Seguretat

Dependency Management for Cargo and npm

ShunsukeHayashi

Manage Rust and Node.js dependencies including adding, updating, auditing, and resolving conflicts. Use when updating dependencies or resolving version conflicts.

Security Audit and Vulnerability Scanning

ShunsukeHayashi

Comprehensive security audit workflow including dependency scanning, unsafe code detection, and secret management. Use when scanning for vulnerabilities or before production deployment.

web-fingerprint

ivanvza

Find and fingerprint web servers on a target. Use when asked to "find web servers", "fingerprint a website", "what's running on this web server", "identify web technologies", or "scan for web services".

production-ready

adamos486

Use when preparing any project for production deployment, performing security audits, or release preparation. Triggers on "make production ready", "security audit", "prepare for release", "hardening", "pre-deployment checklist".

exhaustive-systems-analysis

petekp

Perform comprehensive, deep analysis of a system and its subsystems to identify bugs, race conditions, stale documentation, dead code, and correctness issues. Use when asked to "audit this system", "exhaustive analysis of X", "analyze for correctness", "root out issues in...", "deep dive into...", "verify this code is correct", "find bugs in...", or when reviewing agent-written code for production readiness. Automatically decomposes systems into subsystems, applies appropriate analysis checklists, and produces structured findings with severity classification.

Project Scanner Workflow

KhaiHuynhVN

python-security-scanner

jorgealves

Detect common Python vulnerabilities such as SQL injection, unsafe deserialization, and hardcoded secrets. Use as part of a secure SDLC for Python projects.

research-synthesis

tomwangowa

Use after running 2+ research skills (critical-research, tech-feasibility, narrative-auditor, codebase-audit) to synthesize findings into a unified decision document. Resolves conflicts between sources, weighs evidence, and produces an actionable recommendation.

debt-ledger

odysseythink

Scan the codebase for // ody: / # ody: simplification-debt markers and render a Chinese-first ledger report grouped by file with rot-risk warnings. Use after every simplification session to harvest markers, and before code review to surface pending simplifications.

enterprise-agent-ops

texugo7badger

Operate long-lived agent workloads with observability, security boundaries, and lifecycle management.

topmind-loop

topmindspace

可中断的工作区语义巡检（走专题/Inbox，.loop 断点续跑）。Use when 跑一遍 loop、巡检、整体体检、复盘、 继续 loop、audit。Do NOT use for 快速 doctor（→maintain）、单专题整理、捕获、写作、仅记忆.

ci-cd

costa-marcello

"Creates production-ready GitHub Actions workflows for CI/CD, Docker builds, security scanning, and monorepo orchestration. Triggers on requests for CI/CD setup, workflow creation, pipeline automation, GitHub Actions help, deployment workflows, matrix builds, reusable workflows, or security scanning configuration."

skill-auditor

tomwangowa

Audit Claude Code skills for quality, security, and best practices. Use when reviewing SKILL.md files, ensuring skill quality standards, or before sharing skills with team.

core-security-audit

chrissgon

Audit the workbench for security beyond what the scan sees: every skill, agent, agent override, provider, adapter, script, hook and CI workflow answered against the security checklist, each finding with file:line, a quote, a severity and a fix, high findings verified in the code, and the fixes grouped by owner in a dated audit record. Also vet a third-party skill before anyone installs it, with a verdict. Use this skill when someone asks for a security audit or review of the workbench, a periodic audit is due, a skill from outside is about to be installed ("is this skill safe?", "install this skill"), or the scan passes but something still looks risky.

codebase-audit

tomwangowa

Claims-first codebase audit that extracts documentation claims and verifies them against code. Use when asked to "audit", "verify docs match code", "check if README claims are true", or "validate documentation accuracy". Falsification-first approach.

production-audit

costa-marcello

"Audits a codebase for production readiness across six dimensions: API completeness, frontend-backend sync, security, scalability, infrastructure, and dead code/architecture. Use when asked for a launch assessment, production readiness check, pre-deployment audit, or multi-agent patchwork cleanup."

publish-release

jujumelona

Publish only an explicitly approved, already validated release artifact to a reviewed distribution provider.

config-gc

texugo7badger

Garbage collection for your Claude Code configuration. Periodically scans ~/.claude (skills, memory, hooks, permissions, MCP servers, caches) for redundant, stale, orphaned, or low-value items, then walks the user through a confirm-each-deletion cleanup. Use when the user says "clean up my config", "config GC", "too many skills", "audit my setup", "my .claude is bloated", or asks for a periodic config review.

prompt-injection-scanner

jorgealves

Audits agent skill instructions and system prompts for vulnerabilities to prompt hijacking and indirect injection. Use when designing new agent skills or before deploying agents to public environments where users provide untrusted input.

workspace-governance

crissmoldovan

Audit repository placement and explain inherited policy.

review-code

costa-marcello

"Reviews current git changes with a senior engineer lens. Detects SOLID violations, YAGNI/DRY/KISS breaches, security risks, performance issues, and proposes actionable improvements. Use when reviewing pull requests, checking code quality before merging, or auditing changes for security vulnerabilities."

gdpr-ccpa-privacy-auditor

jorgealves

Audits web applications to ensure declared privacy policies match actual technical data collection practices. Use to identify discrepancies in cookie usage, tracking scripts, and user data handling.

debt-ledger

odysseythink

Scan the codebase for // ody: / # ody: simplification-debt markers and render a Chinese-first ledger report grouped by file with rot-risk warnings. Use after every simplification session to harvest markers, and before code review to surface pending simplifications.

defi-amm-security

texugo7badger

Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math.