Code Review
Automated code review and analysis
gha-security-review
by getsentry
'GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.'
gh-review-requests
by getsentry
Fetch unread GitHub notifications for open PRs where review is requested from a specified team or opened by a team member. Use when asked to "find PRs I need to review", "show my review requests", "what needs my review", "fetch GitHub review requests", or "check team review queue".
django-access-review
by getsentry
'Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".'
gh-review-requests
by getsentry
Fetch unread GitHub notifications for open PRs where review is requested from a specified team or opened by a team member. Use when asked to "find PRs I need to review", "show my review requests", "what needs my review", "fetch GitHub review requests", or "check team review queue".
iterate-pr
by getsentry
Iterate on a PR until CI passes. Use when you need to fix CI failures, address review feedback, or continuously push fixes until all checks are green. Automates the feedback-fix-push-wait cycle.
algorand-vulnerability-scanner
by trailofbits
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
second-opinion
by trailofbits
"Runs external LLM code reviews (OpenAI Codex or Google Gemini CLI) on uncommitted changes, branch diffs, or specific commits. Use when the user asks for a second opinion, external review, codex review, gemini review, or mentions /second-opinion."
token-integration-analyzer
by trailofbits
Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Context-aware for both token implementations and token integrations.
claude-code
by NousResearch
Delegate coding tasks to Claude Code (Anthropic's CLI agent). Use for building features, refactoring, PR reviews, and iterative coding. Requires the claude CLI installed.
code-review
by NousResearch
Guidelines for performing thorough code reviews with security and quality focus
eval-harness
by affaan-m
Formal evaluation framework for Claude Code sessions implementing eval-driven development (EDD) principles
verification-loop
by affaan-m
"A comprehensive verification system for Claude Code sessions."
attack-tree-construction
by rmyndharis
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
codebase-cleanup-refactor-clean
by rmyndharis
"You are a code refactoring expert specializing in clean code principles, SOLID design patterns, and modern software engineering best practices. Analyze and refactor the provided code to improve its quality, maintainability, and performance."
ads-tiktok
by AgriciDaniel
TikTok Ads deep analysis covering creative quality, tracking, bidding, campaign structure, and TikTok Shop. Evaluates 25 checks with emphasis on creative-first strategy, safe zone compliance, and Smart+ campaigns. Use when user says "TikTok Ads", "TikTok marketing", "TikTok Shop", "Spark Ads", "Smart+", or "TikTok campaign".
docs-writer
by google-gemini
Always use this skill when the task involves writing, reviewing, or editing
polish
by elie222
Remove lint and low-risk code quality issues from current branch changes
create-pr
by elie222
Commit changes and open a pull request with safe metadata
design-evaluation-audit
by lyndonkl
Use when systematically evaluating existing designs for cognitive alignment, conducting design reviews or critiques, diagnosing usability issues, quality assurance before launch, or choosing between design alternatives with objective criteria. Invoke when user mentions design review, design critique, evaluate design, audit visualization, checklist, cognitive assessment, or usability evaluation.
openalgo-chart-debug
by marketcalls
Diagnose an openalgo-charts problem - blank or invisible chart, bars in the wrong place, unknown series type or indicator errors, misaligned indicators, drawings that drift, a chart that will not repaint or resize, live ticks not appearing, linked charts out of step, stale cached prices, an unknown interval code, or a broken bundle import. Use when a chart is not behaving as expected.
codex
by NousResearch
Delegate coding tasks to OpenAI Codex CLI agent. Use for building features, refactoring, PR reviews, and batch issue fixing. Requires the codex CLI and a git repository.
constant-time-analysis
by trailofbits
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
guidelines-advisor
by trailofbits
Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Provides actionable recommendations.
pre-submit-pr
by meta-pytorch
Validate changes before submitting a pull request. Run comprehensive checks including lint, tests, alignment review, and RFC analysis. Use before creating a PR, when asked if code is ready for review, or before pushing for PR.