Security

xrplevm Skill

Run a full security audit across all focus areas in parallel, reporting findings to peersyst/security

xrplevm Skill

Create a security finding in the private peersyst/security repo with proper labels and format. Use when reporting a security vulnerability, concern, or observation found during audits or ad-hoc review.

ysys143 Bundle

Develop, test, benchmark, and operate PostgreSQL extensions with reusable harnesses and reference protocols. Use for C/PGXS or Rust/pgrx extension work, planner hooks, CustomScan or index AM design, pg_regress/pg_isolation_regress TDD, filtered ANN/vector benchmarks, matched-recall and pages-per-query analysis, bounded parameter-space exploration, Pareto curves, hypothesis/evidence/report management, accelerator-vs-CPU crossover, resource Pareto tuning, Shape B microservice extensions, Shape C sidecar daemons, service-boundary contracts, async outbox workers, and SECURITY hardening. Balances docs, code evidence, and execution results. Includes copy-ready test, benchmark, contract, and ops assets. Not for projects without a PostgreSQL extension layer.

zauberzeug Skill

Fix one or more Dependabot security alerts by updating the affected packages, rebuilding bundles and vendored files, and preparing a commit. Use when asked to fix Dependabot alerts (e.g. "fix Dependabot alert 252", "fix all new Dependabot alerts").

zhukunpenglinyutong Skill

在添加认证、处理用户输入、处理密钥、创建 API 端点或实现支付/敏感功能时使用此 skill。提供全面的安全检查清单和模式。

mahdihedhli Skill

Operate a Black omARCHy workstation (Omarchy desktop plus the official BlackArch repository and curated tools). Use when the user mentions Black omARCHy, blackomarchy, BlackArch on Omarchy, installing or removing security profiles, verifying the layer, omarchy update with BlackArch, or asks how this host differs from Kali. Slash: /black-omarchy

ageerle Skill

Prove that a coding task is actually complete. Use this after meaningful code changes, when tests/builds fail or are skipped, before marking a plan or goal complete, and whenever acceptance depends on runtime, security, recovery, performance, or cross-module evidence.

pearlthoughts Skill

Use this when user requests code review, pull request analysis, or quality assessment. Provides systematic 6-category checklist: functionality, security (OWASP), code quality (SOLID), performance, testing, and maintainability. Apply for PR reviews, security audits, or teaching code quality principles

mastra-ai Bundle

Security-focused code review checklist for identifying vulnerabilities

nikiforovall Bundle

Keycloak identity and access management (IAM) administration guidance — realm management, client configuration, authentication flows, authorization policies, security hardening, and troubleshooting. Use when configuring Keycloak, setting up SSO, managing realms/clients, troubleshooting authentication issues, or implementing RBAC. Trigger phrases include "Keycloak", "SSO", "OIDC", "SAML", "identity provider", "IAM", "realm", "access management".

provablehq Skill

Fix GitHub issues or PR review feedback in snarkVM using TDD workflow. WHEN: User says "fix issue", "fix #123", "fix pr", "fix PR feedback", "address review comments", "resolve review threads", or wants to fix a bug/feature request from GitHub issues or address reviewer requests. WHEN NOT: Doing security review (use snarkvm-review), fetching context only (use snarkvm-github), or working on non-snarkVM code.

sterlingchin Skill

Audit a software project for hardening — security, AI gaps, test coverage, code quality, and decoupling. Use when user wants to harden a project, audit for vulnerabilities, check test coverage, or separate private data from code.

prismer-ai Skill

Cryptographic signing for every tool call with Ed25519 audit trail

quintinshaw Skill

Argument shapes for the 5 built-in workflow patterns — deep-research, adversarial-review, code-review, multi-perspective, codebase-audit — runnable via the `workflow` tool's `name` input, without slash-command syntax. Use for requests like "research X", "fact-check/adversarially review this", "review this diff/PR", "analyze from multiple perspectives", or "audit the codebase for Y". Not for authoring a new workflow script — see workflow-authoring.

ramimac Bundle

Identify security contact points for organizations. Finds security.txt, bug bounty programs, and other verified disclosure channels.

rbouschery Skill

Produces an unusually strict implementation plan focused on structural simplicity, minimal moving parts, and maintainable execution. Use for a thermo-nuclear plan, plan quality audit, strict planning review, deep implementation plan, or when the user wants an ambitious plan that avoids complexity.

rhino-ty Bundle

How to audit a UI codebase by measurement instead of impression. Covers the five counting pitfalls that produce wrong numbers (subset filters, regex eating template syntax, scraping legitimate values, missed optional suffixes, summed opacity variants), render-time verification in a real browser, the screenshot trap where OS display scaling manufactures a layout bug that does not exist, and a per-project baseline file that records metrics and verdicts so the same argument is not re-litigated every audit. Use when asked to audit, measure, or review a UI codebase, when a layout looks broken, or when checking whether color/state classes actually apply. Triggers: UI audit, design audit, measure this UI, layout looks off, UI 감사, 디자인 점검, 레이아웃이 깨져 보인다. This skill does NOT decide what good design is — the project baseline does.

risal-ea Bundle

Scan a project codebase, detect all security vulnerabilities, and generate SECURITY_REPORT.md with categorized risks

rizsotto Skill

Write, modify, or review a requirement file under docs/requirements -- pick the single owning file, keep the text contract-only, name IDs so they need no explanation, and verify cross-references and test coverage. Use when the user asks to add, change, audit, or review a requirement, or when the decision protocol calls for writing one.

robertodragit Bundle

Audit an application, codebase, product, or AI system for compliance with the EU AI Act prohibited practices (Article 5, Regulation (EU) 2024/1689) and transparency obligations for AI-generated content (Article 50(2), (4) and (5)), based on the official European Commission Guidelines C(2025) 5052 and the Code of Practice on Transparency of AI-Generated Content. Use this skill whenever the user asks to check, audit, review, or verify AI Act compliance, EU AI regulation compliance, prohibited AI practices, Article 5 risks, AI transparency obligations, content marking/watermarking duties, deep fake labelling, or whether an app/feature/AI system "respects the AI Act" — even if they only mention "compliance" or "AI regulation" generically in an EU context. Also use it when reviewing AI-powered features (chatbots, recommenders, scoring, biometrics, emotion detection, scraping, profiling, generative AI outputs) for legal/regulatory risk in the EU.

rstackjs Bundle

Audit ported storybook-rsbuild source files against the CURRENT upstream Storybook source, grouped by the local package that owns each port, independent of commit history. Use this skill whenever the user wants to verify nothing was missed in porting, audit drift against upstream, double-check sync triage, or suspects an upstream fix never landed here. Activate for phrases like "check drift", "audit against upstream", "are we missing anything from storybook", "source-level check", "verify ported files", "did we port this", and also right after a storybook-sync report has been consumed — a check run is how its triage gets verified. This complements (does not replace) the storybook-sync skill.

ruoji6 Bundle

.NET / ASP.NET 鉴权机制审计。用于用户要求检查登录校验、权限校验、[Authorize]/[AllowAnonymous]/Role/Policy、未授权访问、越权/IDOR、基于路由映射分析接口鉴权状态，或对只有 bin/dll/web.config/aspx 的闭源项目先反编译再审计鉴权。适用于 ASP.NET Core、MVC5/Web API2、Web Forms、Minimal API、Handler/ASMX；不用于单纯路由提取、通用漏洞审计、鉴权原理解释、登录功能开发、前端菜单权限或 NuGet CVE 检查。

nikiforovall Bundle

Review code for quality, security, and best practices. Use when asked to review code, find bugs, suggest improvements, or check for security issues.

numekudi Bundle

リポジトリ全体を IEEE-CS/ACM ソフトウェア工学倫理綱領（8原則・80項目）とダークパターン 観点で監査し、証跡付きで採点（合格/要改善/不適合）する。多エージェント敵対的監査により 誤検知（ethical grandstanding）を検証で潰す。結果は自己監査のツイート下書きにできる。 トリガー: 倫理監査, 技術者倫理チェック, ethics audit, 倫理チェック, /ethics-audit

obra Skill

Use when adding, changing, deploying, onboarding, or auditing homedir-manager content repos — the marker-based symlink deployment system that manages dotfiles and config across your machines. Covers the update workflow, the manifest, OS-splitting, secrets, new-machine onboarding, and the audit process.

zyphraxns Bundle

根据项目文件自动生成开源平台（如 GitHub）所需的各种说明文档。扫描项目结构、代码和技术栈，智能判断需要创建哪些文档文件（README、LICENSE、CONTRIBUTING、CHANGELOG、CODE_OF_CONDUCT、SECURITY 等 20+ 种），并为每种文件生成符合规范的内容。 当用户提到"开源文档"、"README"、"上传到 GitHub"、"准备开源"、"项目说明文件"、"文档生成"、"开源准备"、"CONTRIBUTING"、"LICENSE 文件"、"CHANGELOG"等意图时，务必使用此 Skill。即使用户只是说"帮我的项目写个说明"或"我想把项目开源"，也应触发此 Skill。

agoraio Bundle

Run the agentic evaluation repo for a target skill. Use when asked to execute repo-defined suites, collect evidence, write per-case results, and produce a short audit report for the target skill. Also supports evaluation modes: AB tests, subjective scoring, and vendor comparisons via evaluation YAML files in the eval repo.

b1rdmania Bundle

Tighten prose by stripping AI tics and applying Orwell/Gowers plain-English rules. Use when the user asks to rewrite, tighten, simplify, or detox writing — phrases like "plain English", "make this clearer", "cut the AI voice", "fix the writing", "rewrite plainly", "tighten this", "detox this". Also run as a self-audit pass before delivering long-form prose (essays, blog posts, articles, reports) so the output isn't recognisably AI-generated. Three modes: audit (flag + suggest), rewrite (deliver cleaned prose), edit (fix a named file in place). Technical documentation routes to the simple-english skill instead.

codeacme17 Bundle

Audit, initialize, plan, and verify production launch readiness for an existing Web repository through the local LaunchRally CLI. Use when a builder asks whether a repo is ready to launch, wants a launch-readiness report, needs a read-only remediation plan or bounded Provider options, or wants to verify changes after remediation.

conorbronsdon Bundle

Audit a repository or prepare it for an open-source release. Audit mode reports whether the README matches the code and whether stated rules are actually enforced; launch mode walks a repo to release-ready with opt-in checklist packs and README templates. Use when asked to "audit this repo," "is this repo ready to go public," "prepare this repo for release," "open-source this," "get this ready to publish," "check this README," or "what's missing before I launch this." Reports by default; writes only when explicitly asked.

secdev Skill

Use this when conducting a long-running autonomous security audit of Scapy, validating a suspected vulnerability, or preparing a source-backed security report.

silkyland Bundle

Research-first, evidence-first implementation planning in seven gated phases: frame the task, inventory the real codebase, verify ground truth from vendor source or official docs, adversarially audit existing code, analyze gaps, commit to design decisions, and write a phased plan document with timeline, risks, and verification. Enforces "no claim without evidence, no design before research". Use when the user asks to plan, design, architect, audit, or review before implementing a feature, refactor, migration, or system, or mentions deep-plan, /deep-plan, or Plan mode.

silkyland Bundle

Comprehensive development guide for integrating the API-Football v3 API (api-sports.io). Covers authentication (header-based API key), rate limiting, all 38 endpoints grouped by category, TypeScript types, caching, error handling, and security. Triggers on any task involving football livescores, fixtures, standings, odds, transfers, player stats, or team data from API-Football.

skein-js Skill

Audit Plan

slackapi Skill

Run Snyk security scans to find dependency vulnerabilities and source code issues. Use for monthly security reviews or when checking for new vulnerabilities.

slackwero Bundle

Use when remediating a security finding — SAST, SCA / dependency scanning, or secret detection — including fixing a vulnerability, bumping a dependency for security reasons, removing a hardcoded secret, triaging a false positive, or opening the merge request for any of these. Applies whenever a CVE ID, CWE ID, OWASP category, scanner output (GitLab SAST, Semgrep, Gitleaks, Dependency Scanning), or a `mcp__gitlab-security__*` tool is involved, even if GitLab is not named. Also triggers on "resolve this finding", "open an MR for this CVE", "remediate this vulnerability".