This skill should be used when the user asks about Active Record models, database migrations, queries, associations (belongs_to, has_many, has_one, has_and_belongs_to_many),…
Use this skill whenever asked about Andorra payroll processing for employed persons. Trigger on phrases like \"Andorra payroll\", \"CASS contributions\", \"IRPF withholding…
Three-file state management for session continuity. Maintains STATE.md, DECISIONS.md, and PROGRESS.md as human-readable session context alongside the SQLite ticket database.
SQLite-based ticket tracking for structured development workflows. Use this skill when the user asks to initialize a ticket database, import requirements, list tickets, get the…
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before…
Use this skill whenever the user wants to manage their Apple Reminders or Calendars using the `event` CLI tool.
Use this skill when securing web applications, preventing OWASP Top 10 vulnerabilities, implementing input validation, or designing authentication.
This skill should be used when the user asks to "security review this PR", "review this diff for vulnerabilities", "appsec review these changes", "audit this branch for auth,…
SENTINEL — a comprehensive security audit skill for Claude Skills. Performs red-team/blue-team analysis on any SKILL.md (and its bundled scripts, hooks, and references), producing…
Design and implement RESTful API endpoints with proper HTTP methods, status codes, and consistent naming conventions.
Guidance for bypassing HTML/JavaScript sanitization filters in security testing contexts. This skill should be used when tasked with finding XSS filter bypasses, testing HTML…
This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with…
Guide to building offline-first Capacitor apps with data synchronization, caching strategies, and conflict resolution.
This skill should be used when working on security aspects of a Chrome extension or when the user asks about Chrome extension security best practices.
LCM (Lossless Context Management) skill for Claude Code. Implements deterministic, lossless memory management for long agentic sessions using a hierarchical DAG of summaries…
Build agent-facing web experiences with ATXP-based authentication, following the ClawDirect pattern. Use this skill when building websites that AI agents interact with via MCP…
Connects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration, permissions, and deployment.
Use this skill when the user says 'CSP', 'Content-Security-Policy', 'security headers', 'HSTS', 'X-Frame-Options', 'clickjacking', 'unsafe-inline', 'unsafe-eval', or needs to…
This skill automates database backups using the database-backup-automator plugin. It creates scripts for scheduled backups, compression, encryption, and restore procedures across…
Guidance for recovering data from SQLite Write-Ahead Log (WAL) files that may be corrupted, encrypted, or inaccessible.
This skill should be used when deploying Fastify to production, configuring Fastify security headers, setting up reverse proxy with Fastify, implementing graceful shutdown,…
Guidance for filtering JavaScript and XSS attack vectors from HTML while preserving original formatting.
Guidance for identifying and fixing security vulnerabilities in code. This skill should be used when asked to fix security issues, address CVEs or CWEs, remediate vulnerabilities…
Use when operating the ForWin backend through its MCP tools for project creation, Genesis progression, writing handoff, task control, chapter inspection, or WorldModel reads.
Author the graph_os knowledge-graph internals — extractors, backends, indexers, queries. Use when adding a new node/edge type, writing a new extractor (Python AST, doc-headings,…
Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and…
This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or…
Symptom-driven troubleshooting guide for HTTP/transport errors when integrating the Overlens IDP — the "why am I getting this status code?" skill.
This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD
This skill should be used when the user asks to "check for integrity issues", "analyze deserialization", "find supply chain vulnerabilities", "review CI/CD security", "check SRI",…
iOS data persistence expert skill covering SwiftData (@Model, ModelContainer, @Query, #Predicate, migrations, CloudKit), Core Data (NSPersistentContainer, NSFetchRequest, batch…
Security considerations for Jackson @JacksonInject annotation in Java applications. How to prevent JSON input from overriding server-injected values.
Skill: Leiloeiros das Juntas Comerciais do Brasil workflow skill. Use this skill when the user needs Coleta e consulta dados de leiloeiros oficiais de todas as 27 Juntas…
Use Cartographing Kittens MCP tools for structural codebase intelligence — dependency mapping, impact analysis, code exploration, refactoring planning, and semantic search via…
Use this skill when running, configuring, testing, extending, or maintaining the AI Chat local multi-provider chat app: `npm run dev`, `npm run smoke`, SQLite chat state, provider…
Use this skill when running, testing, extending, or maintaining the CRUD API showcase: `main.kujo`, SQLite item/project APIs, Next.js playground, auth strategies, smoke tests,…
Use this skill when running, configuring, testing, integrating, or maintaining Watchdog local AI telemetry/proxy workflows: `dashboard_server.kujo`, `/proxy/v1`, `/api/requests`,…
libSQL is an open-source, open-contribution fork of SQLite by Turso that adds embedded replicas, server mode, and WebAssembly UDFs.
This skill should be used when the user asks to "run LINDDUN analysis", "check privacy threats", "privacy threat model", "GDPR analysis", "check data protection", or invokes…
Apply the LINDDUN privacy threat taxonomy to find linkability, identifiability, and disclosure risks in a system design.
Search, enrich, and manage family heritage and historical relationship data from the LiùDào (六道) SQLite database.
Engineering practices for developing the Lorekeeper codebase. Load this skill when working on Lorekeeper source code, fixing bugs, adding features, writing tests, or reviewing…
This skill should be used when the user asks to "run a security audit", "find vulnerabilities", "check for XSS", "check CSRF protection", "validate form security", "run a…
Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting,…
This skill should be used when the user asks to "check for misconfigurations", "analyze security headers", "find misconfigured settings", "check CORS policy", "find debug mode",…
Use this skill whenever the user wants to write, optimize, debug, or work with Microsoft SQL Server databases.
This skill should be used when authoring an n8n workflow as JSON to import via n8n's REST API (rather than hand-clicking in the editor), when an n8n HTTP Request node's attached…
This skill should be used when working on security aspects of a Next.js application or when the user asks about Next.js security best practices.
Skill for configuring security and authorization in Orchard Core. Covers permission definitions, authorization services, CORS, security headers, content security policies, and…
This skill uses the owasp-compliance-checker plugin to automatically identify potential security vulnerabilities based on the OWASP Top 10 (2021) list.
Audit web applications against OWASP guidance and produce specific remediation steps. Use this skill whenever the user mentions owasp, appsec review, asvs, top ten, web…
Use this skill when the user says 'OWASP audit', 'OWASP top 10', 'security audit', 'vulnerability assessment', 'full security check', or needs a comprehensive web application…
Command-line task management tool for AI coding agents and humans. Provides local SQLite-based task boards for tracking work items, checklists, and comments without requiring an…
Hands-on manual / exploratory QA of web applications driven through the Playwright MCP browser tools (`browser_navigate`, `browser_snapshot`, `browser_find`, `browser_click`,…
Use this skill to scan a Claude Code plugin (or any npm/PyPI package tree) for security issues before installation.
Complete API lifecycle management for Laravel applications — from OpenAPI design through governance and security hardening.
This skill should be used when establishing comprehensive QA testing processes for any software project.
This skill should be used when the user is securing a React application, asking about "XSS in React", "dangerouslySetInnerHTML security", "Server Actions security", "React data…
Complete end-to-end evaluation of an app/codebase — measures the codebase against the dev-best-practices rules of this repo (essential/app/github/architecture).
LLM system review grounded in CMU 11-667 (Harms + Attacking LLMs), Berkeley CS294-196 (Safety/Guardrails), and OWASP LLM Top 10.