Loading...
Loading...
Found 141 Skills
Detects leaked API keys, tokens, passwords, and credentials in code with pre-commit hooks, CI checks, scanning rules, and remediation procedures. Use for "secret scanning", "credential detection", "API key leaks", or "secret management".
Invoke this skill when a user shares test code and questions whether it actually works as intended — not to run or fix the test, but to evaluate whether the test has real value. Triggers on: "is this test any good?", "would this catch a real bug?", "this test always passes — is that normal?", "review these tests before I commit", or "does this test verify anything meaningful?". Also triggers when someone suspects a test is useless, wants a pre-commit quality gate, or is unsure if an auto-generated test is worth keeping. The core question this skill answers: "Would this test fail if the feature broke?" If not, the test gets rejected. Do NOT use for generating new tests, fixing failing tests, or exploring application features.
Set up and maintain hk git hook manager in any repository. Use when adding pre-commit hooks, configuring linters, setting up code quality automation, working with hk.pkl, or maintaining existing hook configurations. Triggers on tasks involving hk, git hooks, pre-commit checks, commit-msg validation, or linting pipelines.
Pre-commit workflow and commit guidelines. Use when asked to commit changes. Requires passing lint and tests, signed commits, semantic prefixes, imperative mood.
Secret detection and credential scanning using gitleaks. Use when scanning repositories for leaked secrets, API keys, passwords, tokens, or implementing pre-commit security checks.
This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.
Performs a technical code review of recently changed files for bugs, security issues, and standards compliance, then writes a report. Use before committing, as a pre-commit quality gate.
Instala, com o OK explícito de quem usa o computador, um alarme de commit (pre-commit do git) que recusa o commit quando encontra CPF ou CNPJ com dígito verificador válido, arquivo de senhas (.env), certificado com chave privada (.pfx, .p12, .pem) ou planilha nova, explica por que e como corrigir, cita git commit --no-verify e diz como desinstalar. Use quando o usuário quiser proteger o repositório contra dado de cliente ou certificado A1 indo para o git, ao preparar a máquina do escritório para trabalhar com SDD, ou quando um commit for recusado por este alarme. Não se aplica a períodos (não consulta norma nem calcula). Não conserta histórico do git, não revoga certificado, não lê planilha .xlsx por dentro, não dá parecer sobre LGPD ou sigilo profissional; para diagnosticar o ambiente sem instalar nada, use sdd-checar-ambiente.
Onboard prek (Rust-powered pre-commit) into any project and suggest hooks tailored to the language/framework. Use when the user says "add prek", "set up pre-commit hooks", "configure prek", "what hooks should I use", or when you notice a project without a prek.toml that would benefit from pre-commit checks. Also trigger when the user wants to add new hooks to an existing prek.toml, audit their hook config, or migrate from pre-commit to prek. Covers Rust, Python, TypeScript/JavaScript, Go, Ruby, and Shell projects. Do NOT use for husky, lint-staged, or CI pipeline hook configuration — this skill is specifically for prek.
Secret Protection prevents credential leaks across the development lifecycle through `.env` scanning, pre-commit hooks, secret rotation policies, and runtime detection.
Plans a touch-by-touch outbound cadence - which channel on which day, touch count, spacing, channel mix, multi-threading, exit and stop rules, recycle and re-entry, and the capacity math behind it, with pre-committed metric thresholds. Use whenever the user mentions a sequence, cadence, follow-up timing, Outreach or Salesloft steps, a drip, "how many touches", inbound-lead or event follow-up, closed-lost re-engagement, or B2C lifecycle and SMS flows, even without the word cadence. Do NOT use for message copy, subject lines (mbfinotti/sales-skills@cold-email-subject-line-tester), call scripts (mbfinotti/sales-skills@cold-call-opener), or inbox placement (mbfinotti/sales-skills@cold-email-deliverability).