Explore skills

Security audit skill for Claude Code community skills. Scans for prompt injection, data exfiltration, permission bypass, dangerous commands, and supply chain risks.

Use when user mentions "security review", "compliance", "SOC 2", "GDPR", "PII", "threat model", when the system handles sensitive data, when preparing for an audit or certification, when assessing risk before launch, or when a STRIDE threat model is needed for a new component.

This skill performs a 4.6/4.7 compatibility scan when requested, covering CLAUDE.md, AGENTS.md, subagents, skill files, settings.json, hooks, package manifests, and Anthropic SDK call sites.

三機(Claude/Gemini/Codex)平行安全審查，掃描OWASP漏洞、威脅建模後投票(CASPER有VETO權)

This skill should be used when the user asks about 'schema drift', 'schema evolution', 'evolve schema', 'schema sync', 'sync schemas', 'update schema fields', 'schema field frequency', 'missing schema fields', 'unused schema fields', 'schema proposal', 'schema cardinality', 'check schema', 'schema audit', 'schema changes'. Detects drift between Basic Memory schema definitions and actual note usage

Audit the project's Claude Code setup. Runs the curator (external best practices) and caretaker (internal integrity) subagents in parallel and presents merged findings in plain language.

Provides active execution protocols to rigorously audit how code, directory structures, and agent actions comply with the authoritative ecosystem specs. Trigger when validating new skills, plugins, or workflows.

Audit file path references in plugins and skills. Trigger with "audit path references", "check file references", "find broken references", "path reference audit", "verify paths", or when you need to validate that all ./references in code actually exist in the skill/plugin. Three-phase audit: (1) SCAN all files for references, (2) VERIFY each exists, (3) REPORT issues. Generates inventory.json for

Diagnose your position on the founder mode vs. manager mode spectrum, based on Brian Chesky's operating system and Paul Graham's framework. Use this to assess if you are leading like a founder or drifting into manager mode.

Autonomous security vulnerability scanner for codebases. Detects secrets, XSS, missing security headers, auth issues, OWASP Top 10 patterns, dependency vulnerabilities, PII exposure, CORS misconfiguration, and more. Aligned to OWASP APTS (Autonomous Penetration Testing Standard) Foundation tier. Outputs SARIF JSON, Markdown report, and APTS Conformance Claim. Use when the user wants a security aud

A black/grey-market intelligence analysis assistant based on JDArmy/BREAK for risk-control, anti-abuse, anti-fraud, trust & safety, and business security teams. It supports analysis of various fraud and abuse cases, from credential stuffing to content manipulation.

Trigger with "run self-audit", "test the analyzer", "regression test the plugin analyzer", "audit the agent-scaffolders", or "verify the analyzer works correctly". Runs the analyze-plugin skill against the agent-scaffolders itself and its test fixtures as a regression smoke test. Use this after making changes to the analyzer to verify nothing broke.