安全
安全扫描与漏洞检测
classifying-review-findings
bitwarden
Use this skill when categorizing code review findings into severity levels. Apply when determining which emoji and label to use for PR comments, deciding if an issue should be flagged at all, or classifying findings as CRITICAL, IMPORTANT, DEBT, SUGGESTED, or QUESTION.
changelog
AsiaOstrich
"[UDS] Generate and maintain CHANGELOG.md entries"
backend-agents-operons
hushh-labs
Use when changing backend agents, operons, ADK surfaces, or orchestration contracts inside the consent-protocol runtime.
backend
hushh-labs
Use when the request is broadly about backend runtime, API routes, services, agents, or protocol package behavior and the correct backend specialist skill is not yet clear.
vault-pkm-governance
hushh-labs
Use when changing vault boundaries, PKM storage rules, encrypted information handling, or ordinary vault/PKM persistence behavior inside the security-audit owner family.
backend-runtime-governance
hushh-labs
Use when changing backend route placement, service boundaries, runtime ownership, or backend docs/tests alignment.
release-ios-appstore
hushh-labs
Use when releasing, submitting, or verifying a public Hussh One iOS App Store build cut from green main: Apple-managed signing with an Admin ASC API key, a binary whose backend is chosen by backend_target (default UAT, or production), per-version "What's New" and build attach via the ASC API, and the two-gate dispatch path (prepare-only default, opt-in irreversible public submit).
security-audit
hushh-labs
Use when the request is about IAM, consent, trust, ordinary vault encryption, failures decrypting PKM entries, PKM storage or persistence, encrypted PKM records, plaintext localStorage leaks, streaming safety, verification, or security audit workflows and no narrower specialist owns the change.
kai-test-account-reset
hushh-labs
Use when resetting a Kai/UAT test account by email for end-to-end onboarding, vault, RIA, consent, or profile retesting.
config-consistency-checker
ArabelaTso
Automatically analyzes configuration files to detect inconsistencies, conflicts, missing keys, and divergent values across environments, versions, or modules. Use when managing multi-environment configurations, detecting config drift, validating configuration changes, or ensuring consistency across microservices. Supports JSON, YAML, TOML, INI, XML, .env, and properties files. Identifies security issues like hardcoded secrets and provides actionable resolution guidance.
dependency-updater
softaworks
Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.
mapbox-token-security
mapbox
Security best practices for Mapbox access tokens, including scope management, URL restrictions, rotation strategies, and protecting sensitive data. Use when creating, managing, or advising on Mapbox token security.
code-review-security
eltmon
Deep security analysis focusing on OWASP Top 10
discover
AsiaOstrich
"[UDS] Assess project health, architecture, and risks before adding features"
ship-safe-scan
asamassekou10
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
code-review
DanielKerridge
Deep code audit that finds dead wiring, silent failures, unfinished features, placeholder stubs, bloated files, and unnecessary complexity. Produces an actionable report with file:line references grouped by severity. Think of it as a senior dev doing a thorough PR review of the entire codebase. Triggers on: "code review", "audit the code", "review the code", "find dead code", "find placeholders", "check for stubs", "prune the code", "code cleanup", "implementation review", "completeness check", "find unused code".
artifact-sbom-publisher
patricio0312rev
Produces build artifacts with Software Bill of Materials (SBOM) and supply chain metadata for security and compliance. Use for "artifact publishing", "SBOM generation", "supply chain security", or "build provenance".
reflect
iliaal
Session retrospective and skill audit. Use when "/reflect", "session review", "retrospective", "what went wrong", "lessons learned", "what should we remember", or "what can we improve".
meta-prompting
iliaal
Enhanced reasoning patterns via slash commands (/think, /verify, /adversarial, /edge, /compare, /confidence, /budget, /constrain, /json, /flip, /assumptions, /tensions, /analyze, /trade) or natural language ("argue against", "what could break", "show reasoning", "deep review", "meta-prompts", "thinking modes", "second-best approach", "list assumptions", "opposing perspectives").
Horizon
simota
非推奨ライブラリの検出、ネイティブAPI置換提案、新技術のPoC作成。技術スタック刷新、モダナイゼーション、レガシーコード更新が必要な時に使用。
Gear
simota
ä¾åé¢ä¿ç®¡çãCI/CDæé©åãDockerè¨å®ãéç¨ãªãã¶ã¼ãããªãã£ï¼ãã°/ã¢ã©ã¼ã/ãã«ã¹ãã§ãã¯ï¼ããã«ãã¨ã©ã¼ãéçºç°å¢ã®åé¡ãéç¨è¨å®ã®ä¿®æ£ãå¿ è¦ãªæã«ä½¿ç¨ã
Grove
simota
ãªãã¸ããªæ§é ã®è¨è¨ã»æé©åã»ç£æ»ããã£ã¬ã¯ããªè¨è¨ãdocs/æ§æï¼è¦ä»¶å®ç¾©æ¸ã»è¨è¨æ¸ã»ãã§ãã¯ãªã¹ã対å¿ï¼ããã¹ãæ§æãã¹ã¯ãªãã管çãã¢ã³ããã¿ã¼ã³æ¤åºãæ¢åãªãã¸ããªã®æ§æ移è¡ãæ å½ããªãã¸ããªæ§é ã®è¨è¨ã»æ¹åãå¿ è¦ãªæã«ä½¿ç¨ã
compliance-audit
NickCrew
Regulatory compliance auditing across GDPR, HIPAA, PCI DSS, SOC 2, and ISO frameworks with automated evidence collection and gap analysis. Use when conducting compliance assessments, preparing for certifications, or implementing regulatory controls.
doc-maintenance
NickCrew
"Systematic documentation audit and maintenance. This skill should be used when documentation may be stale, missing, or misorganized — after feature work, refactors, dependency upgrades, or as a periodic health check. It prescribes folder structure for docs/ and manual/, dispatches haiku subagents for codebase/doc scanning, and routes doc creation to specialized agents (reference-builder, technical-writer, learning-guide) with docs-architect as quality gate."