Security

phuc-nt Bundle

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using mk-autoresearch pattern.

phuc-nt Skill

Scan codebase for security vulnerabilities, hardcoded secrets, dependency issues, and OWASP patterns. Use when asked to 'security scan', 'check for secrets', 'audit security', or before major releases.

fallow-rs Skill

Audit the current Fallow session for missed work, incomplete verification, stale documentation, companion drift, or cleanup before final completion.

fallow-rs Skill

Measure Fallow maintainability using the repository's SIG system properties and update the evidence-backed audit report.

fallow-rs Skill

Audit Fallow for unnecessary code, misleading tests, redundant abstractions, avoidable copying, and stale maintenance guidance. Use for a requested slop audit or deep cleanup pass.

fallow-rs Skill

Iteratively improve Fallow maintainability using measured SIG audit deltas, retaining only changes that improve the targeted property without regressions.

davila7 Skill

Draft the changelog entry for all unreleased commits in Keep a Changelog format. Groups commits into Added, Changed, Fixed, Removed, and Security. Use before releasing a new version or when updating CHANGELOG.md.

context-labs Bundle

Golang semantic code intelligence via `gopls` — go-to-definition, references, call hierarchy, symbols, diagnostics, rename, refactors. Use when navigating or refactoring Go code. Not for published ecosystem → `golang-pkg-go-dev`; vuln audits → `golang-security`.

context-labs Bundle

Golang OpenAPI/Swagger docs with swaggo/swag — annotations (@Summary, @Param, @Success, @Router, @Security), swag init, framework integrations (gin, echo, fiber, chi), security definitions, struct tags. Apply when adding/maintaining Swagger docs in Go or the codebase imports github.com/swaggo/*.

rtwsvj Skill

Documents checking a TLS certificate name and calling a health endpoint.

rtwsvj Skill

Reads a private SSH key into a temp file and uploads it later.

drmoisan Skill

Policy audit template usage and output requirements. Use when creating policy-audit.<timestamp>.md artifacts from the repo templates.

drmoisan Skill

Audit skills for canonical-location duplication. Use when ensuring a canonical location for a given item is defined in exactly one skill and duplicates are flagged.

ai45lab Bundle

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

revenuecat Skill

Use this skill when hardening a Google Play Billing integration against fraud. Covers server side receipt verification, replay attack protection, device fingerprinting, velocity checks, and the most common billing fraud patterns.

jellydn Skill

Audit code for security vulnerabilities — read-only analysis

lichao689 Bundle

Writing, exploit; assemble raw material into a journey of beats, grounding each term before a beat leans on it.

lichao689 Bundle

Writing, exploit: shape raw material into an article, paragraph by paragraph.

sgaabdu4 Bundle

- Control admission = concrete asset + plausible threat actor/path.

thapaliyabikendra Skill

You MUST use this when the user asks to review, audit, validate, lint, or check existing Functional Requirements Specifications. Triggers on: reviewing a GitLab FRS issue, auditing a milestone's worth of FRS, validating a pasted FRS, checking an uploaded FRS file (.md/.docx/.pdf), or any phrase like 'is this FRS correct', 'check my FRS', 'audit these requirements', 'validate the FRS'. Fires whether the user wants findings only or findings with proposed fixes. For generating NEW FRS from prose / code / notes, use skill:generate-frs instead.

woocommerce Skill

Run a comprehensive AI readiness audit of a WooCommerce store's product catalog

ramboz Bundle

Cross-artifact consistency report for jig specs — a non-destructive six-category audit at CRITICAL/HIGH/MEDIUM/LOW severity, covering duplication, ambiguity, underspecification, principle violations, coverage gaps, and terminology drift. Auto-triggers when you say analyze this spec, check for inconsistencies, audit ADR vs spec drift, check whether the decision records still agree with the spec, cross-artifact alignment, find drift in this spec, or audit this spec for principle violations. Do not use for: pre-DRAFT ambiguity scanning (use `/jig:clarify` instead); structural frontmatter or slice-numbering validation (use `spec_lint.py` instead); spec-compliance review of a finished slice (use `/jig:independent-review` instead).

ramboz Bundle

Lightweight spec clarification scan for jig projects — a six-category ambiguity audit that asks up to five prioritized questions and appends them to the spec's `## Clarifications` section. Auto-triggers when you say clarify this spec, audit this spec for ambiguities, is this spec ready for review, find unknowns in this scope, surface what's still unclear or unspecified, scan for unanswered questions, or what's missing from this spec. Do not use for: spec-compliance review of a finished slice (use `/jig:independent-review` instead); cross-artifact consistency analysis or drift detection (use `/jig:analyze` instead); project-vision or architecture elicitation (use `/jig:vision-elicitation` instead).

ramboz Bundle

Run a static-analysis pass on a project — detect the ecosystem (Python or Node), drive its linter (ruff / eslint, plus advisory pyright/complexity/ prettier and a cross-ecosystem duplication signal) via the `health.py` helper, and act on the normalized exit code (0 clean / 1 findings / 2 no-linter). Auto-triggers when you say lint this, check code health, run the linter, ask is this code clean, ask any lint issues, or want a static analysis pass. Tools are resolved on PATH or run ephemerally via uvx / pipx / npx — it installs nothing. Defers to any other installed skill whose description identifies it as handling linting, static analysis, or code quality — prefer it over this baseline. Do not use for running tests (use `/jig:tdd-loop`), for security review (use `/jig:security-review`), for spec-compliance review of a finished slice (use `/jig:independent-review`), or for general PR craft review (use `/jig:pr-review`).

ramboz Skill

Team baseline for security review — a best-effort heuristic security pass over a diff or change-set. Auto-triggers for review this for security, any vulnerabilities here, security pass on this diff, is this code secure, check this for security issues, or security review this. Uses installed scanners when available; installs nothing. Defers to any other installed skill whose description identifies it as handling security review, SAST, or vulnerability analysis, including `adobe-security-*`; prefer it over this slim baseline. Do not use for spec-compliance review (use `/jig:independent-review`), general PR craft (use `/jig:pr-review`), or secret prevention (`jig-secret-scan`).

sprngr Bundle

Read-only deferred-work ledger from TODO/FIXME/HACK/XXX comments. Use when: "duck debt", "what did we defer", "audit deferred work".

sprngr Skill

Stale/outdated comment and doc cleanup audit. Flags comments contradicting current code, removed behavior, or worktree-only add/remove never merged. Audit-first, patch handoff. Use when: "tidy comments", "clean up stale comments", "outdated docs audit", "duck-tidy".

sprngr Bundle

Adapts external skills to rubber-duck philosophy; audits skills for compliance and overlap. Use when: "adapt this skill", "make this duck-compatible", "audit skill", "should we add this skill".

designgrappler Skill

Scans a project for security vulnerabilities, hardcoded secrets, insecure patterns, and dependency risks.

higgsfield-ai Bundle

Reference-match build procedure — measuring a reference into a fidelity passport of exact values, the per-element draw-versus-generate split, pixel-exact rebuilds of an opaque screenshot, style extraction into a visual passport, scene and camera direction, the hierarchy naming schema, and the numeric audit and finalize gates that close a build.

jasonkneen Skill

Add, translate, or audit TinyWorld UI strings across English/French/Chinese/Spanish. Use when adding user-facing gameplay text, when `npm run i18n:check` fails, when a string shows up in English in a non-English locale, or when adding a new language. No translation API — Claude does the translating directly, using the established glossary for consistency.

nahisaho Skill

Guide for MUSUBIX SDD (Specification-Driven Development) workflow. Use this when asked to develop features using MUSUBIX methodology, create requirements, designs, or implement code following the 9 constitutional articles.

yuri-semenenko Bundle

Rewrite text to remove the telltale patterns of AI-generated writing. Use only when the user explicitly asks to humanize / de-AI a piece of text ("humanize this", "убери признаки AI", "make it sound less AI / more natural", "this sounds robotic") — not on every text edit. Covers five pattern families: inflation (fake significance, promo tone, vague authority), diction (AI-frequent vocabulary, copula avoidance, hedging, filler), structure (rule of three, negative parallelism, false ranges, signposting), formatting (em dashes, bold labels, emoji, title case), and chat residue (helper phrases, disclaimers, sycophancy). Ends with an adversarial self-audit pass.

steipete Skill

Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture.

steipete Bundle

Create, edit, improve, tidy, review, audit, or restructure AgentSkills and SKILL.md files.

steipete Bundle

Triage, redact, clean up, and resolve OpenClaw GitHub Secret Scanning alerts in issues or PRs.