code the user is satisfied with.

serhiikorniienko Bundle

Fact-check and hype-audit content. Extracts the discrete claims from a video, article, tweet, or PDF, verifies each against independent sources via web search, and produces a report card with per-claim verdicts and an overall BS score (0-10). Use when the user asks to fact-check, verify, debunk, or evaluate credibility — "is this true/legit/bullshit", "check this video", "how much of this holds up".

skillmedev Skill

Runs a timeboxed weekly review - empty every inbox to a decision, audit every open commitment, and pick the 3-5 outcomes that define next week. Use when someone asks "walk me through a weekly review", "help me plan my week", "my task system feels stale and I don't trust it", or "I keep dropping commitments". Do NOT use for setting up the underlying capture-and-organize system itself - use gtd-system instead - or for tracking long-horizon personal goals with an accountability loop - use goals-accountability instead.

skillmedev Skill

Audits third-party dependencies for exploitable CVEs, abandonment, license exposure, and supply-chain hygiene, and delivers a ranked findings report with a remediation order. Use when someone asks "is this package safe to add", "audit our dependencies", "npm audit is screaming, what actually matters", "can we use this GPL library", or is preparing a security review or vendor questionnaire. Do NOT use for triaging vulnerabilities in first-party code or a full CVE queue - use vulnerability-triage instead; for reviewing the code you wrote for security flaws - use secure-code-review instead; for how secrets are stored and rotated - use secrets-hygiene instead; for assembling compliance evidence - use soc2-evidence-helper instead.

viryazheng Bundle

Scans a merchant website and produces a UCP readiness report. Checks for existing structured data, payment providers, platform type, and /.well-known/ucp presence. Outputs a scored diagnostic with actionable fix list. Use when a merchant wants to know how ready they are for AI commerce integration.

viryazheng Bundle

Generates a /.well-known/ucp business profile JSON from explicit merchant inputs such as domain, business name, payment provider, transport, and capability list. Use after ucp-audit to create a deployment-ready draft.

shkarupa-alex Bundle

Apply repository-grounded senior engineering judgment to substantial Python work and bounded Python changes with production or cross-boundary risk. Do not use for trivial syntax questions, generic tutoring, or tasks with no Python artifact unless explicitly invoked. Use for writing, review, diagnosis, design, refactoring, or maintenance where correctness, state, effects, concurrency, compatibility, security, reuse, testing, or long-term ownership materially matters.

silvioventre Bundle

Perform a two-phase codebase rationalization on a Lovable project — a comprehensive read-only audit to find dead code, unused code, obsolete dependencies, duplicated implementations, and maintainability risks, followed by a strictly-scoped, approval-gated cleanup of only the batches the user explicitly approves. Use this skill whenever the user asks to "audit the codebase," "find dead/unused code," "clean up the project," "reduce technical debt," "find unused dependencies," references an approved audit batch (e.g. "implement Batch 2"), or asks for a codebase health check, even if they don't use these exact words. Do not skip straight to editing code when this skill applies — always determine which phase (Audit or Cleanup) the request belongs to before acting.

anyproto Skill

Audit SCSS and TSX files for dark mode issues — missing variable usage, hardcoded colors, icon gaps, selector misuse, and inline dark overrides outside the theme folder

anyproto Skill

Perform comprehensive code reviews for TypeScript projects, analyzing type safety, best practices, performance, security, and code quality with actionable feedback

auraimage Bundle

AuraImage Secret Key Setup

automattic Skill

Scan a site for AI-slop defaults and replace them with premium patterns. Detects generic giveaways (Inter everywhere,