Loading...
Loading...
Found 36 Skills
Find and replace code patterns structurally using ast-grep. Use when you need to match code by its AST structure (not just text), such as finding all functions with specific signatures, replacing API patterns across files, or detecting code anti-patterns that regex cannot reliably match.
Run Ruff checks with optional scope and rule overrides, apply safe and unsafe autofixes iteratively, review each change, and resolve remaining findings with targeted edits or user decisions.
Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
Semgrep integration. Manage Rules, Scans. Use when the user wants to interact with Semgrep data.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.
Build PHPStan rules, collectors, and extensions that analyze PHP code for custom errors. Use when asked to create, modify, or explain PHPStan rules, collectors, or type extensions. Triggers on requests like "write a PHPStan rule to...", "create a PHPStan rule that...", "add a PHPStan rule for...", "write a collector for...", or when working on a phpstan extension package.
Perform a static, read-only code review of an Astro pull request or of a local branch, commit range, diff, patch, or working tree being prepared as a pull request. Use this skill only when the user asks to review PR changes, review their current branch before opening or updating a PR, or self-review a PR for correctness, security, tests, simplicity, runtime portability, error handling, comments, behavior documentation, and changeset coverage. Do not use it for issue review, bug-report investigation, reproduction, diagnosis, or triage. This skill reports findings only: it never edits code or runs project code, tests, builds, checks, or scripts
Critical Standard Bottom-Up Self-Check (check-standards, Convergence Gate) after Java backend code generation/modification. **This skill must be loaded after any Java code is written or modified—including scattered coding that does not follow the complete development process (e.g., "write an XX interface"/"write a Controller"/"help me write this code"): this skill must be loaded and verified before delivering code products to users**. It uses grep/ast-grep to actually scan and verify each standard—comments (class/field/method Javadoc/step comments, including private and extracted methods), logs (full class @Slf4j, each business method has logs, ERROR exceptions with stack traces), transaction rollbackFor, constructor injection, layered boundaries, SQL in XML, unified return body, pagination limit, password encryption, SQL comments/injection/WHERE, and all other verification items, with "File:Line Number" evidence attached to each item; **No level distinction—any item that is not implemented properly (regardless of importance) will be listed in the pending confirmation list to confirm with the user whether to complete it**. **Correct intermediate product naming and paths before verification** (Technical Solution 3.x.1 / Interface List 3.x.2 / Standard Verification Report 5.2.x / Acceptance Report 5.3.x, remove the task ID prefix T0xx from file names and move to the module version directory). Trigger scenarios: after writing code, after code generation, after modifying code, **before delivering code**, pre-submission check, code standard verification/review, comment and log verification, code review, standard self-check, bottom-up check, acceptance review, product file naming correction, file renaming and relocation, **perform standard scanning on specified directories/modules/packages (e.g., "run check-standards on xx directory"/"verify order module standards"/"only scan the code modified this time")**. It can be used with ai-dev-workflow 5.2 standard verification node / 5.3 acceptance, or triggered independently (output the report in the dialogue and prompt the user for confirmation when there are no docs/no process).
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".
Use this skill when working with the UI5 Linter (@ui5/linter) for static code analysis of SAPUI5/OpenUI5 applications and libraries. Covers setup, configuring linting rules, running the linter to detect deprecated APIs, global variable usage, CSP violations, and manifest issues. Supports autofix for deprecated API usage, global references, event handlers, and manifest properties. Includes CI/CD integration, pre-commit hooks, and UI5 2.x migration preparation.
Use when reviewing scripts, client components, bundles, or runtime behavior related to Lint JavaScript code. Inspect both source code and the browser execution path so fixes target the real bottleneck or bug.
Code-level quality analysis. Use when asked to review code for smells, security issues, implementation quality, or test coverage.