Run a multi-persona review team over an SDD artifact - fan the crew out as parallel subagents that deposit findings to a review blackboard, then reduce them into one scored, coverage-aware report. The shared mechanism behind the team mode of doc-*-audit (review), doc-*-fixer (remediate), and doc-*-autopilot (create). Use at quality gates; falls back to single_pass when subagents are unavailable.

Performs systematic code review checking for correctness, maintainability, security, and best practices. Activates when user requests review, before creating PRs, or when significant code changes are ready. Ensures quality gates are met before code proceeds to production.

Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. OWASP Top 10 audit with GitLeaks and dependency checks.

Security headers configuration and best practices for ASP.NET Core Razor Pages applications. Covers CSP, HSTS, X-Frame-Options, and comprehensive security middleware setup. Use when configuring security headers in ASP.NET Core applications, implementing Content Security Policy (CSP), or setting up HSTS and other security-related HTTP headers.

Security vulnerability detection skill for reviewer agents. OWASP Top 10 checklist, secrets detection, input validation, authentication patterns. CRITICAL for code handling user input, authentication, APIs, or sensitive data.

This skill should be used when the user asks to 'create a skill', 'improve a skill', 'edit a skill', 'add enforcement patterns', 'audit skill enforcement', or needs to substantially create or edit any SKILL.md file.

Review test quality and audit test coverage for any module. This skill should be used when reviewing existing tests, auditing test gaps, writing new tests, or when asked to assess test health. It pipelines testing standards into the audit workflow to produce a prioritized gap report. The output is a report, not code — do not write test implementations until the report is reviewed.

Run an extremely strict performance review for runtime efficiency, memory usage, bundle size, database query patterns, and scalability limits. Use for a thermo-nuclear performance review, thermonuclear performance audit, or especially harsh performance review.

Map threats and controls to compliance frameworks like OWASP Top 10, SOC2, PCI-DSS, HIPAA, GDPR. Generates compliance reports with coverage percentages and gaps. Use when checking compliance status, mapping to security frameworks, or generating audit documentation.

Velociraptor DFIR integration for LimaCharlie. List available VQL artifacts, view artifact definitions, launch forensic collections on endpoints. Find raw collection data in Artifacts (type:velociraptor, source:SID). Query processed JSON events from the 'velociraptor' sensor (tag:ext:ext-velociraptor). Build D&R rules for velociraptor_collection events. Use for: forensic triage, incident response, threat hunting, VQL artifact collection.

Comprehensive XSS prevention strategies, DomSanitizer usage, and Content Security Policy implementation

Analyze Zscaler Microsegmentation (ZMS) policy rules for optimization opportunities. Reviews custom and default policy rules, identifies stale or unused rules, detects overly permissive rules, maps cross-zone communication patterns, and assesses default security posture. Use when an administrator asks: 'Are there unused policy rules?', 'Which rules are too broad?', 'Optimize our segmentation policies', 'Review our default deny posture', 'Show me policy rule coverage', or 'Analyze our ZMS policies.'

Write or audit acceptance criteria for a user story, feature, or requirement. Produces Given/When/Then scenarios with systematic coverage (happy / negative / edge / boundary / accessibility / performance), checks INVEST per story, and splits criteria with SPIDR when the story is too large. Complements user-story-generator.

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Use when the user mentions concurrency checking, Swift 6 compliance, data race prevention, or async code review.

Use when the user mentions memory leak prevention, code review for memory issues, or proactive leak checking.

Multi-perspective quality review gate with architect, security, quality, tester, and performance stakeholders

Conduct two-stage code review: Stage 1 verifies spec compliance (criterion-to-code mapping), Stage 2 evaluates security, correctness, performance, and maintainability across 6 parallel facets with P1/P2/P3 synthesis and deduplication by file:line. Use when reviewing code changes or pull requests. This skill MUST be consulted because reviewing quality on broken logic is wasted effort, and unmet acceptance criteria must block merge.

💡 Tool selector for code search tasks. Helps choose between semantic search (claudemem) and native tools (Grep/Glob) based on query type. Semantic search recommended for: 'how does X work', 'find all', 'audit', 'investigate', 'architecture'.

Generate security-focused DISCOVERY.md for code review and threat modeling. Use when assessing unfamiliar codebases.

Audit and improve CRM data quality by identifying missing fields, inconsistent values, duplicate records, and stale data

Audit an IPLAN - run declarative structural checks plus content review and produce a combined report for doc-iplan-fixer. Use for IPLAN quality gating before code implementation.

Audit a TDD - run declarative structural checks plus content review and produce a combined report for doc-tdd-fixer. Use for TDD quality gating before IPLAN.

Analyze all forms on a page: validation states, autocomplete attribute coverage, label/input association, required field audit, submission behavior interception, password field security, and ARIA attributes on custom controls.

OCaml fuzz testing with Crowbar for protocol implementations. Use when Claude needs to: (1) Write fuzz tests for parsers and encoders, (2) Test roundtrip invariants (parse(encode(x)) = x), (3) Verify boundary conditions and error handling, (4) Test state machines and transitions, (5) Organize fuzz test suites for large codebases, (6) Run long-lived AFL campaigns with Crowbar

Use when writing or editing a Slack message, email, pull request body, GitHub issue, Reddit post, agenda, or doc. Enforces a direct, warm, unfilled tone and removes AI tells. Always scores the final draft and runs a self-audit pass before delivery.

This skill should be used when the user asks to "run LINDDUN analysis", "check privacy threats", "privacy threat model", "GDPR analysis", "check data protection", or invokes /appsec:linddun. Dispatches 7 category subagents in parallel for comprehensive LINDDUN privacy threat coverage.

Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.

Optimizes Nginx configurations for performance, security, caching, and load balancing with modern best practices. Use when users request "Nginx setup", "reverse proxy", "load balancer", "web server config", or "Nginx optimization".

Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.

Optimize web performance for faster loading and better user experience. Use when asked to "speed up my site", "optimize performance", "reduce load time", "fix slow loading", "improve page speed", or "performance audit".

This skill should be used when the user asks to "check for privilege escalation", "analyze authorization risks", "find access control vulnerabilities", or mentions "elevation of privilege" in a security context. Maps to STRIDE category E.

Interactively prune stale non-terminal workflows from the pipeline. Use when the user says 'prune workflows', 'clean stale workflows', 'pipeline cleanup', or runs /prune. Runs a dry-run preview, displays candidates with staleness and safeguard skips, prompts the user to proceed/abort/force, then bulk-cancels approved workflows with a workflow.pruned audit event. Safeguards skip workflows with open PRs or recent commits unless force is set.

Produce RFI / RFP / RFQ documents — select instrument by intent, structure sections (context + criteria + requirements + commercial + security + SLA + timeline + submission), scoring rubric, Q&A process. Not legal advice.

OWASP security patterns, secrets management, security testing

Configure security headers to defend against clickjacking, XSS, MIME confusion, and SSL stripping attacks. Use this skill when you need to set up Content-Security-Policy, X-Frame-Options, HSTS, configure middleware headers, or understand browser security features. Triggers include "security headers", "CSP", "content security policy", "X-Frame-Options", "HSTS", "clickjacking", "MIME confusion", "middleware headers".

Perform a high-signal security code review of pending git/PR branch changes, focusing only on newly introduced HIGH/MEDIUM exploitable vulnerabilities and filtering false positives. Use when asked to security-review a branch, PR, diff, or pending changes.

Generates Solidity smart contracts with security best practices (ERC-20, ERC-721, ERC-1155, custom). Use when user asks to "create smart contract", "solidity contract", "erc20 token", "nft contract", or "web3 contract".

This skill should be used when the user asks to "start security analysis", "assess security", "which security tools should I use", "appsec start", "what should I scan", "security assessment", or invokes /appsec:start. Assesses the project's tech stack, data sensitivity, architecture, and installed scanners, then recommends which /appsec:* tools to run in priority order with rationale.

Verify that security controls documented in the threat model actually exist in the codebase. Searches for control implementations, validates configurations, identifies gaps. Use when validating threat model against code, checking security control implementation, or finding security gaps.

Trim CLAUDE.md and AGENTS.md files to reduce context cost. Apply the "less is more" finding from empirical research on agentic coding context files. Use when user says "trim our context files", "lean up CLAUDE.md", "optimize our agents.md", "reduce context", "our CLAUDE.md is too long", or asks to audit instruction files for bloat.

Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.

Investigate ZIA Sandbox file analysis results, quarantine issues, and security policy enforcement. Uses sandbox report, quota, behavioral analysis, and file hash tools combined with SSL inspection checks to diagnose why files are blocked, allowed, or stuck in quarantine. Incorporates runbook knowledge for Malware Protection, ATP, and Sandbox policy troubleshooting. Use when an administrator asks 'why is this file blocked?', 'check sandbox report for this hash', 'file stuck in quarantine', or 'sandbox is not analyzing files.'

Audit shadow IT and SaaS application usage using Zscaler Analytics (Z-Insights). Discovers unsanctioned applications, assesses risk scores, monitors CASB-protected SaaS usage, tracks data transfers to shadow apps, and reviews IoT device inventory. Use when a security team asks: 'What shadow IT apps are being used?', 'Show me unsanctioned SaaS usage', 'What is our SaaS risk exposure?', 'How many IoT devices are on our network?', or 'Generate a shadow IT report.'

When the user wants to optimize their Google Play Store listing — title, short description, full description, keywords, ratings, or Play Store-specific features. Use when the user mentions "Google Play", "Android", "Play Store", "Play Console", "short description", "full description indexed", "Google Play ASO", or wants Google Play-specific keyword, creative, or ratings strategy. For iOS App Store optimization, see aso-audit and metadata-optimization.

OWASP ASVS 5.0 requirements database for security audits. Provides chapter structure, control objectives, and verification requirements for all 17 ASVS domains.

Codebase health audit scoring 7 categories with progression plan

Audit the health of a PostHog project's data warehouse — find every broken or degraded pipeline item across sources, sync schemas, materialized views, batch exports, and transformations. Use when the user asks "what's broken in my warehouse?", "give me a health check", "audit my data pipeline", "why are some dashboards stale?", or wants a one-shot triage summary before deciding where to spend time. Produces a prioritized report of issues grouped by severity and type, with recommended next steps.

Capture, compare, and release baselines of requirements / specs / artifacts over time. Supports named baselines tied to milestones (release, audit date, phase gate), diff between baselines (added / removed / changed items), impact metrics per diff, evidence preservation per baseline, and rollback protection. Essential for audit and change-control processes.

Use when implementing row-level security (RLS) in Bknd. Covers filter policies, user ownership patterns, public/private records, entity-specific RLS, multi-tenant isolation, and data-level access control.

Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with 2024/2025 best practices. Use PROACTIVELY for code quality assurance.

Comprehensive, codebase-wide quality sweep that dispatches parallel subagents to find and fix structural issues. Covers deduplication, type consolidation, dead code removal, circular dependencies, weak types, defensive try/catch, deprecated paths, and AI slop. Primary support for JS/TS projects (knip, madge, TypeScript types); other languages get grep-based analysis. Use when the user asks to "deep clean the whole repo", "run a full codebase audit", "nuclear cleanup", "deslop everything", or "sweep the entire codebase for quality issues". Do NOT use for single-file fixes, branch-scoped diffs (use de-slopify instead), or targeted refactors.

Manage dependencies and supply chain security to prevent vulnerable or malicious packages. Use this skill when you need to audit dependencies, update packages, check for vulnerabilities, understand supply chain attacks, or maintain dependency security. Triggers include "dependencies", "npm audit", "supply chain", "package security", "vulnerability", "npm update", "security audit", "outdated packages".

Scans dependencies for known vulnerabilities (npm audit, pip-audit, etc.), generates reports, and suggests fixes. Use when user asks to "check vulnerabilities", "security scan", "audit dependencies", "check CVEs", or "vulnerable packages".

This skill should be used when the user asks to "check for denial of service", "analyze availability risks", "find DoS vulnerabilities", or mentions "denial of service" or "DoS" in a security context. Maps to STRIDE category D.

Audit .claude/rules/ files for structural correctness, glob validity, and real-world usefulness. Resolves each paths: pattern against actual project files, then asks the user whether each rule is still relevant and useful. Can update rules in-place based on answers. Use when setting up rules for the first time, debugging rules that fire too often or never, or doing a periodic rules hygiene pass.

This skill should be used when the user asks to "explain security concept", "what is OWASP", "explain this finding", "what does this vulnerability mean", "explain stride", "explain injection", "what is CSRF", "explain spoofing", "what does INJ-003 mean", "compare stride vs pasta", or asks any question about security terminology, frameworks, vulnerability categories, or specific findings. Works at framework, category, finding, and comparison levels.

Work with GitLab attestations for software supply chain security including artifact verification and provenance. Use when verifying software artifacts, managing attestations, or working with supply chain security. Triggers on attestation, verify artifact, provenance, supply chain security.

Full-pipeline Go code optimization: pre-flight check, structure review, developer fixes, then bug + security review. Use when the user wants a comprehensive Go code review and improvement cycle, asks to 'optimize Go code', 'review and fix', 'full code review', or wants to improve code quality across multiple dimensions. Also trigger when user mentions 'go optimize', 'go review', 'review the codebase', or wants structural and detail-level improvements together.

This skill should be used when the user asks to "harden code", "security hardening", "improve security posture", "add security headers", "tighten security", "defensive coding suggestions", or "proactive security improvements". Also triggers when the user asks about CSP, CORS hardening, rate limiting, input validation improvements, security logging, or defense-in-depth measures.

This skill should be used when the user asks to "check for information disclosure", "analyze data leakage risks", "find data exposure vulnerabilities", or mentions "information disclosure" in a security context. Maps to STRIDE category I.

Use when maintaining an existing Intent Layer, during quarterly reviews, after significant code changes, when something confused you, or when user asks to audit/update CLAUDE.md or AGENTS.md files.

SSH into the Jetson Orin Nano and audit the running inference config against known best practices and community optimizations. Reports gaps, misconfigurations, and optimization opportunities. Complements jetson-recon (external landscape) with internal config validation.

Run comprehensive mutation testing to audit test quality, find zombie tests, and propose refactoring

This skill should be used when the user asks to "check for non-repudiation privacy risks", "analyze excessive audit logging", "find privacy issues related to accountability", "check for forced identity linking", or mentions "non-repudiation" in a privacy context. Maps to LINDDUN category N. This is the INVERSE of STRIDE repudiation -- here too much proof is the threat.

Understanding LimaCharlie output stream structures — the four data streams (event, detect, audit, deployment) have different schemas, fields, and use cases. Covers stream structures, detection fields, audit log format, deployment events, filtering, and configuration. Use when configuring outputs, parsing LimaCharlie data in external systems, or understanding detection/audit/deployment stream formats.

Extract atomic propositions from a math manuscript .tex file into a JSONL structural representation, then run R1-R8 mechanical validation. Each prop carries text (verbatim from .tex), location (line range), cites (internal UUID dependency DAG), asserts (atomic claims), claim_type, and evidence_class. Use when: starting propositions side-file for a new manuscript, re-extracting after large rewrite, or running mechanical gate before audit. NOT for L4 semantic walk — that's the /proofread skill. v0.1.0 SCAFFOLDING — execution body TODO. Source-of-truth scripts currently in PsychQuantHsu/psychophysical_representations/scripts/validate-propositions.py.

Read-only static-analysis snapshot. Runs skylos (Python) and fallow (TS/JS) full audits, writes a fingerprinted snapshot to .claude/quality-snapshots/YYYY-MM-DD.json, and renders a grade card plus delta vs the previous snapshot (NEW / RESOLVED / PERSISTING findings). Use when the user asks "what's my code health?", "run skylos", "run fallow", "audit quality", "snapshot quality", or after a cleanup pass to confirm wins.

Deep code audit that detects misleading patterns — fake tests, mock abuse, shallow health checks, overly optimistic error handling, hidden debt. Produces a structured report with findings AND actionable recommendations. Use when code looks green but smells wrong.

This skill should be used when the user asks to "check for regressions", "verify fixes still hold", "regression test security", "check for reintroduced vulnerabilities", "security regression check", or "verify no old bugs returned". Also triggers when the user wants to confirm that previously fixed vulnerabilities have not been reintroduced by recent code changes.

This skill should be used when the user asks to "check for repudiation", "analyze audit logging", "find logging gaps", or mentions "repudiation" or "non-repudiation" in a security context. Maps to STRIDE category R.

This skill should be used when the user asks to "check CWE Top 25", "run SANS analysis", "check for common weaknesses", or mentions "CWE" or "SANS Top 25" in a security context. Checks code against the SANS/CWE Top 25 Most Dangerous Software Weaknesses.

This skill SHOULD be used when the user asks to "review code", "find dead code", "check for duplication", "simplify the codebase", "find refactoring opportunities", "do code cleanup", "check naming consistency", "analyze test organization", "run codebase health check", "review my PR", "refactor this code", "extract method", "rename variable", "consolidate duplicates", "adversarial review", "red team review", "find ways to break this", "multi-model review", "get multiple AI opinions on this code", "hunt bugs", "find bugs", "bug hunt", or "adversarial bug hunt". Routes to specialized analysis agents, refactoring workflow, multi-model adversarial review, or adversarial bug hunt based on the type of request.

Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.

Classify data and functionality by sensitivity and derive security requirements. Produces data-classification tiers, per-tier required controls (authn / authz / encryption / logging / retention / access review), CIA triad impact, abuse cases, and mapping to control-framework-mapping / data-flow-diagramming.

Security-focused code review checklist for identifying vulnerabilities

Security review and penetration testing: evaluate your application against OWASP Top 10, authentication security, HTTP headers, CORS, CSP, supply chain risks, and common attack vectors with browser-based validation.

Run a security audit of the codebase and produce a prioritised findings report. Optionally scope to a specific domain (e.g. /security-sweep auth). Outputs to docs/security/.

Parse a session transcript into a structured Session Governance Index — an annotated bibliography of every file modified and commit made, internal-energy accounting (tool uses, estimated tokens), shipped-vs-tasked atom tally, and classification of missing items as Gaps or Vacuums. Triggers on "visibility-schema-substrate-sweep", "session cascade audit", "session governance audit", or any request to summarize what a session actually produced versus what it was asked to produce.

Security best practices for Sinatra applications including input validation, CSRF protection, and authentication patterns. Use when hardening applications or conducting security reviews.

Audit SKILL.md files against the AgentOps template and readiness checks. Use for quality reviews or template compliance.

Initialize a threat modeling project by analyzing architecture documentation. Creates threat model structure with asset inventory, data flows, trust boundaries, and attack surface mapping. Use when starting new threat modeling work, setting up threat model for a project, or creating initial security assessment.

Generate security test cases from the threat model. Creates test scenarios for each threat and control verification tests. Use when creating security tests, generating penetration test cases, building security regression tests, or validating threat mitigations.

Vendor evaluation on weighted criteria — capability, reliability, security/compliance, TCO, commercial terms, implementation complexity, viability, support, data residency, exit. Includes SLA definition + vendor risk assessment.

When the user wants to get featured on the App Store or understand the editorial process. Also use when the user mentions "get featured", "App Store editorial", "App of the Day", "Today tab", "Apple featuring", or "how to get Apple to feature my app". For launch strategy, see app-launch. For ASO optimization, see aso-audit.

Audit project dependencies for security vulnerabilities and outdated packages, then apply safe updates. Use when user says "audit my dependencies", "check for vulnerable packages", "run npm audit", "find security issues in my packages", "what packages are outdated", "update my dependencies", "dependency health check", or "fix security vulnerabilities in dependencies".

# audit.log

Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks "what endpoints can I clean up?", "are any of my endpoints broken?", "which materialised versions are still being called?", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.

Manage Business Manager users, access roles, role permissions, and per-user access keys on a B2C Commerce instance using the b2c CLI. Use this skill whenever the user needs to list or search BM users on a sandbox or production instance, identify which BM user an OAuth token resolves to ("whoami"), assign or revoke instance-level access roles, edit role permissions, look up a user's WebDAV / OCAPI / Storefront access key, or rotate access keys for SSO-managed users. Also use when the user asks "what's my BM login on sandbox X", "rotate my WebDAV password", "how do I make a custom BM role", "audit BM users on this instance", or "delete a stale BM user from a sandbox".

Full-site blog health assessment scanning all blog files for quality scores, orphan pages, topic cannibalization, stale content, and AI citation readiness. Spawns parallel subagents for comprehensive analysis. Produces per-post scores and a prioritized action queue. Use when user says "audit blog", "blog audit", "site audit", "blog health", "audit all posts", "check all blogs".

Audit a directory of multilingual blog content for completeness, consistency, hreflang correctness, meta-tag parity, and freshness. Builds a translation coverage matrix, flags stale translations, validates hreflang and schema, and emits a prioritized report with runnable fix commands. Use when user says "locale audit", "blog locale-audit", "check translations", "multilingual audit", "translation check", "hreflang check", "Uebersetzungen pruefen".

Comprehensive security guide for Capacitor apps using Capsec scanner. Covers 63+ security rules across secrets, storage, network, authentication, cryptography, and platform-specific vulnerabilities. Use this skill when users need to secure their mobile app or run security audits.

Enforce code quality through the Boy Scout Rule (leave code better than found), secret-free commits, production-ready code (no TODOs, console.log, mocks, or commented code), and self-review against an atomic-commits checklist. Use when writing, modifying, or reviewing code. This skill MUST be consulted because production code without these standards causes quality regressions and operational incidents.

Audits the repo's Claude configuration against docs/config-guidelines.md. Read-only. Produces audit-report.md consumed by config-refactor.

Inventory and audit existing content (pages, articles, media, components) for a site or product. Produces structured inventory with metadata, quality audit (accuracy, freshness, completeness, relevance, findability), gap analysis vs user needs, and per-item recommended action (keep / update / merge / delete / migrate).

Automated security auditing of project dependencies to identify known vulnerabilities.