Results for “pip-audit”

Audits code quality against a shared contract, producing structured findings and blocking pipeline phases on critical issues without modifying code.

Use this skill for glTF/GLB assets, compression, optimization, transforms, texture sizing, browser delivery. Trigger when the task involves 3d web work related to Gltf Asset Pipeline, production implementation, audits, debugging, strategy, or validation.

Systematic audit of all installed tools, packages, and dependencies for available updates. Covers Homebrew, pip, npm/pnpm, system software updates, git repos, and key CLI tools. Run when the user asks "check if anything needs updating" or similar maintenance queries.

Fetch a published article from a URL and extract its title, headings, body content, and metadata into a markdown file the update pipeline can audit.

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations, detecting attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

Detect and triage infrastructure drift by comparing declared Terraform state against live cloud resources using scheduled pipelines and audit logs.

Runs a fast quality gate that detects the project stack, performs static analysis, checks cross-layer consistency, and fixes issues between pipeline phases.

Audita infraestrutura e pipeline em busca de vulnerabilidades, credenciais vazadas, IAM excessivo e exposição pública, com recomendações de hardening e classificação de severidade.

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Run replication, robustness, and specification-sensitivity workflows for Stata projects. Use when a researcher wants to reproduce a result, rerun a pipeline, compare specifications, audit a do-file sequence, or check whether a claim is stable.

Use to check whether a conversation export, dataset or AI pipeline is leaking personal data that should have been redacted, and to measure how well the redaction actually works. Trigger for "is this export safe to share", "check our redaction", "can we use support transcripts for training", sending transcripts to a vendor or model, "is there PII in this dataset", or before opening support data to a wider audience.

Audits and repairs Markdown link health across a skills repo via a four-tier pipeline (config hardening, intra-repo file-ref fixes, external URL substitutions, residual exclusions) and enforces a Tier 3 substitution guardrail that prevents regressions of previously-passing links; designed for lychee-based GitHub Actions link checkers but generalizes to markdown-link-check and similar tools. Use when the request mentions link audit, dead links, link health, lychee, broken links, link checker, markdown link audit, link-health audit, 404 audit, check-links failing, CI link-check, or 連結健檢, 死鏈, 失效連結, 斷鏈檢查. Part of the AlterLab Academic Skills suite.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Designs and implements CI/CD pipelines with automated testing, build automation, deployment, and rollback strategies.

Manages and syncs AI CLI skills across 50+ tools from a single source. Use this skill whenever the user mentions "skillshare", runs skillshare commands, manages skills (install, update, uninstall, sync, audit, check, diff, search), or troubleshoots skill configuration (orphaned symlinks, broken targets, sync issues). Covers both global (~/.config/skillshare/) and project (.skillshare/) modes. Also use when: adding new AI tool targets (Claude, Cursor, Windsurf, etc.), setting target include/exclude filters or copy vs symlink mode, using backup/restore or trash recovery, piping skillshare output to scripts (--json), setting up CI/CD audit pipelines, or building/sharing skill hubs (hub index, hub add).

Audits code quality against a shared contract, returning structured findings without modifying code. Supports gate, audit, diff, changed, and verify modes.

Runs a multi-phase verification pipeline including build, type-check, lint, tests, security scan, and diff review to ensure code quality before creating a PR.

Full test suite improvement composite — audit health, prune dead tests, validate with mutation testing, capture rationale in ADR. Use after a major feature ship, before tightening coverage gates, or when the suite shows bloat, excessive skips, or slow runtime. Chains test-health → test-cleanup → mutation-test → adr-write.

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

Orquestrador do pipeline de evolução do Reversa. Detecta o estágio físico da feature ativa em `_reversa_forward/` e sugere o próximo agente do ciclo forward (requirements, clarify, plan, to-do, audit, quality, coding). Use quando o usuário digitar "/reversa-forward", "reversa-forward", "iniciar evolução", "iniciar pipeline forward" ou pedir para conduzir o ciclo de uma feature do zero ao código. Não escreve artefatos de feature por conta própria, apenas roteia.

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

Run the App Store / Play Store ASO (App Store Optimization) intel pipeline with live Firecrawl-backed signals and weighted LLM council voting. Produces an IdeationBrief with hooks, taglines, captions, screenshot prompts, and a fully-audited council log. Use whenever the user asks to "research keywords", "audit ASO", "analyse competitors", "brief screenshots", "optimise listing", "track app", or to produce App Store creative for an existing or new app.

Humanization Pipeline Orchestrator v3.1 - Multi-pass 4-layer transformation pipeline Orchestrates G5 (Auditor), G6 (Humanizer), F5 (Verifier) in sequential passes Enforces checkpoints between every pass with mandatory AskUserQuestion Supports conservative (L1-2), balanced (L1-3), balanced-fast (L1-3 merged), aggressive (L1-4) modes Rich Checkpoint v2.0: section-level scores, selective humanization, target auto-stop G5+F5 parallel execution, section-selective humanization Triggers: humanize, humanize my draft, humanize manuscript, make natural, remove AI patterns Korean triggers: 휴먼화, 자연스럽게, AI 패턴 제거

Transforma uma ideia em linguagem natural num documento de requisitos completo, ancorado nos artefatos da pipeline reversa. Use quando o usuário digitar "/reversa-requirements", "reversa-requirements", "quero levantar requisitos" ou pedir para iniciar uma nova feature a partir de uma frase. Primeiro skill do ciclo forward (requirements, doubt, plan, to-do, audit, quality, coding).

Turn "what's happening with this account?" into a structured read straight from your CRM. A real-activity audit across every source, a qualification-vs-stage gap check, a one-screen account summary, and a risk verdict on the deal. Built for any sales team, customizable to your CRM and your sales process. Trigger on "analyze this account", "what's happening with this deal", "is this opp healthy", "what's stuck in my pipeline", "deal autopsy on this closed-lost", "where am I missing qualification coverage", "prep me for this account", or any account, opp, or pipeline diagnostic.

Federal acquisition compliance auditor for the active Theseus workspace, backed by live FAR/DFARS text via the vendored `ecfr` MCP. USE WHEN the user asks to audit FAR/DFARS clause coverage, validate that cited clauses actually exist in eCFR (catch fabricated or typo'd numbers), check whether a cited clause has been amended since the solicitation issued, validate regulatory references (NIST SP, DAFI, MIL-STD), check that every "shall" requirement has a deliverable, find missing compliance artifacts, audit proposal_instruction ↔ evaluation_factor coverage (UCF Section L↔M or non-UCF equivalent — FAR 16 task orders, FOPRs, BPA calls, OTAs), or "are we compliant with the proposal instructions?". Cross-references the workspace's clause / regulatory_reference / requirement / deliverable / compliance_artifact entities against live eCFR and flags gaps with severity. Format-agnostic. DO NOT USE FOR drafting compliant prose (use proposal-generator) or extracting clauses (Theseus pipeline does that automatically).

Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enforces secure coding patterns, and automates compliance checks against SOC2, PCI-DSS, HIPAA, and GDPR. Use when conducting a security review or audit, responding to a CVE or security incident, hardening infrastructure, implementing authentication or secrets management, running penetration test prep, checking OWASP Top 10 exposure, or enforcing security controls in CI/CD pipelines.

Operate and extend barretlee/agent-pulse, the evidence-backed AI industry intelligence system: inspect source catalog and lifecycle, collect and normalize signals, bind evidence, cluster Events, evaluate system health, generate Scout hypotheses, export the privacy-safe public site, and verify release gates. Use when the user asks to run, configure, debug, extend, or explain Agent Pulse, its collectors, Control Room, narratives, Scout, or GitHub Pages output. Triggers on: agent-pulse, Agent Pulse, evidence-backed intelligence, source catalog, signal collection, Event clustering, source audit, Scout opportunity, public export, weekly brief, or AI industry intelligence pipeline.