Security

lkc-studio Bundle

This skill should be used when code handles money — when the user says "is my money handling correct", "float rounding bug", "the totals are off by a cent", "should I use Decimal", "check my billing/pricing/payment code", "audit financial calculations", or is about to write code that computes prices, totals, tax, balances, or currency. Finds every place money is computed in floating point, where rounding error silently compounds.

dylanmoo Skill

Simple end-of-session audit that scans for uncaptured corrections, preferences, and decisions, then proposes saving them to the right workspace file. Use this skill whenever you say 'audit this session,' 'session audit,' 'what did we miss,' or 'end of session check.' Works with any Cowork workspace that has a CLAUDE.md and MEMORY.md in the root folder.

dylanmoo Skill

Audits a WorkOS workspace for drift — misplaced entries, size-ceiling violations, archive candidates, format violations, and engagement-specific content that should cascade to a project. Use when the user says 'workspace audit,' 'audit my workspace,' 'check my CLAUDE.md,' 'check my MEMORY.md,' 'is my workspace healthy,' or when periodically maintaining a WorkOS-style workspace. Distinct from session-audit, which only captures new learnings from the current conversation — this skill audits the workspace files themselves.

elastic Bundle

Triage Elastic Security alerts — fetch, investigate, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, investigating detections, reviewing security incidents, or when the user mentions ransomware, malware, lateral movement, credential theft, DLL injection, suspicious processes, or any specific threat. Also trigger for "show me alerts", "what's happening on host X", "any critical alerts", or any security operations question.

elastic Skill

Create, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or search cases. Trigger for: "show me my cases", "open cases", "list cases", "any open cases", "create a case", "case for this alert", "show me case 42", "incident tracking", "investigation status", or any case-related question.

elastic Skill

Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.

elastic Skill

Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".

enigmatry Skill

Full Angular 22 / TypeScript 6 / ES2022 coding standards for this workspace — async handling, DI, standalone migration, type system, error handling, security, performance, and documentation rules. The high-traffic rules are already in CLAUDE.md; load this skill when you need the complete reference, are writing a non-trivial amount of new TypeScript, or are unsure whether a pattern is allowed.

enw Skill

Four-phase decision-making framework with audit trail: What's up? → What's really up? → Approaches → Let's go. Use when the user invokes /wazzap, /wazzap:up, /wazzap:real, /wazzap:approaches, /wazzap:go, /wazzap:list, /wazzap:resume, or describes a fuzzy decision/problem they want to think through with traceable reasoning.

enzed Bundle

Review and challenge spec documents against the project's codebase, best practices, and guidelines. Spawns a team of parallel agents to analyze consistency, code reuse, performance, scope, and testability. Use when the user says "challenge", "review spec", "check spec", "audit spec", or asks to validate a spec file against the codebase. Triggers on spec file paths (e.g., specs/037-hover-brackets-info.md).

epam Skill

Use when the user asks to enhance, refine, polish, or "look at" the release notes for a tag — a fresh CI-generated pre-release (e.g. `0.13.0-rc.0`) or a stable cut. Reads the auto-generated notes off the GitHub release, tidies inconsistent phrasing and issue references, folds duplicate/hotfix entries, reclassifies misfiled security bumps, builds a `Deployment Changes` section from `README.md`'s Environment Variables table, and saves a draft to `claude/release-notes/`. Never edits GitHub directly.

ajwadrana Skill

iOS UX design guidance for building premium SwiftUI interfaces. Triggers on: iOS UI/UX, layout, components, screen design, Liquid Glass, SwiftUI design, app design review, UI audit, view hierarchy, iOS design patterns.

akuity Bundle

Use when a GitHub security advisory (GHSA) has been reported against Kargo and needs to be verified, scored, and redrafted for publication

amineorion Bundle

Audit a multi-tenant codebase for queries, caches, jobs, or searches that are missing a tenant filter — the missed WHERE tenant_id that becomes a cross-tenant data leak. Use whenever the user works on a multi-tenant SaaS, asks to check tenant isolation, reviews data-access code, or mentions tenant scoping, RLS, or data leaks.

amrtawfik160 Bundle

Clean a codebase in fresh BB workers using Matt Pocock's code-first documentation approach: audit or prune redundant docs, slim AGENTS.md and CLAUDE.md, preserve decisions and domain knowledge, and make code easier for agents to navigate. Use for an explicit code-first cleanup request, not routine feature work.

antgroup Bundle

当用户需要编写、重构或修改 JavaScript/TypeScript 代码时，必须激活本技能。激活后，先执行威胁分析，再查阅对应安全规范文档，最后生成符合安全编码标准的代码，确保不引入已知安全漏洞。

antgroup Skill

在整个编码任务完成后（所有文件修改均已完成、即将结束本次回复时），必须主动调用此技能执行一次安全审查。 满足以下任意一条时必须激活： (1) 完成了代码新增、功能实现、bug 修复或重构，即将输出最终回复； (2) 使用了 Write/Edit/NotebookEdit 等工具修改了源代码文件。 不要在每次写入单个文件后调用，整个任务的最后一步调用一次。 不要在仅回答问题、阅读文件、执行 git 操作时激活。 此技能是代码交付前的最后一道安全防线，聚焦于发现并修复本次任务引入的安全漏洞。

antgroup Bundle

当用户需要编写或修改 Web 后端代码时，应当使用此技能。包括但不限于： "写个接口"、"新增 API"、"实现登录功能"、"添加用户查询"、"文件上传接口"、 "数据库查询"、"调用第三方 API"、"写个 Controller"、"REST 接口开发"、 "添加权限校验"、"数据导出功能"。 即使用户没有提到"安全"或"漏洞"，只要涉及 Web 接口、数据访问、用户输入处理、 外部资源调用等场景，都应触发此技能。

antgroup Bundle

当用户需要编写、重构或修改 C/C++ 代码时，应当使用此技能。包括但不限于： "写一个 C 函数"、"帮我实现一个 C++ 类"、"重构这段 C 代码"、"修复这个 C++ bug"、 "优化这段内存操作"、"添加一个网络包解析函数"、"实现文件读取功能"、"使用 memcpy/malloc"、 "处理用户输入"、"多线程同步"、 "智能指针"、"管理动态内存"。 即使用户没有明确提到"安全"或"漏洞"，只要涉及 C/C++ 代码编写或修改，都应触发此技能。

apache Skill

<!---

apache Bundle

Apply Apache ShardingSphere's written coding standards when explicitly requested, or when code-implementation routes task-changed production, test, script, build, generated, or Maven POM artifacts through repository standards. Also perform a standalone read-only compliance audit of a user-specified scope. Use CODE_OF_CONDUCT.md, applicable AGENTS.md rules, Checkstyle, Spotless, and other repository-defined standards, including naming and evidence-based defensive-code rules. Do not invoke independently for an ordinary implementation already governed by code-implementation, and do not independently audit architecture, runtime ownership, caches, or lifecycle.

arova-ai Bundle

Diagnose and analyze self-hosted email server configurations. Checks DNS records (MX, SPF, DKIM, DMARC, MTA-STS, TLSRPT, rDNS, autodiscover, BIMI, DANE/TLSA), TLS certificates (HTTPS, IMAPS, SMTPS, protocol versions), port connectivity, IP/domain blacklist status, SPF lookup limits, open relay, IPv6 consistency, and server internals (Postfix, Dovecot, mailboxes, DKIM keys, mail queue). Also validates against Google/Yahoo/Microsoft 2024-2025 bulk sender requirements. Use this skill whenever the user mentions email server health checks, mail deliverability issues, DNS configuration for email, email authentication setup (SPF/DKIM/DMARC), mail server migration, diagnosing why emails go to spam or get rejected, or checking compliance with Gmail/Outlook sender policies. Also trigger when the user asks to set up or verify a mail domain, check email security, audit an existing mail server (mailcow, iRedMail, Postfix, etc.), or investigate email bounces.

mindsdb Skill

plan safe, idempotent remediation work for known dependency vulnerabilities. use when asked to triage CVEs, dependency alerts, security advisories, Dependabot alerts, or npm/yarn/pnpm/pip/bundler/cargo/go audit findings, and to group them into remediation PR plans before changing code. for CodeQL or code scanning alerts, use plan-code-scanning-remediation instead.

mishankov Bundle

Perform comprehensive software code reviews focused on correctness, regressions, security, reliability, performance, and test quality. Use when asked to review pull requests, commits, branches, patches, or source files and deliver prioritized findings with severity, concrete impact, and file/line references.

modiqo Skill

Assess a pricing page against anchoring, decoy, and plan-grid best practice and return a ranked list of pricing presentation fixes. Use when asked whether a pricing page is helping or hurting, to review plan tiers, or to critique pricing copy.

mohammaddaoudfarooqi Bundle

Run an OSS-only production readiness audit of a codebase and emit a Markdown report with file:line citations, severity-ranked findings, a "What's Good" section, and a Go/No-Go verdict. Use when the user asks to audit production readiness, run a deployment readiness check, perform a pre-release audit, validate ship-readiness, generate a production readiness report (PRR), or scan for security/observability/scalability/reliability gaps before going live. Triggers on phrases like "production readiness", "PRR", "deployment readiness", "pre-release audit", "ship-readiness", "is this prod-ready", "production audit". Supports phase flags (--only, --skip), opt-in DAST/load/visual phases (--include), caching (--cached, --fresh), and parallel execution.

nardovibecoding Skill

Adversarial red team — find security holes, logic bugs, wasted resources. Triggers: "critic", "red team", "attack this", "what's wrong", "find flaws", "challenge this". NOT FOR: code review before merge (use review), debugging (use systematic-debugging). Produces: prioritized list of flaws with severity and remediation steps.

lennarthennigs Skill

Audit README.md against the current Button2 API and recent CHANGELOG entries, then apply any needed updates

levi-qiao Bundle

Route and author durable long-horizon loop-graph runs. Use for multi-round work needing durable state, gated milestones, owner boundaries, host switching, or independent audit. Route code cleanup to /loop-converge, feature requirements to /loop-deliver, and evidence-backed solution comparison to /loop-research; use loop-graph directly only for a custom run shape. For a self-contained task, recommend the host's ordinary task or goal directly. Do not execute or resume generated runtime node files.

levi-qiao Bundle

Compile one durable loop-graph run into executor, ledger, directives, ops, and supervisor artifacts under a dated `.longgraph` directory, then present copy-ready host prompts. Use directly for a custom multi-round shape with gated milestones, independent audit, cross-host execution, or durable state; focused sibling packs handle code convergence, requirement delivery, and evidence-led research. Existing runtime nodes are self-contained.

levi-qiao Bundle

Author and optionally direct-launch a two-node loop-graph run for implementing a product or engineering requirement through verified vertical slices. Use when a requested feature, integration, migration, or behavior change needs multiple rounds, durable acceptance proof, and independent audit. Not for code cleanup, comparing alternatives before choosing, or a one-shot implementation. Do not execute or resume generated runtime node files from this authoring skill.

levi-qiao Bundle

Author and optionally direct-launch a two-node loop-graph run that compares feasible technical approaches with open-source evidence, primary research, and controlled experiments before selecting one. Use when a decision needs several research and evaluation rounds with durable evidence and independent audit. Not for implementing an already chosen requirement, code cleanup, or a quick literature summary. Do not execute or resume generated runtime node files from this authoring skill.

linuxfoundation Skill

Repo-local pre-PR shape check for lfx-v2-email-service. Audits only branch and PR hygiene: branch name, JIRA reference, conventional commits, rebase status, DCO plus GPG signing, total diff size, and email-service protected files. Does not audit Go code or architecture. Run before /email-service-preflight.

linuxfoundation Skill

Post-commit code-convention audit for lfx-v2-email-service. Audits the latest commit in the email service repo against the repo-owned documented rule surface: CLAUDE.md, .claude/skills/email-service-dev, pr-readiness/preflight boundaries, README/docs, public pkg/api contract, cmd/internal layout, Makefile, and chart docs. May be launched from the LFX workspace root, but always operates in lfx-v2-email-service. Every repo-convention finding quotes a loaded source. Pass the keyword `branch` to switch to full-branch mode (audits origin/main...HEAD). Invoke after every pre-PR commit in parallel with lfx-skills:lfx-general-code-reviewer.

liustack Skill

Audit product texts (skills, references, READMEs, rules) against the expression-style disciplines — unexplained coined terms, transliterated loan-words, semicolons, source-citation leaks. Use when asked to 黑话审计 / style audit / 审查表达风格 / check the writing style, or before shipping a batch of skill copy.

lnrd390 Skill

Audit and improve an existing Claude Code context architecture using accumulated evidence, static context measurements, and real telemetry when available.