Security

vichitra-studio Skill

Run the structured review-fix loop on a spec scope. Dispatches specdev-scope (Haiku) for fan-out planning, then runs specdev-reviewer instances in parallel per round, merges findings, dispatches specdev-impl (fix mode) for repairs, and returns CONVERGED or HALT with findings path. NOT when spec/NN_*.json is absent (→ /specdev-step to author it first). NOT for ms_*_plan.json trinity reviews (→ /specdev-trinity). NOT for PR or audit scopes (→ /devspec_pr_audit). The artifact under review must already exist. Sibling skills: specdev-step (author missing step first), specdev-trinity (ms_* plan reviews), devspec_pr_audit (PR/branch audit scopes). Trigger on: "review step NN", "run review", "/specdev-review", review + any step reference, "check step", "audit scope", or after any spec authoring or editing task (artifact must exist).

wcly Bundle

检查 Skill/代码仓库是否存在安全风险。When the user wants to check if a skill, GitHub repository, npm package, or local code is safe to download or use. This includes detecting malicious code, malware, key stealing, environment variable modification, suspicious network behavior, and evaluating repository reputation (stars, forks, contributors, age). Use this skill whenever the user mentions checking skills for security risks, scanning repositories for malware, verifying code safety, checking npm packages for threats, or asking if a download is safe.

woocommerce Skill

Reviews code changes for quality, security, and adherence to project standards. Use when reviewing PRs, commits, or staged changes.

wretcher207 Bundle

Use when the user begins or resumes a work session and wants a focused catch-up before continuing: hey dude, pick this back up, where were we, resume, or what is the next step. Establishes current project truth from the selected workspace, handoff, and working tree, then proceeds with the requested work. Do not use for a general project audit or to scan unrelated directories.

borgbase Skill

Review Rust codebases for performance anti-patterns, with emphasis on async runtimes, client-server networking, memory allocation, serialization, and concurrency. Use when asked to audit, review, or optimize Rust code for performance.

bowtiedswan Skill

Publication gate for Strand content. Audit every drafted article on its branch before it merges or publishes, revise files in place when they fall short, and write a per-article audit log the publish step can require. Use before any publish or merge of drafted content, on scheduled review wakes, and whenever multiple articles ship as one batch.

cess15 Bundle

Performs advanced SAST (Static Application Security Testing) and compliance analysis on Pull Request diffs. Identifies real security vulnerabilities, secrets, and regulatory compliance violations (GDPR, HIPAA, SOC2, PCI-DSS) by analyzing only changed code. Multi-language with exploitability assessment and CWE mapping.

chainreactors Bundle

IoM Operational Security (OPSEC) advisor. Provides OPSEC methodology guidance, helps users understand operational risks, build secure operating habits, and accumulate experience through a case library. Does not execute commands directly; serves as decision support. Concrete technical specifications and OPSEC scoring are maintained in the iom-pentest skill. Trigger conditions: use when the user asks "is this safe?", "will this be detected?", "how should I think about OPSEC?", "risk assessment", "operational security advice", or "help me analyze the detection surface".

christianmerkwirth Bundle

Reviews a proposed design or module to surface hidden contradictions and map them to GoF and TRIZ principles.

chsistrying Skill

Systematic pre-publish audit for a project about to go public on GitHub (open source release or portfolio piece). Use when a repo is about to get its first commit/push, or when the user says things like "ready to publish", "open source my project", "push to GitHub first time", "portfolio repo review", "is this repo ready for GitHub", "can I make this public", or asks to check for secrets/leftover artifacts before sharing a repo. Walks a checklist covering git repo scope, .gitignore coverage, secrets/PII sweep, LICENSE, README completeness, misleading naming, internal process docs, doc consistency, and CI — gathering evidence with shell commands and producing a blocker/recommended/nice-to-have report. Language-agnostic across Swift, Node, Python, Rust, Go, etc. Trigger with "/oss-readiness-audit".

clinton3141 Skill

Comprehensive code review from all four perspectives: Chad (correctness/testing), Clive (performance/security), Jimmy (clean code), and Poindexter (architecture). Usage: /review-all [commit-hash] or /review-all (for staged/unstaged changes)

clinton3141 Skill

Academic/technical review. Deep dive into algorithmic complexity, race conditions, security vulnerabilities, and database optimizations. Usage: /review-clive [commit-hash] or /review-clive (for staged/unstaged changes)

cmj-hub Skill

Pain Signal Profile (PSP) builder for B2B operators. Translates public, recent, verifiable signals (job posts, funding rounds, leadership changes, product launches, pricing changes, hiring patterns) into the felt operational pain that drives buying decisions — and then into the EVP that speaks to it. Anchors every output on a signal that the prospect actually did, not a demographic guess about who they are. Foundation of the JMC framework; loaded by cold-email, outbound-audit, and EVP skills. Triggers on: "build a PSP", "pain signal profile", "what's our ICP pain", "what signals should we hunt", "signal to pain mapping", "buyer pain", "PSP worksheet", "find the signal".

codealive-ai Bundle

Query external AI agents (Codex, Gemini, OpenCode, Claude Code headless) in parallel for independent second opinions, code review, bug investigation, and consensus on high-stakes decisions. Agents and models are configurable in config.json. Use for architecture choices, security review, or ambiguous problems where independent perspectives matter. Not for simple questions answerable from docs or the codebase — use web search or repo exploration instead.

cogpros Bundle

The operator-issued end-of-session protocol for a CLI session: mechanical fact-sheet pre-fill, background repo sweep, capture, clarify, assay, a type-aware Ghost Hours walkthrough, record, seal. Use when the operator asks to close out the session. The Ghost Hours measurement (../../SKILL.md) runs as the Phase 3 sub-step inside this skill. NOT FOR: mid-session checkpointing, mid-session re-orientation, pre-close audit only, one-off log entries (use the ghost-hours skill directly).

coinpaprika Skill

Analyze tokens for security risks, scams, and honeypots. Activates when users share token addresses, ask about token safety, or request honeypot/rug pull analysis across 36 chains.

thegeekybeng Skill

Use when starting a project and needing architecture documentation, logging an architecture decision (ADR) or tech decision (TDR), maintaining the trade-off matrix, checking which governance gates are missing or incomplete, drawing architecture diagrams, auditing code for security and tech debt, or sanitizing PII and internal network topologies. Triggers: "set up the project", "write an ADR", "write a TDR", "record tech decision", "verify compliance", "draw [diagram type]", "audit this", "audit <path>", "sanitize PII".

thegeekybeng Skill

Use when the user wants to scan a live website, web application, or network service for security vulnerabilities from the outside (DAST). Triggers: "scan this site", "find vulnerabilities on", "pentest", "security scan URL", "check if this site is vulnerable". Not for source code analysis — use run-security-scanner for SAST instead.

thonymg Bundle

Analyze existing TypeScript code (function, file, or class) to find unguarded boundaries and propose assertcheck assertions. Trigger when the user says "review this code", "audit this", "find where I should add assertions", "why does this fail silently", "debug this", or shares code asking "is this well-protected?".

thonymg Skill

Internal utility skill — maps an invariant or code pattern to the correct assertcheck function. Loaded on demand by assertcheck-feature, assertcheck-refactor, assertcheck-audit, and assertcheck-spec. Also triggers directly when the user asks "which assert function should I use for…" or "what is the assertcheck equivalent of…".

thrillmade Skill

PR review discipline - flag only correctness, security, and performance issues. Skip nits.

ufira-ai Skill

Run a systematic design audit using lint_node across an entire selection or page, group issues by rule, and produce a prioritized report.

yennanliu Skill

Provides comprehensive Python code review with focus on quality, bugs, security, and best practices. Use when reviewing Python code, functions, or modules for quality assessment.

awakehsh Bundle

Lifecycle-aware memory guidance for AI agents using Tree Ring Memory. Use when agents need local-first recall, explicit memory writes, audit, forgetting, evidence records, or project-scoped durable lessons without transcript dumping.

cardsorting Skill

Security sentinel that analyzes ASTs for injection risks, verifies file path sandboxing, and prevents command tampering.

durdeuvlad Bundle

Draft, rewrite, audit, and refine text through a specific writing persona using a multi-pass workflow. For long documents, process section by section instead of rewriting everything in one shot.

rayfernando1337 Bundle

WAVES - Workers, Aggregate, Verify, Extend - wave-based orchestration for Codex. Decompose a big goal into independent slices, verify coverage, spawn Codex subagents in parallel as a bounded wave, collect evidence-backed handoffs, verify important claims, synthesize one deliverable, and extend into another wave only when warranted. Bounded by design to avoid runaway token loops; invoke deliberately. Formerly parallel-orchestrate-codex; also fan out, parallelize, spin up multiple agents, orchestrate workers, multi-stream research, audit a repo, split disjoint implementation work.

swiftadviser Bundle

Write, rewrite, audit, and iteratively improve prose until it passes isolated content-quality gates. Use when the user asks for high-quality content, cleanup, anti-slop rewriting, article/copy/landing-page improvement, link/text grading, AI-writing trope removal, slop-check validation, or a loop that keeps revising until the final text is clean, specific, fact-dense, and publishable.

abullaisi Skill

Audit and improve an Upwork freelancer profile. Use when the user pastes their profile (title, overview, portfolio list, skills, stats) and wants it scored and fixed, or asks why they aren't getting invitations or search visibility. Triggers include "review my Upwork profile", "why am I not getting invites", "improve my profile", "profile title help", "optimize my overview". Returns a prioritized fix list, biggest lever first. Companion to upwork-proposal-writer (the proposal earns the profile visit; the profile closes it).

bordumb Skill

Run the adversarial review protocol on a review-gated (security-tradeoff) gap for recurve — try to BREAK the change, never to confirm it

databricks-solutions Skill

Audit and improve spec coverage for a given spec. Use when (1) a spec has low or 0% requirement coverage, (2) tests exist but lack @req tags, (3) code behaviors have drifted from the spec's success criteria, (4) you need to identify unspecified behaviors in the codebase. Covers the full audit loop: analyze coverage -> tag existing tests -> identify spec gaps -> propose spec updates.

gfargo Bundle

Use PixelKiln to plan, generate, review, recover, audit, pack, and export manifest-driven pixel-art projects. Apply when a task uses the PixelKiln CLI, manifest, lockfile, or generated asset workflow; do not use for unrelated one-off image generation.

google-labs-code Skill

Cognitive triage of fleet audit findings. Read issue content, evaluate labeling accuracy, and determine open/close/dispatch/relabel actions for fleet-managed issues. Use when triaging undispatched issues or reviewing audit scan results.

mukul975 Skill

Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns

rweisssieker-xp Skill

Use for CEAP quality engineering, automated test generation, security checks, compliance validation, policy gates, auditability, and regulated enterprise or MedTech engineering review.

kimyx0207 Bundle

Runs offline Semgrep static-analysis and secret-pattern scans with bundled local rules. Use for local security scanning, vulnerability pattern checks, or leaked-secret checks. Never downloads rules, uploads code, installs packages, or modifies findings automatically.