Security

microsoft Skill

Ingest the official MITRE CWE database and generate per-domain security audit taxonomies for PromptKit. Use this skill when the user wants to update CWE taxonomies, ingest a new CWE version, or regenerate domain mappings from the CWE corpus.

microsoftdocs Skill

Audit a Data API builder documentation file for Microsoft Learn compliance, style, accuracy, and information architecture. Checks frontmatter, links, images, code fences, alerts, tabs, voice, and peer consistency.

mikeyobrien Skill

Run a deep, whole-wiki health-check and maintenance pass on this OKF wiki. Use when the user asks to lint, clean up, health-check, audit, or maintain the wiki, or periodically after ingesting many sources — to find contradictions, stale claims, orphan pages, missing pages/cross-references, and broken links.

mindsdb Skill

implement an idempotent code scanning remediation plan, apply source code fixes for CodeQL/SAST alerts, verify the fix, commit, push, and create or update a pull request. use after planning code scanning remediation or when asked to fix CodeQL alerts, path injection, XSS, stack trace exposure, workflow permissions, or other SAST findings.

mindsdb Skill

plan safe, idempotent remediation work for GitHub code scanning alerts (CodeQL, SAST). use when asked to triage CodeQL alerts, code scanning findings, fix SAST issues, or group code scanning vulnerabilities into remediation PR plans before changing code. for dependency vulnerabilities (CVEs, Dependabot, npm audit), use plan-vulnerability-remediation instead.

offchainlabs Skill

Run full documentation quality audit — orphan pages, markdown lint, frontmatter validation, globalVars consistency, and broken internal links. Triggers on "audit docs", "check docs quality", "find problems", "content audit".

okturan Skill

Score a repository with nine documented categories and diagnostic checks. Use for project health checks, repository audits, code quality assessments, or the /project-health command.

olegiv Bundle

Perform an independent, read-only audit of the entire current Git checkout—committed HEAD plus staged, unstaged, and untracked files—when the user asks to scan the current branch, check again for findings, audit before commit, or match GitHub Codex review quality. Do not use when the user explicitly limits the review to one PR diff or commit.

openplayerjs Skill

Resolve a `pnpm audit` (dependency-audit CI job) failure — high/critical CVEs in the dependency tree. Use when asked to fix an audit finding, a CVE, a GHSA advisory, or when the "Dependency audit" GitHub check is red. Covers the deterministic pnpm-workspace.yaml override procedure, what it can't fix, and why the E1 "ask before adding/upgrading a dependency" rule doesn't block this specific case.

paidaxing1234 Bundle

C++ 低延迟/高频交易引擎的「热路径猎手」。逐项审查会拖慢热路径、放大尾延迟(P99/P99.9)的工程坑——锁争用、false sharing、cache miss、热路径分配、syscall、序列化、分支预测失败、NUMA 跨节点、TLB miss、PyBind11 GIL——并定位到 文件:行,按严重度(致命/高危/中/低)输出一张「热路径体检报告」。 触发词(中):热路径审查、低延迟审查、延迟猎手、锁争用、伪共享、缓存未命中、尾延迟、热路径分配、NUMA 亲和、TLB miss、GIL 争用、热路径体检。 触发词(英):latency audit、hotpath、hot path、low-latency、false sharing、cache miss、lock contention、tail latency、NUMA、TLB miss、huge page、pybind11 GIL、latency-audit。 适用:用户把 tick 回调/撮合/下单/序列化/无锁队列/PyBind11 混合策略等 C++ 热路径代码丢过来,问「这段会不会拖慢热路径/为什么尾延迟突刺/帮我查锁和分配/有没有 false sharing/NUMA 绑对了吗」。 不适用:纯功能 bug(逻辑错、崩溃)、非性能问题、非 C++ 代码、要求承诺具体延迟微秒数字或替代真实 benchmark/profiling。

paidaxing1234 Bundle

量化回测代码的"照妖镜"——逐项审查会让回测虚高、实盘亏钱的工程陷阱(未来函数/前视偏差、过拟合/数据窥探、成交真实性/成本、收益口径错误),按严重度(致命/高危/中/低)输出一张"回测体检报告"。 何时触发:用户把量化策略/回测代码、信号生成、数据加载、参数寻优脚本丢过来让你审查可信度;或问"这个回测能信吗/为什么实盘对不上回测/帮我查未来函数/有没有过拟合"。 触发词(中):回测审查、回测照妖镜、回测体检、未来函数、前视偏差、数据泄漏、过拟合、数据窥探、幸存者偏差、回测陷阱、回测可信度、实盘对不上回测。 触发词(英):backtest audit、backtest review、look-ahead bias、lookahead、data leakage、overfitting、survivorship bias、curve fitting、backtest-guard。 不适用场景:实时实盘下单/风控逻辑本身的 bug、单纯策略调参或求 alpha、行情数据源运维、非量化的通用代码审查、要你"预测收益/荐股/给买卖建议"——这些都不在本 skill 范围。

paidaxing1234 Bundle

生成或修复生产级交易所行情+交易连接器骨架(自动重连、心跳看门狗、限频令牌桶、 时间同步、签名、listenKey/login 续期、重订阅、序列缺口重快照、密钥走 env)。也能审已有连接器的可靠性缺口。 这是个生成/脚手架型 skill,把『连接器锻造协议』固化下来,让连接器从地基上就不漏。 触发词(中):连接器、连接器锻造、交易所对接、Binance连接器、OKX连接器、行情订阅、断线重连、 老掉线、莫名其妙断线、签名报错、时间戳报错、listenKey 续期、重订阅、序列缺口、本地订单簿、实盘对不上。 触发词(英):connector、connector-forge、exchange connector、market data feed、websocket reconnect、 heartbeat、listenKey、ws login、orderbook snapshot、sequence gap、rate limit token bucket、clock drift。 不适用:非交易所对接的通用网络代码;要你代填/生成真实 API 密钥(只给 env 注入骨架,绝不写死密钥); 要你给出具体策略 alpha/信号逻辑/调参(那是策略层,不是连接器层);纯热路径微秒级优化体检(交给 latency-audit)。

paidaxing1234 Bundle

逐项审查交易系统的风控配置(risk_config.json/yaml)与 pre-trade 风控代码,定位"会让风控形同虚设、实盘爆仓"的工程缺陷,精确到 文件:行,按严重度输出"风控体检报告"。覆盖限额/回撤/杠杆/kill-switch/防胖手指/保证金/爆仓模拟/并发在途订单/单点故障/运维/密钥。触发词(中):风控审查、风控体检、风控配置、仓位上限、敞口上限、回撤止损、最大回撤、kill-switch、爆仓保护、强平、维持保证金、防胖手指、限额、在途订单。触发词(英):risk config、risk limit、risk audit、kill switch、kill-switch、fat finger、fat-finger、liquidation、margin、drawdown stop、position limit、in-flight order、risk-config-lint。不适用:策略 alpha/信号逻辑/调参寻优、行情数据源运维、回测可信度审查(用 backtest-guard)、连接器可靠性(用 connector-forge)、非风控的通用代码审查;也绝不承诺"绝对不爆仓/绝对安全"——本 skill 只做工程审查,不替代实盘风控演练。

panaversity Skill

Extension encoding audit methodology standards: materiality calculation, sampling methodology, documentation requirements, escalation procedures, and quality control per ISA standards.

peanutsee Skill

Architect and optimize existing Supabase integrations for full-stack applications. Trigger ONLY when a user explicitly mentions Supabase or its core ecosystem (GoTrue, PostgREST, Realtime). Do not pitch Supabase to non-users. For existing users, proactively educate on underutilized native features like Row Level Security (RLS), pgvector, Edge Functions, database functions (RPCs), and advocate for a SCHEMA.md file to grant AI agents database visibility.

lncrawl Skill

Add or modify a FastAPI endpoint in lncrawl — router aggregation, ensure_user/ensure_admin security, DTO vs DAO models, pagination, ServerErrors. Use when touching lncrawl/server/api/, security.py, or server/models/.

magic5644 Bundle

Manage Obsidian vaults from any IDE or CLI — notes, search, tags, links, cleanup, organization, semantic index, daily notes, templates, and vault health. Use this skill whenever the user mentions Obsidian or wants to work with a personal knowledge base, even if they don't say "Obsidian" explicitly. Trigger for: "add a note to my vault", "find notes about X", "clean up orphan notes", "update frontmatter on all notes tagged Y", "audit broken links", "reorganize my vault", "ingest this article into my notes", "build a semantic search for my notes", "check vault health", obsidian vault, obsidian search, obsidian links, obsidian tags, obsidian properties, obsidian cleanup, obsidian organize, PKM, personal knowledge management.

marketcalls Bundle

Verify a claim before stating it, and verify a test before trusting it. Use before asserting that a security control holds, that a pattern is safe, that a bug is fixed, or that a test guards a fix. Also use when reporting audit or scanner findings, when a grep "found nothing", when a lint or test count looks clean, and before telling a user that something is or is not a vulnerability.

regenrek Bundle

Implement remaining scoped work in this repository to verified completion. Use for direct bug fixes, regressions, failing tests, `planr-review` findings, or unfinished `.planr` plan phases when the next step is to change code, tests, or docs, keep live `.planr` status honest, and prove the result. Not for writing a new execution contract (`planr-plan`), giving a verdict-only status answer (`planr-status`), or running a findings-first audit (`planr-review`).

regenrek Bundle

Create or update executable `.planr/plans/*.plan.md` contracts in this repository. Use when scope, ownership, phase breakdown, verification, or acceptance criteria must be defined before implementation, including bug-to-plan conversions and review-finding follow-up plans. Not for executing fixes (`planr-fix`), giving a verdict-only status answer (`planr-status`), or running a findings-first audit (`planr-review`).

regenrek Bundle

Assess the honest current state of a scoped `.planr` task in this repository. Use when the user asks what is done, what remains, what is blocked, whether a scope is complete, which scopes are open, or what should come next. Start with the deterministic `.planr` CLI where it has command coverage. Not for implementing fixes (`planr-fix`) or running a findings-first audit (`planr-review`).

regenrek Bundle

Produce a user-facing recap of an owned `.planr` scope in this repository. Use when the user asks what changed, why it changed, what works now, what intentionally no longer works, or what remains blocked after `planr-fix`, `planr-status`, or `planr-review`. Not for deciding completion (`planr-status`), running a findings-first audit (`planr-review`), or continuing implementation (`planr-fix`).

richlander Skill

Audit and update os-packages.json files in dotnet/core to ensure Linux distribution package names are correct. Verifies package names against upstream package repositories and fixes mismatches.

richlander Bundle

Audit and update supported-os.json files in dotnet/core to reflect current OS version support. Uses release-notes verify for automated checking against upstream lifecycle data.

robmcquade Bundle

Stress-test substantive work — surface strengths, weaknesses, hidden assumptions, failure modes, and adjacent ideas, then return prioritized, actionable fixes (each weakness plus how to fix it). Recommends the fixes; does not produce the rewrite (that is /improve's job). User-invoked only. In Claude Code a deterministic orchestrator auto-escalates security, PII, and credential artifacts to deep, fans out fresh-context subprocess critics with schema-forced output, firewalls sensitive content away from web search, runs an independent verifier, and emits a verified findings manifest; without a shell it runs the same lenses inline and discloses that the enforced gate did not run. Use on durable artifacts (files, frameworks, memos, redlines, decisions, contracts, public content, prompts, proposals) and multi-step work where early choices constrain later ones. Apparent narrowness ('just review this') can mask real stakes. Skip single-fact lookups and content already endorsed and ready to execute.

robpalmer99 Bundle

Check ad copy, landing pages, VSLs, and emails for platform compliance issues — Meta/Facebook, Google, TikTok, YouTube, and ClickBank. Use this skill whenever the user asks to check compliance, run a compliance audit, review copy for platform policy violations, check if copy will get banned or flagged, audit for Meta/Facebook ad policy, or scan for trigger words. Also trigger for 'is this compliant', 'will this get rejected', 'check for banned words', 'platform policy check', or any task involving reviewing direct response copy against advertising platform rules.

rogeriochaves Skill

Review recent code changes for correctness, regressions, test strategy, design quality, and security/privacy risks before merge.

romain-nicod Bundle

Stress-test a product idea against the real market, then expand it. Runs a product pass (is there a problem, who pays, who already owns the field, what is genuinely free, what kills this) and a creative pass (flip the object, the user, the payer, the trigger; 10x version; lateral pivots). Use when someone brings a product idea, a feature concept, a startup pitch, a business case, or a shortlist of ideas to compare, and wants to know whether it holds up and where else it could go. Trigger on "is this a good idea", "evaluate this concept", "should we build this", "poke holes in this", "expand on this idea", "what else could this be", "market check", "competitive reality check", or when comparing several ideas before committing.

round2ai Bundle

商品审核工作流：检查待上架商品的信息完整性后批量提交。当用户说'检查商品有没有问题'、'审核商品'、'看看能不能上架'、'检查一下信息'、'哪些可以上架'、'审核通过后上架'时使用。适用于闲鱼、淘宝两平台。不适用于单纯上架（走 r2-goods）或批量上架（走 r2-workflow-batch-up）。

runkids Skill

Cross-validate CLI flags, rules, tests, and integrations for consistency across the veto codebase. Use this skill whenever the user asks to: audit the codebase, check for consistency issues, find undocumented flags, verify test coverage, validate rule definitions, or check integration completeness. This is a read-only audit — it reports issues but never modifies files. Use after large refactors, before releases, or whenever you suspect code has drifted.

seansmithworks Skill

Full design quality audit with composite scoring. Runs guard checks across all active layers and produces a quality report with layer sub-scores out of 100.

sebastiaanwouters Skill

Use when asked to create a git commit, split changes into commits, or write a commit message. Prefer small commits that are easy to review. Follow this repo's commit message pattern when clear from recent history or touched-path history; otherwise default to conventional commits. Never commit gitignored, ephemeral, generated, local-only, or secret files.

securityreviewai Bundle

Security-first threat modelling workflow for code and architecture tasks. Walks all 7 PWNISMS categories, enforces vibe guardrails (secure by code), and synchronizes findings via a direct VibeReview markdown sync. Use before, during, and after implementation.

securityreviewai Skill

Write and synchronize a structured VibeReview markdown artifact under vibereview/ for the current security-relevant session. Use after threat modelling or guardrail-enforced implementation.

securityreviewai Bundle

Analyze the developer request, infer the security categories and likely threats involved, shortlist the most relevant project guardrails, then hydrate the exact guardrails with get_guardrail_by_id before implementation. Use for every security-relevant code task before code is written and preserve the shortlist for the final VibeReview sync.

selfxyz Skill

Create Linear issues from a PR audit doc — one issue per PR bucket with acceptance criteria and linked audit findings.