Audit codebase for dead code, unused exports, orphaned files, and stale manifests

Synchronize documentation and code to eliminate drift with parallel audit and auto-fix

Orchestrate continuous security validation, threat modeling, vulnerability management, and security gate enforcement across SDLC phases

Conduct comprehensive PR review from multiple perspectives (PM, Developer, QA, Security)

The canonical, extensible source-type registry for a research corpus — paper, preprint, blog, repo, book, chapter, standard, doc, discussion, encyclopedia, expert-material, internal-review. Replaces the drifting type / source_type / "Source Type" vocabularies with one registry that declares per-type template, required sections, citation format, acquisition method, storage, quality rules, and radar cadence. Surfaced via `aiwg corpus source-types`; consumed by the by-source-type index view, per-type induction audit, and acquisition dispatch.

Audit and triage general issue backlogs with read-only defaults, interactive cleanup decisions, and guidance steering; use this for "audit open issues" instead of aiwg-issue

AUTO-INVOKE when user mentions forensics, incident response, IOC, log analysis, evidence preservation, breach investigation, threat hunting, attack timeline. Forensics framework quick reference — discovery phrases for incident response, log analysis, evidence preservation, IOC extraction.

AUTO-INVOKE when user mentions ops, runbook, inventory, audit trail, ops repo, sysops, devops, itops, infrastructure operations, fleet management. Ops framework quick reference — capability domains, extension model, and discovery phrases for runbooks, inventory, audit trail, verification.

Audit a research corpus for shallow stubs, missing sources, and doc-depth issues. Detects docs written from abstracts rather than full papers; can dispatch expansion agents.

Use when a project needs DFIR readiness from the security-engineering side: prepare incident evidence handling, chain-of-custody expectations, IOC readiness, and handoff to forensics-complete without collecting evidence.

Threat hunt using Sigma rules against log sources

Audit research-corpus induction quality — depth bands (stub/compact/good/full/deep), structural integrity (analysis doc + sidecar + PDF, honoring audit-exclude conventions), and per-source-type required sections (a blog isn't flagged for missing Benchmark Results). Plus additive frontmatter backfill for legacy docs. Runs via `aiwg corpus induction-audit` / `aiwg corpus frontmatter-backfill`.

Audit npm projects for Shai-Hulud-class supply-chain exposure: lifecycle scripts, Git dependency prepare hooks, release-age gaps, publish-token exposure, trusted publishing, signed releases, and verifier docs.

Apply Sigma rules against log sources for threat hunting; convert rules to Elasticsearch, Splunk, and grep queries

Review GitHub pull requests for code quality, security, and best practices. Use for automated PR feedback and approval workflows.

Research and build a target system profile via SSH — discovers OS, services, users, network baseline, and security stack

Orchestrate a pragmatic npm supply-chain hardening pass: dependency-source audit, release-age gate, lifecycle-script review, trusted publishing, signed releases, SBOM, and user verification docs.

Scan tracked repository files for committed binary blobs and report reviewability/provenance exceptions

Detect bidi controls, zero-width characters, mixed-script identifiers, and homoglyph risks in source and release metadata

Verify configured secondary git mirrors are present and not drifting from the primary remote/default branch

Perform comprehensive security assessment

Enforce minimum security criteria before iteration close or release

Audit source-control organization settings for strong 2FA/MFA requirements across all committers

Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage

Guidelines for implementing OAuth 2.0 and OAuth 2.1 authentication flows with security best practices and PKCE

Guidelines for developing with Deno and TypeScript using modern runtime features, security model, and native tooling

Guidelines for building robust APIs with Express.js and TypeScript, covering middleware patterns, routing, and security best practices

General software development best practices covering code quality, testing, security, performance, and maintainability across technology stacks

Expert guidance for Spring Boot application development with best practices for RESTful APIs, testing, security, and deployment

Expert guidelines for Chrome extension development with Manifest V3, covering security, performance, and best practices

Guidelines for building Python cybersecurity tools with secure coding practices, async scanning, and structured security testing.

Bash scripting guidelines covering security, portability, error handling, and automation best practices for DevOps.

Expert in Solidity smart contract development with security and gas optimization

World-class expertise in tokenizing real-world assets with regulatory complianceUse when "tokenize real estate, tokenize real world assets, RWA tokenization, security token, STO, ERC-3643, T-REX token, tokenized securities, fractional ownership, compliant token, transfer restrictions, regulated token, asset-backed token, tokenize commodities, tokenize art, Reg D token, Reg S token, Reg A+ token, ONCHAINID, rwa, tokenization, security-token, compliance, erc-3643, real-estate, fractional-ownership, regulated, transfer-restrictions, identity-verification" mentioned.

Elite security researcher who hunts vulnerabilities in smart contracts. Has found critical bugs worth millions in TVL. Specializes in reentrancy, access control, oracle manipulation, and economic exploits across EVM and Solana.Use when "audit, security review, vulnerability, exploit, reentrancy, access control, oracle manipulation, flash loan attack, smart contract security, slither, mythril, formal verification, invariant testing, security, audit, smart-contracts, solidity, vulnerabilities, defi, exploits, reentrancy, access-control, oracle-manipulation" mentioned.

Expert guidance on authentication implementation including OAuth 2.0/OIDC, JWT tokens, session management, and secure password handling. Covers both implementing auth from scratch and integrating auth providers. Use when "implement authentication, oauth login, jwt tokens, session management, social login, password reset, multi-factor auth, refresh tokens, Working with Auth0, Clerk, NextAuth, Passport.js, authentication, oauth, jwt, session, security, login, password, mfa, oidc" mentioned.

World-class application logging - structured logs, correlation IDs, log aggregation, and the battle scars from debugging production without proper logsUse when "log, logging, logger, debug, trace, audit, structured log, correlation id, request id, log level, winston, pino, bunyan, log4j, logging, observability, debugging, monitoring, tracing, structured-logs, correlation, aggregation" mentioned.

World-class application security - OWASP Top 10, secure coding patterns, and the battle scars from security incidents that could have been preventedUse when "security, secure, vulnerability, injection, xss, csrf, authentication, authorization, owasp, encryption, secret, password, token, sanitize, validate, escape, encode, harden, security, owasp, injection, xss, csrf, authentication, authorization, encryption, secrets, hardening" mentioned.

Security and privacy specialist for differential privacy, encryption, and complianceUse when "privacy, encryption, differential privacy, PII, GDPR, CCPA, access control, audit trail, data retention, privacy, security, encryption, differential-privacy, gdpr, ccpa, pii, opendp, ml-memory" mentioned.

Blockchain smart contract specialist for Solidity, EVM, security patterns, and gas optimizationUse when "smart contract, solidity, ethereum, evm, contract, web3, gas optimization, upgradeable contract, reentrancy, solidity, ethereum, smart-contracts, evm, web3, blockchain, defi, nft, security, gas" mentioned.

Comprehensive expertise in cross-chain infrastructure, including LayerZero, Wormhole, Axelar, and custom bridge implementations. Covers omnichain token standards, message passing, bridge security, and cross-chain application architecture. Use when "cross-chain, bridge, LayerZero, Wormhole, Axelar, omnichain, multi-chain, chain abstraction, cross-chain messaging, token bridge, " mentioned.

Expert in brutally honest, self-deprecating marketing that converts. Covers transparent messaging, vulnerability as strategy, "we're not for everyone" positioning, and turning weaknesses into strengths. Knows when honesty builds trust and when it backfires. Use when "anti-marketing, honest marketing, brutally honest, we're not for everyone, transparent, no bullshit, self-deprecating marketing, " mentioned.

Use when building DeFi protocols, implementing AMMs, yield farming strategies, or integrating with Ethereum/L2s - covers smart contract patterns, liquidity pools, and security considerationsUse when ", " mentioned.

Use when implementing Sarbanes-Oxley compliance, internal controls, audit trails, segregation of duties, or continuous monitoring - covers COSO framework and IT general controlsUse when ", " mentioned.

Use when implementing policy-as-code, continuous compliance monitoring, automated evidence collection, or audit-ready systems requiring SOC2/ISO/PCI/HIPAA complianceUse when ", " mentioned.

Adaptive Python development guide with tiered complexity levels (Minimal/Standard/Full). Automatically selects appropriate guidance based on project context - from simple scripts (just clean Python code) to full production systems (complete tooling ecosystem). Covers modern conventions, testing, tooling, security, and best practices. Use when writing Python code, converting scripts, setting up projects, or building production systems. Keywords: PEP-8, Ruff, pytest, mypy, simple scripts, project structure, PyPI, packaging, type hints, clean code

Comprehensive authentication implementation guidance including JWT best practices, OAuth 2.0/OIDC flows, Passkeys/FIDO2/WebAuthn, MFA patterns, and secure session management. Use when implementing login systems, token-based auth, SSO, passwordless authentication, or reviewing authentication security.

Provides guidance on secure coding practices including OWASP Top 10 2025, CWE Top 25, input validation, output encoding, and language-specific security patterns. Use when reviewing code for security vulnerabilities, implementing security controls, or learning secure development practices.

Software supply chain security guidance covering SBOM generation, SLSA framework, dependency scanning, SCA tools, and protection against supply chain attacks like dependency confusion and typosquatting.

Vulnerability lifecycle management including CVE tracking, CVSS scoring, risk prioritization, remediation workflows, and coordinated disclosure practices

Migrate legacy .claude/commands/ to .claude/skills/ directory structure. Actions: discover, analyze, migrate, audit, validate, fix.

PCI DSS compliance planning for payment card handling including scope reduction, SAQ selection, and security controls

Use when implementing draft/publish workflows, version history, content rollback, or audit trails. Covers versioning strategies, snapshot storage, diff generation, and version comparison APIs for headless CMS.

Use when implementing service-to-service security, mTLS, or service mesh patterns. Covers mutual TLS, Istio, Linkerd, certificate management, and service mesh security configurations.

Security framework alignment including ISO 27001, SOC 2, NIST CSF 2.0, and CIS Controls mapping

Use when designing security architectures, implementing zero trust principles, or evaluating security posture. Covers never trust always verify, microsegmentation, identity-based access, and ZTNA patterns.

Software Bill of Materials management including generation, formats, vulnerability tracking, and supply chain security

Analyze nullable reference type adoption with warnings breakdown and migration recommendations

Perform a security architecture review with Zero Trust assessment - identifies authentication/authorization gaps, data protection issues, and provides remediation guidance

Apply fixes from audit or review findings. Use after /audit-* or /review commands to implement recommendations from the current conversation.

Audit a codebase for the 12 leverage points of agentic coding. Identifies gaps and provides prioritized recommendations. Use when improving agentic coding capability, analyzing why agents fail, or optimizing a codebase for autonomous work.

Audit current context composition and identify optimization opportunities. Use when context window is overloaded, agents are underperforming, or applying the R&D framework to optimize token usage.

Interactive NuGet package upgrade with vulnerability detection and breaking change warnings

Audit codebase for agentic layer coverage and identify gaps. Use when assessing agentic layer maturity, identifying investment opportunities, or evaluating primitive coverage.

Map controls across multiple security frameworks (ISO 27001, SOC 2, NIST CSF, CIS).

Audit a codebase for agentic layer coverage and identify investment opportunities. Use to assess agentic maturity and find gaps.

Audit content schema for best practices, consistency, and potential issues. Checks naming, relationships, and field usage.

Audit hook event schema for drift. Compares implementation against official docs.

Run security audit on code for OWASP Top 10, CWE vulnerabilities, and security anti-patterns

Check dependencies for known CVEs and security vulnerabilities

Audit and optimize SwiftUI runtime performance. Use when: diagnosing slow rendering, janky scrolling, excessive view updates, or high CPU/memory usage in SwiftUI apps.

Implement tamper-evident audit logs for compliance (SOC 2, HIPAA, PCI DSS). Use when building compliance audit trails, tracking who did what and when, or implementing immutable event logs that satisfy regulatory retention requirements.

Detect, exploit, and prevent Cross-Site Scripting (XSS) vulnerabilities in web applications. Use when tasks involve testing for reflected, stored, or DOM-based XSS, building XSS payloads, bypassing WAF filters, implementing Content Security Policy, sanitizing user input, or auditing web applications for injection vulnerabilities. Covers detection, exploitation, and remediation.

SpiderFoot automated OSINT framework with 200+ modules for comprehensive target profiling. Use when: running automated OSINT investigations on a target, correlating data across dozens of sources, building threat intelligence profiles, or mapping connections between entities.

Implement HIPAA compliance for healthcare applications — PHI handling, encryption, audit logging, access controls, and Business Associate Agreements. Use when building healthtech apps, handling patient data, preparing for a HIPAA audit, or signing hospital/payer contracts.

Achieve SOC 2 Type II compliance for SaaS — Trust Service Criteria, evidence collection, and controls implementation. Use when preparing for a SOC 2 audit, meeting B2B SaaS security requirements, or onboarding enterprise customers who require a SOC 2 report.

Discover subdomains of a target domain using passive and active enumeration techniques. Use when tasks involve subdomain enumeration, attack surface mapping, DNS reconnaissance, finding hidden services, identifying forgotten subdomains, or expanding the scope of a security assessment. Subfinder uses passive sources (certificate transparency logs, DNS datasets, search engines) to find subdomains without touching the target directly.

Analyze contracts for risks, check completeness, and provide actionable recommendations. Use when a user asks to review a contract, check an agreement for red flags, analyze contract terms, find risky clauses, review an NDA, evaluate a service agreement, or audit employment contract terms. Supports employment contracts, NDAs, service agreements, and vendor contracts.

Manage environment variables and secrets across development, staging, and production environments. Use when someone needs to audit env vars, sync secrets between environments, detect missing or mismatched variables, rotate credentials, or set up a new environment from an existing one. Trigger words: env vars, environment variables, secrets, .env file, dotenv, config management, secret rotation, missing variable, environment sync.

Find edge-case bugs with property-based testing using fast-check — generate thousands of random inputs automatically. Use when someone asks to "find edge cases", "fast-check", "property-based testing", "fuzz testing in TypeScript", "generate random test data", "QuickCheck for JavaScript", or "test with random inputs". Covers property definitions, arbitraries, shrinking, model-based testing, and integration with Vitest/Jest.

Build custom Maltego transforms for visual OSINT graph analysis and relationship mapping. Use when: mapping connections between domains, IPs, emails, persons, and organizations; visual threat intelligence; complex OSINT correlation across multiple data sources.

Achieve PCI DSS compliance for handling payment card data — scoping, controls, and SAQ selection. Use when storing, processing, or transmitting payment card data, building e-commerce security, or achieving payment processing compliance.

Advises on multi-tenant SaaS architecture decisions including tenancy models, data isolation strategies, tenant routing, and scaling patterns. Use when someone is building a SaaS product, converting single-tenant to multi-tenant, or evaluating isolation strategies. Trigger words: multi-tenant, SaaS architecture, tenant isolation, shared database, per-tenant database, row-level security, tenant routing, SaaS patterns.

Audit web pages and components for WCAG 2.2 accessibility compliance. Use when a user asks to check accessibility, find a11y issues, audit for WCAG compliance, fix screen reader problems, check color contrast, ensure keyboard navigation works, or prepare for accessibility regulations like the European Accessibility Act or ADA.

When the user wants to set up authentication and authorization for a web application. Use when the user mentions "auth," "login," "OAuth," "SSO," "single sign-on," "role-based access," "RBAC," "permissions," "user roles," "access control," "authentication," or "authorization." Covers OAuth 2.0 provider integration, session management, and role/permission architecture. For JWT-specific tasks, see jwt-handler. For security review, see security-audit.

Perform thorough code reviews with actionable, prioritized feedback. Use when a user asks to review code, check code quality, find bugs, review a pull request, audit code for issues, or get feedback on implementation. Covers correctness, security, performance, readability, and best practices across languages.

Automate GDPR and privacy compliance for web applications. Use when someone asks to "make the app GDPR compliant", "add cookie consent", "handle data deletion requests", "audit PII", "data subject access request", or "privacy policy generator". Covers PII auditing, consent management, data subject request endpoints, retention policies, and privacy policy generation.

Analyze a project and recommend highest-value skills to create or update. Use when: auditing project skills, getting skill recommendations, or reviewing existing skill coverage.

Scans codebases for technical debt signals and prioritizes them by business impact. Finds TODO/FIXME/HACK comments, outdated dependencies, code duplication, and correlates with git history to identify high-churn debt hotspots. Use when someone asks about technical debt, code quality audit, refactoring priorities, or maintainability assessment. Trigger words: tech debt, code quality, refactoring, TODOs, maintainability, code health.

Audit project dependencies for outdated packages, security vulnerabilities, and breaking changes. Use when someone asks to "check for outdated packages", "audit dependencies", "find vulnerable dependencies", "plan dependency upgrades", "detect breaking changes", or "update npm packages safely". Analyzes package.json/lock files, cross-references changelogs, and produces ordered upgrade plans.

Audits and troubleshoots DNS records for domains including A, AAAA, CNAME, MX, TXT, SPF, DKIM, DMARC, CAA, and NS records. Use when someone needs to verify DNS configuration, debug DNS propagation issues, check email authentication records, or audit domain security. Trigger words: DNS records, dig, nslookup, SPF, DKIM, DMARC, MX records, DNS propagation, nameservers, CAA, domain configuration.

Audit Wi-Fi networks with the aircrack-ng suite. Use when a user asks to test their own wireless network, capture WPA2 handshakes, crack captured handshakes offline, put an adapter into monitor mode, or perform a wireless pentest under an authorized engagement.

Analyze application error logs and monitoring platform exports (Sentry, Datadog, Rollbar) to identify error patterns, duplicates, and severity. Use when someone asks to "audit errors", "analyze exceptions", "find noisy alerts", "deduplicate error groups", or "triage production errors". Parses JSON/CSV error exports and produces categorized reports with root cause analysis.

Crack password hashes offline with John the Ripper. Use when a user asks to identify an unknown hash format, recover a forgotten password from a local database or ZIP file, run a CTF hash challenge, or audit the strength of hashes from a system they own.

Assists with configuring Nginx as a web server, reverse proxy, and load balancer. Use when serving static files, proxying to application servers, setting up TLS termination, configuring caching, rate limiting, or writing security headers. Trigger words: nginx, reverse proxy, load balancer, tls, ssl, server block, location block.

Secure webhook endpoints. Use when a user asks to verify webhook signatures, prevent replay attacks, handle webhook retries, or implement secure webhook receivers for Stripe, GitHub, Slack, or any provider.