安全
安全扫描与漏洞检测
web-performance-seo
ZhanlinCui
Fix PageSpeed Insights/Lighthouse accessibility "!" errors caused by contrast audit failures (CSS filters, OKLCH/OKLAB, low opacity, gradient text, image backgrounds). Use for accessibility-driven SEO/performance debugging and remediation.
ljg-xray-book
lijigang
Deep structure extraction from books using the Epiplexity principle - maximizing computational investment to extract maximum learnable structure from any book.
hash-calculator
dkyazzentwatwa
Calculate cryptographic hashes (MD5, SHA1, SHA256, SHA512) for text and files. Compare hashes, verify integrity, and batch process directories.
discover-security
rand
Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.
security-review
mhylle
Comprehensive security audit for code changes. Use this skill when implementing authentication, authorization, user input handling, API endpoints, secrets/credentials, payment features, or file uploads. Provides security checklists, vulnerability patterns, and remediation guidance. Integrates with implement-phase as a security quality gate.
vue-frontend
williamzujkowski
Composition API vs Options API
infrastructure-as-code
williamzujkowski
'Basic Resource:'
nist-compliance
williamzujkowski
NIST 800-53r5 control implementation, tagging, evidence collection, and compliance automation for security frameworks
fintech-compliance
williamzujkowski
Payment card security, SOC2 compliance, and financial services regulatory requirements
Gemini CLI
blacktop
Consult Google Gemini CLI for second opinions on architecture, debugging, and security audits. Use Gemini's 1M+ context window for comprehensive code analysis. Compare Flash (fast) vs Pro (thorough). Use when: need second opinion on architectural decisions, stuck debugging after 2+ attempts, writing security- sensitive code, planning refactors (5+ files), approaching 70%+ context capacity, unfamiliar with tech stack, need peer review, or want Flash vs Pro comparison. Keywords: gemini-cli, google gemini, gemini command line, second opinion, model comparison, gemini-3-flash-preview, gemini-3-pro-preview, architectural decisions, debugging assistant, code review gemini, security audit gemini, 1M context window, AI pair programming, gemini consultation, flash vs pro, AI-to-AI prompting, peer review, codebase analysis, gemini CLI tool, shell gemini, command line AI assistant, gemini architecture advice, gemini debug help, gemini security scan, gemini code compare
legacy-bridge
williamzujkowski
Backward compatibility bridge that translates legacy @load patterns to new Skills format. Enables seamless migration with zero breaking changes during 6-month transition period.
security-practices
williamzujkowski
Modern security standards including Zero Trust Architecture, supply chain security, DevSecOps integration, and cloud-native protection
kubernetes
williamzujkowski
Kubernetes standards for container orchestration, deployments, services, ingress, ConfigMaps, Secrets, and security policies. Covers production-ready configurations, monitoring, and best practices for cloud-native applications.
service-mesh
williamzujkowski
A service mesh is an infrastructure layer that provides transparent service-to-service
containers
williamzujkowski
'Core Principles:'
testing
williamzujkowski
Comprehensive testing standards including unit, integration, security, and property-based testing with TDD methodology
healthtech-hipaa
williamzujkowski
HIPAA establishes national standards for protecting patient health information
pdf-look-scanned
vladmdgolam
Make PDF documents look like they were scanned on a physical scanner. Applies realistic effects: grayscale conversion, Gaussian noise, slight rotation, blur, edge shadows, and random offset. Optionally extract real handwritten signatures from a source PDF (or user-provided images) and replace digital signatures on specific pages. Use when the user asks to: make a PDF look scanned, give a PDF a scanned appearance, replace digital signatures with real/handwritten ones, fake a scan, add scan effects to a document, or make a document look printed and scanned.
polish-repo
axiomantic
"Use when improving project discoverability, attracting users/contributors, or presenting open source work. Triggers: 'write a README', 'improve README', 'get more users', 'get more contributors', 'add badges', 'create a logo', 'set up issue templates', 'audit this project', 'project presence', 'make this discoverable', 'why isn't anyone using this', 'prepare for launch', 'repo presentation', 'open source marketing', 'attract contributors', 'project storefront'. Also triggers on: naming a project, writing taglines, GitHub metadata, community infrastructure, signs of life."
code-review
axiomantic
"Use when reviewing code. Triggers: 'review my code', 'check my work', 'look over this', 'review PR #X', 'PR comments to address', 'reviewer said', 'address feedback', 'self-review before PR', 'audit this code'. Modes: --self (pre-PR self-review), --feedback (process received review comments), --give (review someone else's code/PR), --audit (deep single-pass analysis). For heavyweight multi-phase analysis, use advanced-code-review instead."
reviewing-design-docs
axiomantic
"Use when reviewing design documents, technical specifications, architecture docs, RFCs, ADRs, or API designs for completeness and implementability. Triggers: 'review this design', 'is this spec complete', 'can someone implement from this', 'what's missing from this design', 'review this RFC', 'is this ready for implementation', 'audit this spec'. Core question: could an implementer code against this without guessing?"
plugin-dev
rube-de
"Validate plugin SKILL.md frontmatter and audit hook scripts for silent failures. Run validation to check all plugins pass schema, source path, and frontmatter checks. Run hook audit to detect unhandled errors in shell and Python scripts."
security
rube-de
Security scan: dependency audits, SAST analysis, and secret detection. Detects project type, runs available security tools, classifies findings by severity, and creates a structured GitHub issue.
tarot-mode
axiomantic
"Use when session returns mode.type='tarot', user says '/tarot', or requests roundtable dialogue with archetypes. Ten tarot archetypes (Magician, Priestess, Hermit, Fool, Chariot, Justice, Lovers, Hierophant, Emperor, Queen) collaborate via visible roundtable with instruction-engineering embedded."