florianbuetow

@florianbuetow source repo

121 skills
0 followers
15 hours ago last updated

▌
Create 2 · florianbuetow
Analyze a repository and generate a new .claudeignore file that excludes directories and files wasting context tokens.

0
installs
▌
Update 2 · florianbuetow
Update an existing .claudeignore file by adding, removing, or revising entries based on current repository state.

0
installs
▌
Kiss · florianbuetow bundle
This skill should be used when the user asks to "find simplification opportunities", "simplify this code", "check for unnecessary complexity", "find over-engineering", "audit code complexity", "reduce complexity", or "what can be simplified". Also triggers when the user mentions KISS, "keep it simple", over-abstraction, dead code, redundant code, tight coupling, interface bloat, or asks about simplification opportunities. Supports checking all five dimensions at once or focusing on a single dimension.

0
installs
▌
API · florianbuetow bundle
This skill should be used when the user asks to "check API security", "audit REST API", "find BOLA vulnerabilities", "check for mass assignment", "analyze API rate limiting", "detect excessive data exposure", or mentions "API security", "BOLA", "IDOR", "mass assignment", "rate limiting", "broken function-level authorization", "excessive data exposure", or "OWASP API Top 10" in a security context.

0
installs
▌
Dos · florianbuetow
This skill should be used when the user asks to "check for denial of service", "analyze availability risks", "find DoS vulnerabilities", or mentions "denial of service" or "DoS" in a security context. Maps to STRIDE category D.

0
installs
▌
Fix · florianbuetow
This skill should be used when the user asks to "fix security finding", "fix vulnerability", "generate security fix", "appsec fix", "patch vulnerability", "remediate finding", or "apply security patch". Also triggers when the user references a finding ID (e.g., INJ-001) and asks for a fix, or points to a file:line and asks to fix the security issue there.

0
installs
▌
Run · florianbuetow
This skill should be used when the user asks to "run security scan", "scan for vulnerabilities", "security check", "check security", or invokes /appsec:run. Smart orchestrator that detects the tech stack, selects relevant security tools, and runs them in parallel.

0
installs
▌
Auth · florianbuetow bundle
This skill should be used when the user asks to "check for authentication issues", "analyze auth", "find credential vulnerabilities", "review login security", "check session management", or mentions "authentication", "passwords", "MFA", "sessions", or "brute force" in a security context. Maps to OWASP Top 10 2021 A07: Identification and Authentication Failures.

0
installs
▌
Fuzz · florianbuetow
This skill should be used when the user asks to "generate fuzz inputs", "create fuzz tests", "fuzz test generation", "generate test payloads", "create security test cases", or "generate edge case inputs". Also triggers when the user wants intelligent test inputs for input parsers, API endpoints, file format handlers, or needs context-aware injection payloads for security testing.

0
installs
▌
Ssrf · florianbuetow bundle
This skill should be used when the user asks to "check for SSRF", "analyze server-side request forgery", "find URL fetching vulnerabilities", "check for internal network access", or mentions "SSRF", "URL fetching", "cloud metadata", "169.254.169.254", or "request forgery" in a security context. Maps to OWASP Top 10 2021 A10: Server-Side Request Forgery.

0
installs
▌
Guard · florianbuetow bundle
Use when the user wants to initialize, build a collection in, remove a collection from, clear, or inspect the `guard` CLI file-permission tool. Triggers on "init guard", "set up guard", "guard my test files", "create a guard collection", "remove guard collection", "delete guard collection", "unguard a collection", "clear all guard", "wipe guard", "reset guard", "guard status", "guard info", "show guard", "what's guarded".

0
installs
▌
Learn · florianbuetow
This skill should be used when the user asks to "learn about security", "teach me OWASP", "security tutorial", "learn threat modeling", or invokes /appsec:learn. Interactive guided walkthrough using your codebase as teaching material.

0
installs
▌
Mitre · florianbuetow
This skill should be used when the user asks to "map to ATT&CK", "show attack techniques", "MITRE mapping", or wants to understand how findings relate to real-world attacker behavior. Maps security findings to MITRE ATT&CK tactics, techniques, and procedures.

0
installs
▌
Model · florianbuetow
This skill should be used when the user asks to "create threat model", "threat model architecture", "map security architecture", "build threat model", "STRIDE analysis", "data flow diagram", "DFD security", or "attack tree analysis". Also triggers when the user wants a systematic identification of threats against the application architecture, trust boundaries, data flows, or component interactions.

0
installs
▌
Owasp · florianbuetow
This skill should be used when the user asks to "run OWASP analysis", "check OWASP Top 10", "OWASP scan", or invokes /appsec:owasp. Dispatches 10 category subagents (A01-A10) in parallel for comprehensive OWASP Top 10 coverage.

0
installs
▌
Pasta · florianbuetow
This skill should be used when the user asks to "run PASTA analysis", "PASTA threat model", "risk-centric threat analysis", or invokes /appsec:pasta. Dispatches 7 stages SEQUENTIALLY -- each stage's output feeds the next. This is the ONLY framework that runs sequentially.

0
installs
▌
Start · florianbuetow
This skill should be used when the user asks to "start security analysis", "assess security", "which security tools should I use", "appsec start", "what should I scan", "security assessment", or invokes /appsec:start. Assesses the project's tech stack, data sensitivity, architecture, and installed scanners, then recommends which /appsec:* tools to run in priority order with rationale.

0
installs
▌
Logbook Time · florianbuetow
Analyze time spent per project across all Claude Code sessions. Generates monthly and yearly markdown reports with per-project/branch breakdowns. Use when the user asks about "time spent", "hours per project", "session time", "time report", "logbook time", or wants to know how long they spent coding.

0
installs
▌
Config · florianbuetow
This skill should be used when the user asks to "configure security", "appsec settings", "security preferences", or invokes /appsec:config. Manages security tool preferences and thresholds.

0
installs
▌
Crypto · florianbuetow bundle
This skill should be used when the user asks to "check for cryptographic issues", "analyze encryption", "find weak hashing", "audit password storage", "check for hardcoded keys", or mentions "cryptography", "encryption", "hashing", "TLS", "certificates", or "random number generation" in a security context. Maps to OWASP Top 10 2021 A02: Cryptographic Failures.

0
installs
▌
Harden · florianbuetow
This skill should be used when the user asks to "harden code", "security hardening", "improve security posture", "add security headers", "tighten security", "defensive coding suggestions", or "proactive security improvements". Also triggers when the user asks about CSP, CORS hardening, rate limiting, input validation improvements, security logging, or defense-in-depth measures.

0
installs
▌
Report · florianbuetow
This skill should be used when the user asks to "generate security report", "create appsec report", "export findings", "security summary", "findings report", "executive security summary", or "export to SARIF". Also triggers when the user wants a formatted overview of all security findings, remediation progress, scanner coverage, or needs to share security status with stakeholders.

0
installs
▌
Sans25 · florianbuetow
This skill should be used when the user asks to "check CWE Top 25", "run SANS analysis", "check for common weaknesses", or mentions "CWE" or "SANS Top 25" in a security context. Checks code against the SANS/CWE Top 25 Most Dangerous Software Weaknesses.

0
installs
▌
Status · florianbuetow
This skill should be used when the user asks for "security status", "show findings", "security dashboard", "security posture", or invokes /appsec:status. Shows current security posture overview.

0
installs
▌
Stride · florianbuetow
This skill should be used when the user asks to "run STRIDE analysis", "check STRIDE", "threat model with STRIDE", or invokes /appsec:stride. Dispatches 6 category subagents (S-T-R-I-D-E) in parallel for comprehensive STRIDE threat modeling coverage.

0
installs
▌
Verify · florianbuetow
This skill should be used when the user asks to "verify fix", "confirm fix", "check if vulnerability is fixed", "validate remediation", "recheck finding", or "test if patch works". Also triggers when the user has applied a security fix and wants confirmation that the vulnerability is actually resolved, or when referencing a finding ID and asking if it is still present.

0
installs
▌
Intent · florianbuetow
Use whenever you feel stuck, hit ambiguity, need to make a decision, or are about to ask the user a clarifying question. Runs an intent-based investigation - inferring the task's underlying purpose from the latest prompt, earlier prompts, project goals, plans, and prior corrections - to answer low-risk questions from context before escalating. Escalate to the user only when the ambiguity is material and cannot be resolved from context. Also invoked explicitly as /intent.

0
installs
▌
Explain · florianbuetow
This skill should be used when the user asks to "explain security concept", "what is OWASP", "explain this finding", "what does this vulnerability mean", "explain stride", "explain injection", "what is CSRF", "explain spoofing", "what does INJ-003 mean", "compare stride vs pasta", or asks any question about security terminology, frameworks, vulnerability categories, or specific findings. Works at framework, category, finding, and comparison levels.

0
installs
▌
GRAPHQL · florianbuetow bundle
This skill should be used when the user asks to "check GraphQL security", "analyze GraphQL endpoint", "find GraphQL vulnerabilities", "audit GraphQL schema", "check for introspection", "analyze query depth", or mentions "GraphQL", "introspection", "query depth limit", "query complexity", "GraphQL batching", "alias abuse", or "per-field authorization" in a security context.

0
installs
▌
Linddun · florianbuetow
This skill should be used when the user asks to "run LINDDUN analysis", "check privacy threats", "privacy threat model", "GDPR analysis", "check data protection", or invokes /appsec:linddun. Dispatches 7 category subagents in parallel for comprehensive LINDDUN privacy threat coverage.

0
installs
▌
Linking · florianbuetow
This skill should be used when the user asks to "check for linkability", "analyze cross-service tracking", "find privacy issues related to user correlation", "check for cross-domain tracking", or mentions "linkability" in a privacy context. Maps to LINDDUN category L.

0
installs
▌
Logging · florianbuetow bundle
This skill should be used when the user asks to "check for logging issues", "analyze security logging", "find missing audit logs", "check for log injection", "audit monitoring configuration", or mentions "logging", "audit trail", "log injection", "monitoring", or "alerting" in a security context. Maps to OWASP Top 10 2021 A09: Security Logging and Monitoring Failures.

0
installs
▌
Secrets · florianbuetow bundle
This skill should be used when the user asks to "check for secrets", "find hardcoded credentials", "scan for API keys", "detect leaked tokens", "find passwords in code", "check for committed .env files", "scan for private keys", or mentions "secrets", "credentials", "API keys", or "leaked tokens" in a security context. Also triggers for git history secret scanning and high-entropy string detection.

0
installs
▌
Init · florianbuetow
Create a brand new CLAUDE.md with production-grade agent directives that override Claude Code's built-in limitations. Only use when no CLAUDE.md exists in the project. Use when the user says "fixclaude init", "create claude md", or "initialize claude directives".

0
installs
▌
Create · florianbuetow
Compact the current conversation into a structured handoff document so a fresh agent (or human) can continue the work with zero prior context.

0
installs
▌
Glossary · florianbuetow
This skill should be used when the user asks "what is IDOR", "define CSRF", "security glossary", or wants quick security term definitions. Quick reference for security terms, acronyms, and categories.

0
installs
▌
Spoofing · florianbuetow
This skill should be used when the user asks to "check for spoofing", "analyze identity spoofing risks", "find authentication vulnerabilities", or mentions "spoofing" in a security context. Maps to STRIDE category S.

0
installs
▌
Handoff · florianbuetow
This skill should be used when the user wants to "hand off", "create a handoff", "wrap up for the next session", "pass this to another agent", "continue from a handoff", "pick up where I left off", "resume a previous session", "load a handoff", or mentions handoff documents, session continuity, or task continuation.

0
installs
▌
Sessionlog Info · florianbuetow
This skill should be used when the user asks to "show session info", "find session log", "where are session logs", "current session id", "session path", "sessionlog info", or wants to identify the current Claude Code session and its log file location on disk.

0
installs
▌
Spec Dd · florianbuetow bundle
This skill should be used when the user asks to "write specifications", "create test specifications", "specification-driven development", "spec-first", "behavioral specs", "derive test scenarios", "test implementation specification", "check specification alignment", "review specs", "verify implementation", or "spec-dd". Also triggers when the user mentions "SDD", "SDD-TDD", "spec-driven", "behavioral testing workflow", "test-first design", or asks about writing specifications before code, deriving tests from specs, or verifying implementation against specifications. Supports a full workflow walkthrough or focusing on individual phases.

0
installs
▌
Terminator Info · florianbuetow
Show the configured kill phrases and case sensitivity for both local (project) and global (user) terminator installations. Use when the user asks "what is my kill phrase", "show terminator config", "terminator info", or "what phrase is configured".

0
installs
▌
Detecting · florianbuetow
This skill should be used when the user asks to "check for detectability", "analyze timing side channels", "find privacy issues related to traffic analysis", "check for metadata leakage", or mentions "detectability" in a privacy context. Maps to LINDDUN category D1.

0
installs
▌
Injection · florianbuetow bundle
This skill should be used when the user asks to "check for injection", "analyze SQL injection", "find injection vulnerabilities", "check for command injection", "find NoSQL injection", "check for LDAP injection", or mentions "injection" in a security context. Maps to OWASP Top 10 2021 A03:2021 - Injection.

0
installs
▌
Integrity · florianbuetow bundle
This skill should be used when the user asks to "check for integrity issues", "analyze deserialization", "find supply chain vulnerabilities", "review CI/CD security", "check SRI", or mentions "deserialization", "integrity", "pipeline security", "code signing", or "supply chain" in a security context. Maps to OWASP Top 10 2021 A08: Software and Data Integrity Failures.

0
installs
▌
Misconfig · florianbuetow bundle
This skill should be used when the user asks to "check for misconfigurations", "analyze security headers", "find misconfigured settings", "check CORS policy", "find debug mode", "audit server configuration", or mentions "misconfiguration" in a security context. Maps to OWASP Top 10 2021 A05: Security Misconfiguration.

0
installs
▌
Tampering · florianbuetow
This skill should be used when the user asks to "check for tampering", "analyze data integrity risks", "find injection vulnerabilities", or mentions "tampering" in a security context. Maps to STRIDE category T.

0
installs
▌
Websocket · florianbuetow bundle
This skill should be used when the user asks to "check WebSocket security", "analyze WebSocket authentication", "find WebSocket vulnerabilities", "audit WebSocket handlers", "check for CSWSH", or mentions "WebSocket", "ws://", "wss://", "socket.io", "CSWSH", "WebSocket origin check", "WebSocket rate limit", or "WebSocket authentication" in a security context.

0
installs
▌
Changelog Create · florianbuetow
This skill should be used when the user asks to "create a changelog", "initialize CHANGELOG.md", "start a changelog", or when the main changelog skill detects no existing CHANGELOG.md file. Creates a new CHANGELOG.md from scratch by analyzing the full git commit history and organizing changes by date-based version sections.

0
installs
▌
Changelog Update · florianbuetow
This skill should be used when the user asks to "update the changelog", "add to the changelog", "changelog for new release", "update CHANGELOG.md", or when the main changelog skill detects an existing CHANGELOG.md file. Appends new version entries by analyzing commits since the last documented version.

0
installs
▌
Diagrams Mermaid · florianbuetow
Produce a Mermaid diagram (flowchart, sequence, class, state, ER, gantt, pie, mindmap) inside a ```mermaid fenced code block for rendering in Markdown, docs, or the GitHub/GitLab viewer. Use when the user asks for a mermaid diagram, a flowchart/sequence/class/state/ER/gantt diagram, or a diagram to embed in Markdown.

0
installs
▌
Diagrams Wardley · florianbuetow bundle
Produce a Wardley map in the WTG2 DSL (wardleyToGo) as a .wtg2 file that renders to SVG via wtg2svg — anchors (user needs), components positioned by value chain (visibility) and evolution (roman numerals I–IV), dependencies, movement, inertia, build/buy/outsource, signals, gameplays, and groups. Use when the user asks for a Wardley map, strategic map, or value-chain map.

0
installs
▌
Update · florianbuetow
Update an existing CLAUDE.md (or the file it symlinks to) with production-grade agent directives that override Claude Code's built-in limitations. Merges new directives without destroying existing project-specific instructions. Use when the user says "fixclaude update", "update claude md", "add claude fixes", or "augment claude md".

0
installs
▌
Continue · florianbuetow
Find handoff documents and continue work on a previous task with full context. Companion to the `handoff` skill.

0
installs
▌
Logbook Messages · florianbuetow
Analyze messages exchanged per project across all Claude Code sessions. Generates monthly and yearly markdown reports with per-project/branch breakdowns. Use when the user asks about "message count", "messages per project", "how many messages", "message report", "logbook messages", or wants usage statistics.

0
installs
▌
Sessionlog Recap · florianbuetow
This skill should be used when the user asks to "recap", "brief me", "remind me", "what did we work on", "what happened last time", "catch me up on recent sessions", "sessionlog recap", "session recap", "recent session summary", "tldr sessions", or wants a quick summary of what was worked on in recent sessions for this project.

0
installs
▌
Data Flows · florianbuetow
This skill should be used when the user asks to "map data flows", "trace data through the system", "show how data moves", "identify trust boundaries", "find where data is encrypted or decrypted", "map PII flows", or "trace input to storage". Also triggers when the user asks about data transformation pipelines, where sensitive data is processed, or how user input reaches databases or external services.

0
installs
▌
Full Audit · florianbuetow
This skill should be used when the user asks for a "full security audit", "exhaustive audit", "comprehensive security review", or invokes /appsec:full-audit. Launches every framework, every tool, and every red team agent, producing a dated report file.

0
installs
▌
Pasta Risk · florianbuetow
This skill should be used when the user asks to "calculate risk scores", "prioritize mitigations", "generate remediation roadmap", "analyze business impact", or is running PASTA stage 7. Also triggers when the user asks about risk-weighted findings, compliance gap analysis, or executive security summary in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 7 of 7).

0
installs
▌
Regression · florianbuetow
This skill should be used when the user asks to "check for regressions", "verify fixes still hold", "regression test security", "check for reintroduced vulnerabilities", "security regression check", or "verify no old bugs returned". Also triggers when the user wants to confirm that previously fixed vulnerabilities have not been reintroduced by recent code changes.

0
installs
▌
Serverless · florianbuetow bundle
This skill should be used when the user asks to "check serverless security", "audit Lambda functions", "analyze cloud function permissions", "check IAM policies", "find serverless vulnerabilities", or mentions "serverless", "Lambda", "Cloud Functions", "Azure Functions", "IAM policy", "event injection", "overprivileged", or "/tmp reuse" in a security context.

0
installs
▌
Tldr · florianbuetow
Military-style communication mode — enforce extreme brevity, lead with critical issues and end with a one-line bottom-line conclusion, bullets over prose, and cut filler, preambles, code examples, and hand-holding. Use when the user types "tldr", "/tldr", "short mode", "be brief", or "concise mode", or otherwise asks for terse, no-fluff output.

0
installs
▌
Diagrams · florianbuetow
Router for the diagrams plugin — pick the right diagram format and dispatch to its skill. Routes to ascii-art (text/box-drawing diagrams), mermaid (flowcharts, sequence, class, state, ER, gantt), or wardley (Wardley maps in markdown). Use when the user says "draw a diagram", "diagram this", "make a chart", "visualize this as a diagram", "ascii diagram", "mermaid diagram", or "wardley map".

0
installs
▌
Analyze · florianbuetow bundle
Analyze an existing CLAUDE.md against all 7 Claude Code source leak findings and produce a detailed gap report showing which limitations are mitigated, partially addressed, or completely unaddressed. Use when the user says "fixclaude analyze", "analyze claude md", "check claude md coverage", "audit claude directives", or "what's missing from my claude md".

0
installs
▌
Install · florianbuetow
Default entry point for fixclaude. Detects whether CLAUDE.md exists in the current project and routes to the appropriate subcommand: init (create new) or update (augment existing). Handles symlinks transparently. Use when the user says "fixclaude", "fix claude", "install fixclaude", or "install claude fixes".

0
installs
▌
Sessionlog Export · florianbuetow
This skill should be used when the user asks to "export session log", "convert session to json", "export conversation", "save session", "sessionlog export", "export this session", or wants to export the current Claude Code session as a standard LLM conversation JSON file and human-readable TXT transcript.

0
installs
▌
Terminator Remove · florianbuetow
Remove the terminator kill hooks from local or global scope. Strips single-kill.sh and double-kill.sh Stop hook entries from the appropriate settings file (preserving other hooks), and deletes the hook scripts and config. Use when the user asks to "remove terminator", "uninstall the kill hooks", or "disable session termination".

0
installs
▌
Terminator Update · florianbuetow
Update the terminator kill phrases or case sensitivity at local or global scope. Prints the current phrase before asking for a new one. Rewrites only the changed fields; hooks read config live so changes take effect immediately. Use when the user asks to "update the kill phrase", "change the single/double kill phrase", or "toggle case sensitivity".

0
installs
▌
File Upload · florianbuetow bundle
This skill should be used when the user asks to "check file upload security", "analyze upload validation", "find upload vulnerabilities", "check for zip slip", "audit file upload handling", or mentions "file upload", "upload validation", "content-type check", "magic bytes", "zip slip", or "path traversal in upload" in a security context.

0
installs
▌
Identifying · florianbuetow
This skill should be used when the user asks to "check for identifiability", "analyze re-identification risks", "find privacy issues related to anonymization", "check for PII exposure", or mentions "identifiability" in a privacy context. Maps to LINDDUN category I.

0
installs
▌
Pasta Scope · florianbuetow
This skill should be used when the user asks to "define technical scope", "map attack surface", "identify entry points", "build a data flow diagram", or is running PASTA stage 2. Also triggers when the user asks about DFDs, network boundaries, external dependencies, or deployment topology in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 2 of 7).

0
installs
▌
Pasta Vulns · florianbuetow
This skill should be used when the user asks to "analyze vulnerabilities", "find security weaknesses", "map CWEs", "run vulnerability analysis", or is running PASTA stage 5. Also triggers when the user asks about SAST, DAST, dependency scanning, or CWE mapping in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 5 of 7).

0
installs
▌
Repudiation · florianbuetow
This skill should be used when the user asks to "check for repudiation", "analyze audit logging", "find logging gaps", or mentions "repudiation" or "non-repudiation" in a security context. Maps to STRIDE category R.

0
installs
▌
Review Plan · florianbuetow
This skill should be used when the user asks to "review plan for security", "check plan for security issues", "security review of implementation plan", "audit the plan for vulnerabilities", or "check my plan before coding". Also triggers when the user mentions security in the context of an implementation plan, architecture proposal, or design document before code has been written. This is the FLAGSHIP pre-code security skill -- no other tool reviews plans at design time.

0
installs
▌
Unawareness · florianbuetow
This skill should be used when the user asks to "check for unawareness", "analyze consent mechanisms", "find privacy issues related to transparency", "check for hidden data collection", "audit user consent flows", or mentions "unawareness" in a privacy context. Maps to LINDDUN category U. No STRIDE equivalent exists.

0
installs
▌
Diagrams Ascii Art · florianbuetow bundle
Draw ASCII-art / text diagrams for software documentation using extended ASCII box-drawing characters (IBM CP437 codes > 128 — single-line ┌─┐│└┘├┤┬┴┼, double-line ╔═╗║╚╝, shading ░▒▓█), never +, -, |, or /. Enforces ≤80-char width and strict row/column alignment, renders in monospaced fonts. Use when the user wants an ascii diagram, a text/box diagram, a terminal diagram, or a plain-text visualization.

0
installs
▌
Sessionlog Compact · florianbuetow
This skill should be used when the user asks to "compact session", "compress session", "save session context", "sessionlog compact", "compact this session", "prepare for clear", or wants to create a compressed summary of the current session that can be continued after clearing context.

0
installs
▌
Terminator Install · florianbuetow
Install the terminator kill hooks at project (local) or user (global) scope. Installs single-kill.sh and/or double-kill.sh as Stop hooks, each bound to a phrase, merging into the appropriate settings file without clobbering existing hooks. Use when the user asks to "install terminator", "set up the kill hooks", "add single kill", "add double kill", or "enable session termination".

0
installs
▌
Archibald · florianbuetow bundle
This skill should be used when the user asks to "assess architecture quality", "check for architectural smells", "analyze dependencies", "evaluate technical debt", "review architecture health", "find antipatterns", or "measure coupling/cohesion/complexity". Also triggers when the user mentions specific concepts by name (e.g., "cyclic dependency", "god component", "hub-like dependency", "dependency structure matrix", "DSM", "instability metric", "LCOM", "CBO", "Big Ball of Mud", "cargo cult", "golden hammer"). Supports a full architecture assessment or focused analysis of individual dimensions.

0
installs
▌
Changelog · florianbuetow bundle
This skill should be used when the user asks to "update the changelog", "generate a changelog", "create CHANGELOG.md", "write release notes", "update CHANGELOG", "add changelog entry", "changelog from commits", or mentions changelog generation, release documentation, or keeping a changelog up to date. Auto-detects whether to create or update based on file existence. Follows Keep a Changelog format with Semantic Versioning.

0
installs
▌
Sessionlog Continue · florianbuetow
This skill should be used when the user asks to "continue session", "resume session", "pick up where I left off", "sessionlog continue", "continue from compact", "load session context", or wants to restore context from a previously compacted session file.

0
installs
▌
Terminator Whendone · florianbuetow
Arm the current Claude Code session to self-terminate by uttering a kill phrase once all work is finished and no questions remain. Use when the user says "terminate when done", "whendone", "end the session when finished", or "self-terminate when complete".

0
installs
▌
Outdated Deps · florianbuetow bundle
This skill should be used when the user asks to "check for vulnerable dependencies", "audit dependencies", "find outdated packages", "scan for CVEs", "check for typosquatting", or mentions "vulnerable components", "outdated dependencies", or "supply chain" in a security context. Maps to OWASP Top 10 2021 A06: Vulnerable and Outdated Components.

0
installs
▌
Pasta Threats · florianbuetow
This skill should be used when the user asks to "analyze threats", "identify threat actors", "map attack vectors", "cross-reference MITRE ATT&CK", or is running PASTA stage 4. Also triggers when the user asks about adversary tactics, supply chain threats, or threat intelligence in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 4 of 7).

0
installs
▌
Product Spec · florianbuetow bundle
Use when the user wants to write a "product spec" or "product specification", frame a "product bet", or define a falsifiable hypothesis before building. Also triggers on "replace the PRD", "retire the PRD", "the PRD is too long / too vague", "tighten this spec for an engineer or agent", "what's the bet", "what problem are we solving", "acceptance criteria", "success criteria", "kill / scale / graduate thresholds", "measurement plan", or when scoping a feature's problem, bet, success behaviors, and evaluation before any behavioral spec. Part of the spec-dd workflow; precedes /spec-dd:spec.

0
installs
▌
Agent Guardrails Test · florianbuetow
Test installed agent guardrail hooks by sending trigger phrases through the stop hook script. Checks hook installation first, then runs two test phrases per rule. Use when user asks to "test guardrails", "verify hooks", "check guardrail patterns", "agent-guardrails test", or wants to confirm hooks are working.

0
installs
▌
Access Control · florianbuetow bundle
This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDOR vulnerabilities", "audit CORS configuration", "check for privilege escalation", or mentions "access control", "authorization", "IDOR", "CORS", "JWT tampering", or "directory traversal" in a security context. Maps to OWASP Top 10 2021 A01: Broken Access Control.

0
installs
▌
Attack Surface · florianbuetow
This skill should be used when the user asks to "map attack surface", "list entry points", "inventory API endpoints", "find all inputs", "enumerate routes", "discover exposed endpoints", or "map external interfaces". Also triggers when the user asks about exposed APIs, form handlers, file upload endpoints, WebSocket handlers, CLI argument parsers, or wants to understand where external data enters the system.

0
installs
▌
Business Logic · florianbuetow bundle
This skill should be used when the user asks to "check business logic security", "find logic flaws", "audit workflow security", "check for coupon abuse", "detect negative amount exploits", "analyze state machine security", or mentions "business logic", "workflow bypass", "negative amount", "coupon abuse", "self-referral", "state manipulation", or "time-based exploit" in a security context.

0
installs
▌
Non Compliance · florianbuetow
This skill should be used when the user asks to "check for non-compliance", "analyze GDPR compliance", "find CCPA violations", "check HIPAA compliance", "audit regulatory requirements", or mentions "non-compliance" in a privacy context. Maps to LINDDUN category N2. No STRIDE equivalent exists.

0
installs
▌
Arc42 Framework · florianbuetow bundle
Generate arc42 architecture documentation from a codebase. Read the repository into a structured evidence base, then author the 12 arc42 sections — emitting Mermaid diagrams where the code gives high-confidence structure, and explicit typed GAP flags where human input is needed, never fabricating. Use when asked to create, scaffold, or update arc42 docs, an architecture document, or per-section architecture views (building block view, runtime view, deployment view, etc.) for a project.

0
installs
▌
Clean Code · florianbuetow bundle
This skill should be used when the user asks to "check clean code", "review code cleanliness", "find code smells", "is this function too long", "are these names clear", "review my error handling", "check my tests", or "clean up this code". Also triggers when the user mentions Clean Code, Uncle Bob, Robert Martin, meaningful names, function length, comment rot, F.I.R.S.T. tests, or names a dimension directly ("naming", "boundaries", "concurrency"). Supports auditing all nine dimensions at once or focusing on a single dimension.

0
installs
▌
Onboarding · florianbuetow
This skill should be used when starting a new session, resuming work, or when the user asks to "onboard", "get oriented", "catch me up", "what's the state of the project", "what should I work on", or "where did we leave off". Gathers project context by reading instructions, checking git state, reviewing open issues, and identifying next steps.

0
installs
▌
Maptasks · florianbuetow bundle
Use when you have a specified engineering task or task list and need to decide which AI model should handle each work unit — routes tasks across Claude Opus/Sonnet/Haiku, GPT-5.4 family, GPT-5.3-Codex, and Gemini 2.5/3 with per-unit category, evidence-based rationale, context briefing, and failure-mode warnings. Also checks whether the task is broken down enough and proposes finer decomposition before routing.

0
installs
▌
Sessionlog Export All · florianbuetow
This skill should be used when the user asks to "export all sessions", "export all session logs", "batch export sessions", "sessionlog export-all", "convert all sessions", or wants to export every Claude Code session for the current project as standard LLM conversation JSON and TXT files.

0
installs
▌
Sessionlog Tokenusage · florianbuetow
This skill should be used when the user asks to "show token usage", "how many tokens", "token count", "token stats", "input output tokens", "API usage", "usage summary", "sessionlog tokenusage", "tokenusage", or wants to extract and report input/output token counts from Claude Code session logs.

0
installs
▌
Terminator · florianbuetow
Router for the terminator plugin — Stop hooks that end a Claude Code session (and optionally its terminal) when the agent's final message contains a kill phrase. Routes to install, remove, update, or whendone. Use when the user says "terminator", "install the kill hook", "set up a kill phrase", "single kill", "double kill", "remove the terminator hook", "change the kill phrase", or "terminate when done".

0
installs
▌
Data Disclosure · florianbuetow
This skill should be used when the user asks to "check for personal data disclosure", "analyze PII exposure", "find privacy issues related to data leakage", "check for unauthorized data sharing", or mentions "disclosure" in a privacy context. Maps to LINDDUN category D2. Focuses specifically on PERSONAL data disclosure, complementing STRIDE information disclosure.

0
installs
▌
Info Disclosure · florianbuetow
This skill should be used when the user asks to "check for information disclosure", "analyze data leakage risks", "find data exposure vulnerabilities", or mentions "information disclosure" in a security context. Maps to STRIDE category I.

0
installs
▌
Insecure Design · florianbuetow bundle
This skill should be used when the user asks to "check for design flaws", "analyze security design", "find insecure design patterns", "review threat model", "check business logic security", "find missing security controls", or mentions "insecure design" in a security context. Maps to OWASP Top 10 2021 A04:2021 - Insecure Design.

0
installs
▌
Pasta Decompose · florianbuetow
This skill should be used when the user asks to "decompose the application", "map trust boundaries", "identify components and roles", "catalog permissions", or is running PASTA stage 3. Also triggers when the user asks about role-based access control mapping, data classification, or service-to-service trust in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 3 of 7).

0
installs

121 published skills · page 1 of 2