Security

goldenwing-360 Skill

Harden Android apps against the platform-specific failure modes. Covers Android Keystore and StrongBox, encrypted local storage, network security config and certificate pinning, WebView hardening, exported components and intent hijacking, backup rules, and Play Integrity with root detection as a signal. Invoke when shipping an Android app that holds credentials or tokens, before Play Store submission, or after a mobile security advisory.

goldenwing-360 Skill

Secure the DNS and domain layer below TLS — the records, registrar, and provider access everyone forgets. Covers dangling records and subdomain takeover, registrar hardening and transfer locks, CAA, DNSSEC trade-offs, zone hygiene, split-horizon leakage, scoped DNS API tokens, and CT-log monitoring. Invoke when auditing a zone, when a domain or registrar account changes hands, or after decommissioning a SaaS service a CNAME pointed at.

goldenwing-360 Skill

Secure object storage buckets on S3, Cloudflare R2, GCS, and MinIO against public exposure and credential abuse. Covers public access audit, bucket policy vs ACL vs IAM, presigned URLs with scoped credentials, CORS for direct browser upload, encryption choices, versioning and object lock, and access logging. Invoke when creating a new bucket, auditing inherited buckets for exposure, or wiring an app to storage with presigned uploads.

mrgoonie Skill

Guide for using Repomix - a powerful tool that packs entire repositories into single, AI-friendly files. Use when packaging codebases for AI analysis, generating context for LLMs, creating codebase snapshots, analyzing third-party libraries, or preparing repositories for security audits.

mr-graphnstaff Bundle

Manage HUB Security Architecture weekly status reports in Confluence and Word. Use for `WSR-now`, `WSR-now-config`, `WSR-export`, or requests to create, update, or export the weekly report.

peytonli Bundle

Use when you need a complete top-down architecture audit of any codebase, including full exploration of major paths, endpoint mapping, current-vs-target user journeys from documentation, and deep issue remediation plans with step-by-step fixes. Trigger phrases: architecture audit, full codebase walkthrough, map all endpoints, user journey analysis, current vs desired product flow, find and fix project issues, end-to-end architecture review.

ruslanamandell Bundle

Apply remediations from an unslop audit report. Fixes mechanically safe issues automatically on a dedicated branch with one commit per finding, proposes patches for issues that need a single human decision, and lists the credential rotations and dashboard changes that only a person can perform. Use after unslop-audit, or when the user asks to fix, remediate, harden, or clean up the findings from a codebase audit.

ruslanamandell Bundle

Audit a codebase for the production failures typical of AI-generated software - hardcoded secrets, disabled row level security, IDOR and missing authorization, unvalidated inputs, missing error handling and rate limits, N+1 queries and unindexed columns, hallucinated dependencies, duplicated patch-on-patch code, and missing tests or version control. Use when the user asks to audit, review, harden, or production-check a codebase, mentions vibe coding cleanup, asks "is this safe to ship", or is preparing an AI-built app for real users. Read-only - never edits code.

ruslanamandell Bundle

Install and run pre-ship guardrails that stop new AI-generated slop from re-entering a codebase - a warn-only pre-commit hook that blocks only on secrets, and a GitHub Actions workflow that runs the unslop audit on pull requests and fails on critical findings. Use when the user asks to prevent regressions, add a pre-commit or CI security check, or gate deploys on an audit.

skillmedev Skill

Maps which regulations apply to a product or business across every operating jurisdiction, translates them into concrete obligations, and produces a prioritized compliance-gap table. Use when someone asks "what regulations apply to my product", "are we GDPR or CCPA exposed", "run a compliance gap analysis", or is entering a new market or handling a new data type. Do NOT use for drafting the legal documents themselves - use terms-of-service instead. Do NOT use for assembling SOC 2 audit evidence - use soc2-evidence-helper instead. Do NOT use for patent landscape questions - use patent-prior-art instead.

tgpski Bundle

Classifies an individual FIPS crypto audit finding as real cryptography or a non-cryptographic use of a crypto primitive, using structured diagnostic reasoning. Follows the abductive triage methodology of resolving coordinate mismatches first, since most findings are non-crypto, then tracing data flow and protocol requirements only when a usage is genuinely ambiguous. Use when an audit surfaces a CRITICAL or WARNING finding that needs classification, when a vendored dependency's crypto usage may not ship in the binary, or when producing evidence for a compliance review.

inetgas Skill

Use when: user wants to select architecture patterns, compile a spec, iterate on constraints/NFRs, audit why patterns were selected/rejected, or finalise an architecture for implementation. Not when: no repeatable decisions needed, or constraints/NFRs are not yet known (gather those first).

jgsystemsconsulting Skill

Autonomously harden an engineering specification through a roundtable of independent engineering-discipline reviewers (architecture, security, test/QA, operations, product). Each reviewer is a real subagent thinking independently; the orchestrator collects findings, revises the spec itself, and loops until convergence (no CRITICAL or MAJOR findings) with NO user checkpoints. Use when you say "review this spec", "harden this spec", "spec review", "run the roundtable on this spec", or want a spec battle-tested before implementation. Self-contained, with no dependency on any other skill.

jgtolentino Skill

Fast, top-10 exploitable risks across Odoo ACLs, sudo misuse, SQLi, secrets in CI, root containers, open firewalls, unencrypted backups.

kylezantos Bundle

One-stop mobile review — the umbrella for the thumb-first suite. Runs a design-judgment pass AND a platform-technical pass over a mobile app/screen/PWA, then merges them into ONE prioritized report that keeps design forks (opinions) and platform defects (objective, P0–P3) visually distinct. Use when the user wants to review, audit, critique, or design a mobile app, screen, or PWA — 'review my mobile app', 'is this good mobile UX', 'audit this screen', 'check my PWA'. Routes to: full review (default), design-only (thumb-first-design), or platform-only (thumb-first-platform). Platform-agnostic on judgment; web/PWA-deep on technical, with native handoff.

kylezantos Bundle

The design-judgment layer of the thumb-first mobile suite — decides WHAT the right mobile pattern is and WHY, platform-agnostic across web and native. Reasons through named designer lenses (Hoober, Hurff, Wroblewski, Clark, Rausch, Budiu, Allen, de With, Nelson) with context-aware weighting, and surfaces decision forks where there's no single right answer. Two modes: plan a feature's mobile design before code, or audit an existing one. Use for navigation-pattern choices (tab bar, drawer, bottom sheet), thumb-reach and action placement, mobile forms, gestures vs visible controls, and mobile design critique — or when the user mentions mobile design, mobile UX, thumb zones, one-handed use, bottom sheets, or mobile navigation. Usually run via the /thumb-first umbrella (which also runs platform checks); invoke directly for design judgment only. For web/PWA technical defects use thumb-first-platform.

lee-miya Skill

Runs the KBS Monday weekly update: KEV/N-day, AI audit case studies, CTF tricks, EDR, phishing, perimeter devices, and third-party offensive skill library changelogs (Claude-Red, Claude-BugHunter, Claude-OSINT). Use when the user asks for 周更, 每周情报, weekly intel, or to scan similar GitHub skill repos. Follows 维护/每周更新SOP.md and never copies exploit payloads from third-party skills into the repo.

ailabs-393 Bundle

This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation.

crazyswami Bundle

Complete WordPress white-labeling using FREE plugins only - ASE, Branda, White Label CMS, Admin Menu Editor. Covers login page branding, admin cleanup, security hardening, and client handoff preparation.

litsec Skill

Keep Maven POM files up to date by checking and upgrading all dependencies and plugins to their latest versions. Use this skill whenever the user mentions updating, bumping, upgrading, or checking Maven dependencies or plugins — even if they just say "update my POMs", "are my dependencies up to date?", "bump versions", or "check for newer versions". Trigger also when the user shares or references a pom.xml and asks about version currency. Handles multi-module Maven projects, asks before applying major version upgrades, and keeps a clear audit trail of every change made.

coreeng Bundle

Use when consolidating, generating or refreshing product and journey documentation in a static documentation site from documentation scattered across many source repositories. Reads the consumer repository's `.doc-settings/` and product definition, discovers relevant material across the source repos, and rewrites it into Diátaxis-typed pages under the configured output root, never authoring from scratch — every claim traces to prose that already existed, code and manifests corroborate but are never written from, and material that exists only as code is reported as a gap. Journeys spanning several products are published to their own section, routing readers to the product documentation rather than restating it. Every page carries a computed confidence score. Also refreshes docs it wrote previously — detecting whether sources actually changed, protecting human-edited pages, regenerating minimally — plus a legacy `audit` mode that classifies existing documentation in a single repo without writing.

crafter-station Skill

Manage Spaceship domains, DNS, contacts, transfers, marketplace listings and Hyperlift apps from the command line. Use when the user mentions Spaceship, asks about their domains, wants to check what is expiring, edit DNS records, transfer a domain in, list a domain for sale, or audit a domain portfolio for risk. Covers all 50 operations of the Spaceship public API.

crafter-station Skill

Audit and operate a whole Spaceship domain portfolio at once: find what is expiring, what lost its transfer lock, what is suspended, and what is past expiry but still recoverable. Use when the user asks about many domains rather than one, wants a sweep before a renewal cycle, asks what needs attention, or wants to apply the same change across a set of domains without hitting the API's per-domain rate limit.

crafter-station Skill

Manage Spaceship domains, DNS, contacts, transfers, marketplace listings and Hyperlift apps from the command line. Use when the user mentions Spaceship, asks about their domains, wants to check what is expiring or what needs attention, edit DNS records, transfer a domain in, register or renew a domain, list one for sale, or audit a whole domain portfolio for risk. Covers all 50 operations of the Spaceship public API, with a trust ladder so writes need explicit approval.

danhuaxiansheng Bundle

证明某个目录、文件、导出符号、函数、组件、常量、hook、类型或 helper 是否“没有真实消费者”，再决定是否删除。用于死代码清理、未使用代码检测、未使用导出审计、删除安全检查和消费者搜索；只回答消费关系和删除安全性，不判断“仍被使用但是否有必要”，这类问题使用 necessary-code-audit。

danhuaxiansheng Bundle

审计“仍有消费者的代码”是否真的需要继续存在，重点是 wrapper/facade、兼容层、陈旧公共 API、防御分支、fallback、默认值、配置、重复来源和假设性扩展点。用于已被使用但必要性不足的代码、遗留兼容清理、无意义包装、防御代码移除、无兼容要求清理、深度必要性检查，以及“这个还需要吗？”类请求；不要把它作为纯 unused/dead-code 证明工具。

danhuaxiansheng Bundle

通过追踪状态来源、业务不变量、查询、变更、权限、错误、重复计算和防御代码，审计并清理页面、功能流、组件。用于前端清理、页面清理、功能流清理、source-of-truth 审计、query/mutation 清理、权限/错误状态审查、防御 UI 移除和持续深度清理。

datadog-labs Bundle

Scan and remediate local code-security findings with Datadog. Use when the user explicitly asks to scan or fix code, when a Datadog finding link identifies local code to verify, or after finishing a task that changed source, IaC, or dependency files to offer one optional changed-file scan.

datadog-labs Bundle

Verify and enrich a local Datadog Code Security finding with Datadog platform context. Use when the user asks whether a local finding exists in Datadog, or wants its triage or exposure status.

devolutions Bundle

Audits coordinated PowerShell version pins across workflows, .gitmodules, README.md, and the checked-out upstream PowerShell target framework.

dewitt4 Skill

Perform comprehensive code reviews focusing on best practices, security, performance, maintainability, and code quality

deyil Bundle

Review Github Agentic Workflows (gh-aw) and shared components for architectural fit, security guardrails, correctness, operational quality, and alignment with proven factory workflows when relevant.

maguowei Skill

Code Manager 仓库 pnpm/Cargo 依赖升级技能。依赖巡检、单包升级、Tauri 栈对齐、安全补丁修复、评估 Vite/TypeScript/Rust 主版本 breaking change，或复盘升级失败（构建/测试挂、锁文件漂移、版本回滚），只要涉及 package.json、Cargo.toml、lock 文件或要跑 pnpm audit/cargo update，都使用本技能。

mastra-ai Skill

Add smoke-test coverage for a new Mastra feature, API route, or Studio UI surface. Use when the user asks to "add coverage for X", "write a smoke test for the new Y endpoint", "test the new Z page", when a Mastra release notes mention features not currently exercised, when investigating a regression that wasn't caught because there was no test for that path, or any time you are about to write or modify a `.test.ts` / `.spec.ts` file under `tests/` or `tests-ui/`. This skill explains where tests live (`tests/` API vs `tests-ui/` UI), how to register fixtures in `src/mastra/`, how to update the COVERAGE.md tracking docs so the suite reflects reality, the assertion patterns that are banned because they pass against garbage data, and the self-audit pass to run before committing.

maxbuildog Bundle

Measures whether any website can be found and cited by AI assistants, and reports why not. Runs deterministic checks on AI crawler access, structured data, server-rendered content and answer-shaped structure, then probes real audience questions through search to see who gets cited instead. Triggers: "why doesn't ChatGPT cite my site", "GEO audit", "AEO audit", "answer engine optimization", "generative engine optimization", "am I visible to AI", "are we in AI Overviews", "should I add llms.txt", "am I blocking GPTBot", "my competitor gets cited and I don't", "is my site AI search ready", "does Perplexity know my site". Not for Shopify product-level audits with store prevalence (use shopify-geo-audit), and not for classic Google ranking or rich results.

maxbuildog Bundle

Measures whether an online store can be found and recommended by AI assistants, and reports why not. Runs deterministic checks on AI crawler access and product structured data, then probes real buyer questions through search, and compares every finding to a benchmark of 90,831 audited product pages. Triggers: "why doesn't ChatGPT recommend my products", "GEO audit", "AEO audit", "AI visibility", "am I in AI Overviews", "is my store visible to AI", "should I add llms.txt", "am I blocking GPTBot", "my competitor gets cited and I don't", "AI search optimisation", "does Perplexity know my store". Not for classic Google ranking or rich results (use shopify-store-audit).