Security

tomevault-io Bundle

Perform language- and framework-specific security best-practice reviews and propose improvements. Activate only when the user explicitly requests security best-practice guidance, a security review/report, or help writing secure-by-default code. Activate only for supported languages (python, javascript/typescript, go). Do not activate for general code review, debugging, or tasks unrelated to security. Use when this capability is needed.

tomevault-io Bundle

Code reviewer providing objective quality metrics, security analysis, and actionable feedback. Use for code reviews with scoring, linting, type checking, and duplication detection. Use when this capability is needed.

tomevault-io Bundle

Perform a security audit of the codebase. Checks for OWASP Top 10, AI-specific vulnerabilities, dependency issues, and configuration problems. Use when this capability is needed.

tomevault-io Bundle

Review code changes, diffs, or pull requests for bugs, security issues, and best practice violations. Use after code changes or before merging PRs. Use when this capability is needed.

tomevault-io Bundle

Production-grade security with authentication (API keys, JWT), authorization (RBAC), rate limiting (token bucket, sliding window), request validation, and middleware integration. Use when securing actors, implementing access control, or preventing abuse. Use when this capability is needed.

tomevault-io Bundle

ONVIF device security scanner for testing authentication and brute-forcing credentials. Use when you need to assess security of IP cameras or ONVIF-enabled devices. Use when this capability is needed.

tomevault-io Bundle

Write security checks using the CheckDefinitionV2 system. Use when creating new checks, converting V1 checks to V2, or when the user asks to implement a vulnerability scanner check. Covers defineCheckV2, defineRegexCheck, CheckContext API, parameter injection, testing with testCheck/mockTarget, and registration. Use when this capability is needed.

tomevault-io Bundle

Use when reviewing code changes, a pull request, or a build slice for blockers before approval — correctness, security, scope, consistency, and test coverage. Activates on "review this", "is this ready", "check this PR/slice", or the Orchestrator REVIEW step.

tomevault-io Bundle

Skills for testing API security including GraphQL and REST API vulnerabilities. Use when this capability is needed.

tomevault-io Bundle

Rust coding best practices for cc-audit development. Use when writing new Rust code, reviewing code, or refactoring. Covers error handling, safety, performance, and idiomatic patterns. Use when this capability is needed.

tomevault-io Bundle

Golang OpenAPI/Swagger documentation with swaggo/swag — annotation comments (@Summary, @Param, @Success, @Router, @Security), swag init code generation, framework integrations (gin, echo, fiber, chi, net/http), security definitions (Bearer/JWT, OAuth2, API key), and struct tags (swaggertype, enums, example, swaggerignore). Apply when adding or maintaining Swagger/OpenAPI docs in a Go project, or when the codebase imports github.com/swaggo/swag, github.com/swaggo/gin-swagger, github.com/swaggo/echo-swagger, github.com/swaggo/http-swagger, or github.com/swaggo/files. Use when this capability is needed.

tomevault-io Bundle

Audit a checkpoint specification for realism and design decision forcing. Reviews specs to remove hand-holding, hidden corner cases, and architectural giveaways. Invoke with /audit-spec <problem> <checkpoint>. Use when this capability is needed.

tomevault-io Bundle

Review code quality, security, and maintainability before committing. Use when reviewing code changes, checking code quality, performing security review, or validating changes before commit. Use when this capability is needed.

tomevault-io Bundle

Local AI code reviews via CodeRabbit CLI. ONLY use when (1) user explicitly requests "coderabbit"/"cr review", OR (2) code changes are high-risk (security, concurrency, complex logic). Rate-limited to 1 review/hour—be highly selective. Use when this capability is needed.

tomevault-io Bundle

Token-efficient git operations with security scanning and auto-split commits Use when this capability is needed.

tomevault-io Bundle

Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS). Use when this capability is needed.

tomevault-io Bundle

Comprehensive security code review covering OWASP Top 10, authentication, authorization, and secure coding practices. Use when reviewing code for vulnerabilities or implementing security features. Use when this capability is needed.

tomevault-io Bundle

Greenfield Rust configuration workflow for typed settings, environment variables, config files, CLI overrides, defaults, validation, precedence rules, secret redaction, and test isolation. Use when this capability is needed.

tomevault-io Bundle

Review code changes for Open Mercato compliance with architecture, security, conventions, and quality rules. Use this skill when reviewing pull requests, reviewing code changes, performing code review, auditing code quality, or when asked to review files, diffs, or commits. Covers module structure, naming conventions, data security, UI patterns, event/cache/queue rules, and anti-patterns. Use when this capability is needed.

tomevault-io Bundle

Analyze main branch implementation and configuration to find missing, incorrect, or outdated documentation in docs/. Use when asked to audit doc coverage, sync docs with code, or propose doc updates/structure changes. Only update English docs under docs/** and never touch translated docs under docs/ja, docs/ko, or docs/zh. Provide a report and ask for approval before editing docs. Use when this capability is needed.

tomevault-io Bundle

Release preparation workflow - security audit → E2E tests → review → changelog → docs Use when this capability is needed.

tomevault-io Bundle

Perform automated code reviews checking for security vulnerabilities, performance issues, and code quality. Use before creating PRs, when reviewing complex changes, checking for security issues, or identifying performance problems. Use when this capability is needed.

tomevault-io Bundle

Use when completing tasks, implementing features, before merging, or when asked to review code. Systematic review process covering correctness, security, performance, and maintainability.

tomevault-io Bundle

Reviews code changes using CodeRabbit AI. Use when user asks for code review, PR feedback, code quality checks, security issues, or wants autonomous fix-review cycles. Use when this capability is needed.

tomevault-io Bundle

Audit installed skills and agents for bloat, overlap, and improvement opportunities. Use when the user wants to review, audit, list, or improve their skills and agents. Triggers on "review skills", "audit skills", "list skills", "skill review", "improve skills". Use when this capability is needed.

tomevault-io Bundle

Design, create, audit, and optimize OpenCode skills using a quality-first workflow with dry-run, quality gates, and structured references. Use when users ask to build or improve a skill. Do not trigger for generic OpenCode Q&A or unrelated coding tasks. Use when this capability is needed.

tomevault-io Bundle

Review a pull request on a dmzoneill repo with code analysis. Checks for bugs, security issues, style violations, and test coverage. Can approve, request changes, or comment. Use when this capability is needed.

tomevault-io Bundle

Use when profiling application performance or diagnosing slow page loads. Covers full-stack bottleneck identification including Core Web Vitals, bundle analysis, database queries, and network waterfall. Do not use for cache architecture design (use caching-strategy) or capacity planning (use load-modeling).

tomevault-io Bundle

Security review for Rust systems code. Covers memory safety, buffer handling, unsafe code, input validation, resource exhaustion, and supply chain security. Use when this capability is needed.

tomevault-io Bundle

Audits and optimizes Convex application performance across hot-path reads, write contention, subscription cost, and function limits. Use this skill when a Convex feature is slow or expensive, npx convex insights shows high bytes or documents read, OCC conflict errors or mutation retries appear, subscriptions or UI updates are costly, functions hit execution or transaction limits, or the user mentions performance, latency, read amplification, or invalidation problems in a Convex app. Use when this capability is needed.

tomevault-io Bundle

Analisa padrões de qualidade de código e detecta code smells, complexidade elevada e duplicação. Use when this capability is needed.

tomevault-io Bundle

Web application testing principles. E2E, Playwright, deep audit strategies. Use when this capability is needed.

tomevault-io Bundle

Audit code for security vulnerabilities Use when this capability is needed.

tomevault-io Bundle

Reviews code changes using CodeRabbit AI. Use when user asks for code review, PR feedback, code quality checks, security issues, or wants autonomous fix-review cycles. Use when this capability is needed.

tomevault-io Bundle

Performs thorough code reviews covering quality, security, performance, and best practices. Use when asked to review a pull request, audit code changes, check for security vulnerabilities, assess code quality, or provide feedback on a diff. Outputs structured feedback with severity levels and actionable suggestions. Use when this capability is needed.

tomevault-io Bundle

Review code with fresh eyes for correctness, security, and maintainability. Generate standalone prompts for Claude, Gemini, and Codex. Use when reviewing PRs, commits, staged changes, or auditing code. Use when this capability is needed.