Run a third-party / vendor security review and assign a risk tier with required controls. Use when asked to assess a vendor's security, run a third-party risk assessment, complete…
Гейты качества перед delivery: тесты, lint (ruff/ESLint v9/Biome), types (pyright), LSP, browser/security/design.
Verify whether an online bounty, freelance task, agent marketplace job, hackathon prize, or crypto work offer is actually open, accessible, and credibly funded.
Use when the user asks VibePro to check UI, security, performance, architecture, PR readiness, launch readiness, or performance improvement evidence.
Builds a deterministic, reproducible proof-of-concept for a suspected vulnerability before writing a finding — eliminating false positives and producing airtight evidence.
Prepare an evidence-bound vulnerability publication and publish the exact approved advisory through Runx Connect with independent provider readback.
Turn one confirmed security finding into a disclosure-ready GitHub advisory with root cause, proof of concept, impact, and source evidence.
Evaluate delegated-wallet, embedded-wallet, or agent-signer policy evidence without sharing credentials or raw provider payloads.
3-wave parallel audit — Wave 1 discovery (4 agents), Wave 2 verification (4 agents), Wave 3 cross-optimization (1 synthesizer). Each wave runs agents in parallel.
Explore an authorized URL with headless Chrome DevTools/CDP, build a bounded SPA state-and-action graph, capture and classify browser traffic, optionally harvest browser-loaded…
Gather security intelligence for Proteus hypotheses: expected behavior, public-known status, advisories, changelogs, issues, PRs, docs, tests, affected-version timeline, duplicate…
Security invariants every Wendy interop change must respect, distilled from the AAA contract. Use when: (1) reviewing or writing any code touching pki-core, wendy-auth, cloud,…
Establish who registered and who operates a domain using WHOIS, RDAP and DNS. Use when running a whois lookup, querying RDAP, digging A, AAAA, MX, NS, TXT, SOA or CAA records,…
Use for cold-start, time-boxed, multi-axis audits of unfamiliar codebases — take-home assessments, post-acquisition or due-diligence reviews, inherited-service onboarding,…
Use when results may be sensitive — to specification, sample, measurement, or inference for quantitative work, or to interpretation and triangulation for qualitative work — in a…
Triages WordPress availability, integrity, performance, and suspected-security incidents while stabilizing service, preserving evidence, controlling changes, restoring safely, and…
Use this skill when investigating events in the ThreatLocker Action Log (the API name is "audit") — building incident timelines, tracing a file's history across endpoints,…
Read-only audit of a project's third-party dependencies — lockfile discipline, hallucinated and typosquatted package names (slopsquatting), dependency confusion, install-script…
Knowledge engine over the Colombian Truth Commission (CEV) final report "Hay Futuro Si Hay Verdad" (2022) — the findings, statistics, armed-actor responsibilities, differ — from…
Translate technical threat scenarios into standardized controls and regulatory requirements, covering NIST 800-53, MITRE ATT&CK, SOC 2, and automated control-gap analysis.
A Cursor Canvas is a live React app (.canvas.tsx) that the user can open beside the chat. Use a canvas when the agent produces a standalone analytical artifact — quantitative…
Reconstruct attack timelines through deep data recovery and log correlation, covering deleted-file recovery, memory-dump analysis, registry and shellbag forensics, and…
Check whether the claims in public-facing documentation (README, release notes, install/usage docs) are supported by the evidence the user provides — files, manifests, logs, and…
Analyzes SQL Server ERRORLOG files for operational issues, availability group failures, memory pressure, I/O subsystem warnings, and security events.
Apply structured critical thinking — identifying claims, evidence, reasoning chains, hidden assumptions, and logical fallacies — to evaluate or construct specific written…
Run a structured check on whether an image or video is AI-generated, digitally manipulated, or authentic-but-miscaptioned, and produce a sourced verdict with a confidence level.
Use this skill when converting Kujo audit findings, drift reports, release blockers, DocGen gaps, Dependabot/security triage, or recurring automation output into fix-ready backlog…
Austrian law assistant (Rechtsassistent) for Claude Code. Full case analysis, contract review, evidence evaluation, claim identification (Anspruchsprüfung), litigation strategy,…
Use this skill when working with SentinelOne XSPM misconfigurations - cloud security posture management across AWS, Azure, GCP, Kubernetes, identity, and infrastructure-as-code.
Analyze source for vulnerabilities and non-conformance to MISRA and AUTOSAR safety coding standards. Use this skill whenever the user mentions misra, autosar, coding standard,…
> Use this skill whenever asked about Netherlands cryptocurrency or digital asset taxation. Trigger on phrases like \"crypto tax Netherlands\", \"Bitcoin Netherlands\", \"crypto…
A skill that runs a GAP ANALYSIS & feedback review of an existing project through a multi-agent harness instead of a single review pass.
A skill that runs a GAP ANALYSIS & feedback review of an existing project through a multi-agent harness (enhanced variant: GPT-5.5 cross-model adversarial confirmation) — from…
Use this skill to rate, audit, grade, stress-test, red-team, or issue a ship/no-ship verdict on a vibe-coded, AI-built, prototype, or MVP app, repository, or live deployment.
Use this skill to rate, audit, stress-test, red-team, or issue a ship/no-ship verdict on a concrete API, worker, realtime service, data pipeline, backend repository, or server…
Score a documentation package against the ten-dimension weighted rubric in `references/scorecard-rubric.md` with a cited justification per dimension, then evaluate the eighteen…
Special Court for Sierra Leone (SCSL, 2002-2013) and the Residual Special Court for Sierra Leone (RSCSL, 2013-) research, drafting, and analysis.
This skill designs and runs the security awareness training programme for all employees. Use when asked to create security training, run phishing simulations, or track training…
Assess and govern security-sensitive changes by identifying trust boundaries, secrets, privileges, untrusted execution, dependency/provenance risk, network/data exposure, insecure…
This skill should be used when scoping a feature, designing a surface, planning architecture, reviewing a diff, investigating security or reliability, or testing a change as a…
Extends Capability Evolver with verification, rollback, and promotion gating. Use when an agent logs a learning, proposes a self-improvement, or wants to promote a learning to…
Special Tribunal for Lebanon (STL / TSL — Tribunal Spécial pour le Liban) research, drafting, and analysis.