Security
Security scanning and vulnerability detection
implementing-compliance
by ancoleman
Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection. Use when building systems requiring regulatory compliance, implementing security controls across multiple frameworks, or automating audit preparation.
cross-evolution
by llblab
Horizontal Gene Transfer protocol for skills. Synchronizes best practices and architectural patterns across the skill library.
agent-native-audit
by ratacat
Run comprehensive agent-native architecture review with scored principles
Ai Code Security
by omer-metin
review-security
by nesnilnehc
"Review code for security: injection, sensitive data, authentication and authorization, dependencies and CVEs, configuration and secrets, and crypto. Cognitive-only atomic skill; output is a findings list."
polish-repo
by axiomantic
"Use when improving project discoverability, attracting users/contributors, or presenting open source work. Triggers: 'write a README', 'improve README', 'get more users', 'get more contributors', 'add badges', 'create a logo', 'set up issue templates', 'audit this project', 'project presence', 'make this discoverable', 'why isn't anyone using this', 'prepare for launch', 'repo presentation', 'open source marketing', 'attract contributors', 'project storefront'. Also triggers on: naming a project, writing taglines, GitHub metadata, community infrastructure, signs of life."
code-review
by axiomantic
"Use when reviewing code. Triggers: 'review my code', 'check my work', 'look over this', 'review PR #X', 'PR comments to address', 'reviewer said', 'address feedback', 'self-review before PR', 'audit this code'. Modes: --self (pre-PR self-review), --feedback (process received review comments), --give (review someone else's code/PR), --audit (deep single-pass analysis). For heavyweight multi-phase analysis, use advanced-code-review instead."
reviewing-design-docs
by axiomantic
"Use when reviewing design documents, technical specifications, architecture docs, RFCs, ADRs, or API designs for completeness and implementability. Triggers: 'review this design', 'is this spec complete', 'can someone implement from this', 'what's missing from this design', 'review this RFC', 'is this ready for implementation', 'audit this spec'. Core question: could an implementer code against this without guessing?"
tarot-mode
by axiomantic
"Use when session returns mode.type='tarot', user says '/tarot', or requests roundtable dialogue with archetypes. Ten tarot archetypes (Magician, Priestess, Hermit, Fool, Chariot, Justice, Lovers, Hierophant, Emperor, Queen) collaborate via visible roundtable with instruction-engineering embedded."
gathering-requirements
by axiomantic
"Use when eliciting or clarifying feature requirements, defining scope, identifying constraints, or capturing user needs. Triggers: 'what are the requirements', 'define the requirements', 'scope this feature', 'user stories', 'acceptance criteria', 'what should this do', 'what problem are we solving', 'what are the constraints'. Also invoked by implementing-features during DISCOVER stage and by the Forged workflow."
security-auditing
by axiomantic
"Use when auditing skills, commands, hooks, and MCP tools for security vulnerabilities. Triggers: 'security audit', 'scan for vulnerabilities', 'check security', 'audit skills', 'audit MCP tools'. Integrates with code-review --audit, implementing-features Phase 4, and distilling-prs for PR security review."
security-scanner
by AIDotNet
全面的安全分析，识别OWASP Top 10漏洞、检测硬编码密钥和审查安全配置。
port-scanner
by AIDotNet
扫描网络端口以检查可用性和检测运行的服务。
plugin-dev
by rube-de
"Validate plugin SKILL.md frontmatter and audit hook scripts for silent failures. Run validation to check all plugins pass schema, source path, and frontmatter checks. Run hook audit to detect unhandled errors in shell and Python scripts."
security
by rube-de
Security scan: dependency audits, SAST analysis, and secret detection. Detects project type, runs available security tools, classifies findings by severity, and creates a structured GitHub issue.
dlc
by rube-de
Dev Life Cycle quality gates: run security scans, code quality checks, performance analysis, test coverage, and PR review compliance. Routes to domain-specific sub-skills or runs all checks in sequence.
update
by rube-de
Audit open GitHub issues for staleness, orphaned blockers, missing labels, codebase drift, and already-implemented features. Categorizes issues into close-candidates, update-needed, needs-triage, stale, and healthy. Supports bulk and individual remediation via interactive approval. Triggers: audit issues, clean up issues, update stale issues, issue hygiene, backlog cleanup, prune issues.
health-check
by acedergren
"Run all quality gates across the entire codebase and report results. Headless — no analysis, just execute and print. Use for pre-PR validation, phase completion, or routine health monitoring."
api-audit
by acedergren
"Audit API routes against shared types — scan routes, plugins, and types for mismatches. Read-only, no changes. Use before PRs, after adding routes, or for periodic API contract validation."
prod-readiness
by acedergren
Autonomous production readiness review pipeline — spawns 5 parallel specialist agents (security, testing, performance, observability, code quality) and synthesizes findings into a prioritized remediation plan. Use before major releases or milestone completions.
doc-sync
by acedergren
"Audit project documentation against the codebase and fix drift. Run before PRs or after major changes. Compares documented architecture, test counts, and file paths against actual state."
prd
by acedergren
"Create, validate, and evolve Product Requirements Documents with interactive discovery, technical architecture, phasing, TDD protocol, and dependency analysis. Use when: writing a PRD, planning a feature, defining requirements, or updating an existing PRD. Supports /prd (create), /prd --update (incremental update), /prd --validate (run checklist), /prd --audit-deps (dependency analysis only), /prd --to-plan (generate orchestrate-ready task plan)."
review-all
by acedergren
"Pre-PR review pipeline — runs security, API audit, and scope check agents in parallel. Read-only, no changes. Use before creating PRs or after completing a phase of work."
code-review
by PaulRBerg
This skill should be used when the user asks to "review code", "review PR", "code review", "audit code", "check for bugs", "security review", "review my changes", "find issues in this code", "review the diff", or asks for pull request review or code audit.