Security

Use this skill when the user asks about DOT audits, FMCSA compliance reviews, new entrant safety audits (NESA), focused investigations, what auditors actually ask for, audit document checklists, common audit failures, the audit ratings (Satisfactory / Conditional / Unsatisfactory), or how to prepare for an upcoming audit. Cite 49 CFR 385.

Use this skill when your carrier is selected for an IFTA audit. Covers what records to produce, how the audit is conducted, and common findings.

Use this skill when the user asks about Driver Qualification Files (DQF) — what must be in a DQ file under 49 CFR 391, retention periods, what's required pre-hire vs ongoing, document expiration tracking, audit-readiness for driver files, common DQF deficiencies that auditors find, or how to handle missing documents on existing drivers. Always cite the specific subsection of 49 CFR 391.

Use this skill when the user asks specifically about preparing for the New Entrant Safety Audit (NESA) under 49 CFR 385 Subpart D — different from a Compliance Review. Covers what auditors look at, the 18-month window, automatic failure conditions, the 60-day fix window, what to NOT do, and how to convert from "new entrant" to permanent authority. Cite 49 CFR 385.301-321.

Audit, write, or revise README.md. Use when creating a README, editing one, or noticing smells (missing badges, no install steps, unclear purpose, no engagement guidance). Applies ddbeck's checklist and a shields.io badge principle.

Audit, write, or update CHANGELOG.md following Keep a Changelog 1.1.0. Use when creating a CHANGELOG, or reviewing commits to ensure Unreleased reflects user-visible changes. Defers to auto-managed setups (changesets, release-please, git-cliff, semantic-release, towncrier) and applies semver 2.0.0 — or Haskell PVP for Haskell projects.

Audit, write, or revise CONTRIBUTING.md, including the decision of whether one is warranted. Use when creating contribution guidance, editing existing CONTRIBUTING, or when a README points to missing/thin contribution docs. Applies the nayafia/contributing-template framework.

Design, implement, audit, and plan interface animation and motion systems. Use for animation reviews, motion audits, easing and duration decisions, gesture physics, transform origins, reduced-motion behavior, animation performance, SvelteKit or Motion integration, perceptual feel checks, or self-contained animation improvement plans.

Audit a repository, vet and prioritize evidence-backed findings, write drift-aware implementation plans, delegate bounded work, and independently verify results. Use when asked to improve, audit, modernize, harden, review, plan fixes for, or systematically reduce risk in a codebase. Use native isolated agents for implementation; use OpenRouter/free only for narrow advisory audit slices under its safety limits.

Trigger: OAuth 2.1, JWT session, Secure cookies, Keychain storage, auth flow, user authentication. Scope: User authentication, session storage, authorization boundaries. Boundary: Excludes generic data caching.

Review pull requests or audit repositories for correctness, security, performance, test risk, architecture, dependencies, developer experience, documentation, and grounded product direction. Use for code review, repository audits, evidence-backed findings, false-positive vetting, risk assessment, prioritization, or deciding which improvements should become implementation plans.

System Audit — entry point

Chief Security Officer mode. (gstack)

Expert code reviewer who provides constructive, actionable feedback focused on correctness, maintainability, security, and performance — not style preferences.

Use the skill-reviewer skill to run a full 11-category audit of the $ARGUMENTS skill.

Manage Binding entities — scoped, temporal, many-to-many relationships between v2 entity surfaces. Use when a relationship needs scope, time, or its own attributes — e.g. 'Alice is the tech lead for project X from Jan to June' or 'the security gate applies to this release WorkItem only on the main branch'.

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Audit screens against Nielsen's heuristics and mobile UX best practices using the StyleSeed Toss design language as the implementation context.

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong.

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong.

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Guidance on security analysis, compliance auditing, and vulnerability assessment techniques relevant to legal and regulatory compliance tasks

Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Trace every user-facing button/touchpoint through its full state change sequence to find bugs where functions individually work but cancel each other out, produce wrong final state, or leave the UI in an inconsistent state. Use when: systematic debugging found no bugs but users report broken buttons, or after any major refactor touching shared state stores.

Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices.

Use this skill to generate or audit design systems, check visual consistency, and review PRs that touch styling.

Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

Audit existing business processes to identify AI automation opportunities. TRIGGERS - Use when user wants to find AI opportunities, audit processes for automation, or assess AI readiness.

Perform code audits for quality, security, and maintainability. TRIGGERS - Use when user needs help with code-audit related tasks.

Design Security Operations Centers with processes. TRIGGERS - Use when user needs help with soc-design related tasks.

Audit web applications for WCAG compliance. TRIGGERS - Use when user needs help with wcag-audit related tasks.