Security
Security scanning and vulnerability detection
classifying-review-findings
by bitwarden
Use this skill when categorizing code review findings into severity levels. Apply when determining which emoji and label to use for PR comments, deciding if an issue should be flagged at all, or classifying findings as CRITICAL, IMPORTANT, DEBT, SUGGESTED, or QUESTION.
changelog
by AsiaOstrich
"[UDS] Generate and maintain CHANGELOG.md entries"
backend-agents-operons
by hushh-labs
Use when changing backend agents, operons, ADK surfaces, or orchestration contracts inside the consent-protocol runtime.
backend
by hushh-labs
Use when the request is broadly about backend runtime, API routes, services, agents, or protocol package behavior and the correct backend specialist skill is not yet clear.
vault-pkm-governance
by hushh-labs
Use when changing vault boundaries, PKM storage rules, encrypted information handling, or ordinary vault/PKM persistence behavior inside the security-audit owner family.
backend-runtime-governance
by hushh-labs
Use when changing backend route placement, service boundaries, runtime ownership, or backend docs/tests alignment.
release-ios-appstore
by hushh-labs
Use when releasing, submitting, or verifying a public Hussh One iOS App Store build cut from green main: Apple-managed signing with an Admin ASC API key, a binary whose backend is chosen by backend_target (default UAT, or production), per-version "What's New" and build attach via the ASC API, and the two-gate dispatch path (prepare-only default, opt-in irreversible public submit).
security-audit
by hushh-labs
Use when the request is about IAM, consent, trust, ordinary vault encryption, failures decrypting PKM entries, PKM storage or persistence, encrypted PKM records, plaintext localStorage leaks, streaming safety, verification, or security audit workflows and no narrower specialist owns the change.
kai-test-account-reset
by hushh-labs
Use when resetting a Kai/UAT test account by email for end-to-end onboarding, vault, RIA, consent, or profile retesting.
config-consistency-checker
by ArabelaTso
Automatically analyzes configuration files to detect inconsistencies, conflicts, missing keys, and divergent values across environments, versions, or modules. Use when managing multi-environment configurations, detecting config drift, validating configuration changes, or ensuring consistency across microservices. Supports JSON, YAML, TOML, INI, XML, .env, and properties files. Identifies security issues like hardcoded secrets and provides actionable resolution guidance.
dependency-updater
by softaworks
Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.
mapbox-token-security
by mapbox
Security best practices for Mapbox access tokens, including scope management, URL restrictions, rotation strategies, and protecting sensitive data. Use when creating, managing, or advising on Mapbox token security.
code-review-security
by eltmon
Deep security analysis focusing on OWASP Top 10
discover
by AsiaOstrich
"[UDS] Assess project health, architecture, and risks before adding features"
ship-safe-scan
by asamassekou10
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
code-review
by DanielKerridge
Deep code audit that finds dead wiring, silent failures, unfinished features, placeholder stubs, bloated files, and unnecessary complexity. Produces an actionable report with file:line references grouped by severity. Think of it as a senior dev doing a thorough PR review of the entire codebase. Triggers on: "code review", "audit the code", "review the code", "find dead code", "find placeholders", "check for stubs", "prune the code", "code cleanup", "implementation review", "completeness check", "find unused code".
artifact-sbom-publisher
by patricio0312rev
Produces build artifacts with Software Bill of Materials (SBOM) and supply chain metadata for security and compliance. Use for "artifact publishing", "SBOM generation", "supply chain security", or "build provenance".
reflect
by iliaal
Session retrospective and skill audit. Use when "/reflect", "session review", "retrospective", "what went wrong", "lessons learned", "what should we remember", or "what can we improve".
meta-prompting
by iliaal
Enhanced reasoning patterns via slash commands (/think, /verify, /adversarial, /edge, /compare, /confidence, /budget, /constrain, /json, /flip, /assumptions, /tensions, /analyze, /trade) or natural language ("argue against", "what could break", "show reasoning", "deep review", "meta-prompts", "thinking modes", "second-best approach", "list assumptions", "opposing perspectives").
Horizon
by simota
非推奨ライブラリの検出、ネイティブAPI置換提案、新技術のPoC作成。技術スタック刷新、モダナイゼーション、レガシーコード更新が必要な時に使用。
Gear
by simota
ä¾åé¢ä¿ç®¡çãCI/CDæé©åãDockerè¨å®ãéç¨ãªãã¶ã¼ãããªãã£ï¼ãã°/ã¢ã©ã¼ã/ãã«ã¹ãã§ãã¯ï¼ããã«ãã¨ã©ã¼ãéçºç°å¢ã®åé¡ãéç¨è¨å®ã®ä¿®æ£ãå¿ è¦ãªæã«ä½¿ç¨ã
Grove
by simota
ãªãã¸ããªæ§é ã®è¨è¨ã»æé©åã»ç£æ»ããã£ã¬ã¯ããªè¨è¨ãdocs/æ§æï¼è¦ä»¶å®ç¾©æ¸ã»è¨è¨æ¸ã»ãã§ãã¯ãªã¹ã対å¿ï¼ããã¹ãæ§æãã¹ã¯ãªãã管çãã¢ã³ããã¿ã¼ã³æ¤åºãæ¢åãªãã¸ããªã®æ§æ移è¡ãæ å½ããªãã¸ããªæ§é ã®è¨è¨ã»æ¹åãå¿ è¦ãªæã«ä½¿ç¨ã
compliance-audit
by NickCrew
Regulatory compliance auditing across GDPR, HIPAA, PCI DSS, SOC 2, and ISO frameworks with automated evidence collection and gap analysis. Use when conducting compliance assessments, preparing for certifications, or implementing regulatory controls.
doc-maintenance
by NickCrew
"Systematic documentation audit and maintenance. This skill should be used when documentation may be stale, missing, or misorganized — after feature work, refactors, dependency upgrades, or as a periodic health check. It prescribes folder structure for docs/ and manual/, dispatches haiku subagents for codebase/doc scanning, and routes doc creation to specialized agents (reference-builder, technical-writer, learning-guide) with docs-architect as quality gate."