3-phase issue backlog management with audit, deep analysis, and validated triage actions. Use when triaging GitHub issues, sorting bug reports, cleaning up stale tickets, or detecting duplicate issues. Args: 'all' to analyze all, issue numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit only.

1Password/op: service-account first, targeted secret read/store/inject, tmux.

This skill should be used when the user asks to "remove program", "uninstall app", "delete daemon", "clean up process", "safe uninstall", "find resource hog", "what is this process", "remove bloatware", "kill daemon", "remove LaunchDaemon", "remove security program", "Activity Monitor finding", "high memory process", or wants to safely identify and remove macOS programs and daemons. Also triggers when the user mentions high memory/CPU usage by unknown processes, Activity Monitor concerns, unwanted LaunchDaemons/Agents, or Korean banking security programs (TouchEn, AhnLab, Veraport, INISAFE, CrossEX). Use this skill even when the user simply provides a process name and wants it gone, or describes a process consuming excessive resources they want to investigate.

Focused Signals scout for PostHog projects collecting Content Security Policy (CSP) violation reports. Watches `$csp_violation` events for fresh blocked-URL clusters, per-directive bursts, page-scoped regressions after deploys, and suspicious third-party domains that may indicate a compromised script. Emits aggregated findings only when a cluster clears the confidence bar; otherwise writes durable memory and closes out empty. Self-contained peer in the signals-scout-* fleet — no dependencies on other skills. Picked uniformly at random by the coordinator alongside `signals-scout-general` and other specialists.

First-principles simplification analysis for codebases. Methodically inventories what a codebase actually does, then asks whether each piece of complexity earns its keep. Use when asked to "simplify this codebase", "is this overengineered", "how could this be simpler", "reduce complexity", "first principles review", "essential complexity audit", "do we really need all this", or any request to rethink whether the current implementation is the simplest way to achieve its goals. Also useful when a codebase feels harder to work with than it should, when onboarding takes too long, or when changes that seem simple keep ballooning in scope.

This skill should be used when the user asks to "audit the codebase", "compare spec to implementation", "what's actually built", "reality check the code", "review implementation progress", "what's implemented vs planned", "check phase completion", or wants to understand the gap between documentation/specs and actual working code.

Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.

Audit and update CLAUDE.md, .claude/rules/, and .teamcraft/project.md to reflect the current state of the project. Run anytime — mid-ticket, end of sprint, pure maintenance, or first-time setup for a project with none of these files. Developer drives what changes; skill provides the analysis.

Comprehensive web accessibility audit using WCAG 2.1/2.2 guidelines. Evaluate compliance across 4 POUR principles (Perceivable, Operable, Understandable, Robust) with A, AA, AAA conformance levels.

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Use when the user mentions TextKit review, text layout issues, Writing Tools integration, or UITextView/NSTextView code review.

Manage eCDN zones, security settings, and edge configuration for B2C Commerce storefronts. Use this skill whenever the user needs to purge CDN cache, provision SSL certificates, configure WAF or firewall rules, set up rate limiting, enable logpush or Page Shield, manage MRT routing, configure mTLS or cipher suites, or optimize edge performance. Also use when troubleshooting CDN-layer issues or managing zone settings -- even if they just say 'clear the cache' or 'block bot traffic on our storefront'.

Establishes VPC peering connections between two VPCs for direct private network connectivity. Always use this skill when creating or managing VPC peering — it validates CIDR overlap, updates all route tables in both VPCs, configures DNS resolution, and provides security group guidance that are critical for correct connectivity.

Use when someone says "verify context file", "check if AGENTS.md is correct", "validate context accuracy", "audit CLAUDE.md", "check documentation truth", "are the docs accurate", or mentions "context verification" or "documentation audit". Treats all existing content as potentially incorrect, extracts every technical claim, and verifies each against the actual codebase and web sources.

Manage model risk governance in Domino using policies, bundles, and evidence. Covers creating governance bundles, attaching model artifacts and MLflow results as evidence, progressing through policy stages, and documenting findings. Use when the user mentions governance, compliance, bundles, policies, model risk management, SR 11-7, NIST AI RMF, or audit trails.

Everything In Its Right Place. The universal post-work organizer. After any significant work session, EIIRP runs a 7-phase audit: (1) inventory every output, (2) walk taxonomy to decide where each lands, (3) check schema-pack consistency against the brain's actual shape, (4) file enriched brain pages, (5) audit the skill graph for DRY+MECE, (6) verify resolvability, (7) report. Named after the Radiohead song. Nothing produced during significant work lives only in chat — knowledge becomes permanent, patterns become reusable.

Review the current branch diff for real bugs and security issues, verify findings against surrounding code, and report only issues that survive context checks. Runs as a forked review workflow so the audit has separate reasoning budget and stays isolated from the main task flow. Use when the user asks to find bugs, review changes, or audit branch risk.

Git history secret scan.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Audit installed macOS software storage usage and run prioritized cleanup. Use when the user asks to inspect installed apps, list storage-heavy software, clean priority-1 caches and simulator data, or get reclaim recommendations.

Use when the user asks to discover and deliver repository optimization work end to end: identify performance/reliability/maintainability/security/dx/cost optimization points, prioritize by impact-effort-risk, then execute fixes step by step with continuous testing and explicit commit policy (`final_only`, `per_step`, `milestone`). Default to `per_step` for implementation work so each feature is tested then committed before the next feature. Supports optional BDD (Given/When/Then).

This skill should be used when the user asks to "review paper quality", "check paper completeness", "validate paper structure", "self-review before submission", "audit claims", "check overclaiming", "verify whether results support claims", or mentions systematic paper quality checking. Provides comprehensive quality assurance checklist for academic papers.

Use when working on security-sensitive code to catch secrets, eval(), innerHTML, and other dangerous patterns before they're written. Activate with /security-watch for real-time security scanning.

Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.

Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

Analyze web application bundle size to find what's making it large and how to shrink it. Always use this skill whenever the user says "analyze the bundle", "what's making my bundle large", "bundle size analysis", "check my webpack output", "why is my app so big", "find heavy dependencies", "optimize the bundle", "check my Vite build size", "bundle is too large", "reduce my JS bundle", "find large modules", "tree-shaking opportunities", "what dependencies are bloating the bundle", "bundle report", "check build output size", "source map analysis", or asks to audit build artifacts for size. Also trigger when the user sees slow initial page load and suspects large JavaScript as the cause.

Guide for Ansible Vault secrets management and security practices. Use when encrypting variables or files with ansible-vault, configuring vault passwords, using vault IDs, or applying security hardening to playbooks.

Use when the user mentions Codable review, JSON encoding/decoding issues, data serialization audit, or modernizing legacy code.

Use when the user mentions in-app purchase review, IAP audit, StoreKit issues, purchase bugs, transaction problems, or subscription management.

Use when the user wants to audit SpriteKit game code for common issues.

Guide for conducting code reviews. Use when reviewing pull requests, auditing code quality, identifying security issues, or providing code feedback.

Analyze Content-Security-Policy headers for misconfigurations and bypass risks. Use when reviewing CSP from raw strings, URLs, or domains.

Track data origin, transformations, and flow through construction systems. Essential for audit trails, compliance, and debugging data issues.

Generate auditor-ready compliance evidence from Datadog Audit Trail for SOC 2 and PCI DSS. Maps framework controls to specific query patterns and produces formatted output.

Audits font loading behavior: FOIT/FOUT detection via timed screenshots, font-display validation per family, font file sizes and format efficiency (WOFF2 vs WOFF vs TTF), preload link validation, unused font declarations, and subsetting opportunities. Produces a font-by-font report with loading timeline and recommendations.

Security techniques and quality control for prompts and agents

Validate and sanitize user input to prevent XSS, injection attacks, and ensure data quality. Use this skill when you need to validate forms, sanitize user input, prevent cross-site scripting, use Zod schemas, or handle any user-generated content. Triggers include "input validation", "validate input", "XSS", "cross-site scripting", "sanitize", "Zod", "injection prevention", "validateRequest", "safeTextSchema", "user input security".

Reviews a code change against the accepted Architectural Decision Records (ADRs) in the project, flagging violations, erosions of invariants, and drift toward rejected alternatives. Use when the user asks to check a change against ADRs, verify a PR respects architectural decisions, audit whether a diff honors policy, or phrases like "does this respect our ADRs", "is this change on-policy", "will this violate ADR-0007", "review this branch against our decisions", "check policy compliance". Also invoke proactively before merging a PR that touches code areas governed by prior ADRs.

Reviews tests for issues that coverage tools miss — falsifiability, isolation hazards, dead expectations, tautological assertions, missing edge cases, and unclear test names. Use when asked to review tests, audit a test suite, check test quality, validate test isolation, or check whether tests actually catch regressions. Also invoke when a user says things like "review these tests", "audit tests/", "are these tests any good", "do these tests catch real bugs", "check test isolation", "is this tested", or asks for a quality-level (not coverage-percentage) read of unit, integration, or e2e tests.

Use this skill when the user needs to secure their SaaS app, implement authentication, protect user data, secure APIs, or check for vulnerabilities. Also use when the user says 'is my app secure,' 'security check,' 'I'm worried about hackers,' 'how do I protect user data,' or 'security before launch.' Covers OWASP Top 10, auth best practices, data protection, and security checklists for apps built with AI tools.

Security auditing and vulnerability assessment specialist. Use when conducting security reviews, analyzing code for vulnerabilities, performing OWASP assessments, or creating security audit reports.

Comprehensive OWASP security guidelines, secure coding patterns, vulnerability prevention strategies, and remediation best practices for building secure applications

Audit and update CLAUDE.md, .claude/rules/, and .teamcraft/project.md to reflect the current state of the project. Run anytime — mid-ticket, end of sprint, pure maintenance, or first-time setup for a project with none of these files. Developer drives what changes; skill provides the analysis.

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Comprehensive quality verification system for code changes with build, type, lint, test, and security checks

Reviews Wish SSH server code for proper middleware, session handling, and security patterns. Use when reviewing SSH server code using charmbracelet/wish.

Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).

Use when the user mentions GRDB performance review, slow GRDB queries, app-group database setup audit, or pre-release GRDB scan.

Check code against security compliance standards and best practices.

VPS security auditing and hardening

macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.

This skill guides integrating 1Password CLI (op) for secret management in development workflows. Use when loading secrets for infrastructure, deployments, or local development.

Refactor Flask code to improve maintainability, readability, and adherence to best practices. This skill transforms Flask applications using the application factory pattern, Blueprint organization, and service layer separation. It addresses fat route handlers, missing error handling, improper context local usage, and security issues. Apply when you notice global app instances, routes without Blueprints, business logic in handlers, or missing CSRF protection.

Accessibility audit. Dispatches an accessibility auditor to identify WCAG conformance gaps, prioritize by user impact, and recommend fixes. Advisory only — no changes made.

Validate and implement HTTP security headers to protect web applications.

Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.

Scan code changes for security vulnerabilities using STRIDE threat modeling, validate findings for exploitability, and output structured results for downstream patch generation. Supports PR review, scheduled scans, and full repository audits.

Use when reviewing code for security vulnerabilities, implementing authentication or authorization, handling user input, managing secrets, or auditing dependencies for known CVEs. Triggers: auth implementation, input handling, secrets management, dependency audit, pre-deployment security check, OWASP compliance review.

Audit and harden TypeScript type safety by finding and fixing weak typing patterns. Always use this skill whenever the user says "strengthen types", "improve TypeScript types", "fix any types", "type safety audit", "remove any from the codebase", "tighten TypeScript", "find unsafe casts", "harden types", "type hardening", "clean up TypeScript types", "get rid of type assertions", "fix non-null assertions", "improve type coverage", "find implicit any", "type-safe refactor", "add missing return types", "reduce ts-ignore", "eliminate type suppression", "TypeScript strict mode cleanup", "fix weak types", "find type holes", "our types are too loose", or any request to make the codebase more type-safe. Also trigger when the user is migrating to strict mode, preparing to enable `noImplicitAny` or `strictNullChecks`, or doing a type-quality pass before a major release.

Understand supply chain vulnerabilities and dependency risks in AI-generated code including outdated packages, malicious packages, and dependency confusion attacks. Use this skill when you need to learn about vulnerable dependencies in AI code, understand supply chain attacks, recognize typosquatting, or identify outdated package suggestions. Triggers include "supply chain attacks", "dependency vulnerabilities", "outdated packages", "malicious npm packages", "typosquatting", "dependency confusion", "vulnerable dependencies AI", "npm security".

Run pre-PR reviews (code health, security, deviation), push the branch, mark the Draft PR as ready for review, and update Jira issue status to "In Review". The final step before the PR goes to a teammate for review.

Technical analysis capabilities for APIs, data models, integrations, and security requirements. Use when analyzing technical aspects of systems or documenting technical requirements.

Generate a STRIDE-based security threat model for a repository. Use when setting up security monitoring, after architecture changes, or for security audits.

This skill MUST be invoked when the user says "review constitution", "validate principles", "check quality", "constitution review", "quality check", "version bump", "anti-patterns", or "constitution audit".

Scans code for security vulnerabilities, identifies CVE patterns, and provides severity ratings with remediation guidance. Use when scanning for security issues, code vulnerabilities, or OWASP top 10 problems.

Create, list, supersede, deprecate, or audit Architecture Decision Records (MADR 4.0). Handles auto-numbering, directory detection, and cross-reference consistency. For quick stale-reference scans in markdown, use adr-ref-guard instead.

Reviews Elixir code for security vulnerabilities including code injection, atom exhaustion, and secret handling. Use when reviewing code handling user input, external data, or sensitive configuration.

Analyze saved trajectories and recall audit events offline to record whether recalled guidelines influenced completed sessions.

Audit and enforce the core/client boundary in multi-client projects. Detects where shared platform code is tangled with client-specific code, finds hardcoded client checks, config files that replace instead of merge, scattered client code, migration conflicts, and missing extension points. Produces a boundary map, violation report, and refactoring plan. Optionally generates FORK.md documentation and restructuring scripts. Triggers: 'fork discipline', 'check the boundary', 'is this core or client', 'platform audit', 'client separation', 'fork test', 'refactor for multi-client', 'clean up the fork'.

Generate a professional, client-facing GEO report combining all audit results into a single deliverable with scores, findings, and prioritized actions

Audit and rewrite your LinkedIn profile to attract the right people. Scores each section, rewrites headline and about copy, and includes an AI visibility checklist so you show up in ChatGPT, Perplexity, and Claude search. Use when someone says "optimize my LinkedIn," "LinkedIn profile help," "rewrite my about section," or "how do I show up in AI search."

Brain health checks: back-link enforcement, citation audit, filing validation, stale info detection, orphan pages, and benchmarks. Use when asked to check brain health, run maintenance, or audit quality.

Analyzes and optimizes npm package dependencies across 5 maintenance modes: FULL (update all), DRY-RUN (analysis only), SECURITY-ONLY (urgent CVE fixes), PRE-RELEASE (conservative patch-only), POST-FEATURE (cleanup after development). Activates when user mentions "update packages", "pnpm audit", "npm audit", "check dependencies", "security fix", "outdated dependencies", "deprecated packages", "devDependencies", "pre-release cleanup", "post-feature housekeeping", "remove unused packages", or package.json optimization. NOT for @lenne.tech/nest-server version updates (use nest-server-updating).

Chris Voss FBI negotiation framework — tactical empathy, calibrated questions, mirroring, labeling, and the Ackerman model for B2B sales and deal negotiation. Use when: negotiation, tactical empathy, calibrated questions, mirroring, labeling, accusation audit, ackerman, deal negotiation, price negotiation, never split the difference.

Use this skill when reviewing the quality and completeness of an existing Linear or GitHub issue — does it have a type tag, does it match the template for that type, are the required sections filled, is the acceptance criteria testable. Trigger phrases "review this issue", "review issue <ID>", "is this issue ready", "check the issue", "audit this issue", "/pm-review", "review the bug I just filed", "lint the issue". Also use proactively when an issue is about to be picked up for work (handoff into "In Progress") and the operator wants a sanity pass first. Produces a structured review report; with `--apply`, posts the findings as a comment on the issue.

Analyze saved trajectories and recall audit events offline to record whether recalled guidelines influenced completed sessions.

Quality assurance verification. Checks test coverage against thresholds, validates test quality, identifies E2E/integration gaps, runs security dependency audit, performs static analysis, and generates QA report with quality score.

ALWAYS LOAD THIS SKILL for PolicyEngine PR reviews, including when the user invokes $review-program or Codex /review on a PolicyEngine PR. Performs read-only code validation, source-reference checks, regulatory review, optional PDF audit, summary reporting, and optional GitHub comment posting.

Understand the defense-in-depth security architecture of Secure Vibe Coding OS. Use this skill when you need to understand the overall security approach, the 5-layer security stack, OWASP scoring, or when to use other security skills. Triggers include "security architecture", "defense in depth", "security layers", "how does security work", "OWASP score", "security overview", "security principles".

Scans code for security vulnerabilities including injection attacks, authentication flaws, exposed secrets, insecure dependencies, and data exposure. Use when the user says "security review", "is this secure?", "check for vulnerabilities", "audit this", or before deploying to production.

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Run pre-MR reviews (code health, security, deviation), push the branch, mark the Draft MR as ready for review, and update issue labels. The final step before the MR goes to a teammate for review.

⚡ Test analysis skill. Best for: 'what's tested', 'find test coverage', 'audit test quality', 'missing tests', 'edge cases'. Uses claudemem AST with callers analysis for efficient test discovery.

Evaluate threat reports, breach analyses, and IOC reports to search for compromise indicators across LimaCharlie organizations. Extract IOCs (hashes, domains, IPs, file paths), perform IOC searches, identify malicious behaviors, generate LCQL queries, create D&R rules and lookups. Use when investigating threats, APT reports, malware analysis, breach postmortems, or threat intelligence feeds. Emphasizes working ONLY with data from the report and organization, never making assumptions.

Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.

Scans project dependencies for known vulnerabilities (CVEs), categorizes them into three severity-based reports (Critical/High, Medium, Low), and generates detailed markdown documents with remediation guidance. Saves output to project-decisions/ folder. Use when the user says "vulnerability report", "dependency vulnerabilities", "CVE report", "package vulnerabilities", "npm audit report", "dependency scan", "vulnerable packages", "security vulnerabilities in dependencies", or "generate vulnerability reports".

ALWAYS use when working with Angular Security, XSS prevention, CSRF protection, Content Security Policy, or sanitization in Angular applications.

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

Use when the user mentions file storage issues, data loss, backup bloat, or asks to audit storage usage.

Use when the user mentions security review, App Store submission prep, Privacy Manifest requirements, hardcoded credentials, or sensitive data storage.

Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".

Binary hardening skill for security-hardened C/C++ builds. Use when enabling RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI sanitizers, shadow stack, or seccomp-bpf syscall filtering. Covers checksec analysis, compiler and linker flags for hardened builds, and NSA/CISA-recommended mitigations. Activates on queries about binary hardening, checksec, RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI, shadow stack, or seccomp.

⚡ AUTO-INVOKE when user asks: 'audit', 'investigate', 'how does X work', 'find all', 'where is', 'trace', 'understand', 'map the codebase', 'comprehensive'. MUST run BEFORE Read/Glob when planning to read 3+ files. Prevents tool familiarity bias toward native tools.

Measure Core Web Vitals (LCP, INP, CLS) with full attribution across mobile, tablet, and desktop viewports. Produces a multi-viewport report card with pass/fail grades, element-level attribution, and annotated screenshots.

Securing .NET code or reviewing for vulnerabilities. OWASP Top 10 mitigations, pattern warnings.

Firebase Firestore, Auth, Storage, real-time listeners, security rules