Security

slowmist Bundle

Run authorized fake-deposit (false-recharge) security tests against a target address via the BadWhale API, and query which chains / networks / tokens are supported. Use when the user wants to test whether an exchange, wallet, or custody system correctly detects forged deposits, or asks what BadWhale supports. Triggers on: "fake deposit", "false recharge", "假充值", "充值检测测试", "deposit detection test", "BadWhale", "which chains/tokens are supported".

smartbrainactivity Bundle

A universal, dependency-free Node.js tool to statically audit AI Skills and local agents for malicious patterns.

sebamar88 Bundle

Audit repositories for AI-generated technical debt and add lightweight guardrails during high-risk refactors or architecture-sensitive changes. Use when the user asks to scan, audit, review debt, or explicitly wants a guardrail before broad code changes.

serenakeyitan Bundle

Vision-enabled verification gate with web search. Use when users want to (1) verify slides/reports/PDFs/images against authoritative online sources, (2) validate that citations actually exist and say what's claimed, (3) check charts/graphs/tables for accuracy, (4) audit AI-generated content in doc-only mode (no external knowledge). Two modes - search mode validates against web, doc-only mode ensures everything traces to provided documents. Supports content in any language.

sergeykrin9 Bundle

An eight-step working loop for coding agents on production systems: measure → plan with visible progress → build → verify by BREAKING it → look through the end user's eyes → stress-test the batch → take a meta position → log it → report. Use for any task of three or more steps: fixing a live service, a data migration, an audit, a batch of research, a new feature. Triggers: 'go ahead', 'fix it', 'figure it out', 'audit', 'stress test', 'check it with your own eyes', 'take it in any order'.

sergiobuilds Bundle

Use when you need to find what a real user would need but nobody wrote down — surfacing tacit assumptions, missing screens/features, and broken workflow links grounded in the user's actual intent, not imagined "best practices." Triggers: "UX check", "find what's missing", "workflow gaps", "is this annoying to use", "review this product for users", or when you're about to declare a one-pass review done. Works for UI, CLIs, reports, and docs — anything a user consumes, at plan stage (a spec) or audit stage (a built product). Not for visual polish (use a design-review tool) or idea/demand validation (use an idea-validation tool).

shaolongfei Bundle

Extract network APIs from Android APK, XAPK, JAR, and AAR files by decompiling with jadx and searching Retrofit, OkHttp, Volley, WebView, HttpURLConnection, GraphQL/Apollo, WebSocket, gRPC, auth headers, base URLs, resource URLs, certificate pinning, and network security config. Use for Android API endpoint extraction, APK network analysis, call-flow tracing to network layers, or Chinese requests such as 提取API、提取接口、安卓逆向、反编译APK、分析安卓应用网络接口、追踪调用链.

sharmasundip Bundle

Comprehensive API design reviewer that analyzes any API — OpenAPI/Swagger specs, GraphQL schemas, gRPC proto files, plain-English descriptions, or raw code snippets — and produces a scored audit report with actionable fix suggestions. Use this skill whenever the user mentions reviewing, auditing, critiquing, or improving an API design. Also triggers on: "check my API", "is this a good API?", "API best practices", "review this endpoint", "API anti-patterns", "REST maturity", "API naming conventions", "review my OpenAPI spec", "review my Swagger file", "GraphQL schema review", "gRPC service review", "rate my API", "API design feedback", "endpoint review", "API health check", or any request where a user shares API-related code, specs, or descriptions and wants quality feedback. Even if the user just pastes some endpoint definitions and says "what do you think?" — this skill should trigger.

shawnpana Skill

Comprehensive human-style playtesting of a browser game. Use when asked to test, playtest, or verify a browser game build. You play like an experienced human game tester — you read the manual and play the intended loop, AND you bring genre instinct, probing every mechanic a gamer would expect from the game type and environment (movement, sprint, jump, crouch, reload, aim/ADS, melee, weapon handling, pickups, etc.). You judge whether the game is complete and feels right, and report what's broken, janky, or missing. This is thorough playtesting — NOT adversarial QA (no exploit/soft-lock/edge-case hunting) and NOT automation-driven (real human input only). Treats the game as a true black box — only the rendered screen + real input, never internal state or test hooks — and discovers mechanics (including how to aim and track targets) for itself by observation, so it generalizes to any game without per-game backdoors. Starts cold with no prior knowledge of the controls or rules — learns them by experimenting (tryin

shimellism-eng Bundle

Plan, write, research, edit, review, and analyse essays while protecting the writer's voice and factual integrity. Use when asked for an essay writer, AI essay writer, essay writing assistant, essay helper, thesis, outline, argument, complete draft from scratch, essay editor, essay rewriter, essay improver, natural or human-sounding essay, evidence ledger, citation audit, rubric review, revision history, pattern audit, mechanical-pattern repair, personal statement, scholarship essay, lab report, literature review, source-based research, or an assessment of whether text shows probable AI-generated writing signals.

stellar Skill

Use when checking whether Stellar SDKs listed in the docs have new releases, or when code examples in docs/ may use outdated, renamed, or deprecated SDK syntax, or whether the Stellar RPC OpenRPC spec (openrpc/) matches the current stellar-rpc release. Runs per-release on a schedule, or as a full standing-correctness audit on demand.

stevederico Bundle

Evaluate any project against fixed "Hon Maguro" quality bars via bin/maguro (init/links/eval), optional Lighthouse median for SCORE1, and a capped fix loop (max 2 rounds). Binary pass/fail — no partial credit. Use when the user says "hon maguro", "eval this project", "quality bar check", "is this project ready", "audit code quality", or wants a pass/fail verdict against Hon Maguro standards. Do not use for generic Lighthouse/PageSpeed-only or open-ended "inspect and fix" requests unless they ask for Hon Maguro / these bars.

subhashdasyam Bundle

Use when generating Java code for web applications, APIs, or enterprise systems - prevents OWASP Top 10 vulnerabilities in Spring Boot, Jakarta EE, and core Java

subhashdasyam Bundle

Use when generating Python code for web applications, APIs, or handling user input - prevents OWASP Top 10 vulnerabilities in Django, Flask, FastAPI

succtorlin Skill

Use when asked how a project could make money, whether monetization opportunities are being missed, to research pricing or competitors for an existing codebase, or to turn a project into a revenue plan with concrete executable next steps.

sunfmin Bundle

Diagnose and fix skills by analyzing session logs for friction events — user interruptions, rejected actions, wrong approaches, test failures, and manual corrections. Cross-references friction against the patient skill's SKILL.md to find missing rules or enforcement gaps, generates patches with regression tests, and submits a PR. Use this skill after any development session where a skill underperformed, when you want to audit a skill's effectiveness, when debugging why a skill keeps making the same mistakes, or when the user says things like "fix this skill", "why does it keep doing X", "audit the skill", "doctor", or "skill-doctor".

supabase Skill

Generate a CVE catalog + Supabase impact analysis for a PostgreSQL security release. Use when reviewing a new upstream PG quarterly security release to decide what to ship and how to communicate. Inputs are the version ranges (e.g. REL_15_14..REL_15_18 + REL_17_6..REL_17_10); output is a draft catalog markdown ready to post on the breaking-change-analysis Linear ticket.

suriyalk Bundle

Use any time a student asks Claude to find sources, suggest citations, build/expand a reference list or bibliography, write a literature review, add citations to a paper, or check/audit citations already in a document. Also trigger whenever Claude is about to write a DOI, an author/year citation, a reference entry, OR a specific factual claim (a statistic, date, named study's finding, percentage) inside academic work — even inside a larger task like a proposal, thesis chapter, essay, or report. Stops hallucinated citations and hallucinated facts (fake DOIs, invented papers, wrong authors, made-up statistics) — a real academic integrity risk for NZ undergrad/postgrad students — and formats references in APA 7 including NZ/Māori conventions (macrons, iwi/hapū as corporate author, Waitangi Tribunal reports, NZ legislation, Stats NZ/govt reports). Don't skip this just because a citation or fact "seems obviously real" — that confidence is how fabrications end up in student work.

softwareasg-tools Bundle

Autonomous security auditor for AI-generated applications. Provide a codebase path and it will automatically detect the stack, execute a comprehensive 12-phase security scan, identify vulnerabilities, and provide a production decision.

soheilmomeniii Bundle

Write prose clean of AI texture, or audit a draft through two gates: source fidelity (every quoted or attributed line verified against primary sources, four verdicts, correction log) and taste (mechanical tell scan plus a nine-dimension scorecard). Use when the user says "de-slop this", "slop check", "AI smell", "sounds like ChatGPT", "make it human", "humanize this", "sounds robotic", "reads like AI", "kill the em dashes", "verify the quotes", "fidelity check", "run the audit", or "taste pass", and when writing or rewriting X posts, threads, articles, essays, fiction scenes, book chapters, or landing copy that must not read AI-generated. Works at any length; the fidelity gate activates whenever quotes or attributions are present. Do not use for voice imitation (use a style-converter skill), UI design, or proving a text was AI-written: the banned list is house style, not a detector.

solinkz Skill

Expert micro-interaction architect for mobile apps, web applications, and responsive websites. Use this skill when the user asks to add, build, fix, audit, or consult on micro-interactions, animations, transitions, motion design, gesture feedback, haptics, loading states, skeleton screens, pull-to-refresh, swipe actions, scroll animations, button states, form validation feedback, toast notifications, modals, dropdowns, toggles, progress indicators, shared element transitions, spring physics, easing curves, motion tokens, or any interaction that provides visual/haptic/auditory feedback to user actions. Triggers on: "micro-interaction", "animation", "transition", "motion", "easing", "spring", "gesture", "haptic", "feedback", "loading state", "skeleton", "shimmer", "pull to refresh", "swipe", "drag", "hover effect", "press state", "focus ring", "scroll animation", "parallax", "stagger", "orchestration", "reduced motion", "View Transitions", "layout animation", "shared element", "hero animation", "morphing", "Fra

songoao25 Bundle

Safely audit and batch-organize the native macOS Launchpad into user-named folders, with backups, classification review, and post-write verification. Use only for the native Launchpad, not replacement launchers.

spectrai-initiative Bundle

Audit a life-science or chemistry paper into BioBench Atlas with two independent local Codex evidence passes and deterministic Registry generation. Use for a paper URL, DOI, preprint, GitHub paper-candidate or paper-intake issue, a request to check whether a paper's benchmarks are already covered, or a request to add its benchmark uses and evaluation settings.

squizzle23 Bundle

Expert Canadian GRC and cyber law advisor covering OSFI B-10/B-13/E-21/I-CRT, FSRA, AMF/Loi 25, BCFSA, CIRO, AER Reg 84/CSA Z246.1, PIPEDA, PHIPA, PIPA BC, PIPA AB, Bill C-26, and AIDA. Use this skill whenever the user mentions any Canadian financial regulator, provincial privacy law, Alberta energy security, Canadian cyber incident reporting, federally regulated financial institutions, credit unions, investment dealers, or health information custodians. Trigger for: OSFI, FSRA, AMF, BCFSA, CIRO, AER, PIPEDA, PHIPA, Loi 25, Bill C-26, AIDA, Canadian TPRM, Canadian cyber compliance, Canadian breach notification, or any Canadian regulatory question. ALWAYS use this over general knowledge for Canadian regulatory questions.

sscarduzio Bundle

Activate when the user wants to teach their AI code reviewer from PR history, set up Cursor Bugbot rules (.cursor/BUGBOT.md), harvest review comments into review rules, or audit existing rules. Commands — /pr-war-stories setup | harvest | audit | rebalance | add-module | recheck.

starkiller-stucky Bundle

美股数据源分层配置与运行时路由 / US stock data-source layered setup and runtime routing. 提供 10 层数据源架构(实时行情 / SEC财报原文 / 基本面 / 分析师观点 / 新闻 / 散户情绪 / 宏观 / 期权微观结构 / 筛选与市场广度 / 历史回测),向导式一键配置免费数据源(含券商开户即用), 运行时按请求自动路由并标注延迟级别与来源。 Provides a 10-layer data-source architecture (real-time quotes / SEC filings / fundamentals / analyst views / news / retail sentiment / macro / options microstructure / screening and breadth / historical backtesting), a wizard to configure free sources (including broker account feeds), and runtime routing that labels latency tier and source. Triggers / 触发词: "配置美股数据源", "数据源", "美股数据", "实时行情", "券商数据", "数据源审计", "查看我的数据源", "重新配置数据源", "配置 L5", "数据源覆盖", "行情延迟", "财报原文", "散户情绪", "configure us stock data source", "us stock data", "market data", "data source audit", "real-time quotes", "SEC filings", "retail sentiment".

stellar Bundle

Comprehensive best practices for the Freighter browser extension. Covers code style, architecture, security, testing, performance, error handling, i18n, messaging, git workflow, dependencies, and anti-patterns. Use when writing new features, reviewing PRs, adding message handlers, working with Redux, modifying content scripts, handling keys, building transactions, or any development work in the freighter extension repo. Triggers on any task touching the freighter codebase.

stellar Skill

Audit backend code for security vulnerabilities — DoS vectors, query performance, connection pool exhaustion, injection, missing rate limits, and resource exhaustion

metrics-rs Skill

Run the multi-crate workspace release process for metrics-rs/metrics: audit unreleased changes, plan version bumps and changelog entries, then execute per-crate (cargo-release publish + per-PR comments + S-awaiting-release label removal) with explicit gates between crates. Invoke with /release-workspace when the user asks to prepare/run a release, says "what's ready to release?", or wants to drain the S-awaiting-release queue.

mickeylorenzini Bundle

Audits any substantial deliverable — documents, grant sections, strategies, protocols, skills, configs, roadmaps, plans — against domain-specific quality criteria before delivery. Searches the web for best practices, runs dual-pass thematic and structural audit with severity classification, fixes all issues, and iterates until convergence. Activates when producing deliverables exceeding 4 paragraphs or 20 lines, or when the user says "harden", "audit", "stress test", or "review before delivering", or when re-auditing a modified deliverable for regressions. Does not activate for conversational responses, brainstorming, web search summaries, or rough drafts.

miclivne Bundle

Pre-launch security audit for web apps. Runs OWASP checks via shell scripts, then AI analyzes findings. Covers rate limiting, hosting bypass, data exposure, headers, session security, AI risks. Complements /security-review.

mikefutia Bundle

Audit whether AI recommends a brand. Runs a category's buyer questions through Google AI Overview, ChatGPT, and Perplexity, detects if the brand is mentioned/cited, shows which competitors AI recommends instead, and scores overall AI visibility. Trigger on "run the ai visibility audit", "does AI recommend my brand", "am I showing up in ChatGPT / AI search", "AI search visibility", "GEO audit", "AEO audit".

mishka-group Skill

Audit this Elixir/OTP project for the official Elixir & Erlang anti-patterns — GenServer bottlenecks, hot-path try/rescue, runtime module introspection in loops, dynamic atoms. Use when reviewing performance/structure, before merging, or when adding hot-path code.

input-output-hk Skill

Writes and reviews GitHub Actions workflows with security hardening. Use when creating, modifying, or reviewing .github/workflows/*.yml or .github/actions/*/action.yml files. Covers shell injection prevention, trust gating for fork PRs, action pinning, and secrets hygiene.

input-output-hk Skill

Remediate Dependabot / npm advisory vulnerabilities in this Yarn-3 monorepo with a low-risk, prefer-relock-over-resolution strategy, then produce a per-dependency security audit (vulnerability status, license, prod/dev + consumer reachability, blast radius, and supply-chain provenance/publisher-continuity). Use when asked to patch security alerts, bump vulnerable dependencies, assess dependency blast radius, or do a supply-chain review.

insiderx-pro Bundle

Build, customize, audit, and package native macOS desktop-pet apps from owned or licensed image/video assets. Use when Codex needs to create an AppKit transparent floating pet, convert transparent/green-screen/black-screen animation clips into PNG frame packs, replace pet actions, prepare a universal macOS app, separate a public open-source engine from restricted demo assets, or inspect a desktop-pet repository before public release.