Results for “audit”

Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw — chart scaffolding, values design, template patterns, dependency management, security hardening, and chart testing. Use when: user wants to create or improve Helm charts, design values.yaml files, implement template helpers, audit chart security (RBAC, network policies, pod security), manage subcharts, or run helm lint/test.

Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw — chart scaffolding, values design, template patterns, dependency management, security hardening, and chart testing. Use when: user wants to create or improve Helm charts, design values.yaml files, implement template helpers, audit chart security (RBAC, network policies, pod security), manage subcharts, or run helm lint/test.

Use to design or audit the support contribution to a customer health score, so the score predicts something instead of averaging weakly-related signals into a colour. Trigger for "build a customer health score", "add support signal to health scoring", "our health scores don't predict churn", red/amber/green account scoring, or a health score nobody trusts.

Docker and container development agent skill and plugin for Dockerfile optimization, docker-compose orchestration, multi-stage builds, and container security hardening. Use when: user wants to optimize a Dockerfile, create or improve docker-compose configurations, implement multi-stage builds, audit container security, reduce image size, or follow container best practices. Covers build performance, layer caching, secret management, and production-ready container patterns.

Verify a GitHub pull request against a Jira issue's goals, requirements, and acceptance criteria, then post a PR comment with the findings. Use when a user asks Codex or MoonMind to compare a PR to a Jira story/task/bug, confirm whether a PR satisfies Jira requirements, audit implementation coverage from Jira, or publish a Jira-vs-PR verification summary.

Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (LCP, INP, CLS) and supplementary metrics (FCP, TBT, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when asked to audit, profile, debug, or optimize page load performance, Lighthouse scores, or site speed. Biases towards retrieval from current documentation over pre-trained knowledge.

Docker and container development agent skill and plugin for Dockerfile optimization, docker-compose orchestration, multi-stage builds, and container security hardening. Use when: user wants to optimize a Dockerfile, create or improve docker-compose configurations, implement multi-stage builds, audit container security, reduce image size, or follow container best practices. Covers build performance, layer caching, secret management, and production-ready container patterns.

Growth strategy for product-led and loop-driven growth systems. Use when building growth strategy, designing growth loops, planning acquisition channels, evaluating network effects, deciding when to scale, or coordinating product, engineering, data, and marketing around growth. For SEO audits use seo-and-aeo-strategy; for page/form CRO use conversion-rate-optimization; for A/B test design use ab-test-setup.

Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.

Use this skill when the user asks about CMV maintenance program requirements under 49 CFR 396.3 — what records must be kept, retention periods (12-18 months on vehicle file + 1 year after disposal), what counts as systematic inspection/repair/maintenance, preventive maintenance scheduling, brake adjustment records, and what auditors look for in vehicle files. Cite 49 CFR 396.3 + 396.21.

Audit, write, or revise Architecture Decision Records (ADRs), including the decision of whether one is warranted. Use when an architecturally significant decision needs recording, when reviewing an existing ADR collection, or when adding ADRs to a project that has none. Detects existing template (Nygard or MADR) and defaults to Nygard for new repos. Gates comparison ADRs through a decompose-and-verify interview before drafting.

Garbage collection for your Claude Code configuration. Periodically scans ~/.claude (skills, memory, hooks, permissions, MCP servers, caches) for redundant, stale, orphaned, or low-value items, then walks the user through a confirm-each-deletion cleanup. Use when the user says "clean up my config", "config GC", "too many skills", "audit my setup", "my .claude is bloated", or asks for a periodic config review.

Inspect, profile, clean, reconcile, analyze, visualize, and verify spreadsheet data while preserving formulas, formatting, types, and source files. Use when working with .xlsx, .xlsm, .xls, .ods, .csv, or .tsv files; answering questions from a workbook; auditing formulas or data quality; comparing sheets or versions; producing pivots, charts, forecasts, or summary workbooks; repairing malformed tables; or validating that spreadsheet edits and calculations are accurate.

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector).

Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (LCP, INP, CLS) and supplementary metrics (FCP, TBT, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when asked to audit, profile, debug, or optimize page load performance, Lighthouse scores, or site speed. Biases towards retrieval from current documentation over pre-trained knowledge.

Use to design or audit the executive escalation path for a major account — intake, ownership, communication cadence and follow-through — so escalations are resolved rather than merely attended. Trigger for "design our escalation process for key accounts", "an executive escalation went badly", "customer went to our CEO", red account war rooms, or escalations that get attention and then quietly stall.

Rewrite, draft, and review prose so it is clear, specific, human, and appropriate to context. Use this skill when improving emails, essays, documents, reports, UI copy, marketing copy, posts, or any text that may sound generic, AI-written, over-polished, verbose, salesy, evasive, or structurally formulaic. Supports voice calibration, anti-slop audits, context-aware taste decisions, and final pre-flight checks.

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector).

Use to review how an outsourcer, BPO or vendor handles your customer data and meets your conduct obligations, using evidence from the work rather than from their questionnaire answers. Trigger for "review our BPO's data handling", "vendor risk assessment for our outsourcer", "are our partners compliant", third-party oversight, outsourcing due diligence, or a supplier audit of a support vendor.

Measure pleasur.ai's AI-citation share across ChatGPT / Perplexity / Gemini / Google AI Overviews for the tracked query list, using SemRush (data API for AIO-presence screening + AI Toolkit via browser for share-of-voice / mention + citation gaps) and direct engine queries. Scores each query into the GEO ledger and surfaces the highest-leverage gaps to fix. The GEO Lead's core measurement loop.

Verify a completed implementation against the original instructions, a declarative source document, an issue brief, or an optional MoonSpec feature packet, plus AGENTS.md repo guidance and required tests. Use when the user asks to run or reproduce `/moonspec.verify`, perform a final read-only implementation check, audit unit and integration test evidence, classify requirement coverage, or decide whether more code or test work is needed.

Extract brand identity from a website URL — voice, colors, typography, imagery, values, and target audience — into a structured brand-profile.json. The profile feeds downstream skills (seo-content-writer, email-composer, frontend-design, pro-deck-builder, cross-platform-audit) for brand-consistent output. Use when the user says brand DNA, brand profile, extract brand, analyze brand, brand voice, brand identity, brand colors, or brand style guide.

After a Content Factory run completes successfully, harvest prompts, character references, cost data, and quality scores; diff them against the canonical prompt_registry and character_identity store; open improvement PRs (prompt updates + new character references). Runs ONCE per successful run, then closes. Also files findings into a CF_IMPROVER_ISSUES.csv (Intelliverse audit framework pattern) for the librarian's weekly roll-up.

Use to push call recordings into Rulebase over the REST API when the phone system has no native connection, in reviewed batches with a dry-run plan, resume and audit log. Trigger for "upload calls to Rulebase", "import call recordings", "backfill our call history into Rulebase", "get XCally calls into Rulebase", "Rulebase isn't seeing our calls", or bulk-ingesting audio for QA evaluation.

Shipley-methodology federal proposal outline and section drafter. USE WHEN the user asks to draft a proposal volume, build an outline from the proposal_instruction ↔ evaluation_factor traceability (UCF Section L/M or equivalent for non-UCF — FAR 16 task orders, FOPRs, BPA calls, OTAs, agency-specific formats), generate a compliance matrix, write win themes, draft an executive summary, propose FAB (Feature → Advantage → Benefit) chains, identify discriminators, or 'respond to this RFP'. Pulls requirements, evaluation factors, instructions, customer priorities, and pain points from the active Theseus workspace KG and produces an evidence-cited draft. Also ships govcon HTML render templates under assets/ — hand the rendered content off to the `huashu-design` skill for PPTX / PDF / animation export. Format-agnostic — never assumes UCF section labels are present. DO NOT USE FOR clause compliance auditing only (use compliance-auditor) or extracting new entities (use govcon-ontology + the Theseus pipeline).

Design system implementation in Sage/Tailwind v4 — Figma to @theme tokens, design tokens CSS, Tailwind v4 @theme, color tokens, typography tokens, spacing scale, Blade UI components, kitchensink page, design-to-code, @layer base @layer components, CSS custom properties, resources/css/app.css, Paper MCP, Figma MCP, design file to code, SVG icons, responsive layout, design system audit, UI component library, atom design, layout components

Review a code file or directory and produce an evidence-backed GitHub or Jira issue proposing bug fixes, performance improvements, modularity improvements, DRY refactors, file splitting, reusable helpers, and architecture-alignment work. Use when a user asks for a code review, technical-debt proposal, refactor proposal, quality audit, bug-risk review, architecture-alignment review, or issue creation. This skill proposes work; it does not modify code.

Use when asked to "QA this", "is this ready to ship?", "test it like a user", "bug hunt", "sign off this build/phase", or before declaring a web app / feature shippable — a real-user QA pass that files severity-ranked bug reports and returns a binary ship verdict. Not for visual/CRO polish (frontend-audit) or fixing an already-reported UI bug (ui-fix-observe-first).

Reverse-engineers a federal RFP we received — given the SOW/PWS and evaluation criteria already in the Theseus KG, reconstructs the CO's hidden decision tree (upstream `sow-pws-builder` 6 scope blocks + 3 intake answers), surfaces hot buttons, ghost language, discriminator hooks, missing-section signals, and CPFF-form / Section-5 / QASP / Key-Personnel traps. USE WHEN the user asks "what scope decisions did the CO already make?", "reverse engineer this RFP", "what hot buttons are hiding in this PWS?", "where are the discriminator hooks?", "did they pick CPFF completion or term form?", "anything suspiciously missing?", or any variant of decoding CO intent. Pulls `requirement`, `deliverable`, `proposal_instruction`, `evaluation_factor`, `clause`, `performance_standard` from the active workspace KG and emits a JSON envelope feeding `proposal-generator`. DO NOT USE FOR proposal prose (`proposal-generator`), pricing (`price-to-win`), clause audit (`compliance-auditor`), or sub SOW (`subcontractor-sow-builder`).

Simplify application code for clarity without changing behavior — refactor after tests pass, reduce nesting and duplication, match project conventions. Load when refactoring for readability, cleaning up after a feature ships, or when code review flags complexity. Also triggers on "simplify this code", "code simplification", "make this easier to read", "reduce complexity", "refactor for clarity". Not for compress/split/prune-skill (skill-library files). Pairs with technical-debt-audit.

Audit, write, or revise .vale.ini, or work through vale findings on a repo. Use when adding Vale, troubleshooting silent passes or noisy findings, evolving config, or applying the suggestion → warning → error cleanup cascade after a vale run (interactive or pre-commit failure). Applies the two-hook pre-commit pattern (sync + lint), explicit Packages and per-format BasedOnStyles, scoping/ignores for false positives, and a shared accept.txt vocabulary.

Run the quarter-boundary ritual — roll the quarter-scoped project folders, archive finished projects, grade the closing quarter's GOALS/OKRs, and draft the new quarter's goals behind an approval gate. Trigger on /quarter-rollover, "quarter rollover", "roll the quarter", "close out Q2", "new quarter setup", or when tools/quarter_path.py --check reports drift. Distinct from /triage-tasks (daily gate) and /audit (repo health check).

Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerberos configuration. Uses enum4linux-ng, netexec, impacket, ldapsearch, certipy-ad, bloodhound-python, and rpcclient. Produces attack path diagrams, prioritized risk register, and PoCs. Chains into /gh-export for issue filing.

Use to measure whether a support bot, AI agent, or self-service channel actually reduces contact volume, and to audit a vendor's containment or deflection number. Trigger for "what's our real deflection rate", "is the bot working", "our containment rate is 70% but tickets haven't dropped", automation ROI, self-service savings, AI agent resolution rate, or designing a holdout test for a support bot.

Personal finance review skill for individuals who want to understand their spending, budgets, and financial patterns. Use whenever the user wants to analyze expenses, categorize spending, review a budget, build a budget from scratch, analyze debt, audit subscriptions, understand their savings rate, or track progress toward a financial goal. Triggers: "help me review my spending", "here are my expenses", "can you look at my budget", "help me build a budget", "I want to understand where my money goes", "categorize these transactions", "help me pay off my debt", "audit my subscriptions", "am I saving enough", "am I on track for my goal", "analyze my finances", or any time the user shares financial data (even raw or messy) and wants insight. Does NOT provide investment, tax, or financial planning advice — helps users understand their own data. Trigger proactively when the user pastes transactions, expenses, or any money-related data, even without an explicit request for analysis.

Reviews animation and motion code against a high craft bar derived from Emil Kowalski's design engineering philosophy (see `emil-design-eng`). Default to flagging; approval is earned. Use when reviewing a diff for motion quality — not for writing features, fixing unrelated bugs, or general (non-motion) code review. For building an animation from scratch, use `animate`; for a whole-codebase audit, use `improve-animations`. Source: github.com/emilkowalski/skills.