Security

Read-only animation audit system — analyze a project's existing animations, identify quality gaps, and generate actionable improvement plans. Never modifies source code. Phases: Recon → Parallel Audit → Vetting → Implementation Plans. Pairs with apple-design for physics validation and gsap-animation for implementation.

Package skills into publishable plugin or bundle formats for ClawHub, Claude marketplace, and related runtimes. Use when: converting a skill into a plugin or release bundle, generating manifests, and assembling a release-ready upload directory. Not for standalone metadata optimization or deep security auditing.

Audit public skill or plugin bundles for ClawHub, Claude, Hermes, and GitHub release risks. Use when: checking Suspicious/upload flags, dangerous local behaviors, metadata mismatches, legacy auth surface, or non-runtime files before publishing.

Drafts a Written Information Security Program compliant with Massachusetts 201 CMR 17.00 and supplementary frameworks (GDPR, CCPA, HIPAA, GLBA, PCI-DSS). Produces a board-ready regulatory document covering coordinator designation, risk assessment, safeguards, training, incident response with breach notification, and vendor oversight. Use when an organization handles personal information of MA residents and needs a standalone WISP for regulatory examination or executive approval.

Drafts U.S. employee non-disclosure/confidentiality agreements that protect employer trade secrets and proprietary information while preserving employee mobility. Triggers on: employee NDA, confidentiality agreement, non-disclosure agreement, trade secret protection, proprietary information, onboarding confidentiality clause, pre-employment NDA.

Drafts combined Deed of Trust and Security Agreement instruments creating real property and UCC Article 9 personal property security interests for commercial financing. Use when drafting trust deeds, security agreements, commercial real estate financing documents, or combined real/personal property security instruments.

Conduct lean audits to identify waste reduction opportunities. TRIGGERS - Use when user needs help with lean-audit related tasks.

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

Analyze cex operations. Use when you need to understand cex mechanisms, evaluate protocol security, or reference on-chain concepts.

CLI interface for igf (Grapefruit) dynamic instrumentation server. Use to enumerate Frida devices, list apps, run hooks, query logs, access device file systems, inspect classes, dump memory, and perform mobile app security analysis.

Pwn/Binary kategorisi SKILL.md — BOF, ROP, kernel exploit araçları kurma rehberi

Tls reference tool. Use when working with tls in security contexts.

When the user wants to audit or optimize an App Store or Google Play listing. Also use when the user mentions 'ASO audit,' 'app store optimization,' 'optimize my app listing,' 'improve app visibility,' 'app store ranking,' 'audit my listing,' 'why aren't people downloading my app,' 'improve my app conversion,' 'keyword optimization for app,' or 'compare my app to competitors.' Use when the user shares an App Store or Google Play URL and wants to improve it.

Use when a Firebase app needs Firestore collection design, document shape, subcollection strategy, security rule implications, or query-aware data modeling. Trigger on requests to design Firestore data structures before implementation.

Scan project dependencies for known vulnerabilities, generate software bills of materials, and enforce license compliance across the software supply chain. Use when the user requests dependency scanning or provides relevant inputs for this workflow.

Perform dynamic security testing against running web applications and APIs to discover vulnerabilities through active probing and fuzzing. Use when the user requests dynamic application security testing or provides relevant inputs for this workflow.

This skill should be used when establishing comprehensive QA testing processes for any software project. Use when creating test strategies, writing test cases following Google Testing Standards, executing test plans, tracking bugs with P0-P4 classification, calculating quality metrics, or generating progress reports. Includes autonomous execution capability via master prompts and complete documentation templates for third-party QA team handoffs. Implements OWASP security testing and achieves 90% coverage targets.

> ⚠️ **AUTHORIZED USE ONLY** — This skill is intended for authorized security professionals only. Use only against systems you own or have explicit written permission to test. Unauthorized use may violate applicable laws.

> ⚠️ **AUTHORIZED USE ONLY** — This skill is intended for authorized security professionals only. Use only against systems you own or have explicit written permission to test. Unauthorized use may violate applicable laws.

Full website audit for ICP alignment, messaging clarity, conversion optimization, and trust signals

Assess NFRs like performance security and reliability. Use when the user says "lets assess NFRs" or "I want to evaluate non-functional requirements"

Review code changes with the Bugbot or Security Review subagent.

Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Use to review how an outsourcer, BPO or vendor handles your customer data and meets your conduct obligations, using evidence from the work rather than from their questionnaire answers. Trigger for "review our BPO's data handling", "vendor risk assessment for our outsourcer", "are our partners compliant", third-party oversight, outsourcing due diligence, or a supplier audit of a support vendor.

Use to audit arrears, collections and financial-difficulty conversations for fair treatment — forbearance offered, pressure absent, vulnerability recognised. Trigger for "audit our collections calls", "are we treating customers in arrears fairly", "did we offer forbearance", financial difficulty handling, payment plan conversations, or a complaint about collections conduct.

Audit and rewrite content to remove AI writing patterns ("AI-isms"). Use this skill when asked to "remove AI-isms," "clean up AI writing," "edit writing for AI patterns," "audit writing for AI tells," or "make this sound less like AI." Supports a detection-only mode that flags patterns without rewriting.

Audit SQLite persistence layer for unused tables and broken integrations. Trigger when: (1) checking database usage, (2) cleaning up schema, (3) finding missing methods.

中英双语学术降 AIGC / bilingual academic de-AIGC skill. Removes AI-generated writing signatures from empirical papers in economics, management, and the social sciences — in both English and Chinese. Covers Turnitin AI, GPTZero, Originality.ai on the English side and 知网 AMLC, 万方, 维普 on the Chinese side. Uses a six-step loop (intake → audit → claim-evidence check → differentiated rewrite → five-dimension self-score → cold-reader recheck) with two pattern libraries (22 English + 17 Chinese patterns), section-by-section strategies for empirical papers, and hard protections that keep every number, coefficient, and citation intact.

Verify references in an academic paper: check whether each BibTeX entry is real, whether in-text citations match the cited paper's actual content, and produce a structured verification report. Use when user says "验证参考文献", "ref verify", "check references", "核实引用", "引用是否正确", or wants to audit citations in a LaTeX manuscript.

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Audit project dependencies for risk — known-vulnerable versions, unpinned ranges, abandoned packages, and badly outdated majors. Reads package.json, requirements.txt, go.mod, Cargo.toml. Pure Claude Code, no signup.