Loading...
Loading...
Found 1,862 Skills
Build and maintain project-specific review policy for `agentic-review` by combining repository docs (`AGENTS.md`, `ENGINEERING.md`, `CONTEXT.md`/`CONTEXT-MAP.md`, ADRs), repository-mined conventions, and structured user input, then writing machine-usable policy files under `<docs-dir>/review/policies/`, including audit-governance metadata consumed by `agentic-review`. Use when the user wants architecture integrity checks (onion/clean/hexagonal), module-specific review rules, dependency-direction policy, naming/inheritance convention enforcement, stricter project/domain review standards, or explicit auditability requirements for specialist review coverage.
Turns npm audit/Snyk results into prioritized patch plans with severity assessment, safe upgrade paths, breaking change analysis, and rollback strategies. Use for "dependency security", "vulnerability patching", "npm audit", or "security updates".
Analyzes project dependencies for known security vulnerabilities using npm audit, pip-audit, or similar tools. Use when auditing packages, checking for CVEs, or updating vulnerable dependencies.
Patterns and techniques for adding governance, safety, and trust controls to AI agent systems. Use this skill when: - Building AI agents that call external tools (APIs, databases, file systems) - Implementing policy-based access controls for agent tool usage - Adding semantic intent classification to detect dangerous prompts - Creating trust scoring systems for multi-agent workflows - Building audit trails for agent actions and decisions - Enforcing rate limits, content filters, or tool restrictions on agents - Working with any agent framework (PydanticAI, CrewAI, OpenAI Agents, LangChain, AutoGen)
Use this skill when you need to verify cross-file data/asset consistency in a content-driven site — not "does it render?" (that's `web-visual-verification`) but "do the data, files, and references all line up?". Triggers on phrases like "盤點內容", "稽核資產", "對照 course-data 跟 markdown", "找缺圖", "task ID 有沒有重複", "quiz 編號 vs 硬編碼總數", "audit", "content audit", "content drift", "asset coverage", "three-way sync check", "cross-file consistency", "find missing illustrations", "資料一致性檢查", "找出該補插圖的地方", or any moment when the user senses divergence between source files and deployed data. Output is a human-readable markdown report, not a pass/fail. Pair with `web-visual-verification` for full pre-release coverage.
Comprehensive dependency health auditing for JavaScript/TypeScript projects. Run npm audit, detect outdated packages, check for security advisories, and verify license compliance. Prioritises vulnerabilities by severity and provides actionable fix recommendations. Use when: auditing project dependencies, checking for vulnerabilities, updating packages, preparing for release, or investigating "npm audit" warnings. Keywords: audit, vulnerabilities, outdated, security, npm audit, pnpm audit, CVE, GHSA, license.
CQRS and Event Sourcing patterns for scalable, auditable systems with separated read/write models. Use when building audit-required systems, implementing temporal queries, or designing high-scale applications with complex domain logic.
Test Isolation + Anti-Patterns audit worker (L3). Checks isolation (APIs/DB/FS/Time/Random/Network), determinism (flaky, order-dependent), and 6 anti-patterns.
AI generation provenance and audit trail tracking. Records decision factors, data lineage, reasoning chains, confidence scoring, and cost tracking for AI-generated content.
Use when you need to execute I2 (Implementation Execution) in the Spec Pack of sdlc-dev, using `{FEATURE_DIR}/implementation/plan.md` as the sole SSOT to implement in batches, run minimal validation, write back audit information, and report at batch checkpoints; stop immediately when encountering blocks or clarification items.
Audit and optimise context window usage for AI coding tools (Claude Code, OpenCode, etc.). Estimates token breakdown, identifies waste (duplicate skills, overlapping rules, bloated instruction files, dirty git status, MCP server overhead), and provides actionable recommendations with projected savings. Use when the user says "context checkup", "reduce context", "check context", "context audit", "how big is my context", or when sessions feel sluggish.
Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.