Code Review
Automated code review and analysis
aif-security-checklist
by lee-to
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".
aif-ci
by lee-to
Generate CI/CD pipeline (GitHub Actions / GitLab CI) with linting, static analysis, tests, security. Use when user says "ci", "setup ci", "github actions", "gitlab ci", "pipeline".
aif-verify
by lee-to
Verify completed implementation against the plan. Checks that all tasks were fully implemented, nothing was forgotten, code compiles, tests pass, and quality standards are met. Use after "/aif-implement" completes, or when user says "verify", "check work", "did we miss anything".
aif-roadmap
by lee-to
Create or update a project roadmap with major milestones. Generates .ai-factory/ROADMAP.md — a strategic checklist of high-level goals. Use when user says "roadmap", "project plan", "milestones", or "what to build next".
web-design-guidelines
by calcom
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
deep-researcher
by lofcz
Performs comprehensive, multi-layered research on any topic with structured analysis and synthesis of information from multiple sources.
claude-setup-audit
by codemie-ai
This skill should be used when the user asks to "audit my claude setup", "check my claude configuration", "assess my claude code setup", "audit claude", "review my .claude folder", "is my claude setup correct", "check repo health", "assess my skills quality", "review my agents", "check my CLAUDE.md", "validate my hooks", "audit claude configuration", "check my MCP config", "how good is my claude setup", "scan my .claude folder", or wants a comprehensive quality assessment of all Claude Code components in a repository. Evaluates skills, subagents, CLAUDE.md rules, commands, hooks, and MCP configuration against established best practices. Produces a graded health report (A–F per component) with good/bad example references and prioritized recommendations.
integration-e2e-testing
by shinpr
Integration and E2E test design principles, ROI calculation, test skeleton specification, and review criteria. Use when designing integration tests, E2E tests, or reviewing test quality.
unsafe-checker
by actionbook
"CRITICAL: Use for unsafe Rust code review and FFI. Triggers on: unsafe, raw pointer, FFI, extern, transmute, *mut, *const, union, #[repr(C)], libc, std::ffi, MaybeUninit, NonNull, SAFETY comment, soundness, undefined behavior, UB, safe wrapper, memory layout, bindgen, cbindgen, CString, CStr, 安全抽象, 裸指针, 外部函数接口, 内存布局, 不安全代码, FFI 绑定, 未定义行为"
analyzing-heap-spray-exploitation
by mukul975
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns,
web-quality-audit
by addyosmani
Comprehensive web quality audit covering performance, accessibility, SEO, and best practices. Use when asked to "audit my site", "review web quality", "run lighthouse audit", "check page quality", or "optimize my website".
cron
by HKUDS
Schedule reminders and recurring tasks.
contract-redliner
by travisjneuman
Contract review, redlining, and negotiation support with clause analysis, risk identification, and markup templates. Use when reviewing contracts, identifying unfavorable terms, suggesting amendments, or preparing negotiation positions.
create-pr
by helderberto
Create GitHub pull requests. Use when user asks to "create a pull request", "open a PR", "/create-pr", or requests creating pull requests.
review-pr
by helderberto
Review pull requests. Use when user asks to "review a PR", "/review-pr", or wants to review a pull request.
safe-repo
by helderberto
Check for sensitive data in repository. Use when user asks to "check for sensitive data", "/safe-repo", or wants to verify no company/credential data is in the repository.
security-monitoring
by ibuilder
How to monitor and fix security issues in Massing — CodeQL alerts, dependency audits, secret scanning, and ReDoS/XXE fixes. Invoke after a push (standing directive) or when doing a hardening pass. Emphasises that a green CodeQL run != zero alerts.
git
by youlianvr
"Standardized Git operations: conventional commits, branch naming, workflow rules. Create commits with auto-detected type/scope, manage branches, run workflow operations. Use when committing changes, managing branches, or any git workflow task."
fable-method
by youlianvr
A step-by-step problem-solving loop (classify the ask, define done, gather evidence, decide, act surgically, verify by observation, report outcome-first). Use when the user says "/fable-method", "use the fable method", or "approach this like Fable", or proactively when starting any multi-step task that no task-specific skill covers. Subcommands - plan (stop after the plan), audit (grade finished work against the loop), report (rewrite an answer outcome-first).
fable-loop
by youlianvr
End-to-end workflow that describes the way Fable ran sessions - parallel evidence subagents when the host supports them, one committed plan, surgical execution with an intent gate, adversarial verification, honest outcome-first report. Use for non-trivial multi-step tasks when the user says "/fable-loop", "run the fable loop", or "do this the way Fable would". For the rules alone without orchestration, use fable-method; for the plain task cycle without subagents, use task-cycle; for large multi-phase projects, prefer the GSD workflow and use this inside phases.
code-critic
by youlianvr
MUST USE when user asks to review code, find bugs, check for issues, audit code, code review, find bugs, check code, review, re-review, critique this, review this file, is this code good, what's wrong with, check for bugs, find problems. Sends code to proxy:4000 (deepseek-v4-flash) for merciless review. Returns structured report: score (0-10), critical count, each issue with severity/file/line/description/suggestion.
code-audit
by youlianvr
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
cross-eval
by youlianvr
"/cs:cross-eval <memo> — Multi-model consensus on a board memo or strategy brief. Claude + Codex + Gemini cross-review with graceful degradation. Use when a high-stakes memo needs an independent sanity check before the boardroom — e.g. a bet-the-company pivot or fundraise terms."
brainstorming
by youlianvr
"You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation. Adapted 2026-08-09 for this workspace: design docs go to knowledge/findings/, handoff goes to executing-plans (not writing-plans)."