Security
Security scanning and vulnerability detection
web-fingerprint
by ivanvza
Find and fingerprint web servers on a target. Use when asked to "find web servers", "fingerprint a website", "what's running on this web server", "identify web technologies", or "scan for web services".
production-ready
by adamos486
Use when preparing any project for production deployment, performing security audits, or release preparation. Triggers on "make production ready", "security audit", "prepare for release", "hardening", "pre-deployment checklist".
exhaustive-systems-analysis
by petekp
Perform comprehensive, deep analysis of a system and its subsystems to identify bugs, race conditions, stale documentation, dead code, and correctness issues. Use when asked to "audit this system", "exhaustive analysis of X", "analyze for correctness", "root out issues in...", "deep dive into...", "verify this code is correct", "find bugs in...", or when reviewing agent-written code for production readiness. Automatically decomposes systems into subsystems, applies appropriate analysis checklists, and produces structured findings with severity classification.
Project Scanner Workflow
by KhaiHuynhVN
python-security-scanner
by jorgealves
Detect common Python vulnerabilities such as SQL injection, unsafe deserialization, and hardcoded secrets. Use as part of a secure SDLC for Python projects.
research-synthesis
by tomwangowa
Use after running 2+ research skills (critical-research, tech-feasibility, narrative-auditor, codebase-audit) to synthesize findings into a unified decision document. Resolves conflicts between sources, weighs evidence, and produces an actionable recommendation.
debt-ledger
by odysseythink
Scan the codebase for // ody: / # ody: simplification-debt markers and render a Chinese-first ledger report grouped by file with rot-risk warnings. Use after every simplification session to harvest markers, and before code review to surface pending simplifications.
enterprise-agent-ops
by texugo7badger
Operate long-lived agent workloads with observability, security boundaries, and lifecycle management.
topmind-loop
by topmindspace
可中断的工作区语义巡检（走专题/Inbox，.loop 断点续跑）。Use when 跑一遍 loop、巡检、整体体检、复盘、 继续 loop、audit。Do NOT use for 快速 doctor（→maintain）、单专题整理、捕获、写作、仅记忆.
ci-cd
by costa-marcello
"Creates production-ready GitHub Actions workflows for CI/CD, Docker builds, security scanning, and monorepo orchestration. Triggers on requests for CI/CD setup, workflow creation, pipeline automation, GitHub Actions help, deployment workflows, matrix builds, reusable workflows, or security scanning configuration."
skill-auditor
by tomwangowa
Audit Claude Code skills for quality, security, and best practices. Use when reviewing SKILL.md files, ensuring skill quality standards, or before sharing skills with team.
core-security-audit
by chrissgon
Audit the workbench for security beyond what the scan sees: every skill, agent, agent override, provider, adapter, script, hook and CI workflow answered against the security checklist, each finding with file:line, a quote, a severity and a fix, high findings verified in the code, and the fixes grouped by owner in a dated audit record. Also vet a third-party skill before anyone installs it, with a verdict. Use this skill when someone asks for a security audit or review of the workbench, a periodic audit is due, a skill from outside is about to be installed ("is this skill safe?", "install this skill"), or the scan passes but something still looks risky.
codebase-audit
by tomwangowa
Claims-first codebase audit that extracts documentation claims and verifies them against code. Use when asked to "audit", "verify docs match code", "check if README claims are true", or "validate documentation accuracy". Falsification-first approach.
production-audit
by costa-marcello
"Audits a codebase for production readiness across six dimensions: API completeness, frontend-backend sync, security, scalability, infrastructure, and dead code/architecture. Use when asked for a launch assessment, production readiness check, pre-deployment audit, or multi-agent patchwork cleanup."
publish-release
by jujumelona
Publish only an explicitly approved, already validated release artifact to a reviewed distribution provider.
config-gc
by texugo7badger
Garbage collection for your Claude Code configuration. Periodically scans ~/.claude (skills, memory, hooks, permissions, MCP servers, caches) for redundant, stale, orphaned, or low-value items, then walks the user through a confirm-each-deletion cleanup. Use when the user says "clean up my config", "config GC", "too many skills", "audit my setup", "my .claude is bloated", or asks for a periodic config review.
prompt-injection-scanner
by jorgealves
Audits agent skill instructions and system prompts for vulnerabilities to prompt hijacking and indirect injection. Use when designing new agent skills or before deploying agents to public environments where users provide untrusted input.
workspace-governance
by crissmoldovan
Audit repository placement and explain inherited policy.
review-code
by costa-marcello
"Reviews current git changes with a senior engineer lens. Detects SOLID violations, YAGNI/DRY/KISS breaches, security risks, performance issues, and proposes actionable improvements. Use when reviewing pull requests, checking code quality before merging, or auditing changes for security vulnerabilities."
gdpr-ccpa-privacy-auditor
by jorgealves
Audits web applications to ensure declared privacy policies match actual technical data collection practices. Use to identify discrepancies in cookie usage, tracking scripts, and user data handling.
debt-ledger
by odysseythink
Scan the codebase for // ody: / # ody: simplification-debt markers and render a Chinese-first ledger report grouped by file with rot-risk warnings. Use after every simplification session to harvest markers, and before code review to surface pending simplifications.
defi-amm-security
by texugo7badger
Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math.
topmind-maintain
by topmindspace
确定性体检/清理/结构修复/回执恢复。Use when 快速体检、诊断、doctor、清理、修复、workspace check。 Do NOT use for 整体巡检 loop、内容整理、捕获、写作、记忆.
track-roadmap
by AntJanus
Plan, update, and audit a high-level project roadmap. Use when asked to "create a roadmap", "plan features", "what should we build next", "update the roadmap", "audit the roadmap", "review project direction", "prioritize features", or when starting a new project and needing to map out future work.