Security

mcclew Bundle

Runs an interactive SOC analyst training exercise — Claude presents a realistic security alert and plays the surrounding environment while the user practices as the analyst - triaging, investigating, communicating with stakeholders, and escalating or closing it correctly, then gets a structured performance review.

zscole Bundle

Review Python code for common security vulnerabilities

1shot-api Bundle

Build an iframe-isolated, passkey-derived Ethereum wallet using the WebAuthn PRF extension. Use when the user wants to implement a passkey-based wallet, derive an EVM private key from a passkey without server custody, add a non-custodial wallet pattern to a web app, harden wallet key handling against XSS via an isolated iframe, or check whether a client platform supports the WebAuthn PRF extension. Covers PRF + HKDF → secp256k1 key derivation, LongBlob fallback for compatibility, cross-frame RPC via Postmate, and browser/OS platform support gating.

2389-research Skill

This skill should be used when adding features to existing Firebase projects. Triggers on "add function", "create endpoint", "new tool", "add api", "new collection", "implement", "build feature". Guides TDD workflow with test-first development, security rules, and emulator verification.

antono Bundle

Diff-driven code review for a branch or PR using codanna's call graph plus difftastic's structural diff. Use when the user asks to "review this PR / branch / diff", "audit callers after my changes", "check what I missed", or otherwise wants to find untouched callers of functions whose signatures or bodies changed between two refs.

elliothux Bundle

Audit the current Lynx branch and working tree for test-, fixture-, demo-, page-, domain-, or scenario-tuned production logic. Use for anti-cheating reviews of code, prompts, skills, tool descriptions, or e2e-related changes; do not use for general code review.

gemini-cli-extensions Skill

Expert guidance for security alert triage. Use this when the user asks to "triage" an alert or case.

gemini-cli-extensions Skill

Expert guidance for deep security investigations. Use this when the user asks to "investigate" a case, entity, or incident.

hadden-industries Bundle

Engineers source-grounded concepts and definitions, including definition, revision, audit, comparison, mapping, formalization, multilingual equivalence, and epistemic-governance work. Use for deliberate semantic work on a concept's identity, boundary, designation, reuse, relation, or representation. Do NOT use for casual dictionary lookup, code-symbol naming, product or brand naming, copyediting without semantic work, or implementation-only requests.

innovationengines Skill

Review the user's installed Claude Skills for overlap, dead weight, vague triggers, and gaps, then deliver a keep/merge/fix/delete action plan. Use whenever the user types /skill-audit, says their skills overlap or fire at the wrong times, asks which skills to keep or delete, wants their skill library cleaned up or organized, or asks "which of my skills are actually useful". Also use after a user has installed a batch of new skills and wants to know how they fit together.

winterddo Skill

Show which of your installed skills actually fire and which sit dormant. Use when you want to audit your skill library, or see whether the skills you set up are being used.

aayushbtw Bundle

The standard for code comments, both writing them and removing them. Use when writing or reviewing a comment, when asked to remove unnecessary, obvious, or useless comments, clean up comment noise, or audit a file or codebase for comment quality, and before committing a change that added comments.

adewale Bundle

Create and improve README documents for GitHub projects. Use when the user wants to write a new README, improve an existing one, audit README quality, or asks about documentation best practices for their repository.

adjurtime Bundle

Audit a paper's complete figure set and each multi-panel figure for scientific, visual, typographic, geometric, and delivery consistency. Use for 整套论文图检查, 同一图内子图检查, 子图编号和横纵坐标对齐, 图1到图N统一, 投稿前图件校对, multi-panel alignment, figure suite audit, or read-only comparison of OPJU, SVG, PDF, PNG, captions, and source tables. Default to read-only reporting; hand approved single-figure Origin fixes to origin-figure.

aibot88 Bundle

Use when generating a security conference paper draft that should preserve the existing sec-conf-write and sec-conf-plot workflows, produce a full English draft with figures first, then produce a Chinese text-only mirror draft while leaving figure assets unchanged. Use for bilingual ACM CCS, NDSS, IEEE S&P, USENIX Security, RAID, ACSAC, and similar security-paper drafting workflows where the user provides fixed English and Chinese headings.

jim60105 Skill

Audit SubX-CLI's configuration coverage matrix (`docs/config-usage-analysis.md`) so every configuration key in `subx-core/src/config/` has a row with the correct status. Use when the user asks to audit, verify, or update the configuration usage analysis doc, when configuration items have been added, renamed, or removed in `subx-core/src/config/`, or when the README's configuration/subcommand reference needs to be synced with the configuration documentation.

just-mpm Bundle

Guide for integrating Gemini AI models with Firebase using Firebase AI Logic SDK. This skill should be used when implementing Gemini features (chat, content generation, structured JSON output), configuring security (App Check), or troubleshooting issues (rate limits, schema errors).

epicweb-dev Skill

Guide on security practices including CSP, rate limiting, and session security for Epic Stack

nvidia Bundle

Use when generating a Warp pre-release or release-candidate audit report from Towncrier fragments and release history.

nvidia Bundle

Use when auditing and recovering Warp changelog fragments, finalizing a release changelog, or synchronizing a tagged release back to main.

2233admin Bundle

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

mattjoyce Skill

Audit, align, and refine the seam between code execution and written specification (docs, manifests, schemas) using Ousterhout × Liskov surface/contract discipline. Use when the user requests a documentation audit, a review of architectural alignment, a verification of public-facing API contracts, manifest validation, or when code changes are made to core subsystems (SQLite queue, plugin protocol, routers) and their corresponding specifications must be updated. This skill focuses on identifying lies, leaks, quiet promises, and shallow abstractions, ensuring the written word is both a deep abstraction and a strict, truthful contract.

maxaeo Bundle

Audit whether a website can be found, crawled, and cited by AI answer engines such as ChatGPT Search, Perplexity, Google AI Overviews, and Microsoft Copilot. Use when someone asks why their brand is missing from AI answers, whether AI crawlers can read their site, how to get cited by ChatGPT or Perplexity, or asks for a GEO or AEO (generative / answer engine optimization) review. Produces a citation baseline across buyer-intent prompts, a crawler-access check, a citability review of named pages, and a ranked fix list. Not for keyword rank tracking, paid search, or pages behind a login.

meleantonio Skill

Independently attack a candidate math proof or disproof: check exact claim match, edge cases, hidden assumptions, circular reductions, non-counting partial results dressed as solutions, and lemma counterexamples. Use when reviewing a proof draft, after a research loop iteration, or when invoking /adversarial-audit. Keywords: audit proof, adversarial review, gap finding, proof check, referee math.

memgraph Skill

Run before every release to ensure all merged memgraph PRs have a docs label assigned, have changelog entries, have docs pages where required, that all changed text is free of spelling and grammar issues, and that existing documentation cross-links the new content. Use when preparing a release branch, before merging into the main branch, or when asked to "check before release". Also use standalone when asked to audit docs labels on a milestone.

mgifford Bundle

Prepare and route confidential vulnerability reports under the receiving project's policies, with authorization checks, evidence verification, sensitive-data redaction, coordinated disclosure, and human approval. Use when a suspected vulnerability may need to be reported to an upstream project, vendor, maintainer, or security team. Do not use for routine code review, public bug reports, incident response, or unauthorized security testing.

mhenke Bundle

Quantitative design audit. Counts pass-throughs, duplication, doc gaps, naming issues, and exceptions across 5 dimensions, scored 0-4.

microsoft Skill

Serialize AI-detected security findings as SARIF v2.1.0 conforming to the AI-generated-findings profile, using the Sarif.Multitool emit verbs.

microsoft Skill

Uploads a finalized SARIF file to GitHub Advanced Security (GHAS) code scanning using the Sarif.Multitool publish-to-ghas verb, deriving the GitHub target, commit, and ref from the run's version-control provenance.

mimaowang Bundle

Always invoke this skill for ANY request to write, propose, choose, rank, rewrite, compare, or audit an economics paper title—including 中文 requests for 论文标题, 英文标题, 标题候选, 推荐标题, or 备选标题. Invoke it when the user asks for one recommended English title plus alternatives from an empirical, theoretical, or structural economics manuscript, even if the skill is not named. It reads the paper body and treats every displayed title as a factual promise. Do not use for section, table, figure, news, or book titles.

minxnnu-cloud Skill

Stop revision loops from eating the project. Use when a deliverable keeps cycling through revision rounds (r1, r2, ... r10+), when the same kind of defect keeps coming back, when every fix seems to trigger a full rebuild and re-audit, or when workspace documents are ballooning with receipts and re-audits. Encodes round budgets, minimal-successor rounds, escalation ladders, and identity gates mined from a 52-round revision-history audit.

christopherkarani Bundle

Benchmarking and performance auditing for the Wax repo. Use when running or interpreting Wax benchmarks, diagnosing CPU, memory, or I/O bottlenecks, or investigating Swift 6.2 concurrency issues such as Sendable, actor isolation, `@unchecked Sendable`, task-group fan-out, and data races.

mathisk2095 Bundle

This skill should be used when the user wants to find, audit, or remove dead code, unused imports, unused functions, unused variables, duplicate implementations, or simplify a codebase. Works across all programming languages. Relevant when the user says "find dead code", "remove dead code", "remove unused imports", "find duplicate code", "simplify this codebase", "find unused functions", "find unused code", "remove commented out code", "what code is unused", "find orphaned files", "detect duplicate implementations", "find unreachable code", "clean up this codebase", or "audit for unused code".

xrplf Skill

Review an XRPL documentation page through the reader personas relevant to its type. Detects the doc's section (folder) and topic, fans out the matching persona subagents in parallel, then collates findings and suggested fixes for you to act on. Use when asked to review, audit, or get persona feedback on a docs page.

deer-flow Bundle

Run one 0-1 product kaizen loop. Use when the user asks to inspect a product, decide what to build next, plan or implement the next coherent capability, audit a workflow, or advance beyond maintenance. Ground the loop in current product evidence, external market scan when proposing new product functionality, capability-map freshness, one north-star metric, one main recommendation plus two alternatives, and an approval gate before product-code changes.

b-amir Skill

Audit an existing product playbook against current evidence without editing Markdown or state. Use when the user asks for a playbook audit, drift check, coverage gap review, or read-only reconciliation report. Prefer the main product-playbook skill for create or edit runs.