Claude Skills by aibot88

OWASP Top 10 for LLM Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in large language model systems.

ASCENT engineering framework. Use to scaffold new projects, enhance existing ASCENT projects, migrate non-ASCENT projects to ASCENT standards, or answer questions about ASCENT's conventions, principles, or nine engineering roles (delivery-lead, architect, ui-ux-designer, developer, data-engineer, ai-engineer, tester, devops, cybersecurity).

Creates AGENTS.md canonical and CLAUDE.md @AGENTS.md stub; audits token budget, cache safety, import-pattern compliance. Use when instruction files need alignment.

Creates design_guidelines.md with WCAG 2.1 compliance and design system docs. Use when project has a frontend.

Worker that checks DRY/KISS/YAGNI/architecture compliance with quantitative Code Quality Score. Validates architectural decisions via MCP Ref: (1) Optimality - is chosen approach the best? (2) Compliance - does it follow best practices? (3) Performance - algorithms, configs, bottlenecks. Reports issues with SEC-, PERF-, MNT-, ARCH-, BP-, OPT- prefixes.

Checks DRY/KISS/YAGNI/architecture compliance with quantitative Code Quality Score. Use when implementation tasks are Done and need quality scoring.

Audit project documentation quality across 8 categories (Hierarchy, SSOT, Compactness, Requirements, Actuality, Legacy, Stack Adaptation, Semantic Content). Delegates to ln-601 for deep semantic verification of project documents. Use when documentation needs quality review, after major doc updates, or as part of ln-100-documents-pipeline. Outputs Compliance Score X/10 per category + Findings + Recommended Actions.

Audit code comments and docstrings quality across 6 categories (WHY-not-WHAT, Density, Forbidden Content, Docstrings, Actuality, Legacy). Use when code needs comment review, after major refactoring, or as part of ln-100-documents-pipeline. Outputs Compliance Score X/10 per category + Findings + Recommended Actions.

Checks hierarchy, links, SSOT, compression, requirements compliance, freshness, legacy cleanup. Use when auditing documentation structure.

Checks hardcoded secrets, SQL injection, XSS, insecure deps, input validation. Use when auditing security.

Checks application security boundaries: secrets, injection, XSS, input validation, and sensitive env defaults. Use when auditing exploitable code paths.

Checks DRY, KISS/YAGNI, error handling, DI patterns. Use when auditing code principles compliance.

Checks outdated packages, unused deps, reinvented wheels, CVE/CVSS vulnerability scan. Use when auditing dependencies.

Validates E2E coverage for critical paths (money, security, data integrity). Risk-based prioritization. Use when auditing E2E test coverage.

Identifies missing tests for critical paths (money, security, data integrity, core flows). Use when auditing test coverage gaps.

Checks layer leakage in method signatures, missing DTOs, entity leakage to API, inconsistent error contracts. Use when auditing API contracts.

Discovers custom modules replaceable by OSS, evaluates alternatives (stars, license, CVE), generates migration plan. Use when reducing custom code.

Configures environment variables and secrets protection. Use when setting up .env files and gitignore rules for a project.

Sets up security scanning for secrets and dependency vulnerabilities. Use when adding security infrastructure to a project.

Scans codebase for hardcoded secrets with severity classification and remediation guidance. Use when auditing a project for leaked credentials.

Use mbox-to-sqlite when an agent needs to work across an email archive as structured data instead of parsing one message at a time. The agent imports a mailbox into SQLite, then hands the resulting database to search, reporting, and cross-dataset workflows without depending on a live mail provider.

Carica nel contesto corrente la Knowledge Base di produzione cinematografica (MovieMagic Scheduling + MovieMagic Budgeting + Final Draft + produzione italiana compliance + set operations + competitor landscape). Usata dall'orchestrator prima di task su moduli produzione (lib/schedule, lib/odg, lib/budget, lib/screenplay, lib/schedule/compliance) e prima di ogni sessione parlamento. Garantisce che ogni decisione architetturale sia production-aware e tracciabile a pattern MMS/MMB/FD/CCNL concreti.

MemGPT-style virtual context-load egy 11.11 session indulásakor. B-2 sprint Week 3 rewrite (2026-05-13): a klasszikus aggressive 15-20K token-os cat-jel helyett **lean ~5K token** working+top-K episodic + semantic on-demand. B-1 Week 3-4 bővítés (2026-05-17): **KO-DB Top-K structured facts** réteg (13K+ fact, cross-source-corroboration ranking, instant SQLite). Production-stack v2 (2026-05-20): **RRF hybrid-fusion** retrieval (vault-search + agentmemory), 77.5% avg R@5 (+23pp), drop-in via `v...

Run constant-rate HTTP attacks, capture binary results, and generate reports or plots before capacity changes and releases.

Use when querying, ingesting, or maintaining a local RAG MCP corpus for semantic document retrieval with privacy controls.

本地资源库导航——字典库(Dic)、Payload库、POC库的结构和使用方法。当需要使用 ffuf/spray 目录爆破、密码爆破、或构造 Fuzz payload 时必读。覆盖字典选择策略、payload 模板调用、POC 库搜索方法。字典库统一安装在 /pentest 目录下

Use when the user wants to localize an entire campaign for multiple markets — translate all campaign assets, adapt cultural references, adjust compliance per region, and coordinate multilingual publishing.

Deterministic secret storage for guppi skills. Use when you need to store, retrieve, or manage API tokens and secrets across guppi skills.

· Handle authorized privesc, CTFs, post-exploitation on Linux, containers, K8s. Triggers: 'privesc', 'CTF', 'pentest', 'post-exploitation', 'container escape', 'SUID', 'GTFOBins'. Not for hardening (use security-audit).

Locus payment infrastructure for AI agents — send USDC payments, call 30+ pay-per-use APIs, order prepaid cards, manage email inboxes, hire freelancers, and more. Use when the agent needs to make crypto payments, call external APIs, or interact with Locus services.

Logdy is a zero-dependency single-binary log viewer that pipes any command output into an interactive browser-based UI. It supports custom TypeScript parsers, column definitions, filtering, and works with stdin, files, sockets, and REST API inputs.

Monitor and log API requests with correlation IDs, performance metrics, and security audit trails. Use when auditing API requests and responses. Trigger with phrases like "log API requests", "add API logging", or "track API calls".

Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the scope is multi-file — "audit the whole codebase", "health check", "audit src/", "audit auth and payments modules", "where should I focus testing", "onboarding review", "logic overview before we ship". SCOPE HARD RULE: multi-file or directory scope. One file or one function uses logic-review; a concrete failure uses logic-locate; two versions uses log...

Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Remedy). Trigger when a user shares code and suspects something is wrong without naming a concrete failure — phrases like "review this", "does this look right", "check this function", "audit this code", "tests pass but prod fails". SCOPE HARD RULE: one file or one function only. For a directory or whole module use logic-health; for a confirmed failure (stack trace, failing test, spe...

Logto is a modern, open-source authentication and authorization infrastructure built on OIDC and OAuth 2.1. It provides multi-tenancy, enterprise SSO, RBAC, and SDKs for 30+ frameworks, making it the go-to Auth0/Cognito alternative for SaaS and AI applications.

Base de connaissances sur la Loi 25 du Québec (protection des renseignements personnels) appliquée au développement logiciel. Ce skill doit être utilisé quand l'utilisateur demande "audit loi 25", "vérifier la conformité", "protection des données personnelles", "PII", "renseignements personnels", "vie privée", "chiffrement des données sensibles", "droit à l'effacement", "portabilité des données", "EFVP", "évaluation des facteurs relatifs à la vie privée", ou toute question sur la conformité d...

Implement Lokalise translation data handling, PII management, and compliance patterns. Use when handling sensitive translation data, implementing data redaction, or ensuring compliance with privacy regulations for Lokalise integrations. Trigger with phrases like "lokalise data", "lokalise PII", "lokalise GDPR", "lokalise data retention", "lokalise privacy", "lokalise compliance".

Deploy Lokalise integrations to Vercel, Netlify, and Cloud Run platforms. Use when deploying apps with Lokalise translations to production, configuring platform-specific secrets, or setting up deployment pipelines. Trigger with phrases like "deploy lokalise", "lokalise Vercel", "lokalise production deploy", "lokalise Netlify", "lokalise Cloud Run".

Install and configure Lokalise SDK/CLI authentication. Use when setting up a new Lokalise integration, configuring API tokens, or initializing Lokalise in your project. Trigger with phrases like "install lokalise", "setup lokalise", "lokalise auth", "configure lokalise API token".

Configure Lokalise across development, staging, and production environments. Use when setting up multi-environment deployments, configuring per-environment secrets, or implementing environment-specific Lokalise configurations. Trigger with phrases like "lokalise environments", "lokalise staging", "lokalise dev prod", "lokalise environment setup", "lokalise config by env".

Apply Lokalise security best practices for API tokens and access control. Use when securing API tokens, implementing least privilege access, or auditing Lokalise security configuration. Trigger with phrases like "lokalise security", "lokalise secrets", "secure lokalise", "lokalise API token security".

Use when a task is multi-step, may span context resets or sessions, uses subagents, or risks losing state before completion - keeps todo, checkpoint, resume, drift, and evidence discipline without granting completion authority

Graham cigar-butt (NCAV / net-net) single-stock diagnostic. Combines a 100-point static cheapness score (NCAV, PE, PB, dividend yield, debt coverage, earnings stability) with a dynamic adjustment layer (industry cycle, earnings trend, insider activity, NCAV trajectory) to separate real bargains from value traps. Pulls data from Longbridge CLI first; MCP fallback if CLI unavailable; falls back to WebSearch only for gaps, runs cross-statement reconciliation (勾稽校验) before scoring, and footnotes ...

Fetch current documentation for libraries used in channelhub (Bun, grammy, MCP SDK, Playwright, bun:sqlite, etc.). Prefer Context7 when installed; fall back to WebFetch against the canonical doc site. Use when the user asks "how does X API work" or you're about to call an unfamiliar library method.

Checks every subnet in a Virtual Network for an associated Network Security Group, and also inspects each NIC attached to those subnets for NIC-level NSG coverage.

Finds the Network Interface Card (NIC) and associated Network Security Group (NSG) for a VM given its public IP address.

Web accessibility patterns, WCAG compliance, and inclusive design. Use when implementing accessible UI, keyboard navigation, screen reader support, focus management, semantic HTML, ARIA patterns, or auditing for compliance.

Document REST APIs with OpenAPI/Swagger specifications, endpoint references, authentication flows, error handling, and SDK guides. Use for API reference docs, Swagger specs, interactive explorers, and client library documentation.

Authentication and authorization patterns including OAuth2, JWT, RBAC/ABAC, session management, API keys, password hashing, and MFA. Use for login flows, access control, identity management, tokens, permissions, and API key authentication. Do not use for vulnerability scanning (use loom-security-scan), audits (loom-security-audit), or threat modeling (loom-threat-model).

Design, repair, or interpret automated quality and deployment gates. Use when CI/CD, test pipelines, lint/type/build checks, preview deploys, branch protection, generated artifacts, secrets in automation, rollout, rollback, or pipeline failures affect Loom work.