All authors
Claude Skills by annatchijova
github.com/annatchijova90 skills1 installs136 views
- Pipeline TrustTreat the CI/CD pipeline as a privileged execution environment that runs attacker-influenceable code with production credentials — not as configuration — because a build step is arbitrary code execution holding the keys to deploy, and the pipeline sits inside your trust boundary while rarely being modeled as an attack surface. Use whenever the subject is a build/deploy system: "is our CI secure", "GitHub Actions / GitLab CI / Jenkins pipeline", "a PR can run our workflow", "secrets in the run...Votes: 0GitHub stars: 8
- Purple Team ExerciseRun an AUTHORIZED, collaborative purple-team exercise — turn each attack technique into a detection hypothesis, detonate it minimally and marked, and measure whether the blue side prevented it, detected it, or missed it entirely. Use this whenever the user wants to validate detection coverage, test whether a control or alert actually fires, close the loop between offensive testing and defensive telemetry, map findings to MITRE ATT&CK, or plan/run/write up a purple exercise. Trigger even when ...Votes: 0GitHub stars: 8
- Recovery IntegrityTreat a backup you have not proven restorable and untampered as a hope, not a recovery plan — because the backup is inside the blast radius (same domain credentials, same network, same admin), and ransomware operators delete or encrypt backups before they detonate, so "we have backups" answers a question you did not ask. Use whenever recovery or backups are the subject: "we have backups so we're fine", "ransomware recovery", "can we restore", "backup strategy", "how fast can we recover", "are...Votes: 0GitHub stars: 8
- Red Team AuditingAdversarial security auditing and red-teaming of your own systems with strict epistemic discipline. Use this skill whenever the user is red-teaming, doing a security audit, adversarial review, threat modeling, or "trying to break" their own code or system; whenever they ask you to find bugs, vulnerabilities, invariant violations, or architectural fractures; whenever they want to audit another agent's audit or check whether a finding is real; and whenever a report labels something "CONFIRMED /...Votes: 0GitHub stars: 8
- Remediation Driven ReportingWrite the report that actually gets the class fixed — survivable in a triage queue of forty, severity scored to the demonstrated impact instead of inflated, framed so that closing your instance does not close the underlying pattern, and followed through until the patch is verified against the class and not merely against your payload. Use whenever a confirmed finding goes to whoever can fix it: a vendor security team, a bug bounty program, an internal owning team, a maintainer, or several ven...Votes: 0GitHub stars: 8
- Resource Exhaustion ReviewFind the places in your own code where a small input buys a large amount of work or memory, and bound them — input-controlled loops and allocations, super-linear algorithms, catastrophic regex backtracking, decompression and expansion ratios, unbounded fan-out and retries, and missing backpressure. Use whenever writing or reviewing code that sizes anything from an untrusted value, and whenever a system falls over under load rather than under attack. Trigger on "ReDoS", "zip bomb", "billion la...Votes: 0GitHub stars: 8
- Reverse EngineeringReconstructing how an undocumented, closed, or unfamiliar system works when you do NOT have its design — a binary, a network protocol, a file or wire format, an undocumented or third-party API, a firmware image, a memory dump, an opaque database, or a model whose behavior you can only infer from inputs and outputs. Use whenever the user asks to reverse engineer, decode, decompile, disassemble, sniff, or figure out an unknown format/protocol/binary/API; infer an undocumented schema or wire for...Votes: 0GitHub stars: 8
- Root Of Trust ReasoningReason about integrity you cannot verify from inside the thing you are verifying — a compromise below your vantage point is invisible because it controls what you see, so a bootkit that owns UEFI or SPI flash shows a spotless OS to every OS-level scanner, and trust must be anchored to a root below the layer that could lie. Use whenever integrity, boot, or attestation is the question: "is this machine clean", "detect a bootkit / rootkit / UEFI implant", "Secure Boot", "measured boot", "TPM att...Votes: 0GitHub stars: 8
- Secret Lifecycle DisciplineTreat credentials as a lifecycle — issued, scoped, distributed, used, rotated, revoked — with redaction enforced at the boundary and rotation rehearsed before it is needed. Use whenever a secret is created, read, passed, logged, printed, committed, or exposed: API keys, tokens, passwords, private keys, connection strings, webhook signing secrets, service accounts. Trigger on "store this API key", "put it in the env", "we committed a secret", "rotate the credentials", ".env", "vault", "the tok...Votes: 0GitHub stars: 8
- Secure By ConstructionDeliberate, security-first software construction that assumes a hostile user rather than an ideal one. Use this skill whenever code is being designed, written, extended, refactored, or reviewed before merge — features, endpoints, APIs, parsers, auth, file/DB/network/subprocess handling, schemas, architecture decisions — and whenever tests are being written, fixed, or reported. Threat model before file layout, trust boundaries before modules, fail closed by default, contract before diff, and t...Votes: 0GitHub stars: 8
- Social Engineering PlausibilityReason about attacks that exploit human trust rather than a software flaw — where the target made a locally reasonable decision on deliberately crafted context, and no patch fixes it because the "vulnerability" is a person doing their job. Use whenever the vector is a human: "was this phishing", "how did they fall for it", "analyze this pretext", "why did the user click / wire the money / reset the password", "is this email a scam", "vishing / smishing / BEC", "social engineering assessment",...Votes: 0GitHub stars: 8
- Software ArchaeologyDisciplined modification of existing, legacy, inherited, or unfamiliar code — change without breakage, deletion without regret. Use this skill whenever the user asks to modify, refactor, clean up, simplify, modernize, migrate, or delete existing code; fix a bug in code they (or you) did not write; upgrade a dependency or framework; remove "dead" code, "unnecessary" checks, or "old" workarounds; understand why a strange piece of code exists; or work inside any codebase that predates the curren...Votes: 0GitHub stars: 8
- Sql Aggregation Not MaterializationPush counting, summing, and grouping into the database instead of loading rows to tally them in application code; replace per-item queries inside loops with one batched query; and cap any result set that can grow without bound. Use this whenever code reads from a database to compute a statistic, whenever a loop issues one query per element (the N+1 pattern), whenever an endpoint returns "all" of something, and whenever a function that runs on a hot path (every request, every tick, every recal...Votes: 0GitHub stars: 8
- Surgical PatcherApply changes to existing source files by anchored, verified, reversible patches instead of rewriting whole files. Use this whenever you are about to edit, refactor, or modify an existing file programmatically; when applying a patch, diff, or change set proposed by an auditor or another model; when doing find-and-replace across a repo; or any time you would otherwise overwrite a file from memory or from a snapshot. This is especially important in AI-assisted coding, where the single largest s...Votes: 0GitHub stars: 8
- Tamper Evident Audit ChainBuild and verify append-only logs that prove no entry was altered, inserted, reordered, or dropped after the fact — a hash chain where each entry seals the previous one. Use this whenever you build or review an audit trail, ledger, chain of custody, provenance record, or any append-only log that could later be challenged; whenever you need to detect tampering rather than just record events; and whenever someone says "audit log", "tamper-evident", "tamper-proof", "hash chain", "ledger", "prove...Votes: 0GitHub stars: 8
- Threat Attribution RestraintResist the pull to name an actor — attribution is the most overinterpreted act in security, and every signal that points at APT-X (shared hash, reused C2, a Cyrillic string, a compile timezone) is evidence of contact between datasets, not identity of hands, and most of it is cheap to plant. Use whenever an investigation starts reaching for a name: "this looks like APT29 / Lazarus / a Russian group", "same actor as last time", "the TTPs match", "shared infrastructure", "attribute this campaign...Votes: 0GitHub stars: 8
- Traffic As EvidenceRead network traffic as evidence to be interpreted under two hard limits — you usually cannot see the payload (encryption) and rare is usually benign (base rates) — never as a verdict on its own; beaconing, JA3/JA4 fingerprints, timing, volume, and destination reputation are weak signals whose meaning lives in baseline and context. Use whenever a network observation is being read for intent: "this host is beaconing", "periodic connection to an unknown IP", "is this C2", "the JA3 matches a mal...Votes: 0GitHub stars: 8
- Training Run ProvenanceGet determinism in machine learning where it is actually achievable — the artifact, not the process — by pinning data version, materialized split, code, resolved config, environment and hardware into a sealed manifest, naming the irreducibly nondeterministic parts instead of pretending they are absent, and labeling the reproducibility claim at the level the evidence supports. Use whenever a model is trained, compared, registered, or deployed, whenever two runs disagree, and whenever a result ...Votes: 0GitHub stars: 8
- Training Serving ParityHunt the gap between the features a model was trained on and the features it is actually served — two implementations of one computation, a value that is complete offline and partial online, preprocessing shipped separately from the model, and the silent default that fills in a failed feature so the model answers confidently on a vector it never saw. Use whenever a model is deployed, whenever a feature pipeline exists in more than one place, and whenever offline and online results disagree. T...Votes: 0GitHub stars: 8
- Untrusted Sample HandlingExamine a hostile artifact as what it is — a live adversary you invited onto your desk — with two invariants: never let it execute where it can reach anything real, and never confuse what it CAN do (capability) with what it DID or was aimed at (intent). Use whenever a suspicious binary, script, document, archive, APK, container image, or captured payload is in hand and someone wants to know what it is: "analyze this malware", "is this file malicious", "what does this sample do", "detonate thi...Votes: 0GitHub stars: 8
- Validate At The BoundaryValidate untrusted inputs at the edge of the system — with a clear error raised at the boundary — instead of letting bad shape, bad dtype, non-finite values, or hostile paths explode deep inside a library or propagate as silent corruption. Use this whenever code ingests data from outside its own control — deserialized tensors/arrays, file paths from a caller, parsed JSON, anything fed to numpy/pandas/a parser, anything that becomes a filesystem operation. Triggers — an opaque numpy broadcast ...Votes: 0GitHub stars: 8
- Variant AnalysisTurn one disclosed or found bug into a family: extract the violated invariant, hunt the same class across shared deps and sibling sinks, and check dedupe/fix-coverage before filing.Votes: 0GitHub stars: 8
- Versioned Schema EvolutionStamp every serialized artifact with a schema version and evolve the format over time without breaking data that was already persisted — detect the version on load, migrate old shapes forward, and keep readers for old versions working. Use this whenever you design or change a serialization format (JSON, SQLite rows, pickle, .npy), whenever you load data that an older version of the code may have written, whenever you add or remove a field from something already on disk, and whenever a "load" ...Votes: 0GitHub stars: 8
- Zero Trust As A ClaimTreat "zero trust" as a per-request property to be verified, not a product you bought or a network you segmented — the honest question is always "trusted to do what, verified how, on every request", and the failure is the implicit trust that survives the architecture diagram: a flat network behind the VPN, a service mesh that authenticates identity but never authorizes the action, an internal API that trusts any caller who reached it. Use whenever "zero trust" is claimed, designed, or bought:...Votes: 0GitHub stars: 8
- Cloud Architecture SelectionDerive cloud infrastructure from a workload's actual constraints and required capabilities — never from "X is popular" or from whichever provider is already open in a tab. Use whenever choosing or re-evaluating a cloud provider, a managed service, or a deployment architecture; whenever comparing AWS/GCP/Alibaba/Azure/other for a workload; or whenever a choice is being justified by brand familiarity, a tutorial's default, or sunk cost instead of a stated requirement. Trigger on "which cloud sh...Votes: 0GitHub stars: 8
- Debt Closure DisciplinePriority determines resolution order, not permission to accumulate indefinitely — every known issue (bug, inconsistency, TODO, workaround, deferred P3) must terminate in resolved, explicitly rejected with a reason, or documented as an open unresolved constraint, never silently vanish by being written down. Use whenever triaging bugs/findings/technical debt, prioritizing a backlog, closing a task under time pressure, or reviewing whether a TODO/workaround/deferred item has actually been addres...Votes: 0GitHub stars: 8
- Destination Driven ConstructionBuild toward a chosen, ambitious final product in coherent levels — each one architecturally compatible with the destination, useful standalone, and carrying the invariants (security, persistence, authority boundaries) it will need later, never bolted on afterward. Use whenever planning or building a project meant to be kept, used, or maintained — including a hackathon project. Trigger on "let's scope this as an MVP", "build a quick prototype first", "we'll add security/tests/proper persisten...Votes: 0GitHub stars: 8
- Distributed Write AtomicityDesign the intermediate state, redelivery, and deduplication explicitly whenever two effects cannot share one transaction — a DB write plus an event/webhook/second-service call, a payment plus a notification, a state change plus a cache invalidation. Use whenever an operation must affect two systems that don't share a transactional authority. Trigger on "dual write", "outbox pattern", "idempotency key", "exactly-once", "duplicate event", "webhook delivery", "the payment charged twice", "publi...Votes: 0GitHub stars: 8
- Frontend Accessibility By ConstructionBuild interactive frontend components — forms, modals, navigation, custom widgets — so they are operable and perceivable by construction, not patched afterward with ARIA. Use whenever writing or reviewing a component with keyboard interaction, focus behavior, or non-text content. Trigger on "accessible", "a11y", "keyboard nav", "screen reader", "focus trap", "aria-*", "custom dropdown/modal/tabs", "tap target", or a component built from a bare `<div>`/`<span>` instead of a native interactive ...Votes: 0GitHub stars: 8
- Frontend Component BoundariesDecide where to cut a frontend component's boundary by cohesion, behavior, semantics, reuse, and shared reasons to change — not by a mechanical "one responsibility per component" rule that produces ceremonial fragmentation. Use whenever creating a new component, splitting or merging existing ones, or reviewing a PR that adds/removes component files. Trigger on "should this be its own component", "this component is doing too much", "prop drilling", "too many props", "extract a component", "whe...Votes: 0GitHub stars: 8
- Frontend Performance BudgetsSet and enforce explicit performance budgets before writing frontend code, not measure after the fact — outcome metrics (LCP/INP/CLS) and the causal resource budgets that actually produce them (JS shipped, image weight, font loading, third-party scripts, critical request count, hydration cost). Use whenever adding a dependency, image, route, or client component, or when a page "feels slow" and the cause isn't obvious. Trigger on "bundle size", "Core Web Vitals", "hydration", "third-party scri...Votes: 0GitHub stars: 8
- Frontend Testing StrategyAllocate frontend test effort by the Testing Trophy (static > unit > integration > E2E) and write tests that assert on what the user perceives, using stable selectors, instead of internal implementation. Use whenever writing or reviewing UI tests, deciding what layer to test something at, or diagnosing flaky tests. Trigger on "how should I test this component", "flaky test", "testing implementation details", "what should be an E2E test", "selector broke when I refactored", "test pyramid". Not...Votes: 0GitHub stars: 8
- Honest Technical OratoryPresent a technical project out loud, under a real time limit, to an audience that may not share your vocabulary or technical background — without hyping unearned claims, without opening on caveats, and without inventing an answer live rather than saying "I don't know." Use whenever preparing or delivering a pitch, demo, talk, or hackathon presentation; whenever deciding what goes on a slide versus what stays for Q&A; or whenever a draft pitch either overclaims or buries its own value under l...Votes: 0GitHub stars: 8
- Live Contract CompatibilityChange a request/response shape, RPC contract, or message schema so that vN and vN+1 producers/consumers keep working while both are simultaneously alive — not just so a future reader can parse an old artifact. Use whenever changing a field, endpoint, protobuf message, or GraphQL type during or across a rolling deploy, or when clients (especially ones you cannot force to update, like a mobile app) may run an old contract indefinitely. Trigger on "breaking change", "rolling deploy", "mixed ver...Votes: 0GitHub stars: 8
- Non Overwhelming UxDesign and review user flows, forms, dashboards, and onboarding for cognitive, sensory, and choice load — grounded in WCAG 2.2 cognitive-accessibility criteria and W3C COGA guidance, and applicable to every user, not only neurodivergent ones, because reduced cognitive load helps anyone under stress, time pressure, or divided attention. Use whenever designing or reviewing a flow with multiple steps, simultaneous choices, interruptions, or time pressure. Trigger on "too many options", "overwhel...Votes: 0GitHub stars: 8
- Resilient Ui StatesDesign every view that fetches or mutates data around its full state machine — loading, success, empty, and error are all mandatory, none optional — with error handling that fails at the right boundary and produces a specific, actionable message. Use whenever building or reviewing a component that does async data fetching, mutation, or submission. Trigger on "loading state", "error state", "empty state", "skeleton", "error boundary", "form validation", "what happens if this fails", "spinner f...Votes: 0GitHub stars: 8
- Writing Agents MdWrite an AGENTS.md (or CLAUDE.md) that actually changes agent behavior — falsifiable, enforced invariants grounded in this repo's real incidents, not a generic checklist any repo could have. Use whenever creating or reviewing a repo's agent-facing contract file, whenever an agent keeps making the same mistake a doc was supposed to prevent, or whenever a repo has none and one is being requested. Trigger on "write an AGENTS.md", "add agent instructions", "this repo needs a CLAUDE.md", "the agen...Votes: 0GitHub stars: 8
- Language SelectionSelect programming languages, DSLs, query languages, policy languages, proof systems, or runtimes from the concrete forces of the problem rather than from model familiarity or the human's prior exposure. Use whenever new code must be written and the language is not already fixed: scripts, tools, services, parsers, deterministic cores, security components, smart contracts, queries, data pipelines, scientific code, infrastructure, embedded software, kernels, CLIs, prototypes, or agent-generated...Votes: 0GitHub stars: 8
- Known Defect DispositionSeverity controls response urgency; it does not authorize neglect. A P0/P1 earns immediate review — but P2/P3/P4 remain known defects requiring disposition, not a silent backlog, and before anything is deferred its severity must be re-tested under interaction, composition, adversarial control, and deployment context, because initial severity usually scores the finding in isolation while the real exposure is reachable only in combination. Use whenever a finding, bug, or audit result is being t...Votes: 0GitHub stars: 8
- Readme ArchitectureOrder a complex technical project's presentation (a README, a hackathon submission, a project landing doc) by the reader's cognitive dependency, not by architectural importance — problem before mechanism, observable behavior before internals, evidence before technical depth. Use whenever writing or reviewing a README, a hackathon README/pitch doc, or any human-facing document that introduces a technically deep system. Trigger on "write a README", "review this README", "hackathon submission", ...Votes: 0GitHub stars: 8