Security

jin-doh Bundle

Handle repeated GitHub PR review/fix cycles, GitHub PR review churn, and non-converging GitHub PR feedback end to end when asked to inspect or address review comments, requested changes, unresolved threads, or follow-up reviews; validate each comment, derive the underlying invariant, audit related code for the same defect class, implement bounded fixes, and report independent review, QA, and delivery states.

jneaimi Bundle

Structured thinking skill implementing Bloom's AI Collaboration Framework v3. Auto-scales depth from stakes (reversibility + reliance): quick 3-question framing for reversible exploration, standard 6-question protocol for real decisions, deep mode with epistemics + teach-back + independent audit for binding one-way doors. Produces a decision contract; can run as a session or be packaged as a brief for delegated agents (/think fan). Use when the user says /think, wants to think through a problem, plan a project, make a decision, or start something new. Also trigger on phrases like "help me think through", "let's figure out", "I need to plan", "what should I do about", "how should I approach", or "let's work through this".

jnmetacode Skill

OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

joelhooks Skill

Portable credential management for AI agents using age encryption, session-scoped leases, auto-rotation, and killswitch. Use this skill when agents need secure, time-bounded access to API keys, tokens, or credentials without direct exposure to plaintext secrets.

johanesalxd Bundle

Agentic Vision via Gemini's native Code Execution sandbox. Use when: user needs image analysis with spatial reasoning, visual math (geometry, measurements), UI screenshot auditing, or object detection with bounding boxes. Triggers on 'analyze this image', 'what's in this screenshot', 'measure', 'UI audit', 'visual grounding'.

johnastinnett Skill

Applies principal/staff software architecture and engineering discipline to any codebase or domain. Use for software architecture, system design, code review, specs and ADRs, boundaries and contracts, incremental delivery, root-cause debugging, migrations and deprecations, architectural tradeoffs, release planning, and engineering decisions. Encodes named principles (Hyrum's Law, Chesterton's Fence, Conway's Law, Least Privilege, Defense in Depth, Shift Left, Strangler Migration, Fail Safe Defaults) and a seven-axis code review (correctness, readability, architecture, security, performance, reliability, operability). Enforces spec-before-code, test-driven development, incremental delivery, structured decision-making, and the gated specify-plan-tasks-implement workflow. Skip for line-level clean-code mechanics like naming, function size, or comment hygiene — use definitive-clean-code-craftsman.

klarkxy Bundle

Keep code complexity proportional to requirements. Use during substantive code changes, reviews for overengineering or unnecessary defense, and codebase simplification. Do not trigger for pure explanation, formatting, or unrelated prose edits, or turn a specialist security or migration task into a cleanup.

konata9 Bundle

Audits pnpm dependencies for security vulnerabilities, generates a pre-fix report for moderate-and-above issues, and applies fixes only after user confirmation. Supports optional low-severity fixes on request. Use when the user asks to fix pnpm audit issues, run pnpm audit repair, or says 帮我进行 pnpm audit 修复 / pnpm audit 修复 / 修复 audit 漏洞.

konata9 Bundle

Comprehensive vulnerability analysis for npm packages across different versions. Use when Claude needs to: (1) Analyze security vulnerabilities for specific package versions, (2) Compare vulnerability counts across multiple versions of the same package, (3) Identify safe version ranges based on vulnerability thresholds, (4) Track vulnerability trends over version releases, (5) Work with npm, pnpm, or yarn package managers for audit analysis, or (6) Generate vulnerability reports and recommendations for dependency management.

kgateway-dev Bundle

Patch CVEs surfaced by the kgateway OSV scanner by bumping the affected Go module dependencies (direct, indirect via require, or replace) and curating false-positive entries in osv-scanner.toml. Use this skill whenever the user wants to fix CVEs, address OSV-Scanner alerts, bump deps for security reasons, triage code-scanning findings, "see what CVEs we have", or do anything CVE/security-bump-flavored in this repo — even if they don't name the skill explicitly.

justrach Bundle

Analyze an API repository with Codex, create or update safe Markdown documentation, validate a Smolify bundle, and publish it only after the user reviews the generated diff. Use when the user asks to document, refresh, audit, or publish an API with Smolify.

jweihe Bundle

Create, evolve, audit, and validate Codex skills from repeated workflows or hard-won project experience. Use when the user wants a new skill, wants a self-improving skill system, wants to turn conversations or repository work into reusable procedural knowledge, or wants experiments that prove a skill is practical before installation.

kaposty Bundle

Plan a non-trivial task with the SAOP method before starting the work: Sketch, Analyze, Optimize, Partition. It first locks the goal with you, grounds itself in the real context, then returns a decomposed plan pyramid whose endpoints are each checkable, ready for approval, and never implements a planned task until you approve. Domain-agnostic: a new project or subproject, a feature, a migration, a security hardening, a compliance review, a backend. Invoke it explicitly with /saop; it does not fire on its own. Skips routine or well-understood tasks where a full four-phase pass would be overkill.

kappaemme-git Bundle

Find likely software bugs in a codebase, rank concrete bug candidates, and prove or reject them with focused regression tests before proposing a fix. Also turn bug reports, stack traces, screenshots, failing behavior, support tickets, and regressions into minimal reproducible cases with red-to-green evidence. Use when Codex needs to hunt for unknown bugs, audit code for correctness defects, test suspicious edge cases, reproduce a reported failure, isolate root cause, or verify that an approved fix works without regressions. Always require explicit approval before creating reproduction files and separate approval before changing production code.

kappaemme-git Bundle

Assemble six named Codex roles for an evidence-backed, read-only code review of a pull request, branch, working-tree diff, selected files, release candidate, or full repository. Use when the user wants independent architecture, correctness, security, adversarial testing, performance, and reliability reviewers to challenge one another, reject false positives, and produce one native Markdown verdict report. Do not use for implementing fixes unless the user separately requests a follow-up change.

kappaemme-git Bundle

Audit software projects for practical security risks before launch or publication. Use when Codex is asked to review a codebase, SaaS, web app, API, mobile app, GitHub repo, deployment, or MVP for exposed secrets, insecure authentication, authorization bugs, unsafe input handling, dependency risk, CORS/header issues, file upload risk, logging leaks, payment/security misconfiguration, or to produce a prioritized security fix plan.

kbelasheuski Bundle

Senior iOS architecture skill for choosing, auditing, refactoring, and migrating app architectures across UIKit and SwiftUI. Use when the user mentions architecture choice, refactor planning, codebase audit, migration between patterns, or asks which architecture to use.

keithpatton Bundle

Classify, validate, generate, and audit documentation using the Diátaxis framework. Enforces quadrant purity across tutorials, how-to guides, reference, and explanation. Use when creating documentation, reviewing docs, auditing doc sets, restructuring existing content, or when the user mentions Diátaxis, documentation structure, or doc quality.

liferay Skill

Format `spotbugs-security-exclude.xml` (or another `<FindBugsFilter>` file in this repo) according to the rule at `.claude/rules/spotbugs-security-exclude-xml.md`. Use when the user asks to format or normalize the SpotBugs exclude file, or when adding entries to it.

lingbol088-spec Bundle

Guided workflow for authorized penetration testing, vulnerability validation, security reporting, CTF/local sandbox reverse engineering, and user-directed vulnerability research. Use when Codex is asked to run or plan a security assessment, triage a target or artifact, maintain pentest state, produce interim/final reports, choose next steps, perform deep authorized testing, validate vulnerabilities with controlled proof-of-concept evidence, or reverse engineer binaries, mobile apps, firmware, protocols, captures, scripts, document samples, or unknown artifacts as part of a local sandbox, CTF, training lab, owned-codebase audit, or authorized security review. Also use when the user invokes the activation phrase documented in references/prompting.md.

lirantal Bundle

Builds a Claude Code statusline from scratch or extends an existing one. A statusline is a live status bar that runs a shell script after every Claude response and displays data — security scans, git status, API quotas, build state — directly in the session. Use this skill when the user says "create a statusline", "make a statusline for X", "add X to my statusline", "show Y in the status bar", "build a statusline plugin", or "I want live data in my Claude session". Trigger even if the user just describes wanting live feedback during a Claude session without naming "statusline" explicitly. The skill drives from idea to a working, installed, tested statusline without requiring the user to direct every step.

sari3l Bundle

Help: `/security-code-audit help` or `/security-code-audit --help`. Code security scanning capability for web/API and smart-contract repositories, provided by the RockBund Capital Security Team. Use for security review, vulnerability scan, pentest-style code analysis, or remediation retest. Modes: `quick`, `standard`, `deep`, `regression`; optional beta `multi`.

sarveshtalele Bundle

Pre-development planning skill. Given a free-text feature request or change description, deterministically identifies which file(s) need to be created or modified, the exact function/class/line to change, an existing pattern to follow, plus the security, compliance, and formatting/linting rules that apply. Trigger phrases: "I want to add...", "implement this feature", "where should I make this change", "what files do I need to update for...", "plan this change", "what's the right place to add...".

sarveshtalele Bundle

Validate a Spec-Driven Development (SpecKit) project end-to-end. Runs a deterministic rule engine (file structure, spec/plan/tasks schema, cross-references, env security, code quality, CI config) and produces a scored, graded report — optionally enriched with AI analysis. Use whenever someone asks to "validate", "audit", "health-check", or "lint" a SpecKit / SDD project, or to verify spec ↔ code alignment.

scaryrawr Skill

Audit or prepare this GNOME Shell extension for extensions.gnome.org review. Use after changing extension lifecycle, asynchronous work, signals, GLib sources, preferences, GSettings, supported Shell versions, packaging, or before a release or EGO submission.

schroneko Bundle

Security check skill. Triggers on "Could you please run a security check?", "セキュリティチェックをお願いします。", "请帮我做一次安全检查。". セキュリティチェックのデモスキル。「セキュリティチェックをお願いします。」「请帮我做一次安全检查。」などのリクエストで発動する。

scottholdren Bundle

Audit all installed Claude Code skills for conflicts, overlaps, redundancies, and trigger ambiguities. Scans personal, project, and plugin skill locations. Use when the user asks to audit their skills, check for skill conflicts, review installed skills, find duplicate or overlapping skill triggers, distinguish auto-run from explicit-call skills, or asks "what skills do I have installed".

scout-dev-org Skill

Use only when the user explicitly invokes `/scout` or asks to take, handle, fix, resume, continue, inspect, check status, triage, review, or audit work from Scout, in any repository that reports to Scout. Do not trigger for incidental Scout mentions or ordinary repository work.

madisonrickert Bundle

Fable Super Audit

magicblock-labs Bundle

Design, implement, and debug MagicBlock applications on Solana. Covers Ephemeral Rollups with delegated state; ER/PER architecture and settlement; private payments and token flows; oracles and randomness; scheduling and temporary authority; security and local validation. Use for MagicBlock product selection, integration, cross-product design, or production troubleshooting.

loft-sh Skill

Use this skill whenever a user wants to validate, review, or audit e2e tests that have been migrated from an old framework (typically in a `e2e/` directory) to the new `e2e/` framework. Triggers include: "review my migrated test", "validate this e2e test", "check my test migration", "did I migrate this correctly", "review e2e PR", "check test coverage after migration", or any request involving comparing old vs new e2e test files across the vcluster, vcluster-pro, or loft-enterprise repos. Always use this skill when an e2e test file or PR from one of these repos is provided for review — even if the user just says "take a look at this test".

lum1104 Bundle

Teach, practice, apply, and reference an evidence-grounded founder operating system derived from Sam Altman's Startup School 2026 interview: use AI leverage to raise ambition, exploit fast technology shifts without abandoning business fundamentals, build evidence-updated conviction and compounding relationships, and evaluate safety, power, and human agency.

luochen211 Bundle

Coordinate GitHub Issue dependency graphs specifically for Codex delivery across independent Codex sessions and session-local Codex subagents: verify detailed requirements and the matching GitHub repository; validate dependencies and conflict boundaries; compute Ready / Claimed / Stale Claim / Conflict / Review / Blocked / Done queues; coordinate safe claims; execute one scoped Issue per session; recalculate after graph changes; and audit PR, CI, deployment, and closeout. Use when the user asks Codex to plan or run an Issue DAG, coordinate parallel Codex sessions or subagents, compute current work queues, finish an Epic in dependency order, or verify delivery. Do not use this skill as a generic workflow for human-only or non-Codex executors.

luxonis Skill

Reviews C++ changes against this project's rules plus modern C++ Core Guidelines — memory safety, concurrency, security, performance, and idiom. Use for any C++ code review, before committing or merging C++ changes, and whenever the user asks to check, review, or audit .cpp/.hpp/.cc/.h files. Also use proactively after writing or refactoring C++ in this repo.

shubhamaniket Bundle

Interactive code intelligence tool that audits, rewrites, and guards code across 8 quality dimensions (SOLID, design patterns, architecture, SDLC, security, code smells, error handling, performance) plus optional concurrency and API design layers. Scores code 0–100 per layer, identifies anti-patterns before prescribing fixes, and cites a named principle for every finding. Use when the user wants to analyze, optimize, or build code with quality guardrails.

skobak Bundle

Codex-specific one-command workflow to ship a branch safely: read repository rules, run project quality gates, perform security-focused review, write a concise conventional commit, and create a clear PR. Use when the user asks for GG, ship this, commit and push, or create a PR from current changes.