Loading...
Loading...
Found 195 Skills
Deep audit of a Frappe app for security, correctness, and customization defects. Runs every security scope and every quality rule in a separate agent, verifies each candidate in a fresh context, and compiles one report. User-invoked only - run /deep-app-audit [app path] [options].
Audits production source code files based on the strategy in workspace/plan.json. Use when a review plan exists and you need to perform static analysis and deep-dive reviews of targeted files. Don't use for planning, deduplicating, or writing patches.
Filament rules review. Use when the user asks to check Filament code against the project's Filament ways, or when another skill needs a Filament review of the code it touched.
Review existing Rust code for idiom, API design, error handling, safety, and maintainability, and produce a prioritized report where every finding cites the rule it breaks and gives a concrete fix. Use this whenever the user asks to review, audit, critique, grade, or "check" Rust code, a crate, a module, a .rs file, a diff, or a pull request, or asks what is wrong with their Rust or how to make it more idiomatic, even if they don't say "review". Pairs with the rust-best-practices skill, which covers writing new code.
Audits a Rails app for tech debt, citing each finding to PoEAA, SOLID, or the Rails guides with file:line evidence and before/after code. Use when the user says "audit Rails tech debt", or when auditing Rails for anti-patterns, fat models or controllers, callback abuse, or N+1 queries. Not for over-engineering; use simplifying-ruby-code.
Audits, reviews, and refactors code so many coding agents can change it in parallel without merge conflicts: few shared files, strong boundaries, explicit contracts, fast checks. Use when the user says "make this agent-friendly", or when asked to make code agent-friendly or find where parallel agents will collide. Not for general code review; use reviewing-code.
Creates PR review reports. In addition to investigating bugs and vulnerabilities, it verifies the consistency between exported conversation contexts, PR descriptions, and implemented code, and critically scrutinizes the soundness of the implementer's work. Used when users say things like "Write a PR review report", "Conduct a code review with conversation context", or "Question the sanity of this PR".
Audits Android codebases for ANR risks and diagnoses ANR stack dumps. Use this skill when scanning Android code for ANR risks or triaging ANR stack dumps. Don't use for non-ANR crashes, dropped frames, general CPU profiling, or Perfetto system traces.
End-to-end defect hunt and repair across a whole codebase - context and business-rule capture, hierarchical sweeps (business logic, error handling, security, correctness, concurrency, data integrity, performance, config, test quality), reproduction, root-cause fixes, regression proofing, and an evidence-backed audit report. Use whenever bugs are to be found or fixed at repository or module scope, such as "find all the bugs", "fix everything", "audit this codebase", "review the whole codebase", "QA review", "harden this before release", "check for vulnerabilities", "why is this flaky". Use it equally for business-logic defects where nothing crashes but the result is wrong - "the calculation is wrong", "the numbers do not add up", "the discount applies twice", "a step can be skipped", "the request can be replayed", "the limit does not hold", "a user can see another user's data". Prefer this over ad-hoc reading whenever the scope is a repo, a module, or "everything" rather than one known failing line, and when reviewing AI-generated or recently merged code before shipping. This skill CHANGES CODE. If the user wants findings only with nothing modified - "review only", "do not touch anything", "report only" - use anti-bug-review instead.
Read-only defect review of a codebase - deep context and business-rule capture, perspective-based sweeps (business logic, error handling, security, correctness, concurrency, data integrity, performance, config, test quality), reproduction of each finding, severity calibration, and a decision-ready audit report with recommended fixes that are described but never applied. The codebase is left byte-identical. Use this whenever findings are wanted without changes, such as "review this codebase", "audit it but do not touch anything", "code review", "PR review", "second opinion on this code", "security assessment", "due diligence", "is this safe to ship", "what is wrong with this code", "review only", "report only", "read-only review", "check it without changing anything". Use it equally for business-logic defects where nothing crashes but the result is wrong - a wrong total, discount, tax or balance, a skippable step, a replayable action, a quota that does not hold, a user seeing another user's data. Prefer this over anti-bug whenever the user wants a report rather than a repaired repo, when the code belongs to someone else, or when changes need approval first. If the user actually wants the bugs fixed, use anti-bug instead.
Reviews a change, a session or a whole codebase against every skill in this collection and returns one ranked, numbered report.
Audit source code for threat exposure, authentication flaws, injection sinks, SSRF, concurrency races, and security debt.