Claude Skills by aibot88

Use age-plugin-yubikey when an agent needs age encryption tied to a physical YubiKey identity instead of software-only keys.

Validate encryption implementations and cryptographic practices. Use when reviewing data security measures. Trigger with 'check encryption', 'validate crypto', or 'review security keys'.

Audit a manufacturing energy management system for monitoring quality, cost optimization, and compliance. Evaluates power metering infrastructure, energy baseline and EnPI calculations, peak demand management and load shifting, renewable energy and battery storage integration, GHG Protocol carbon footprint tracking (Scope 1/2/3), energy cost optimization, and ISO 50001 compliance. Use when building or reviewing industrial energy platforms, building management systems, or sustainability report...

Building energy simulation and analysis for construction. Calculate heating/cooling loads, evaluate envelope performance, optimize HVAC sizing, and ensure energy code compliance.

Run a repeatable pre-commit gate that catches formatting, lint, secret, and policy issues before they land in the repo.

[PROTOCOL] Canonical contract for agency engagement lifecycle: artefact schemas, state files, iteration budget, escalation rules, cross-domain handoff, observability. Single source of truth referenced by agency-intake, leads, directors, and pipeline skills. Pure reference — no triggers, not invoked by the secretary as a router target.

Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.

Write text that avoids all known AI writing patterns and passes human detection. Use when writing articles, essays, blog posts, social media copy, or any content that must read as authentically human. Triggers on requests to write naturally, avoid AI slop, avoid AI detection, humanize writing, write like a human, or make text sound authentic.

Enhance author profiles by filling missing fields. Use when asked to "enhance author", "complete author profile", "find author info", or "update author details". Fills bio, avatar, website, and social links via parallel web research.

Deep reference skill for Enosys DEX V3 (CLMM) development on Flare Network. Use this skill whenever Darren asks about: building tools or apps that interact with Enosys DEX V3 positions (LP position manager, burn tool, reward checker), contract addresses for the Enosys V3 position manager or reward system on Flare, how delegation rewards / FlareDrops / APS incentives / rFLR work and how to claim them on-chain, writing ethers.js v6 code against the Enosys V3 contracts, or any task referencing t...

Find and add authoritative source links for all facts, citations, and references in markdown documents

Verifies if a required CLI tool is installed and offers to install it. Use when about to execute a command whose binary might not be installed. Trigger: "¿tienes X instalado?", "instala Y si no está", "check dependencies", "setup environment".

Operate long-lived agent workloads with observability, security boundaries, and lifecycle management.

Apply Gremlin's enterprise chaos engineering methodology. Emphasizes categorized failure injection, safety controls, and structured experimentation. Use when implementing chaos engineering in enterprise environments with compliance requirements.

Combines search results from multiple sources into coherent, deduplicated answers with source attribution. Handles confidence scoring based on freshness and authority, and summarizes large result sets effectively.

Türk şirketler hukuku için tüzel kişi ve şirket kayıt takip skill'i. MERSİS, ticaret sicili, faaliyet belgesi, imza sirküleri, karar defterleri, pay defteri, VERBİS, vergi/SGK, KEP/e-imza ve sektörel izin kayıtlarını izler. Init, rapor, güncelleme, sağlık denetimi ve CSV/table export modları için kullanılır.

Generates entrypoint.sh script for Docker container runtime environment variable injection. Replaces placeholder values in built assets with actual environment variables at container startup.

Use when dispatched to author the QA test plan for a game feature. Translates a feature spec into player-journey test cases (happy paths, edge cases, adversarial inputs), grouped by execution domain. Outputs test-cases.json. Does not run anything.

Enumerate and exploit network services including SMB, FTP, SSH, RDP, HTTP, databases (MySQL, MSSQL, PostgreSQL, MongoDB), LDAP, NFS, DNS, and SNMP. Use when testing network service security or performing port-based exploitation.

Environment variable and configuration audit. 8 dimensions (ENV1-ENV8): variable completeness, unused vars, startup validation, secret exposure, environment parity, type safety, default values, and documentation. Supports Node.js (.env/process.env), Python (os.environ/settings), and framework-specific patterns (Vite import.meta.env, Next.js NEXT_PUBLIC_). Switches: zuvo:env-audit full | [path] | --secrets-only | --parity

Apply when managing application configuration: environment variables, secrets management, and config validation.

Diagnose and fix Laravel environment configuration issues, cache problems, and database connection errors. Use when user reports "configuration not applied", "database connection error", "SQLite connection attempt", "hosts array is empty", or any environment-related issues. Also use after .env file modifications.

Generates .env.local file for local development environment variables. Contains developer-specific configuration like API URLs, ports, and feature flags. Gitignored for security.

트리거: "환경변수 관리", "env 정리해줘", ".env 만들어줘", "환경변수 설정", "env 파일 생성", "시크릿 관리", "secrets manager", "vault", "doppler", "환경변수 검증", "env diff" 수행: .env, .env.example, 환경변수 문서 일관 관리. 타입 검증 스크립트(Zod/pydantic), 시크릿 관리 도구 연동, Git hooks로 .env 커밋 방지, 환경별 diff 비교까지 포함한다. 출력: .env.example, 검증 스크립트(TS/Python), .gitignore, pre-commit hook, 시크릿 관리 가이드

Full environment variable reference for SAM. Use when adding, modifying, or documenting environment variables, configuring deployment, or working with Worker secrets. Trigger when asked about env vars, secrets, or configuration.

Complete environment and secrets management lifecycle. Covers .env file scaffolding, validation scripts, secret leak detection in git history, credential rotation playbooks, and integration with HashiCorp Vault, AWS SSM, 1Password CLI, and Doppler. Use when setting up projects, scanning for leaked secrets, or rotating credentials after an incident.

Use when updating environment secrets like GITHUB_TOKEN, NPM_TOKEN, or API keys on the user's machine

Environment variable consistency validator. Checks GH_* vs GITHUB_* naming conventions, validates documentation matches code, and ensures deployment scripts correctly map secrets. Use proactively when modifying environment variables, updating CLAUDE.md, editing configure-secrets.sh, or changing the Env interface.

Audit env var usage vs .env.example and code references — surface drift, unused vars, missing docs, and security risks.

Environment variable management across Vercel, Convex, and other platforms. Invoke for: trailing whitespace issues, cross-platform parity, Invalid character errors, webhook secrets, API key management, production deployment, dev vs prod configuration.

Official AI Agent Skill for Envault Secrets Management platform. Enforces strict zero-hardcode rules, Client-Side Encryption, and Human-in-the-Loop (HITL) approval workflows.

Environment variables, setup procedures, API configurations, and security for the omer-akben portfolio. Use when setting up the project, configuring services, or troubleshooting environment issues.

Auto-activates when user mentions environment variables, .env files, secrets management, configuration, or multi-environment setup. Manages environment configs securely.

Manage environment configurations, secrets, and .env files across environments. Use when configuring application environments or managing secrets.

Environmental assessments (Phase I/II ESA), contamination risk evaluation, cleanup cost estimation, regulatory pathway analysis, liability allocation. Use for site acquisitions, contaminated properties, environmental due diligence

Monitor environmental conditions on construction sites. Track air quality, noise levels, vibration, dust, and weather to ensure compliance and worker safety.

Discipline epistemique stricte pour eliminer les derives cognitives de Claude. Activation SYSTEMATIQUE sur TOUTES les conversations. Impose: (1) Zero invention/supposition, (2) Honnetete absolue, (3) Vision holistique avec relecture du contexte, (4) Questions plutot que suppositions, (5) Remise en contexte perpetuelle avec checkpoints structures, (6) Documentation incrementielle sans doublons, (7) Vigilance workflow/CI-CD/securite, (8) TODO/plan obligatoire avant tout travail, (9) Documentati...

Use when authoring any artifact that makes claims — skill content, documentation, audit findings, architecture proposals, code review comments. Covers the discipline of grounding every claim to a verifiable source, distinguishing verified-by-evidence from inferred-from-context, using normative vocabulary precisely (RFC 2119 MUST/SHOULD/MAY), and structuring arguments so the warrant from data to claim is visible to a reader. Do NOT use for verification protocol mechanics in this repo (use the ...

22 production-ready AI agents with database-driven orchestration for security reviews, code quality analysis, deployment validation, infrastructure checks, and compliance. Auto-activates for security concerns, deployment tasks, code reviews, quality checks, and compliance questions. Includes upgrade paths to enterprise features (GDPR, HIPAA, multi-account AWS, ML-based optimization).

Privacy-preserving ERC-4337 wallet development for vehicle identity and sensitive data protection. Use when implementing ERC-4337 account abstraction wallets that handle sensitive information (vehicle license plates, biometric data, personal IDs) requiring on-chain privacy. Triggers on requests like "implement ERC-4337 wallet for vehicle", "create privacy-protected account abstraction", "build wallet with vehicle number privacy", "develop ERC-4337 with ZK proof integration", or any smart cont...

Language-specific vulnerability hotspot reference for manual code audit. Trigger when the user asks to: "what sinks should I look for in Java?", "Python security hotspots", "dangerous functions in Go", "JavaScript injection patterns", or when starting a manual audit of a specific language and needing a sink/source checklist.

Deserialization vulnerability audit skill with gadget chain knowledge for all major languages. Trigger when the user asks to: "audit deserialization", "check for insecure deserialization", "find pickle vulnerabilities", "Marshal.load audit", "gadget chain analysis", "check for unsafe YAML loading", or when reviewing code that processes serialized data (JSON with type info, YAML, XML, binary formats).

Elite manual security code review skill for deep, adversarial vulnerability hunting and exploit-chain discovery. Trigger when the user asks to: "do a deep security audit", "manual code review", "find exploit chains", "hunt for logic bugs", "red-team this codebase", "do an offensive security review", "review this like a pentester", or needs a human-class manual code review that goes far beyond pattern matching. This skill operates as a top-tier offensive security engineer reading code line by ...

Deep PHP-specific security audit skill covering injection, deserialization, file operations, auth bypass, POP chain discovery, and CMS-specific patterns. Trigger when auditing PHP code: "audit this PHP app", "find PHP security issues", "check Laravel/WordPress for vulnerabilities", "PHP SAST review", "check for PHP deserialization", "review this WordPress plugin". Includes scripts/rules.json for programmatic rule lookup.

Security-focused pull request and diff review skill for finding newly introduced vulnerabilities, risky regressions, and missing security tests in changed code. Trigger when the user asks to: "review this PR for security", "check this diff for vulns", "do a security code review", "audit changed files", or wants findings on a patch instead of a full-repo scan. Best used alongside eresus-sast-scanner.

Deep Python-specific security audit skill with 50+ vulnerability class coverage across 7 categories. Trigger when auditing Python code: "audit this Python app", "find Python security issues", "check Flask/Django for vulnerabilities", "Python SAST review", "check for pickle vulnerabilities", "review this FastAPI code". Covers misconfiguration, injection, crypto, XSS, deserialization, and ML/AI attack surfaces. Includes scripts/rules.json for programmatic rule lookup.

Security remediation skill for fixing confirmed or likely SAST findings in source code. Trigger when the user asks to: "fix a vulnerability", "patch this security bug", "remediate SAST findings", "harden this endpoint", "make this auth flow safe", or wants code changes that remove a confirmed security issue while preserving intended behavior. Best used alongside eresus-sast-scanner.

General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis. Trigger when the user asks to: "analyze code for vulnerabilities", "review code security", "find security bugs", "do a SAST scan", "check for [vulnerability type] in code", "audit source code", or requests a security code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.

Serialization and deserialization security review skill for object mappers, parser pipelines, message formats, and state transfer mechanisms. Trigger when the user asks to: "review serialization security", "check deserialization", "audit Jackson/Fastjson/YAML/XML parsing", "look for gadget-chain risk", "review session or message deserialization", or wants a focused audit of parser-driven attack surface. Complements eresus-sast-scanner with a deep dive on serialization abuse paths.

Threat modeling skill for new features, services, endpoints, or repositories. Trigger when the user asks to: "threat model this", "analyze attack surface", "find abuse cases", "map trust boundaries", "prioritize security review", or wants a structured security design review before or alongside coding. Complements eresus-sast-scanner by turning architecture into a prioritized scan plan.