Reviews GitHub Actions workflow diffs for script injection of untrusted input, pull_request_target with untrusted checkout, over-broad GITHUB_TOKEN permissions, and unpinned…
End-to-end engineering workflow for Ghayth and similar business systems. Use to plan, build, fix, refactor, test, review, secure, optimize, monitor, release, or merge code…
Crea tareas y subtareas en ClickUp para implementaciones de GoHighLevel. Usar SIEMPRE que el usuario quiera subir workflows de GHL a ClickUp, registrar tareas de automatización, o…
Scan, tag, validate, and catalog files using the Ghost Catalog semantic file header system (SOM-XXX-NNNN-vX.X.X).
Ghost is an open-source publishing platform built for modern blogs, newsletters, memberships, and headless CMS use cases.
Ghostfolio is an open-source wealth management application for tracking stocks, ETFs, and cryptocurrencies across multiple platforms.
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD.
The ghttp test HTTP server for testing HTTP clients — NewServer/NewTLSServer, AppendHandlers, the Verify* assertions…
Ensure firms claiming GIPS compliance under the CFA Institute Global Investment Performance Standards satisfy requirements for composite construction, performance calculation,…
Manage git-crypt encrypted repositories with seamless worktree support. Handles unlock/lock operations, key management, and the critical worktree smudge filter issue that causes…
Backup Clawdbot workspace and config to GitHub with git-crypt encryption. Use for daily automated backups or manual backup/restore operations.
Audit local git history to identify commits that likely fixed vulnerabilities, infer the underlying bug from the diff, turn those patches into a reusable bug-fix reference set,…
Analyze Infrastructure-as-Code (IaC) in git repositories to extract cloud architecture and security configurations for threat modeling.
Review pull requests for code quality, security issues, and best practices. Use when reviewing PRs, checking code changes, or analyzing diffs before merge.
Use when creating new repositories, reviewing existing repos for compliance, or enforcing repository naming, structure, documentation, and security standards.
Detects leaked secrets in Git repositories using pattern-based scanning with Gitleaks rule definitions and the GitHub Secret Scanning API.
Scans Git repositories for leaked secrets using Gitleaks, TruffleHog, and custom regex patterns. Detects API keys, AWS credentials, private keys, and database connection strings…
Git security best practices for 2025 including signed commits, zero-trust workflows, secret scanning, and verification
Pre-commit security validation and secret detection. Runs gitleaks scan and validates configuration, integrates with pre-commit hooks to prevent credential leaks.
Build concise Git shadow-AI security reports from shadow-ai-git outputs, including models and providers, agent frameworks, MCP tooling, prompts, RAG/vector usage, training or eval…
GitHub Actions CI/CD guide for the dotfiles repository. Use when creating or modifying GitHub Actions workflows, adding CI/CD pipelines, setting up build/test automation,…
Use when the user wants to create, generate, or set up a GitHub Actions workflow. Handles CI/CD pipelines, testing, deployment, linting, security scanning, release automation,…
Make a GitHub Actions workflow faster, cheaper, and harder to attack — by profiling where wall-clock and billed minutes actually go, then adding content-keyed caching, matrix/job…
Build production CI/CD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning.
Debugs and authors GitHub Actions workflows — OIDC federation to AWS/GCP/Azure, GITHUB_TOKEN permissions hardening, reusable workflows vs composite actions, deploy concurrency,…
Load GitHub Actions automation workflows documentation including CI/CD pipelines, security scanning, and maintenance automation
Review GitHub Actions workflows for correctness, security, and maintainability. Use when reviewing GitHub Actions workflow PRs, checking workflow security, evaluating CI/CD…
Quick reference for GitHub Actions security patterns. Copy-paste snippets for action pinning, token permissions, secrets, runners, and workflow hardening.
Validate GitHub Actions workflows for syntax and security with actionlint, ghalint, and zizmor. Use when committing workflow changes, running CI validation, or checking workflow…
Build comprehensive GitHub Actions workflows for CI/CD, testing, security, and deployment. Master workflows, jobs, steps, and conditional execution.
GitHub Actions workflow patterns for static site CI/CD, security scanning, and quality checks
Comprehensive expertise in GitHub Agentic Workflows (v0.68.1) — AI-powered repository automation with five-layer security, safe outputs, MCP tools, and Continuous AI patterns
Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted…
World-class #1 expert GitHub developer specializing in Git operations, GitHub Actions CI/CD, Pull Requests, Issues, GitHub CLI (gh), GitHub API, Copilot, Pages, Security,…
Generate, export, load, and verify forensic evidence from GitHub sources. Use when creating verifiable evidence objects from GitHub API, GH Archive, Wayback Machine, local git…
GitHub platform health assessment with 7 phases, per-finding triage (Fix/Defer/Skip/Suppress), scoped single-phase mode, session-begin quick check, and inline fix execution.
Agent skill for safe, dry-run-first, deduplicated, root-cause-consolidated, evidence-validated, and secret-redacted logging of repository execution friction into GitHub Issues.
foundational definitions for GitHub skills, safety rules, tool escalation, and security boundaries
GitHub API operations - repositories, issues, pull requests, actions, code security, discussions, gists, and more.
Use when implementing GitHub OAuth + GitHub App authentication with Nango - provides two-connection pattern for user login and repo access with webhook handling
Pre-merge functional reviewer skill. Invoke for GitHub PR quality, contract validation, and release readiness. Do not invoke for deep security audit of auth/secrets/permissions.
Utility scripts for GitHub pull request management. Includes tools for fetching bot-generated review comments (linters, security scanners, dependabot), replying to review threads…
GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL). Use for project setup, Actions workflows, security scanning, or encountering YAML syntax, workflow…
Assess and guide safer github.com repository releases. Use when an existing private GitHub repository becomes public for the first time, or whenever an already-public GitHub…
Configure GitHub Secret Protection — secret scanning, push protection, custom patterns, and partner alerts.
Analyze GitHub repository security alerts and generate remediation plans. Use when the user asks to review security alerts, fix vulnerabilities, check dependabot alerts, review…
Diagnose and fix GitHub authentication issues on Windows when pushing fails with "Repository not found" or wrong-account errors.
Decentralized git for AI agents and humans. Use when the user wants to create repositories, push code, open pull requests, review and merge PRs, manage issues, create or claim…
Set up gitleaks secret-scanning on a repo. Scans history for existing leaks first — stops if dirty, because installing CI on top of a polluted history makes CI permanently red.
Gitleaks is an open-source SAST tool for detecting hardcoded secrets like passwords, API keys, and tokens in Git repositories, files, and directories.
A multifaceted OSINT and forensics tool for GitHub repositories that detects fake stargazers, tampered commits, infected releases, leaked PGP keys, and suspicious contributor…
Add opencode-mem to OpenCode so coding sessions can store, search, and reuse project memories through a local SQLite and vector index.
Přidání nové featury end-to-end přes všechny vrstvy bez zapomenuté permission, route nebo DI bindingu.
Error tracking (Sentry) na BE i FE — hlásí jen neočekávaná selhání (paniky, terminálně padlé joby, Vue chyby), obohacuje event o uživatele/request/breadcrumbs, je vypnuté bez DSN.
Configures GKE Backup Plans and restore workflows. Use for backup policies, disaster recovery, or GKE cluster restores. Don't use for database backups.
Plan, create, and configure production-ready Google Kubernetes Engine (GKE) clusters using the golden path Autopilot configuration.
Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling…
Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and…
Improves GKE workload reliability, using PDBs, health probes, and topology spread constraints. Use when configuring GKE workload reliability, setting up PDBs, or configuring GKE…
Plans, configures, and hardens Google Kubernetes Engine (GKE) security. Covers Workload Identity Federation, Secret Manager integration, RBAC hardening, Binary Authorization,…