Security

0xdarkmatter Skill

Given the parcels belonging to a wave, compute merge order and gate status by combining parcel-roster inventory, parcel-reader claims, and parcel-audit verdicts against the wave's plan document. Surfaces: ready-to-merge, blocked, at-risk, and the next recommended merge. Triggers on: wave triage, wave status, what merges next, gate status, which parcels are blocked, wave readiness, merge order, wave plan.

0xdarkmatter Skill

Parse a parcel's PARCEL_DONE.md into structured sections (summary, what-built, contracts-honoured, deviations, open-questions, verification-results, affected-trees) without reformatting the body. Read-only utility used by parcel-audit and wave-triage. Triggers on: read PARCEL_DONE, parse parcel done, what did this parcel deliver, extract parcel report, parcel completion summary, fleet parcel report.

0xdarkmatter Skill

Inventory active parcel worktrees under the configured worktrees root and emit a table per parcel: branch, commits ahead/behind main, PARCEL_DONE presence, audit presence, last commit. The parcel analogue of lane-roster. Triggers on: parcel roster, which parcels, parcel status, list parcels, what parcels exist, parcels overview, parcel fleet, parcel inventory.

q00 Bundle

Review an existing Seed for blind spots, ask two blind-spot questions, and apply only user-approved changes to create the next Seed. The latest Seed replaces the top-level ## Seed section in .symposium/scratch/socrates.md; audit history is appended to .symposium/scratch/evolve-step.md. Triggers (EN): evolve-step, evolve seed, seed blind spots, seed v1 v2, review blind spots Do NOT use when: creating the first Seed from a vague request (-> socrates), running convergence through ontology (-> interview-harness), or only defining semantic boundary (-> ontology) vs socrates: Socrates creates Seed v1; Evolve-step turns an existing Seed into a user-approved next Seed.

r-jelly Bundle

Audit Chronicle project, STAR, and resume claims for evidence quality, ownership, consistency, stale assertions, sensitive information, and unsupported metrics. Use when preparing to write or publish career materials, reviewing captured project records, checking a potentially exaggerated claim, or deciding what evidence must be recovered.

redis Bundle

Analyze master branch implementation and configuration to find missing, incorrect, or outdated documentation in docs/, README.md, and per-package READMEs. Use when asked to audit doc coverage, sync docs with code, or propose doc updates/structure changes. Provide a report and ask for approval before editing docs.

ccch1mneyyy Skill

Audit the repository or a broad subsystem for security, correctness, and maintainability risks. Use for audit requests or /audit; use review for a specific change and vuln-check for a security-only assessment.

ccch1mneyyy Bundle

Review or de-slop concrete changes in ccch1mneyyy/dsh-TUI at maintainer level: PR numbers or URLs, branches, commit ranges, patch files, staged or unstaged worktrees, and scoped repository-hygiene requests. Use for evidence-first correctness, contract, repository-rule, process, and behavior-preserving cleanup review, including debug residue, dead or duplicate code, speculative abstractions, stale comments or tests, and unrelated diff churn. Do not use for abstract designs with no concrete repository artifact; use audit for repository-wide assessments and vuln-check for security-only checks.

ccch1mneyyy Skill

Check resolved dependencies and relevant code paths for security vulnerabilities. Use for security checks or /vuln-check; use audit for a broader correctness and maintainability assessment.

ch4570 Bundle

Diagnose generic, cluttered, or AI-looking product UI through read-only evidence and prioritized findings. Use when asked to audit or critique a screen before editing; identify task friction, hierarchy problems, and misleading states without redesigning or changing code.

clownware Skill

Reverse-pass UX audit of an existing product: extract problem, personas, journeys, and value props from its repository, validate with the owner, and produce a prioritized optimization spec. Entry point for products built without formal UX artifacts.

cognitedata Skill

Validate CDF resource identifiers against naming conventions — for a single file, resource type, or small set of identifiers. Use for quick spot-checks: "does this externalId look right?", "check naming in this file", "is this identifier valid?", "validate this resource name". For a full project sweep across all domains (data modeling, transformations, functions, workflows, DMS queries) use `cog-vd-audit` instead.

comet-ml Skill

Audit the Makefile against the tooling actually installed (ruff, pytest, mypy, etc.) and the scripts under src/<module>/, then propose missing targets or fix stale ones. Use when adding a new tool or script that should be invokable via make. Preserves user-added custom targets.

contentstack Skill

Use when reviewing PRs for contentstack-marketplace-sdk—API, bundles, tests, and npm publish impact.

cyranob Bundle

Audit a full article for factual accuracy, missing counter-voices, numerical context, and promotional or one-sided framing. Use when a user shares an article or URL and asks whether it is accurate, credible, balanced, or PR.

hathach Bundle

Enumerate, download, and import vendor hardware documentation — datasheets, reference manuals, errata, programming/user manuals, application notes — into the Calibre library at ~/Documents/calibre-library, and refresh local copies when the vendor has published a newer revision. Use this whenever the user wants a datasheet or reference manual for a chip, asks to update/check/audit their documentation library, mentions ST/STM32 or NXP/i.MX/LPC/Kinetis/MCX documents, or wants to bulk-fetch a vendor's docs — even if they never say "Calibre".

hoangvantuan Bundle

Người dọn dẹp hệ thống knowhow: rà soát, dọn, và sửa cấu trúc cho kho .knowhow/. Dùng khi user muốn tìm và sửa vấn đề trong kho (link hỏng, page mồ côi, thiếu metadata, trùng wiki, lệch schema), sinh lại index/registry sau khi thêm nội dung, khôi phục page từ archive, hoặc đo kho có đang được dùng không. Trigger: 'knowhow lint', 'kiểm tra knowhow', 'rà soát kho', 'audit kho', 'dọn dẹp kho', 'rebuild index', gộp wiki (consolidation), kiểm tra mâu thuẫn, deep audit, metrics. KHÔNG dùng cho: linter code (eslint/pylint), review PR, audit file chung, hay thêm/sửa NỘI DUNG tri thức (đó là knowhow-capture/knowhow-distill).

idaholab Bundle

Audit a prepared MOOSE branch for applicable AGENTS.md instructions, MOOSE contribution standards, tests, documentation, and PR readiness; draft and, only after explicit approval, push the branch and open a draft GitHub pull request against next. Use when someone asks to create, open, prepare, or submit a MOOSE PR. Do not use this to review someone else's PR or to address feedback on an existing PR.

idaholab Bundle

Review a MOOSE pull request or local branch against MOOSE's contribution standards: applicable AGENTS.md guidance, the MOOSE Code Standard (SCS), the SQA testing rules (every test is a requirement, with requirement/design/issues), required documentation stub pages for new objects, and PR governance (issue references, scope, required-vs-suggested phrasing). Use this whenever someone wants to review MOOSE changes or asks "review this PR", "review my branch", "is this ready to merge", "check my changes before I submit", or wants pre-submission feedback on code in the MOOSE framework or its modules - even if they never say the word "review". This is the MOOSE-aware review layer; it complements the generic /code-review and /security-review skills and defers to them for deep correctness and security analysis rather than duplicating that work.

duolahypercho Bundle

Maintain or assess a large, mature repository when a proposed or existing change may cross modules, platforms, clients, installers, configuration, security boundaries, tests, or documentation. Use for incoming-change adoption decisions, consequential bug fixes, refactors, dependency upgrades, compatibility work, maintenance audits, and release preparation. Do not use for factual questions or obviously isolated trivial edits.

dwani-ai Skill

Incident-style handoff brief from structured per-chunk scene, events, security, and logistics JSON.

dwani-ai Skill

Cross-industry operations compliance read from chunk-level scene, security, logistics, and attendance JSON.

eunomia-bpf Skill

Triage open-source GitHub issues, maintainer inbox items, and the user's own outbound PRs to external repositories. Use when classifying issues, drafting maintainer replies, deciding labels/priority/milestones, requesting reproduction details, finding duplicates, deciding close/reopen/escalate, separating bug, feature, support, docs, and security reports, or checking whether the user's PRs to other projects have unanswered maintainer feedback. Do not use when the user asks to implement the fix, prepare a release, or debug CI.

eunomia-bpf Skill

Audit or prepare an open-source release. Use when checking whether a repo is ready to tag, publish, cut a GitHub release, update changelog/release notes, bump versions, publish packages, document breaking changes, or verify release smoke tests and provenance. Do not use for ordinary feature/bug implementation, issue triage, or paper prose review.

ezzatmakar Bundle

Reviews your local uncommitted changes before you push, in any language or framework (auto-detected), and scores Security, Performance, and Clean Code as Pass/Warn/Fail with an overall push-readiness recommendation. Use before pushing or committing — "check my changes before I push", "review my local diff", "is this safe to push?" — to get one Markdown report with evidence, impact, fixes, verification, references, and a per-measurement scorecard. Supports Quick, Standard, and Deep review modes. Do not use for feature implementation unless the user separately asks for fixes.

ezzatmakar Bundle

Reviews pull requests, merge requests, branch changes, and code diffs for Laravel and PHP applications (Laravel 9–12, PHP 8.0–8.4). Use when asked to review a PR or changed code for security, performance, and clean-code quality, then create one detailed Markdown report containing evidence, impact, rationale, recommendations, validation results, references, and a merge verdict. Supports Quick, Standard, and Deep review modes and can optionally post findings as inline PR comments. Do not use for feature implementation unless the user separately asks for fixes.

iusztinpaul Bundle

Health-check a research directory produced by /research. Runs seven checks — orphan sources, missing entity/concept hubs, missing comparison candidates, broken wikilinks, stale claims, contradictions, and open-question synthesis. Outputs a report; edits where safe (broken-link flags, open-question append, contradiction surfacing); flags-only otherwise. Always user-triggered, never automated. Trigger when the user says things like "lint my research", "health check my research", "check the wiki", "audit my research dir", "what's wrong with my wiki", "find orphans / contradictions / stale claims".

ivuorinen Skill

Routes audit requests to the right /nitpicker command. Use when the user wants to run one of the hostile audit commands in this repo, or asks what audit commands are available.

ivuorinen Skill

Scaffolds a new nitpicker audit command through the full RED → GREEN → REFACTOR → adversarial-review → validate cycle, wiring its command file, dispatch-table row, and docs together. Use when adding a new /nitpicker command to this repository, or when asked to create, scaffold, or add an audit command here.

jakerains Bundle

Audit and enable security-oriented Xcode build settings. Progressively enables compiler warnings, static analyzer checkers, and Enhanced Security features. Use when: user wants to secure their Xcode project, audit security settings, enable hardening, review security posture of build configuration, set up security-focused static analysis, enable static analysis, improve warning coverage, harden diagnostics, or catch more bugs at compile time in C/C++/Objective-C/Swift. SKIP: network security (TLS/ATS), code signing, privacy APIs.

jcosta33 Skill

Audit present code against direct evidence. Use when running debt surveys, cleanup assessments, single-implementation benchmarks, current-state quality assessments, or fresh passes over prior audits without a governing spec or task. Do not use for conformance review, rotating adversarial review, or option research.

jeremieb Skill

Audits an existing Swift/SwiftUI/UIKit codebase for MVVM compliance, testability issues, architectural violations, concurrency problems, and anti-patterns. Use when user says "audit the codebase", "review the architecture", "why is this hard to test", "onboard to this project", "analyze the code structure", "find issues in the code", or "what needs refactoring".

jeromwolf Skill

Generate refactoring checklists — performance optimization, security audit, and database migration guides. Actionable step-by-step guides with verification commands.

jessedegans Skill

Use when reviewing code for security vulnerabilities, before shipping to production, or when the user asks for a security audit. Runs OWASP Top 10 + STRIDE analysis with a strict false positive filter. Confidence gate at 8/10. No theoretical hand-waving.

jiayaoqijia Skill

Generate a minimal security patch for a specific vulnerability finding. Produces a .patch file with the smallest code change needed to remediate the issue without altering unrelated logic.

jiayaoqijia Skill

Run a comprehensive security scan on a codebase using available security scanners (Semgrep, Bandit, Trivy, osv-scanner). Returns structured findings with severity, file location, and OWASP mapping.