Skills for your AI
Scans code for security vulnerabilities, assesses their severity, checks compliance against security standards, and consults reference material. Use when a user asks to scan a project directory, assess vulnerabilities in a path, run a compliance check, or look
Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team,
Runs threat modeling, security audits, penetration tests, and security architecture, cryptography, and best-practices guidance on projects. Use when the user asks to threat model, audit, pentest, or review a project's security, or asks about security patterns,
Analyzes server metrics and infrastructure data to recommend performance, caching, load balancing, database, security, power, and disaster recovery optimizations. Use when a systems administrator asks to analyze server performance, design load balancing, plan
Manages Railway services — checking status, renaming, changing icons, linking, and creating services from Docker images. Use when the user asks about Railway service health or deployments, wants to rename a service or change its icon, switch the linked service
Audits web applications for session management vulnerabilities, including fixation, logout invalidation, persistence after password change, refresh token rotation, entropy, JWT sessions, cookie attributes, and DBSC downgrade. Use when the user wants to test se
Hunts Microsoft SharePoint Server on-prem farms for anonymous endpoint exposure, version disclosure, legacy SOAP login bypass, ToolShell preconditions, SafeControl enumeration, NTLM topology leaks, custom-branding modules, and EoL permanent-CVE windows. Use wh
Pre-production audit that scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues. Intercepts deploy commands and blocks until critical items pass. Stack-agnostic. Use for "run ship gate", "am I
Builds and runs SimPy discrete-event simulations of queues, resources, and timed processes, from model design through code, monitoring, and results analysis. Use when the user wants to simulate a system with resource contention, such as a bank with tellers, a
Find which APIs of a project's pinned Python dependencies changed after the model's training cutoff, where the code uses them, and write short AGENTS.md or CLAUDE.md notes.
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugin
Validate, test, and score the quality of skills within the claude-skills ecosystem. Comprehensive meta-skill: structure validation, Python script testing (syntax + imports + runtime + output format), multi-dimensional quality scoring with letter grades and tie
Builds, reviews, and deploys Slack apps using @slack/bolt, the Slack Web API, and Block Kit, covering app scaffolding, code review, OAuth V2 setup, Block Kit UI design, and architecture guidance. Use when the user asks to create a Slack bot or app, review Slac
/cs:soc2-audit-prep <scope> — SOC 2 Type II readiness 6-question forcing interrogation. Observation-period focused. Use before Type II observation begins, mid-period checkpoint, or pre-field-test month-10 readiness.
Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.
Designs and documents software architecture from requirements through deployment, covering requirements analysis, component design, data modeling, technology selection, security, integration, and architecture style adoption. Use when the user provides system d
Provides practical guidance on coding, debugging, testing, version control, security, documentation, agile practices, CI/CD, design patterns, and developer learning resources. Use when an IT specialist asks for help optimizing code, debugging errors, setting u
Writes production-ready code, tests, and documentation autonomously from specifications, running full test suites and recording decisions. Use when given a feature, fix, or refactor spec, when asked to run and fix a test suite, or when documenting architectura
Extracts backend API hosts, routes, and secrets from a SPA's JavaScript bundles and tests discovered endpoints for missing authentication and broken access control. Use when analyzing an authorized SPA target, mapping its API surface from JS bundles, or probin
Use when the user says 'build me an app', 'create a project from this spec', 'scaffold a new repo', 'generate a starter', 'turn this idea into code', 'bootstrap a project', 'I have requirements and need a codebase', or provides a natural-language project speci
Designs, implements, and hardens Spring Boot 3+ microservices, reactive systems, and cloud-native Java applications. Use when planning service architecture, generating Spring Boot code, production hardening, microservices patterns, or reactive WebFlux/R2DBC wo
Finds and validates Spring Boot vulnerabilities during authorized security testing by fingerprinting targets, enumerating actuator endpoints, and testing heap dump secrets, SpEL, H2, Spring4Shell, and Jolokia. Use when testing Spring Boot apps for authorized p
Use when the user asks to write SQL queries, optimize database performance, generate migrations, explore database schemas, or work with ORMs like Prisma, Drizzle, TypeORM, or SQLAlchemy.
Hunts SQL injection vulnerabilities in web applications and APIs by enumerating input vectors, identifying the tech stack, running error-based, boolean, time-based and NoSQL probes, extracting proof data, and documenting findings. Use when testing an authorize
