Loading...
Loading...
Found 57 Skills
Find and replace code patterns structurally using ast-grep. Use when you need to match code by its AST structure (not just text), such as finding all functions with specific signatures, replacing API patterns across files, or detecting code anti-patterns that regex cannot reliably match.
Run Ruff checks with optional scope and rule overrides, apply safe and unsafe autofixes iteratively, review each change, and resolve remaining findings with targeted edits or user decisions.
Builds and queries multi-language source code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, and entry point enumeration. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, or building a code graph for audit prioritization. Supports 16 languages including Solidity, Cairo, Circom, Rust, Go, Python, C/C++, TypeScript.
Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
Find orphan functions, dangling imports, and dead code via GitNexus CLI (npx gitnexus@latest). CLI ONLY - NO MCP server exists, never use readMcpResource with gitnexus:// URIs. TRIGGERS - dead code, orphan functions, unused imports, dangling references, unreachable code.
Semgrep integration. Manage Rules, Scans. Use when the user wants to interact with Semgrep data.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.
Build PHPStan rules, collectors, and extensions that analyze PHP code for custom errors. Use when asked to create, modify, or explain PHPStan rules, collectors, or type extensions. Triggers on requests like "write a PHPStan rule to...", "create a PHPStan rule that...", "add a PHPStan rule for...", "write a collector for...", or when working on a phpstan extension package.
Perform a static, read-only code review of an Astro pull request or of a local branch, commit range, diff, patch, or working tree being prepared as a pull request. Use this skill only when the user asks to review PR changes, review their current branch before opening or updating a PR, or self-review a PR for correctness, security, tests, simplicity, runtime portability, error handling, comments, behavior documentation, and changeset coverage. Do not use it for issue review, bug-report investigation, reproduction, diagnosis, or triage. This skill reports findings only: it never edits code or runs project code, tests, builds, checks, or scripts
Critical Standard Bottom-Up Self-Check (check-standards, Convergence Gate) after Java backend code generation/modification. **This skill must be loaded after any Java code is written or modified—including scattered coding that does not follow the complete development process (e.g., "write an XX interface"/"write a Controller"/"help me write this code"): this skill must be loaded and verified before delivering code products to users**. It uses grep/ast-grep to actually scan and verify each standard—comments (class/field/method Javadoc/step comments, including private and extracted methods), logs (full class @Slf4j, each business method has logs, ERROR exceptions with stack traces), transaction rollbackFor, constructor injection, layered boundaries, SQL in XML, unified return body, pagination limit, password encryption, SQL comments/injection/WHERE, and all other verification items, with "File:Line Number" evidence attached to each item; **No level distinction—any item that is not implemented properly (regardless of importance) will be listed in the pending confirmation list to confirm with the user whether to complete it**. **Correct intermediate product naming and paths before verification** (Technical Solution 3.x.1 / Interface List 3.x.2 / Standard Verification Report 5.2.x / Acceptance Report 5.3.x, remove the task ID prefix T0xx from file names and move to the module version directory). Trigger scenarios: after writing code, after code generation, after modifying code, **before delivering code**, pre-submission check, code standard verification/review, comment and log verification, code review, standard self-check, bottom-up check, acceptance review, product file naming correction, file renaming and relocation, **perform standard scanning on specified directories/modules/packages (e.g., "run check-standards on xx directory"/"verify order module standards"/"only scan the code modified this time")**. It can be used with ai-dev-workflow 5.2 standard verification node / 5.3 acceptance, or triggered independently (output the report in the dialogue and prompt the user for confirmation when there are no docs/no process).
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".
Security Check - Security review for skills before installation. Triggers: Before installing new skills, regular review of installed skills, or when security issues with a skill are suspected. Security Checks: - Dangerous Commands: rm -rf, sudo, curl|bash, etc. - Network Requests: Potential data leakage risks - File Writes: Writing to sensitive locations - Credentials: Risk of API key/password leakage - Resource Exhaustion: Infinite loops - Privilege Escalation: Privilege escalation attempts - External Dependencies: Suspicious dependencies Commands: - /安检 <skill-path> - Review skill security - /安检 scan <path> - Deep scan - /安检 list - List risks of installed skills - /安检 fix <skill> - Fix security issues - /security <skill-path> - English command Actions: - Auto-fix: Remove or replace dangerous code - Disable: Disable dangerous features - User Confirm: User chooses whether to proceed - Block: Block installation for severe risks Capabilities: Static code analysis, dangerous pattern recognition, risk assessment, auto-fix, user interactive decision making.