Claude Skills by aibot88

Analisa e classifica um repositório GitHub via repo-radar CLI (SQLite + LLM), registrando o veredito em PROJECT_EVALUATIONS.md

Security audit for GitHub repositories before installation. Use when user wants to check if a repo/app is safe to install, review install scripts for malicious code, verify an open source project isn't collecting data, or audit dependencies for suspicious packages. Triggers on phrases like "is this safe to install", "check this repo", "review this script", "audit this code", "is this sketchy".

Repomix packs an entire code repository into a single AI-friendly file optimized for LLM consumption. It provides token counting, security scanning via Secretlint, Tree-sitter-based code compression, and outputs in XML, Markdown, or plain text format.

TRIGGER: "analise meu repo inteiro", "repomix", "empacotar código", "passar repo para LLM", "compress repo", "share with AI". Usa Repomix para empacotar repo em um único arquivo (XML/JSON/Markdown) otimizado para context window de LLM, com filtros por extensão/path e remoção de comentários/secrets.

渗透测试报告生成。当完成安全评估需要输出正式报告时使用。覆盖报告结构模板、风险评级标准（CVSS）、漏洞描述写法、修复建议规范。适用于正式渗透测试报告和红队评估报告

Checks biomedical manuscripts against reporting guidelines such as CONSORT, STROBE, PRISMA, and TRIPOD to identify missing or weak reporting elements before submission or revision.

Take a suspected injectable request, replay it on an authorized target, confirm the finding, and enumerate reachable database actions before manual follow-up.

Rédaction de requêtes devant le Conseil de prud'hommes pour contester un licenciement pour faute grave. Utiliser ce skill quand l'utilisateur demande de rédiger une requête CPH, contester un licenciement pour faute grave, préparer une saisine du CPH pour un litige lié à un licenciement, ou créer un document de contestation de licenciement en droit du travail français.

Rédaction de requêtes devant le Conseil de prud'hommes pour contester un licenciement pour faute grave. Utiliser ce skill quand l'utilisateur demande de rédiger une requête CPH, contester un licenciement pour faute grave, préparer une saisine du CPH pour un litige lié à un licenciement, ou créer un document de contestation de licenciement en droit du travail français.

Audit research data management infrastructure -- score FAIR principles compliance (Findable, Accessible, Interoperable, Reusable) across all sub-principles, evaluate data governance frameworks and lifecycle management, assess metadata schema quality (Dublin Core, DataCite, DDI, ISO 19115), review electronic lab notebook integrity and IP protection, check controlled vocabulary and ontology usage, and verify repository integration and funder sharing compliance (NIH 2023 policy, NSF, ERC). Cover...

Researches malware analysis, CVEs, attribution reports, and hacker community sources. Use when the album subject involves cybersecurity incidents or threat actors.

Resource compliance skill. Analyze one or more SmartCMP resources with componentType-driven cloud/software/OS analyzers.

Analyze and guide security incident response, investigation, and remediation processes. Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts. Trigger with phrases like "security incident response", "ransomware attack response", "data breach investigation", "incident playbook", or "security forensics".

Assess an AI feature or product for ethical risks, bias, safety issues, fairness gaps, and regulatory compliance. Use when reviewing an AI feature before launch, conducting a responsible AI audit, or responding to a bias or safety concern.

Tracks breaking changes across REST API versions by diffing OpenAPI specs with oasdiff and monitoring endpoint deprecation headers. Stores version history in SQLite via better-sqlite3.

Generates comprehensive API test suites from OpenAPI specs using Postman Collection SDK and Newman CLI. Creates parameterized test scenarios with environment-specific variables, auth flows, and assertion chains.

Reference skill for Zoom REST API. Use after choosing an API-based workflow when you need endpoint selection, resource-management patterns, OAuth requirements, rate-limit awareness, or API error debugging.

Restic is a fast, secure, and efficient backup program supporting local, SFTP, S3, Azure, GCS, and many other storage backends. Written in Go with 32k+ GitHub stars, it features deduplication, encryption, and snapshot-based incremental backups.

Use for recurring backup-restore validation and disaster-recovery simulation, including restore runbooks, drill frequency, pass/fail gates, evidence capture, and remediation tracking.

Retell AI install auth — AI voice agent and phone call automation. Use when working with Retell AI for voice agents, phone calls, or telephony. Trigger with phrases like "retell install auth", "retellai-install-auth", "voice agent".

Retell AI security basics — AI voice agent and phone call automation. Use when working with Retell AI for voice agents, phone calls, or telephony. Trigger with phrases like "retell security basics", "retellai-security-basics", "voice agent".

Audit retirement planning software for projection model accuracy, asset allocation by age, Social Security optimization, tax-advantaged account strategy, withdrawal sequencing including Roth conversion ladders, Monte Carlo simulation quality, and inflation adjustment methodology. Use when reviewing financial planning tools, 401k platforms, pension calculators, or wealth management systems.

Audit an existing repo against a profile and offer to fix what's drifted. TRIGGER when the user says "retrofit this repo", "fix this repo's hygiene", "bring this repo into compliance", "remediate drift", "fix what's drifted", "make this repo match the profile", "my repo is half set up, finish it", "I already have some hooks but they're incomplete", "fill in the gaps", "upgrade this repo to nyann standards", "apply the profile to this existing repo". ALSO trigger when doctor finishes with drif...

Pipeline automatica di reverse engineering per APK Android (Flutter e nativi). Fa preflight dei tool, scarica l'app dal device con adb, rileva se è Flutter o nativa, lancia il toolchain giusto (blutter o jadx+apktool), produce un report di vulnerabilità con segreti hardcoded, analisi manifest, anti-tamper e crypto weakness. Invoca quando l'utente chiede "/reverse-apk" o dice di voler fare reverse engineering / audit sicurezza di un'app Android installata su device.

Analyze YOU — not your content, but your unique knowledge intersections, unexploited strengths, hidden expertise, and personal competitive moat. Content-dna analyzes your output. This analyzes your INPUT — who you are and what only you can create.

Challenge a design, plan, or artifact by actively looking for weaknesses, risks, and blind spots. Use when the user says 'challenge this design', 'red team this', 'steelman the alternative', or 'find what we missed'.

Detect AI-generated writing patterns in developer text — docs, docstrings, commit messages, PR descriptions, and code comments. Use when reviewing any text artifact for authenticity and clarity.

Reviews an architecture (file, repo, design doc, or pasted text) against scalability, security, reliability, compliance, and anti-pattern checklists plus fitness functions. Use when the user asks to "review my architecture", "critique this design", "audit this system", or invokes /sdd:review-architecture.

Production-readiness audit for authentication. Use when auth code changes or when auth feels fragile, unclear, or unsafe. Covers OIDC, sessions, tokens, route protection, and secret management.

CI/CD and deployment reliability audit. Use when pipeline configs, Dockerfiles, K8s manifests, Skaffold config, or GitHub Actions workflows change. Checks build integrity, environment parity, secret hygiene, and rollback safety.

Audit and fix CLAUDE.md files using a tiered binary checklist based on official Anthropic best practices and community guidelines. Use when the user asks to "review CLAUDE.md", "audit CLAUDE.md", "score CLAUDE.md", "improve CLAUDE.md", or "fix CLAUDE.md".

Multi-agent code review by delegating to (1) codex-cli with GPT-5.5 xhigh, (2) gemini-cli with Gemini 3.1 Pro, and (3) four Claude specialist subagents (security, performance, logic, regression) spawned via the Agent tool — then synthesizing all six streams with your own diligence. Use this whenever the user asks for a deep review, second opinion, council review, multi-tool review, or wants the most thorough analysis of code changes / a PR / a commit / staged changes / a branch — even if they...

Deep audit of a Rust crate for vulnerabilities, bugs, unfinished work, inconsistencies, duplicate code, and oversights. Works on the current crate or a specified path.

This skill should be used for cross-artifact consistency reviewer -- validates alignment across SPEC.md, REQUIREMENTS.md, ROADMAP.md, and DESIGN.md. Detects unmapped ACs, orphaned requirements, missing design coverage, and phantom phase requirements.

Comprehensive pre-release review pipeline. Runs /review-health, /review-arch, /review-security, /review-perf, /review-a11y, /review-test, /review-doc, and /review-release in sequence. Thin orchestrator — each sub-skill keeps its normal interactive behavior. Auto-detects phases that do not apply and asks the user to confirm skipping them. Ends with a consolidated report.

Detect package managers and discover outdated or vulnerable dependencies. Returns structured findings without upgrading. Use when the user asks to \"review dependencies\", \"check for outdated packages\", \"check dependencies\", \"scan dependencies\", or \"dependency review\".

Use for security review of dependency updates — bumps, upgrades, or new dependencies.

Fuehrt den eigentlichen Reviewlauf ueber den Wuerfel durch — Anzahl Zellen = Spalten x Zeilen x Arbeitsblaetter. Pro Zelle: Spaltenprompt + Zeilenprompt + Arbeitsblatt-Perspektive zusammenfuehren, Antwort aus dem Dokument extrahieren mit woertlichem Zitat und Fundstelle, Ampel anhand der Spalten-Ampelregel setzen. Bei Quasi-Duplikaten Cache aus `caching-und-teil-rerun` nutzen. Bei OCR-Konfidenz unter 90 Prozent automatisch Pruefer-Flag. Pro Reviewlauf Audit-Eintrag in `audit-trail-protokoll`....

User-invoked skill to run a comprehensive pre-ship review using all review agents relevant to the project's tech stack, with rad-code-review as the final gate. Reads the stack profile and dispatches specialist agents in parallel, then runs rad-code-review for AI slop detection, architecture, security, and release readiness. Trigger when the user says "/review-for-ship", "review before shipping", "is this ready to deploy", "pre-ship review", "run all reviews", "comprehensive review", "final ch...

GitHub PR code review - fetches the diff, runs automated checks, launches 3 parallel review agents (correctness, convention compliance, efficiency) to analyze changes, validates findings against actual code, and drafts a GitHub review. Use when reviewing pull requests. Triggers on "review this PR", "review PR #123", "review github.com/owner/repo/pull/N", "check this pull request", "review changes in PR", "give feedback on this PR", "PR review", "look at this pull request".

Adversarial review of any input (human idea, agent analysis, research report, feedback, observation) BEFORE it mutates persistent project state. Universal interceptor with domain auto-detection, 2-phase classification + evaluation, and triple-verdict output (veracity / fit / actionability). Anti-girouette guardrail that distinguishes drift from pivot — preserves human decisional authority. Manual invocation only (no hooks, no enforcement). Activate when an input may affect strategic-frame.md,...

Use when planning or reviewing production database migrations, adding columns, indexes, constraints, backfills, renames, table rewrites, or concurrent operations. Covers phased rollouts, lock behavior, rollback strategy, strong_migrations compliance, and deployment ordering for schema changes.

Sets the reviewer persona for all code review, security review, and /simplify agents. Default mood: strict. Persists for the session until changed. Invoke /review-mood [mood] to switch. Invoke /review-mood to see current mood.

Run an in-house P0-P3 security review on a Sui Move package. Use when the user wants a Move security review or self-audit.

Review code changes for Effect-TS pattern compliance in the Reactive Agents framework. Use when reviewing PRs, completed packages, or any code changes to enforce project conventions.

Pre-release readiness review. Scans for debug artifacts, version mismatches, changelog gaps, git hygiene issues, breaking changes, and license compliance. Runs tests and build verification. Presents consolidated findings for human review before release.

Review an API design, endpoint set, or OpenAPI spec before implementation and return prioritized findings on design quality, security, resilience, and missing contract decisions.

Use when code changes need review before merge - validates architecture, types, security, and test coverage.

White-box security audit. Blue-teamer and lead red-teamer run in parallel isolation for an independent first pass — neither sees the other's output during reconnaissance. A synthesis step categorizes findings into four prescriptive buckets (anchoring-suppressed, convergent, blue-flagged-unverified, divergent), producing a unified target list. Focused red-teamers then deep-dive each target. Iterates when exploit chains are discovered. Heavy and thorough by design.

Use when the user wants a review of currently staged git changes before committing. Triggers on phrases like "review staged", "посмотри что я застейджил", "review before commit", "проверь изменения перед коммитом". Returns a structured findings list focused on correctness, security, and conventions — not style nitpicks.