Security

guiomeb Bundle

Install, audit, or extend an AI-collaboration blueprint on a code repository — the AGENTS.md / CLAUDE.md / .agents/ structure that lets AI agents (Cursor, Claude Code, Codex Desktop/CLI, Windsurf) collaborate without drift. Three additive sizes (S/M/L) plus an opt-in L+ autonomy profile. Trigger when bootstrapping a new repo's AI scaffold, promoting an existing harness to the next size, or auditing one for sprawl.

aditya-m-bharadwaj Skill

Bootstrap a new "<vendor>-api-skill" project — a safe, cross-platform single-file Python CLI that mediates a third-party REST API, plus a matching Claude skill that drives it under explicit AI-safety constraints (token never enters AI context; every mutation passes through a six-tier safety classifier; every mutation is recorded in a local audit log). Trigger when the user asks to "build a CLI / skill for <some API>", "wrap the <X> API safely", or to mirror the linode-api-skill pattern for a new vendor.

adityamparikh Bundle

Guides Spring Boot version migrations: 2.7.x to 3.5.x, 3.5.x to 4.x, and minor upgrades within 4.x. Covers Java/Kotlin baseline upgrades, Jakarta EE namespace (javax to jakarta), Hibernate 5/6/7, Spring Security 5/6/7, modular starters, Jackson 3, Spring Framework 7, observability (Micrometer Tracing, OpenTelemetry), property and package relocations, JUnit 6, Testcontainers 2, MockitoBean, HTTP clients, resilience, AOT/native, API versioning, and OpenRewrite recipe automation. Supports all-at-once and gradual strategies with compatibility bridges. Java and Kotlin; Maven and Gradle. Trigger on requests like "upgrade/migrate to Spring Boot 3 or 4", "Spring Boot 2 to 3", "javax to jakarta", "upgrade to 4.1", "OpenRewrite Spring Boot", or any request moving a Spring Boot project to a newer major or minor version. Do NOT use for general Spring Boot development on a fixed version (new endpoints, services, JPA, tests) — use the spring-boot skill for that.

admin-remix Skill

Google Workspace administration - manage users, groups, email, Drive, calendars, and devices through natural conversation. Triggers on: Google Workspace, G Suite, user management, group management, admin tasks, offboarding, onboarding, email forwarding, Drive permissions, suspended users, organizational units, ChromeOS devices, audit logs, admin reports.

0xmythril Bundle

ClawdTM skills for OpenClaw agents -- search, install, and review skills with security awareness.

mbackschat Skill

Produce a well-isolated bug-and-findings report for the dmtool CLI (a12-dmkits / A12 kernel) and save it to a folder the user picks. Use when a user hits an error, crash, internal error, or unexpected behaviour in dmtool, when they want to capture findings / DX friction / improvement notes, or when they ask to write or file a bug report against dmtool. Covers reading the result envelope (telling an internal tool error apart from a rejected input), shrinking to a minimal repro, an affected-vs-unaffected table, classifying genuine defects vs. your own input mistakes, a verbatim replay log, and a self-audit — then writing the report to a folder the user can upload or send however they like.

petyosi Skill

Pre-PR code review for branch changes. Use when user wants to review changes before opening a PR, asks to check their branch for issues, or mentions code review. Analyzes diff against base branch for code quality, bugs, security vulnerabilities, logical fallacies, and style/convention violations. Provides detailed analysis with file:line references and improvement suggestions.

apex-stack-ai Bundle

Free version — audit your content for AI search citability with the GEO Scorecard. Covers 4 of 8 dimensions.

aplaceforallmystuff Bundle

Run the 11-gate Really Effing Useful gauntlet to validate project utility before investing significant effort

appariciojunior Bundle

Comprehensive website content and UX audit. Use this skill whenever someone asks to review, audit, check, or improve a website, landing page, or web product. Triggers include: "audit my website", "review my site", "check my content", "is my website ready to launch", "what's wrong with my site", "content review", "UX review", "website feedback", "check for broken links", "check for lorem ipsum", "review my copy", or any request that involves evaluating an existing website's content quality, UX structure, copy, or readiness for launch. Also trigger when someone shares a URL and asks for feedback, improvements, or a teardown. This skill combines content editing, UX strategy, creative direction, and technical QA into a single structured audit.

arcadeai Skill

Deep code quality review with web research. Use when user explicitly requests verification against latest docs ('double check against latest', 'verify versions', 'check security'), needs deeper analysis beyond automatic hook, or is working on projects without SAFEWORD.md/CLAUDE.md. Fetches current documentation (WebFetch), checks latest versions (WebSearch), and provides deep analysis (performance, security, alternatives).

art-of-technology Bundle

Multi-layered anti-fraud and bot detection system for registration flows. Use when implementing: (1) Registration form security, (2) Bot detection and shadow banning, (3) Behavioral analysis (keystroke, mouse tracking), (4) Risk scoring systems, (5) Honeypot field implementation, (6) Disposable email detection, or any fraud prevention for user registration

artemavrin Bundle

Execution-topology selector for non-trivial tasks: decides the simplest sufficient execution shape — a single disciplined loop, a loop with parallel fan-out, or a milestone graph with shared state — states its cost, and executes it. Use whenever the user invokes /occam, or brings a task that is clearly multi-part or large-scale: "audit this thoroughly", "migrate all X", "research this across many sources", "build this feature end to end", "refactor the whole module", "process every file in this folder". Also use when the user asks how to split work between parallel agents or whether a task needs multiple agents. Most tasks are a loop; never reach for a graph unless the work forces it.

artmann Bundle

Review code changes in a feature branch before merging. Use when asked to review a branch, review changes, check a PR, or audit code before merge. Compares the current branch against the default branch (main/master) and categorizes issues by severity (Critical, Major, Minor) with actionable solutions.

artsy Bundle

Tighten prose by stripping AI tics and applying Orwell/Gowers plain-English rules. Use before posting any PR review, review summary, or inline review comment, as a self-audit pass over the text you are about to post. Also use when asked to rewrite, tighten, simplify, or detox writing.

asgard-ai-platform Bundle

Update the Yggdrasil gallery from upstream open-source repos under github.com/asgard-ai-platform. Use when new MCPs/skills have been published, when upstream READMEs/SKILL.md have been updated, or when you need to surface inconsistencies (skeleton skills, missing translations, broken cross-refs) for the maintainer to fix. Triggers on '同步 gallery', '更新到網頁', 'sync the gallery', 'pull in new MCPs', 'audit open-source repos'.

cicoccc Bundle

一键检查 OpenClaw 安全配置，防止被黑客监控。基于 Composio 专业安全指南的 16 项全面检查。

cocoon-ai Skill

Analyze and edit Unreal Engine Blueprints via the digbp persistent server. Use when the user asks to inspect, export, search, understand, or MUTATE Blueprints — including editing variables, functions, components, nodes, and pin connections, reparenting, implementing interfaces, compiling, and saving. Also handles finding function callers, variable get/set sites, native events, asset references, generating C++ migration stubs, **auditing which BPs reference a C++ symbol before deletion (cpp-audit)**, **generating C++ UPROPERTY declarations from BP metadata (cppgen upropertys)**, and the **BP→C++ variable lift workflow** (edit variable lift / unshadow for recovery from the shadow-rename trap).

btmoriarty Bundle

Validate or draft prose in the user's own voice rather than generic or flattened writing. Validation mode triggers on a voice check, voice audit, tone check, "does this sound like me," or a draft submitted to check whether it sounds like them. Authoring mode triggers when the user asks to write, draft, or rewrite prose in their voice, or wants text they will send as themselves (emails, posts, papers) to come out in their voice. Also triggers to build or update the voice profile from samples. First run builds the profile; later runs draft from it and validate against it.

bydtesla1609 Bundle

Supervise whether an AI response, research pass, or proposed solution has adequately advanced the user's research plan. Use when the user asks to 监督/检查/评估 AI 是否真正解决了方案, keep a research workflow moving, audit progress against a plan, or decide the next effective research step. Do not use for ordinary code review, final document polishing, or pure requirement clarification with no research/solution progress to evaluate.

camiloespinoza Bundle

Expert guidance for IFRS Accounting Standards analysis (IAS/IFRS plus relevant IFRIC/SIC), including scope-first transaction assessment, recognition and measurement, presentation and disclosure analysis, accounting policy drafting, technical memo drafting, and audit-ready issue triage.

carapace-sh Bundle

Use when working with pnpm — the fast, disk-space-efficient Node.js package manager. Covers the symlinked node_modules layout (isolated/hoisted/pnp, hoist, shamefullyHoist, nodeLinker, virtualStoreDir), the content-addressable global store, pnpm-lock.yaml (lockfileVersion 9.0, importers, packages, snapshots), pnpm-workspace.yaml monorepos (-r, --filter, workspace: protocol), catalogs (catalog: protocol), overrides, packageExtensions, patching (pnpm patch / patch-commit), peer dependency isolation (autoInstallPeers, strictPeerDependencies), .pnpmfile hooks (readPackage, afterAllResolved, custom resolvers/fetchers), the CLI (install, add, update, run, exec, dlx, create, publish, pack, list, why, outdated, audit, store, fetch, prune, config, env, runtime), configuration (pnpm-workspace.yaml, .npmrc auth, pnpm_config_*, the v11 config split, minimumReleaseAge, trustPolicy, allowBuilds), env variables (PNPM_HOME, XDG_DATA_HOME, PNPM_PACKAGE_NAME), and how pnpm differs from npm, Yarn Classic, and Yarn Berry.

carolmonroe22 Bundle

Run a comprehensive Supabase security audit with ASCII visual report. Checks RLS policies, function permissions, storage policies, API exposure, and auth config. Use before going to production or after any security concern.

carsxe Bundle

Performs a high-signal senior-engineer PR review of code changes, classifies how critical the changed surfaces are, and decides whether the PR can be self-merged or must go to a human reviewer. Use this skill for pull request reviews, branch diffs, pasted diffs, uncommitted changes, GitHub PR URLs, or requests like "review my changes", "check this PR", "is this ready", "can I merge this", "does this need a reviewer", "how risky is this change", "what could this break", "audit this diff", "sanity check before I push", or "does this look clean". Covers correctness, security, contracts, blast radius, prior failed fixes in the same code path, tests, maintainability, and regressions while aggressively avoiding noisy false positives. Designed to work reliably even with smaller/cheaper models.

alphilippo Bundle

Système d'alignement personnel avec 4 modules — purpose clarifier (clarifier ce qui compte vraiment au-delà des récits sociaux), ethics filter (passer une décision au filtre de ses valeurs déclarées), discipline reinforcement (identifier les patterns de dérive et les corriger structurellement), life audit (audit trimestriel ou annuel sur cohérence vie/valeurs). Utilise cette skill dès que l'utilisateur dit "je sais plus pourquoi je fais ça", "qu'est-ce qui compte vraiment", "j'ai perdu le nord", "cette décision me grise mais me gêne", "je tiens pas mes engagements avec moi", "je dérive sur X depuis longtemps", "fin d'année/trimestre", "bilan de vie", "suis-je aligné", "j'ai l'impression de trahir X". Pas de développement personnel creux, pas de citations gourou, pas d'émojis 🙏. À la place des questions dures et exercices d'écriture structurés. Garde-fou obligatoire sur signaux de détresse profonde.

am-will Skill

Import a LEGO or DUPLO set into this playground, deduplicate its inventory and CAD models, and audit how every specialty part connects and renders.

amanmaqsood Bundle

Draft, rewrite, voice-match, or audit prose so it is specific, natural, and faithful to the supplied evidence and writer. Use for articles, posts, emails, scripts, reports, and prose files; do not use it to infer AI authorship or promise detector evasion.

amatya-aditya Bundle

Plan and implement user-visible features, bug fixes, and GitHub issues for the RSS Dashboard Obsidian plugin, including TDD, risk-based Obsidian audit checks, validation, CHANGELOG updates, and manual testing. Use for requests to add, change, or fix plugin behavior or address a GitHub issue. Do not use for read-only explanations, status checks, general repository questions, or release-only work that does not modify plugin behavior.

amir-the-sanctions-guy Bundle

Adjudicates whether a hit generated by sanctions, PEP, or adverse-media screening is a true positive, false positive, or requires human escalation. Use whenever a user presents a screening alert, a name match against a watchlist (OFAC SDN, EU consolidated list, UK OFSI, UN list, PEP list, adverse media hit, etc.), or asks to clear a screening hit / reduce false positives / determine whether a flagged name is actually the listed party. Use even when the user describes the task casually — "is this person actually on the sanctions list", "did we get a real match", "clear this alert", "I have a hit on X" — these are all screening-adjudication tasks. Produces a deterministic determination with full audit trail (structured JSON + human-readable narrative). Designed for use by compliance analysts and screening systems.

anchit-choudhry Skill

Checks for outdated npm dependencies across the app-drawer workspace (root and packages/express-static-serve), facilitates user-guided updates, and verifies the project still starts cleanly and passes npm audit afterward.

andrewbakercloudscale Bundle

Analyse bash scripts in a repository and produce a prioritised actionable report with Critical, High, Medium, and Low findings. Triggers when the user asks to analyse, audit, review, or scan bash/shell scripts in a repo, or asks for a health check, quality report, or action plan for shell scripts.

andrewbakercloudscale Bundle

WordPress.org plugin submission standards, code quality, and documentation discipline. Covers Plugin Check (PCP) compliance, security hardening, code reuse via shared utility classes, DocBlock documentation, version tracking, and CHANGELOG discipline. Use when writing, editing, reviewing, or preparing any WordPress plugin for WordPress.org submission.

andrian-syh Bundle

Framework-agnostic Roblox/Luau coding standards. Use when writing, reviewing, or refactoring any Luau code (Script, LocalScript, ModuleScript) in a Roblox project, or when the user asks to keep best practices in mind as standing guidance — enforces the VARIABLES/FUNCTIONS/INITIALIZATION layout, naming, performance, memory, networking, and security rules regardless of framework, folder structure, or genre. Two modes: Default (apply these conventions as-is) and Adaptive (study the project's existing style first, confirm, then apply). Adapts to community libraries (ProfileStore, Packet, Trove, Knit, Fusion, ...) and honors supervision levels (!ask / !bal / !go). Not for non-Roblox Lua, Studio UI or asset questions that do not touch code, or game design discussion with no Luau to write or review.

anivar Bundle

Evaluate digital and AI infrastructure against the five corrigibility tests (EXIT, CODE, AUDIT, GOVERN, FORK). Use when assessing DPI systems (identity, payments, registries) or EPI systems (AI/ML in public services) for structural corrigibility.

anivar Bundle

Enterprise technical documentation best practices, patterns, and frameworks for developer and partner adoption. Covers content architecture (Diataxis four quadrants), 14 content types (tutorials, how-to guides, API reference, SDK docs, migration guides, changelogs, runbooks, integration guides, troubleshooting, architecture docs), pluggable writing styles (Diataxis, Google, Microsoft, Stripe, Canonical, Minimal), information architecture, docs-as-code workflows, documentation audit, anti-patterns checklist, and developer experience (DX) strategy. 27 rules, 5 references, 6 style guides. Baseline: Diataxis + Google OpenDocs + Good Docs Project. Triggers on: "write docs", "document this", "API docs", "developer docs", "migration guide", "changelog", "tutorial", "how-to guide", "reference docs", "documentation strategy", "docs audit", "information architecture", "developer experience", "partner docs", "SDK documentation", "runbook", "troubleshooting guide", "integration guide", "quickstart", "getting started", "t

anomalyco Skill

Audit or write models.dev reasoning_options in provider TOML files and reasoning-option PRs. Use when verifying toggle, effort, budget_tokens, provider reasoning controls, or citations.