Security

bagelhole Bundle

Batch-rewrites page titles, meta descriptions, and matching on-page headlines (including JSON-LD where the site duplicates the title) using tiers from Google Search Console data—prioritizing high impressions with zero or low CTR on page 1–2, then deeper positions. Encodes repeatable CTR patterns from production workflows: numbers and list counts in titles, bracket qualifiers, question-led descriptions, concrete examples, deduped title phrasing, and current-year refresh on time-sensitive pages. Use after a GSC audit or alongside gsc-ahrefs-browser-audit output when the user wants implementation, not just research. Trigger when the user mentions batch title tags, meta rewrites, GSC tiers, zero-CTR pages, snippet optimization, or SEOLayout-style title/description updates across many URLs.

bamboo-dcm Bundle

Audit a fundraise deck (or structurer proposal, M&A teaser) using a sector-tuned lens. Outputs a per-slide gap analysis, red-flag checklist, and rewrite suggestions. TRIGGER when user asks to audit / review / critique a pitch deck, fundraise deck, investor deck, structurer proposal, or M&A teaser; says "audit my deck", "review this pitch deck", "what's wrong with my Series A deck", "critique this fundraise deck"; or shares a deck PDF asking for feedback. DO NOT TRIGGER when user asks to design slides visually (use design tools), generate a deck from scratch (this skill audits existing decks; use a content-authoring approach for greenfield), or draft email follow-ups to investors.

benchflow-ai Bundle

Scan a git repository for leaked secrets and env keys, a missing LICENSE, and unclear authorship (bot or non-employee committers), then optionally fix the safe parts. Reports secret matches with values redacted, .env files tracked or untracked, secrets found in git history, license presence, and committer domains. With --fix it untracks .env, adds it to .gitignore, writes a values-blanked .env.example, and scaffolds a LICENSE; --redact-code also replaces secrets found in tracked source. Never rewrites git history automatically — it prints the command instead. Use before publishing, open-sourcing, transferring, or sharing a repository, or when asked to find leaked keys, add a license, or check IP hygiene. Trigger phrases: 'scan for secrets', 'is there an API key in this repo', 'check before open-sourcing', 'add a license', 'clean this repo before sharing'.

berriai Skill

Produce the secret-free Codex config to distribute to a whole team via MDM, and plan the gateway deployment behind it. Use for questions about rolling Codex out company-wide, shipping config.toml to every laptop, per-user keys, or centralizing spend.

bgauryy Skill

Use when an Atlas task asks for a repository audit record or evidence manifest.

bishalu Skill

Decide which engineering skills should run before starting non-trivial engineering work — a feature, a refactor, a bug, a review, or an audit — when more than one installed skill could plausibly claim it. Picks at most one lifecycle owner, names the supporting skills that augment it, and says when to escalate to a security or diagnosis specialist. Skip for a one-line edit, a direct question, or work already inside a chosen skill.

boojack Bundle

Manually invoked code-cleanup capability that reviews changed code for reuse, simplification, efficiency, and abstraction-level issues, then applies verified behavior-preserving fixes. Use only when the user explicitly invokes or names the simplify skill. Do not activate for correctness or security review, bug fixing, formatting-only requests, or broad refactoring.

breferrari Skill

Review the memory stores and keep them lean — walk each memory and recommend KEEP, DROP or UPDATE with reasons, acting only on what the user approves. Use when the user says "audit memories", "review memories", "clean up memories", or asks whether the store is still any good. User-initiated only; never run automatically.

caoergou Bundle

Comprehensive code review combining Clean Code principles and senior engineer expertise. Reviews git changes for SOLID violations, security risks, clean code smells, and proposes actionable improvements.

capawesome-team Bundle

Comprehensive guide for Firestore Standard Edition, including provisioning, security rules, and SDK usage. Use this skill when the user needs help setting up Firestore, writing security rules, or using the Firestore SDK in their application.

capitalone Bundle

Scan a codebase for exploitable security defects. Enumerates every user-controllable input, traces each forward to dangerous sinks, proves exploitability with executable tests, and proposes validated fixes.

capitalone Bundle

Automate vulnerability remediation from VulnHunter scan results using TDD. Parses VulnHunter findings, writes exploit demos proving each vulnerability, writes security tests that define correct behavior (RED), implements fixes to pass those tests (GREEN), and delivers via PR or fallback GitHub issue. Each PR includes the exploit demo, failing-then-passing test, and fix. Use when the user says "/vulnhunter-fix", "fix the vulnerabilities", "remediate the findings", "apply the security fixes", "create PRs for the vuln fixes", or provides a GitHub repo URL alongside a VulnHunter results path.

anfreire Bundle

Maintain the user's wiki's health. Use when the user says "tend wiki", "clean wiki", "audit wiki", "fix tags", "normalize tags", "link pages", "cross-reference", "wiki status", or wants a health check, tag audit, or cross-linking pass.

apache Skill

Audit a datafusion-spark function implementation for correctness against Apache Spark 4.2.0. Studies the Spark source across versions, reviews the Rust implementation and its signature, verifies expected values against a real PySpark, fixes divergences, and captures the rest as issues and disabled tests.

automattic Skill

Pre-release code health and traceability audit for WooCommerce plugins. Runs after code review -- focuses on dead code, duplication, structural complexity, and full-stack traceability analysis. Use when finalizing, auditing, or preparing a WooCommerce plugin for release. Also trigger when the user mentions "finalize", "pre-release audit", "code health check", "traceability analysis", or "ready to ship". This skill complements security and UX review by catching structural issues and broken data paths that checklist-based reviews miss.

automattic Bundle

Comprehensive WooCommerce plugin development skill that enforces WordPress and WooCommerce coding standards, security best practices, and end-to-end testing for every file created. Use this skill whenever the user wants to create, scaffold, build, or start a WooCommerce plugin, WooCommerce extension, or WordPress plugin that integrates with WooCommerce. Also trigger when the user mentions "WooCommerce plugin", "Woo extension", "WooCommerce add-on", "payment gateway plugin", "shipping method plugin", or any plugin that touches orders, products, carts, checkout, or the WooCommerce REST API. Even if the user just says "start a new plugin" in the context of a WooCommerce project, use this skill. This skill should be the first thing consulted before writing any code for a WooCommerce plugin project.

autoworks-ai Bundle

Install the AutoHub docs-drift Codex automation from signed AutoVault skill resources and audit its render fidelity with autovault doctor.

aws-samples Bundle

Resolve git merge conflicts in AI-DLC multi-user projects. Use this skill when users mention merge conflicts, git merge, pull conflicts, or when multiple developers are working on different AI-DLC units in parallel and need to combine their work. Covers both AI-DLC state file conflicts (aidlc-state.md, audit.md) and application code conflicts from shared/common units.

aztecprotocol Bundle

Write or customize Aztec private escrow contracts in Noir with TypeScript integration. Use for secret contracts, contract-owned shared private state, ConfigNote/StateNote design, authwit patterns, role-gated private actions, events, or atomic settlement logic.

aztecprotocol Bundle

Scaffold generalized Aztec private escrow projects from scratch: secret contracts, contract-owned shared private state, Noir contracts, TypeScript SDK, and Bun localnet tests. Use for private escrow systems, atomic swaps, or escrow protocol prototypes.

mozilla Bundle

Scans a Firefox WebExtension/add-on codebase for likely violations of Mozilla's Add-on Policies — permissions scope, remote code loading, CSP relaxation, data collection & consent (manifest data_collection_permissions), monetization rules (ads, affiliate links, crypto miners), source/obfuscation requirements, and "No Surprises" feature disclosure. Use whenever someone is building, reviewing, or about to submit a Firefox extension to addons.mozilla.org (AMO) and wants a policy/compliance/review-readiness check, or wants to know if their extension might get rejected or blocked — even without the word "policy," e.g. "will AMO reject this," "check my manifest.json," "audit my extension for Mozilla compliance." UNOFFICIAL, THIRD-PARTY HEURISTIC TOOL, NOT BUILT OR ENDORSED BY MOZILLA — always say so, before running it and in the report, and make clear a clean scan is NOT a guarantee of Mozilla approval.

narumiruna Skill

Use the codebase knowledge graph for structural code queries. Triggers on: explore the codebase, understand the architecture, what functions exist, show me the structure, who calls this function, what does X call, trace the call chain, find callers of, show dependencies, impact analysis, dead code, unused functions, high fan-out, refactor candidates, code quality audit, graph query syntax, Cypher query examples, edge types, how to use search_graph.

nasa Skill

Audit repository documentation for stale, conflicting, or incomplete install/run guidance and outdated examples; report concrete file-level gaps and recommended fixes.

nativephp Bundle

Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.

neilotoole Skill

Reviews and merges Dependabot pull requests for Go modules (gomod) at the sq repo root. Use for dependabot gomod PRs, go.mod/go.sum updates, and Go module security bumps—not site/ Bun PRs.

nethermindeth Skill

Deep code review for an Ethereum execution client. Checks consensus correctness, security, robustness, performance, DI patterns, breaking changes, and observability. Use when asked to "review", "check this PR", "look for bugs", "audit", or "review my changes".

newton-physics Bundle

Use when auditing Newton's pending Towncrier fragments for keep/defer decisions, reviewing an RC for readiness, or calibrating against an already-shipped release.

nobodywho-ooo Skill

Review code changes in a git repository, including pull requests, branch diffs, commits, staged/unstaged work, or local changes. Focus on bugs, security, correctness, and maintainability issues introduced by the change.

carrilloapps Bundle

Use this skill whenever the user asks for a security analysis, vulnerability assessment, security audit, or any form of Security Assessment Report (SAR) over a codebase, infrastructure, API, database, or system. Triggers include: "audit my code", "find security issues", "run a security check", "generate a SAR", "check for vulnerabilities", "is this code secure", or any request that involves evaluating the security posture of a project. Also triggers when the user uploads or references source code, config files, environment variables, or architecture diagrams and asks for a security opinion. Do NOT use for generic coding tasks, code reviews focused on quality rather than security, or performance optimization unless a security angle is explicitly present.

cockroachdb Skill

Audit a Go package in this repository for subtle correctness bugs, including both bugs inside the package and bugs in how the rest of the repository uses it. Optimized for Pebble- and CockroachDB-style code where invariants, iterator semantics, ownership, and API contracts matter more than style issues.

cockroachdb Skill

Audit a Go package in this repository for incorrect or misleading code comments — places where the documentation contradicts what the code actually does. Optimized for Pebble- and CockroachDB-style code where comments encode contracts, invariants, and ownership rules that callers depend on.

codalanguez Skill

Review attached code for bugs, security issues, and simplification opportunities. Use when the user asks to review, audit, or improve code in the attached files.

consensys-incorporated Skill

Review docs.linea.build content for editorial compliance (voice, terminology, naming, formatting, frontmatter) before opening or merging a pull request. Use before submitting a PR, when reviewing someone else's draft, or when asked to audit existing pages.

consensys-incorporated Bundle

Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions, release-age policies, audits, CI validation, Dependabot boundaries, PRs, and GitHub tracking issues. Use whenever the user asks to update, bump, refresh, audit, clean, modernize, or review dependencies or GitHub Actions, reduce vulnerabilities, clean overrides, or prepare dependency PRs/issues.

jasonkneen Bundle

Localization rules and audit workflow for cmux UI strings, settings rows, menus, shortcuts, schema/config text, docs, command/help text, alerts, tooltips, and web messages. Use whenever changing user-facing text.

fandhe-ai Bundle

静的サイトを Firebase Hosting（Spark プラン・課金なし）で公開し、GitHub Actions から自動デプロイする環境をコードで構築する。プロジェクト作成・API 有効化・サービスアカウント・Secret 登録・firebase.json・デプロイワークフローまでを一括で用意する。「Firebase で公開したい」「無料でデプロイ」「CI からデプロイ」などで使用。