Security

irahardianto Bundle

Interface review of a change rather than a screen: uncommitted work, the current branch, or a pull request. Covers interface quality, not correctness, tests, or security.

get-convex Skill

Static analysis checklist for Convex backends covering 72 rules across security, performance, correctness, schema, architecture, configuration, and client-side patterns. Use when writing, reviewing, or auditing Convex code. Trigger on mentions of "convex-doctor", "health score", "static analysis", "anti-patterns", "audit convex", or before shipping backend changes.

4444j99 Bundle

Verify claims in a session/PR/transcript against on-disk reality. Produce a verification report (verified / false-positive / false-negative / partial) with explicit owners. STOP at verification — do not execute remediation without explicit approval.

2389-research Skill

Use when preparing a codebase for first-time public/open-source release. Full lifecycle from audit through documentation, hardening, and final review.

architektapx Skill

Verify the auth-guard credential protection is fully working. Checks betterleaks and jq availability, hook presence and registration, sandbox and deny-rule settings, which custom-checks file resolves and whether it is valid, and runs redaction and custom-check self-tests with synthetic inputs. Use for "auth-guard doctor", "check auth-guard", "is my secret protection working", "are my custom checks valid".

architektapx Skill

Scan all Claude Code session transcripts for leaked secrets using betterleaks (grep fallback). Reports rule ids and file paths, never the secrets themselves. Use for "audit transcripts", "did anything leak", "scan my sessions for secrets".

askaboutai Bundle

Run this skill whenever a user wants to optimize their resume for a specific job. Triggers on: "optimize my resume", "tailor my resume for this job", "ATS check", "rewrite my resume", "match score", "keywords missing from my resume", "help me apply for this role", "is my resume good enough for this job", "resume audit", "will my resume pass ATS", "fix my resume", "resume review", or any time the user uploads or pastes both a resume AND a job description together. Also triggers when the user says things like "I keep getting ghosted after applying" or "not getting interviews". Run even if the user only says "can you look at my resume" while providing a job description — they almost certainly want the full optimization. Do NOT run for general resume writing advice without a specific job description.

brinshadewater Bundle

Audit, clean, upgrade, and repackage your own skills on an ongoing basis. Use whenever the user says "look at my skills", "audit my skills", "are any of my skills stale / bloated / redundant", "upgrade a skill", "clean up a skill", "repackage this skill", "should I retire any skills", or wants to wire skills together. Encodes the packaging contract, the patch protocol, and the failure modes that silently corrupt a skill library. SKIP for building a brand-new skill from scratch (use skill-creator) and for memory-vault work (use project-memory). This skill audits and repackages skills that already exist.

juspay Skill

NeuroLink's review standards — the critical rules to enforce, what NOT to comment on, the security bar, hot paths. Load before reviewing any change in this repository.

k-telux Bundle

Design new measurement paths or reconstruct, audit, and revise Blender optical-table systems from measurement requirements, 2D schematics, and provenance-bound CAD. Use for high-fidelity optics-only models, Thorlabs-compatible optomechanics, optical topology, whole-system validation, or publication renders with scoped physical evidence.

karagos Bundle

The Sun Tzu Lens: strategic intelligence for executive decisions. Applies Sun Tzu's 13 chapters to business situations: mergers, market entries, competitor moves, pricing, restructuring, negotiations, failures. Seven modes: War Council, Strategic Analysis, Enemy's Eyes, Five Factors Audit, General's Debrief, Terrain Map, and Negotiation Table. Web search before every response. Trigger when the user says "war council", "strategic lens", "enemy's eyes", "audit", "debrief", "terrain", "negotiate", "sun tzu", "sun tzu help", "show me the commands", "what can the sun tzu lens do", "how do I use sun tzu". Also trigger on strategic analysis through a Sun Tzu or military strategy framework, analyzing a decision like a general, competitor analysis from the opponent's perspective, or pre-decision readiness assessment. By Stefanos Karagos, CAIO (wearecaio.com).

kevmoo Skill

Detects, audits, and safely remediates structural code duplication across Dart and Flutter repositories using the standalone Dedupe engine (pkg:dedupe) and empirical test gating. Use when asked to run dedupe, clean up duplicate Dart code, analyze copy-paste blocks, evaluate code redundancy, or audit structural code health across Dart and Flutter Git repositories. Don't use for non-Dart projects, non-Git checkouts, or simple single-file syntax lints.

keysjoao Skill

Audit existing UI code against all 30 Laws of UX, scoring compliance 0-60 with prioritized code fixes. Use when user says "review UX", "UX audit", "audit this page", "check UX compliance", "score this UI", "how good is the UX", or "laws-of-ux review".

kshanxs Bundle

Acts as a Research Adversary, Critical Thinker, and Synthesis Partner. Use this skill when evaluating, exploring, or critiquing ideas, claims, arguments, plans, decisions, beliefs, research topics, business ideas, historical interpretations, or conclusions. Trigger this skill whenever the user wants to understand a topic in-depth, stress-test an idea, audit evidence, or construct a balanced, multi-perspective synthesis.

kshanxs Bundle

Polish, humanise, or proofread any pasted text, draft, or document. Triggers when the user asks to humanise, polish, refine, rewrite, de-risk, sound less like AI, remove AI signatures, bypass AI detectors, audit writing style, check prose, fix grammar/typos, or polish code comments and docstrings. Use for creative fiction, academic essays, non-fiction articles, conversational copy, or code comments. Five modes: Creative, Academic-Formal, Non-fiction/General, Conversational/Casual, Proofreading. Does NOT structure assignments or plan narratives (delegate those to TrueDraft or Book Writer).

dograh-hq Bundle

Audit Dograh `AGENTS.md` files for drift against the live repo and for bad scope boundaries between parent and child docs. Use when the user asks to review existing AGENTS files, identify stale guidance, decide whether a subtree needs its own `AGENTS.md`, or update the `AGENTS.md` hierarchy under the repo root, `api/`, or `ui/`.

dograh-hq Skill

Merge the latest upstream pipecat-ai/pipecat tag into the pipecat submodule fork (dograh-hq/pipecat) and bump the dograh repo to it. Use whenever the user asks to bump, upgrade, sync, or merge pipecat, resolve pipecat merge conflicts, audit whether upstream changes break or supersede Dograh's in-fork patches, or verify the api/ wrapper subclasses still match the upstream classes they wrap.

doodledood Skill

Audit a plan, design, architecture, or process for whether every requirement and mechanism earns its keep — an ordered deletion pass (question requirements, delete or absorb parts, simplify only what survives, accelerate/automate last) that reports what to cut and what to question without rewriting the artifact. Use before finalizing a design or plan, when a proposal feels over-built or accreted, or when the user asks for a deletion pass, a simplicity audit, a Musk-algorithm pass, or "what can we remove."

dososo Bundle

严格审视 HarmonyOS、OpenHarmony 与 ArkUI 产品或代码，只报告有证据的设计、导航、跨设备适配、输入状态、动效、异步状态真实性、无障碍和动画性能问题，并给出规则 ID、ArkUI 落点与通过结论。用于用户明确要求 review、audit、审查、验收或评估鸿蒙 UI；不要用于从零设计、直接实现功能、修复构建签名或审查非界面代码。

ecelayes Skill

The definitive guide for building Hypermedia-Driven Applications (HDA) using HTMX, prioritizing security and UX patterns.

eldermoraes Bundle

Audit an existing Quarkus + LangChain4j project against this stack's agentic conventions — a read-only conformance or gap-analysis review. Use when the user asks to audit, review, check, assess, or validate a Quarkus project against the LangChain4j agentic conventions, or wants to know whether an existing project conforms to (or is ready to adopt) this stack. User-invoked only.

epam Skill

Scan the codebase for DFP (Decimal64) misuse — raw Java comparison operators used on DFP-encoded long values instead of Decimal64Utils helper methods. Run periodically to catch regressions.

esmuellert Skill

Dispatch tasks to high-performance subagents. Use when asked to investigate, implement, audit, or delegate work to subagents.

rs2pydev Skill

Critical audit of a Python codebase — type annotations, docstrings, SOLID/DRY, error handling, logging, pytest, ruff, pyright. Re-invoke until converged.

saltbo Bundle

Integrate a browser, mobile, desktop, CLI, or server-side application with Realmroot as its OAuth 2.1 and OpenID Connect provider. Use when building or changing product sign-in, callback, session, refresh, logout, device authorization, PKCE, client-secret handling, or end-to-end authentication against a Realmroot deployment.

scaryrawr Bundle

Perform a thorough code review of diffs or branch comparisons for correctness, structure, regression risk, and edge-case coverage. Use when the user asks to review uncommitted changes, inspect a PR/diff, compare a branch to default, or audit recent changes for regressions. Not for general conceptual explanations of code-review practices or static-analysis tooling.

sfrangulov Skill

Audit which Claude Code skills you actually invoke. Use when the user wants to find dead/unused skills, hallucinated skill invocations, per-project skill stats, or token cost of installed skill metadata. Triggers on "what skills don't I use?", "clean up my skills", "why didn't this skill work?", "audit skills". Runs locally; reads ~/.claude session JSONL logs. No network calls.

shanmukhaditya Bundle

Operate a hierarchical software-development team of up to ten agents to understand a codebase, turn product requirements and bug reports into safe production-ready changes, and verify the result end to end. Use for multi-file feature implementation, bug fixing, refactoring, migrations, integrations, performance, security, reliability, technical debt, release readiness, or complete engineering delivery; consume implementation-ready PRDs when available, preserve an approved 70:30 product-to-quality portfolio across multi-item programs, and scale to a focused team for bounded changes.

shelf-nu Skill

Use when formatting a GitHub release for Shelf — turns GitHub's auto-generated "What's Changed" list into the house format (categorised sections, highlights, security block). Invoke for "format the release notes", "write the release notes for X", or when preparing a draft release.

skalesapp Skill

Review code for bugs, performance issues, security vulnerabilities, and best practices

snapsynapse Bundle

Audit one or more capabilities for implementation coverage gaps. Reads capability definitions and the implementation index, cross-references against platform files, classifies each missing product as a mapping gap (existing feature not tagged) or data gap (feature not documented), presents findings, and applies fixes after confirmation.

pambrose Skill

This skill should be used when the user asks to "find bugs", "review for bugs", "find logic errors", "check for race conditions", "find resource leaks", "audit error handling", "find null safety issues", or wants a systematic codebase review focused on functional bugs that files findings as Linear issues.

pambrose Skill

This skill should be used when the user asks to "review design", "find design problems", "check architecture", "find tight coupling", "find god classes", "audit separation of concerns", "review code structure", or wants a systematic codebase review focused on design and architecture issues that files findings as Linear issues.

patebry Skill

Turn a body of source material into a short, defensible document. Not for reviewing code, diffs or pull requests, tasks ending in a code change, or exploring and documenting a codebase — use code-review, security-review, simplify or init. Not for a single short document or a straight summary. Use for contract bundles, RFPs, spec bundles, research corpora, interview transcripts, incident evidence — dense material whose correctness cannot be assumed, where the output will be acted on and being wrong is expensive. Triggers on "distill", "synthesise these", "what do these documents actually say", "produce a memo from this", "verify this memo against its source corpus".

patebry Skill

Review a GitHub pull request or code diff for actionable correctness, security, data-integrity, lifecycle, contract, architecture, and test defects, then publish one terse final review when permitted. Use for PR review, audit, judgment, or assessment; request changes only for proven merge blockers, distinguish defects from verification gaps, use comment-only reviews for self-authored PRs, and do not publish clean results.

petekass Skill

Pre-launch and post-launch audit for web projects per Launchgrade Web Standards 2026. Runs Lighthouse, Mozilla Observatory, and PageSpeed Insights, parses JSON output, maps findings to MUSTs/SHOULDs from AGENTS.md, returns a bucket report (Blockers / Recommended / Nice-to-have). Triggers on "audit", "pre-launch", "check", "Lighthouse", "score", "how fast", URL + check verb, "Audit", "prüfen", "wie schnell".