Loading...
Loading...
Found 44 Skills
Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
Use when explicitly asked to run the security-reviewer subagent or when another skill requires the security-reviewer agent card.
Configure an AI agent to send OpenTelemetry traces to Coval. Use when a user wants to add Coval tracing, instrument an agent for simulations or conversation monitoring, make traces show up in Coval, handle SIP/PSTN/WebSocket trace correlation, or replace the one-command wizard with a security-reviewable manual setup.
Runs available security scanning tools against the current project and produces a consolidated markdown report. Auto-detects installed tools (gitleaks, semgrep, grype, npm audit, bandit, pip-audit, gosec, govulncheck, cargo audit, bundle-audit) and activates language-specific scanners based on project files. Gracefully skips missing tools and provides installation hints. By default scans the entire target directory. Pass --full to make the intent explicit (useful in workflows that combine full-codebase and diff-only scans). Use when running security scans, checking for vulnerabilities, detecting leaked secrets in git history, or validating security posture before commits or releases. Pairs with security-review for a complete security workflow.
Spencer's house style for UIs. DO NOT INVOKE THIS SKILL UNLESS SPECIFICALLY ASKED. Use whenever Spencer asks for a frontend, page, screen, component, dashboard, app shell, modal, form, table, or any kind of web visual — including phrasings like "build a UI for X", "throw together a screen", "make a dashboard", "I need a quick app". Also use when starting a brand-new React project from scratch on this machine. Overrides any general "frontend-design" skill: Spencer dislikes the default shiny-AI aesthetic and wants tight, neutral, dense, system-font UIs that look like the due-diligence and security-review apps. If Spencer is editing an existing repo with a clearly different stack (e.g. Next.js with shadcn already wired up), follow that repo's conventions, but still apply Spencer's typography, density, and tone preferences from this skill.
Backend security review and hardening for authentication, authorization, tokens, sessions, secrets, validation, injection, payments, uploads, webhooks, data exposure, rate limits, and deployment configuration. Use when asked to audit, security-review, harden, threat-check, or inspect backend code for vulnerabilities across Express, NestJS, Django, Rails, Go, and other stacks.
Run a final release checklist before shipping. Verifies no TODOs, no debug code, docs updated, tests passing, dependencies justified, and security reviewed.
Review Server Actions for security, validation, and best practices in React 19. Use when reviewing forms, mutations, or server-side logic.
Comprehensive multi-stage code review using specialized subagents. Use when reviewing PRs with complex architectural impact, security concerns, or when thorough multi-perspective analysis is needed.
Use this skill whenever performing security threat modeling, attack surface mapping, or trust boundary analysis on a codebase. Triggers on 'threat model', 'security review', 'attack surface', 'trust boundaries', or when assessing a project's security posture. Also trigger when the user is about to build security-sensitive features (auth, crypto, file I/O, network services, native bridges) and needs to understand the threat landscape first — even if they don't explicitly say "threat model." Also triggers on 'what changed' or 'diff analysis' for incremental security review of recent commits.
Run parallel quality reviews (React, SOLID, Security, Simplification, Slop) on branch changes and auto-fix issues
Audit Flux CD GitOps repositories for structure, security, API compliance, and best practices. Use this skill whenever the user asks to audit, analyze, review, validate, or check a GitOps repository. Also use it when users mention Flux repo structure, GitOps best practices, manifest validation, deprecated APIs, security review, or repository organization — even if they don't explicitly say "audit".