Loading...
Loading...
Found 1,953 Skills
Audits Claude Code setup across CLAUDE.md, rules, skills, hooks, and MCP. Run when Claude ignores rules, hooks malfunction, or MCP needs auditing. Not for debugging code or reviewing PRs.
Query efficiency audit worker (L3). Checks redundant entity fetches, N-UPDATE/DELETE loops, unnecessary resolves, over-fetching, missing bulk operations, wrong caching scope. Returns findings with severity, location, effort, recommendations.
General-purpose security auditing guide. Covers OWASP Top 10, dependency vulnerabilities, authentication, authorization, input validation, and secret management. Use this when performing a security review or audit.
Systematic documentation authoring workflow for AI coding agents. Analyzes repositories to determine what documentation is needed, classifies each document by Diataxis type (tutorial, how-to, reference, explanation), and generates accurate, maintainable documentation that stays synchronized with the codebase. Handles greenfield projects (no docs exist), brownfield updates (refresh, enhance, rewrite existing docs), and doc audits with workflow-specific guidance for each. Use when the user requests documentation for a project: README creation, API reference, architecture docs, developer guides, changelogs, or any technical writing tied to a codebase. Also use when existing docs need auditing, updating, rewriting, or restructuring. Triggers on phrases like "write a README", "document this project", "API reference", "architecture doc", "developer guide", "getting started guide", "tutorial", "how-to", "audit our docs", "what docs are missing", "refresh the docs", "Diataxis", "doc the public API", "write a CHANGELOG", "explain this codebase", "onboarding doc", or "ADR". Triggers when creating or editing `README.md`, `CONTRIBUTING.md`, `CHANGELOG.md`, `docs/`, `mkdocs.yml`, `docusaurus.config.*`, `sphinx`/`conf.py`, ADRs, or any markdown file paired with code. Triggers when public APIs, CLI flags, configuration options, or environment variables change and the user wants the docs kept in sync. Do NOT use for standalone prose, marketing copy, blog posts, design documents, RFCs unrelated to a codebase, or documents where the source of truth is not source code.
Use this skill when the user wants to audit Agent Skills, SKILL.md files, imported skills, prompts, tools, scripts, or skill repositories for safety, prompt injection risk, secret leakage, unsafe commands, unclear permissions, untrusted external references, or repo policy violations. Trigger phrases include "audit this skill," "skill security," "review imported skills," "prompt injection risk," "unsafe skill," "scan skills," and "security audit for skills."
The method for finding the gap between what a system is supposed to do and what the code actually does — the class of bug generic scanners miss because they have no model of intent. Defines what counts as documented intent, what counts as implementation evidence, which mismatches matter, and how to avoid hand-wavy findings. Use when auditing AI-built code, reviewing access control against documented permissions, or checking whether a codebase matches its own documentation.
Design products and pricing around validated willingness to pay, from Ramanujam & Tacke's "Monetizing Innovation". Use when the user mentions "pricing", "how much should we charge", "willingness to pay", "pricing page", "packaging", "freemium vs free trial", "are we leaving money on the table", "nobody buys at this price", "price increase", or "good-better-best". Also trigger when designing or auditing pricing and packaging, validating willingness to pay before building, segmenting customers by value, or choosing between subscription, usage-based, and freemium models. Covers price-before-product, willingness-to-pay talks, the four failures (feature shock, minivation, hidden gem, undead), leader/filler/killer packaging, and behavioral pricing. For offers and guarantees, see hundred-million-offers. For what customers value, see jobs-to-be-done.
12 production-ready regulatory affairs and quality management skills for HealthTech/MedTech: ISO 13485 QMS, MDR 2017/745, FDA 510(k)/PMA, ISO 27001 ISMS, GDPR/DSGVO compliance, risk management (ISO 14971), CAPA, document control, and internal auditing. Python tools included (all stdlib-only). Works with Claude Code, Codex CLI, and OpenClaw.
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
Review Next.js security audit patterns for App Router and Server Actions. Use for auditing NEXT_PUBLIC_* exposure, Server Action auth, and middleware matchers. Use proactively when reviewing Next.js apps. Examples: - user: "Scan Next.js env vars" → find leaked secrets with NEXT_PUBLIC_ prefix - user: "Audit Server Actions" → check for missing auth and input validation - user: "Review Next.js middleware" → verify matcher coverage for protected routes - user: "Check Next.js API routes" → verify auth in app/api and pages/api - user: "Secure Next.js headers" → audit next.config.js for security headers
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
Validate Tailwind CSS v4 configuration and detect/prevent Tailwind v3 patterns. Use this skill when setting up Tailwind, auditing CSS configuration, or when you suspect outdated Tailwind patterns are being used. Ensures CSS-first configuration with @theme blocks.