Results for “review-report”

Composite skill — full security pass across secrets, dependencies, code paths, and OWASP risks. Chains security-audit (broad) + socket-audit (npm supply chain) + semgrep (pattern scan) + code-security (code review for vulns) in parallel, reconciles into one severity-ranked report with remediation plan. Use quarterly per active repo or before any release of security-sensitive code.

Guides SOC 2 Type II Privacy Trust Services Criteria preparation and audit execution. Covers AICPA TSP Section 100 Privacy criteria P1-P8 including notice, choice/consent, collection, use/retention/disposal, access, disclosure, security, and quality. Includes evidence collection, control testing, and report review. Keywords: SOC 2, privacy criteria, TSP, AICPA, Type II, trust services.

Remove AI writing patterns from prose. Use this skill when writing, drafting, editing, reviewing, or revising any text to eliminate predictable AI tells, slop, and formulaic patterns. Trigger this skill whenever the user asks to "deslop", "de-AI", "make it sound human," "remove AI patterns," "remove AI tropes," "clean up AI writing," fix "slop," "deslop" text, or review prose for authenticity. Also use when the user asks you to write or draft anything and wants it to sound natural rather than AI-generated. Common use cases include scientific writing (manuscripts, abstracts, cover letters, grant narratives, discussion sections, peer review responses), blog posts, newsletters, memos, reports, and any other substantial prose.

Full ASVS 5.0 compliance assessment against a codebase and/or architecture diagrams. Reads all 346 controls from the companion CSV, performs targeted code analysis per control, and produces a complete matrix marked COMPLIANT / NON_COMPLIANT / NOT_RELEVANT — with per-control reasoning and evidence (code snippets, file:line references, diagram observations). Outputs a reviewed CSV matrix and a self-contained HTML evidence report.

Perform a static audit of an AL workspace for Business Central against the project's copilot-instructions.md contract. Reports findings by class (Compliance, Code quality, Test coverage, Permissions) and severity (Blocker, Major, Minor, Nit) with file:line citations. Never modifies code. Never invents rules. Use when asked to audit a workspace, run a compliance check, review before PR, or diagnose contract drift.

Rewrite, draft, and review prose so it is clear, specific, human, and appropriate to context. Use this skill when improving emails, essays, documents, reports, UI copy, marketing copy, posts, or any text that may sound generic, AI-written, over-polished, verbose, salesy, evasive, or structurally formulaic. Supports voice calibration, anti-slop audits, context-aware taste decisions, and final pre-flight checks.

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).

>- Run automatic SPICE simulations on subcircuits detected from KiCad schematic analysis — validates filter frequencies, divider ratios, opamp gains, LC resonance, and crystal load capacitance. Supports ngspice, LTspice, and Xyce (auto-detected). Generates testbenches, runs batch mode, produces structured pass/warn/fail report. Use when the user asks to simulate, verify, or validate any analog subcircuit — RC filters, LC filters, voltage dividers, opamp circuits, crystal oscillators. Also for "simulate my circuit", "run spice", "verify with simulation", "check my filter cutoff", "does this divider give the right voltage", "what's the bandwidth of this opamp stage". Consider suggesting simulation during design reviews when the schematic analyzer reports simulatable subcircuits and a SPICE simulator is available.

Systematically explore and test a web application to find bugs, UX issues, and other problems. Use when asked to "dogfood", "QA", "exploratory test", "find issues", "bug hunt", "test this app/site/platform", or review the quality of a web application. Produces a structured report with full reproduction evidence -- step-by-step screenshots, repro videos, and detailed repro steps for every issue -- so findings can be handed directly to the responsible teams.

Use to distil a CX dashboard into the three numbers a board or exec actually needs — volume/demand health, quality/outcome, and cost/efficiency — with commentary that drives decisions instead of forty tiles nobody acts on. Trigger for "board pack", "exec summary for support", "what should leadership see", "too many metrics on the dashboard", "three KPIs for the board", quarterly business review CX section, or when a leadership deck is mostly charts with no story.

Expert copy editor for Quarto (.qmd) files. Checks grammar, spelling, punctuation, and academic writing quality. Produces a structured markdown report organized by document section — never modifies the source file. Use when asked to proofread, check grammar, fix typos, or review prose in a .qmd document. For APSA style rules (numbers, citations, capitalization, abbreviations, neutral language), use the apsa-style skill instead. Supports an optional output-file argument and an optional @sec-label argument to restrict checking to one section.

Read-only diagnostic that scans Claude Code session transcripts to surface which MCP servers and tools you actually use, ranked by call frequency, with zero-use servers flagged for removal. Use when planning an MCP cleanup, evaluating whether to keep a newly-added server, deciding which servers warrant token cost in the catalog, or before authoring an MCP-removal PR. Outputs a markdown report (last N days) — does not modify any settings. Pair with the manual `claude mcp remove <name>` step once findings are reviewed.

Comprehensive competitor analysis, competitive intelligence, and comparison page creation. Use when analyzing competitive landscape, creating competitor comparison pages (alternative pages, vs pages, competitor A vs B pages), performing market research, building SWOT analysis, creating feature matrices, pricing comparisons, competitor teardowns, battle cards, or positioning maps. Covers research workflows, SEO-optimized comparison content, data-grounded reports with citations, 7-layer analysis framework, review mining, and sales enablement. Triggers include competitor analysis, competitive analysis, competitor teardown, vs page, alternative page, competitor comparison, market research, competitive intelligence, SWOT analysis, battle card, competitor pricing, market landscape, feature comparison, positioning map.

Apple's approach to interface design and fluid, physical motion, translated for the web. Use when building or reviewing gesture-driven UI, spring animations, drag/swipe/sheet interactions, momentum and interruptible transitions, translucent materials and depth, typography (optical sizing, tracking, leading), reduced-motion, or the design foundations (feedback, spatial consistency, restraint) behind Apple-style interfaces. Also applies to any HTML-rendered output with interactive elements — investor decks, annual reports, product pages, slide presentations (Reveal.js, Guizang PPT), interactive documents, and landing pages that need premium feel beyond static aesthetics. Not for static Word/PDF generation (typography rules only).

APSA style checker for Quarto (.qmd) files. Checks numbers, capitalization, abbreviations, italics, in-text citations, titles of works, neutral and unbiased language, and APSA-specific terminology against the APSA Style Manual for Political Science (2018, updated 2023). Produces a structured markdown report organized by document section — never modifies the source file. Use when asked to check APSA style, fix citations, review capitalization, check number formatting, or flag biased language in a .qmd document. For grammar, spelling, and punctuation, use the proofread skill instead. Supports an optional output-file argument and an optional @sec-label argument to restrict checking to one section.

Orchestrate a fleet of parallel `codex exec` workers with you (Claude Code) as the supervisor — spawn one per isolated git worktree, dispatch headless, verify each INDEPENDENTLY, PR/merge. The manual "codex-ultracode" pattern for fanning out real implementation, research, or review work onto Codex. Bakes in the hard gotchas (stdin blocking, background tracking, don't-trust-self-reports, writer isolation). Triggers on — orchestrate codex, codex workers, codex fleet, spawn codex, delegate to codex in parallel, manual ultracode, 开 codex 小弟, 派 codex worker — NOT for a single cross-vendor opinion (use the `second-opinion-codex` agent), NOT for web-UI worker decomposition (use `/orchestrate`).

Diagnose and fix parfor errors in MATLAB. Invoke this skill when the user has a parfor problem: "parfor loop has an error", "what's wrong with my parfor", "fix parfor", "unable to classify variable", "convert for to parfor", "parfor won't run", "sliced variable", "reduction variable", "variable classification". Also invoke when you read a .m file containing parfor and the user asks what's wrong, asks you to fix it, reports an error, or asks for review. Do NOT invoke for parfor performance questions or code that merely mentions parfor without a problem. ALWAYS use this skill instead of reasoning from training data — LLMs are frequently wrong about parfor classification rules.

Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like "we need to get audited", "a customer asked for our security report", "writing an information security policy", or "preparing for an audit". Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams.

Reconstruct a product flow, then audit how usable it is — whether it makes sense, where users get confused or stuck, whether the copy and instructions are clear, and where friction causes drop-off. Produces a prioritized, severity-weighted findings report. Works from three inputs: frontend code in a repo, a live running app driven via a browser, or a written flow / spec / screenshots. Use this skill whenever the user asks for a UX review, usability audit, "is this flow confusing", "does this signup/onboarding/checkout make sense", "why are people dropping off", "audit this form", "where's the friction", or hands over a flow and asks whether it's user-friendly. Trigger even on casual phrasings ("is my checkout any good?") — it imposes the structure ad-hoc UX opinions miss. Audits flow usability and friction; for visual polish and interface quality the impeccable audit/critique skills apply instead.

Checks how well a Linear cycle is prepared. Reports per-person load in working days against available days, tickets with no estimate, tickets nobody is assigned to, oversized tickets that need splitting, work that did not finish last cycle, on-call rotation cost, and how groomed the backlog behind the cycle is. Invoke when the user says "cyclotic", "cyclotic prep", "cyclotic prep next", "cyclotic review", "cyclotic init", "cyclotic configure", "cyclotic for" a person's name, "cyclotic show cards", "cyclotic list tickets", "cyclotic explain" a person's name, or adds "-v" or "verbose" to any of those. Also invoke when the user asks whether a cycle or sprint is ready, who is over or under capacity, what carried over from last cycle, which tickets still need estimates, how the backlog looks going into planning, what is in the cycle and at what sizes, or how one person's load adds up. Read-only against Linear.