Security

vitoriarntrindade Skill

Perform a comprehensive backend security review of a source code repository, identifying vulnerabilities, insecure patterns, misconfigurations, and AI security risks. Use when asked to audit, review, pentest, or assess application security.

0xmassi Skill

Code review combining language strictness rules, security auditing, and performance analysis. Use when a user says /code-review or asks to review a branch, PR, or set of changes. Auto-detects languages and applies the relevant rule sets from typescript-strict, rust-strict, swift-strict, go-strict, javascript-strict, security-audit-standard, performance-audit-standard, and github-standards.

0xmassi Skill

Rust security, strictness, and vulnerability prevention rules. Use when writing, reviewing, or auditing Rust code. Complements rust-skills (179 general rules) with security-focused rules: unsafe audit, unwrap/expect bans, error handling hierarchy, secret handling, concurrency safety, input validation for Tauri commands, and release profile hardening. Derived from production Rust projects.

0xmassi Skill

Swift/SwiftUI strictness, clean code, and security rules. Use when writing, reviewing, or refactoring Swift code in iOS/macOS projects. Covers force unwrap prevention, @Observable vs ObservableObject patterns, access control, concurrency safety (@MainActor, actors, Sendable), error handling with typed enums, memory leak prevention, guard-first style, and naming conventions. Derived from production iOS apps.

0xmassi Skill

Performance audit methodology for codebases. Use when profiling applications, identifying bottlenecks, or optimizing hot paths. Covers Big O analysis, hot path identification, data structure optimization (Set/Map over Array), algorithm improvement patterns, async I/O fixes, connection pooling, caching strategies, and priority quick-wins matrix format. Derived from production performance optimization work.

akiselev Skill

Audit the altium-cli codebase (or a specified scope) against project rules from CLAUDE.md. Activate when the user requests a rules review, rules check, compliance audit, or codebase audit. Checks for: fail-fast violations, raw type usage, privacy leaks across crate boundaries, silent error suppression, unconsumed data skipping, missing domain types, and error handling correctness. Can target the full codebase, specific crates, files, or git changes.

hraness Bundle

Create or evolve a durable Markdown plan inside a hraness/kb vault. Use when a user asks for an implementation plan, proposal, RFC, migration plan, execution audit, phased checklist, or an update to an existing plan's decisions, progress, review findings, verification evidence, or final result.

nateherkai Bundle

Use when someone asks to audit their AIOS, score the Four Cs, find stale paths or unlinked projects, compare AGENTS.md and CLAUDE.md, check Claude/Codex skill compatibility, or assess migration readiness. Automatically saves dated reports and tracks evidence-backed improvements across runs.

nateherkai Bundle

Use when someone asks to level up their AIOS, close an audit gap, find what to automate next, or improve one workflow. Walks the 3Ms from choosing the constraint to shipping one useful artifact or verified repair.

schneidenbach Bundle

Review code changes for bugs, security issues, and code quality using OpenAI Codex CLI as an external adversarial reviewer. Use from any agent or provider when the user asks for a code review, wants to check code for bugs or security issues, asks to review a PR, branch, commit, or diff, or says things like "any issues with this?", "review before I push", "check my changes", "look at what I changed", or "review my PR". Tell Codex where to find the code.

schneidenbach Bundle

Review code changes for bugs, security issues, and code quality using Claude Code CLI as an external adversarial reviewer. Use from any agent or provider when the user asks for a code review, wants to check code for bugs or security issues, asks to review a PR, branch, commit, or diff, or says things like "any issues with this?", "review before I push", "check my changes", "look at what I changed", or "review my PR". Tell Claude where to find the code.

muhammedzohaib Skill

Perform a defensive review of authentication and authorization flows in an authorized codebase. Use for login, session, MFA, OAuth, password reset, cookie security, JWT validation, impersonation, privilege checks, and object-level access control.

muhammedzohaib Skill

Review an authorized pull request diff for security regressions. Use when changes modify trust boundaries, auth logic, data-access scope, file handling, logging, headers, or secrets.

muhammedzohaib Skill

Conduct authorized defensive security audits of codebases and web applications. Use for broad appsec review across OWASP, authz, business logic, SSRF, XSS, CSRF, injection, file upload, secrets, logging, and tenant isolation. Produces structured findings with severity, confidence, evidence, and safe remediation guidance.

thecolliery Skill

Docs-health audience-safety scan — PROSE-level sensitive content in a doc meant to be public: internal URLs/hostnames/paths, personal data (names, emails, phone numbers in examples or logs), unpublished plans or roadmaps, private figures (pricing, customers), anything whose audience boundary the doc crosses. Catches LEAKED docs. Explicitly NOT a secret scanner: token-shaped secrets (API keys, passwords, private keys) are gitleaks' job — this canary hunts the sensitive PROSE that token scanners and gitignore both miss. Triggers on: "/doc-leak", "doc-leak", "is this safe to publish", "leak check", "anything private in this doc". Semantic, conservative by design: EVERY finding is SUSPECTED — public-vs-private is the human's judgment, never the tool's. Config-gated via `docLeak` (`.coalledger.json`, global + project merge; default on; a private-only project turns it off).

amkisko Bundle

Inventory and verify checkable claims, quotations, dates, statistics, research summaries, causal statements, and citations in docs or prose. Use for factual review, source audits, citation checks, or verification when text relies on external events, scholarship, technical behavior, law, policy, or other verifiable assertions.

amkisko Bundle

Select, alter, and audit third-party dependencies with advisory scans, target-scoped vulnerability assessments, and deep recon/OSINT. Use when adding, replacing, or removing packages; when asked to audit, review, or harden dependency graphs, lockfiles, or manifests; or when ordinary work surfaces suspicious package behavior, an advisory, a scanner match, or a plausible vulnerability or exploitation signal involving a package. Includes freshness lag (libyears or equivalent).

amkisko Bundle

Triage live service evidence from alerts, error groups, monitors, traces, profiles, metrics, logs, probes, deployment changes, and user reports. Use to establish observed impact, test reliability and security hypotheses such as resource exhaustion or abuse, correlate the minimum useful evidence, record confidence and gaps, and route confirmed work. Do not use to install telemetry, redesign monitoring, conduct a full engineering or vulnerability audit, or mutate production.

whenpoem Skill

Audit a past pruning or approval decision by creating a counterfactual branch from a saved snapshot without mutating the live graph. Use when the user asks what would have happened under another decision, disputes a paused branch, or wants to inspect an earlier checkpoint.

whenpoem Bundle

Build and audit a statistical or mathematical proof from proposition capture through skeleton selection, diagnosis, correction, optional empirical checking, and optional Lean reinsurance. Use when the user asks to prove or rigorously derive a proposition, a graph proposition lacks a verified proof, or a reviewer requires a theorem-side gate.

vinhnx Skill

Perform comprehensive codebase analysis and generate reports (usage: /analyze [full|security|performance])

vixues Skill

Review procurement contracts and purchase packages against uploaded compliance rules (招标/采购制度). Use for 采购审核, contract compliance checklists, or procurement statistics rollups.

vixues Skill

Audit travel / 差旅报销 claims against uploaded policy handbooks and rate tables (lodging caps, transport, per diem). Use for 差旅费审核, travel expense review, or lodging over-limit checks.

wellwelwel Skill

Author a new built-in Lagune sub-skill inside the Lagune source, not a scaffolded `.lagune/` target. Use when adding or refining a security knowledge module that ships with Lagune, against the native layout (`spec/skills/*.md` plus the catalog).

skillmedev Skill

Builds a 4-week multi-platform posting calendar for a brand or social team, balancing content pillars, per-channel cadence, and real key dates into a week-by-week grid. Use when the user asks to plan, build, or audit a social content calendar or posting schedule across multiple channels (LinkedIn, X, Instagram, TikTok, YouTube Shorts), assign content pillars and ratios, or map a month of posts to launches and events. Do NOT use when planning a solo creator's single-channel video or podcast cadence and theme rotation - use creator-content-calendar instead.

exiao Bundle

Score a skill against best practices and output a scorecard with fixes. Use for audit this skill, review this skill, skill health check, check for drift.

exiao Bundle

Score an AGENTS.md, CLAUDE.md, or .cursorrules for how Hermes loads it. Use for audit my AGENTS.md or why isn't it being followed. For SKILL.md use skill-audit.

githits-com Bundle

Use whenever invoking the GitHits CLI for public OSS source, documentation, or example evidence, including code search/grep, file navigation, source verification, docs lookup, or canonical cross-project examples. For GitHits CLI package, dependency, security, release, or upgrade evidence, use githits-package.

gwolf2025 Skill

DEMONSTRATION ONLY — Not intended for production use. Rotates secrets stored in environment variables.

rcarmo Skill

Project conventions with module caching, linting, security checks, and tests via Make

kkenny0 Bundle

Execution reliability expert. ALWAYS invoke this skill after any coding skill completes its work. Do not accept completed work without running this guard first. Use this skill to audit step execution and catch silent omissions.

kkenny0 Bundle

Use after implementation is complete. Triggers after /taku-build. Analyzes diffs for security issues, bugs, and code quality. Run when asked to "review this", "check my diff", "code review", "审查代码", "看看有什么问题", "检查一下", "准备合并", "代码质量", or before shipping. Proactively invoke when the user is about to merge or land code changes.

skillmedev Skill

Answers RFPs and security questionnaires with discipline - a go/no-go score before any writing (win probability times deal size against effort, under 30 percent win chance means decline), a compliance matrix mapping every requirement to a response, answer-library reuse, and win themes threaded through every section. Use when a user says "we got an RFP, help us respond", "should we even bid on this RFP", "build a compliance matrix for this RFP", "answer this security questionnaire", or "our RFP responses take weeks and we keep losing". Do NOT use for proactive proposals sent without a formal solicitation - use sales-proposal-writer instead.

akillness Bundle

PR triage: audit open PRs, deep review selected ones, draft and post review comments. Args: "all" to review all, PR numbers to focus (e.g. "42 57"), "en"/"fr" for language, no arg = audit only in French.

akillness Bundle

Issue triage: audit open issues, categorize, detect duplicates, cross-ref PRs, risk assessment, post comments. Args: "all" for deep analysis of all, issue numbers to focus (e.g. "42 57"), "en"/"fr" for language, no arg = audit only in French.

automattic Skill

Provide advisory guidance for scanning Automattic/wp-calypso Dependabot alerts and Dependabot remediation PRs using the public dependency security alerts playbook.