Claude Skills by OutlineDriven

Use when a scheduled or watcher tick fires and a lightweight pulse must capture current external state. Not for remote, credential, publish, deploy, or irreversible changes.

Use when a proven watch pattern should become a reusable harness artifact with configurable inputs. Not for remote, credential, publish, deploy, or irreversible changes.

Use when work decomposes across subagents or phases: audits, migrations, research sweeps, or scale one context cannot hold. Not for remote, credential, publish, deploy, or irreversible changes.

Use when asked to analyze a Burp Suite .burp project for audit items, request/response metadata, or captured traffic. Modes: parsed (default) and stream. Not for source or remote-system changes.

Use when an Algorand, Cairo, Cosmos SDK, Solana, Substrate, or TON codebase needs vulnerability scanning with reachability-backed findings. Not for non-chain review: use security-review.

Use when reviewing cryptographic code for timing side-channels, statically in compiled output or at runtime with statistical timing tests. Not for known-answer vectors: use wycheproof.

Use when asked for a sequence diagram of cryptographic protocol semantics from code, prose, RFCs, papers, ProVerif, or Tamarin, or for code/spec divergence. Not for architecture: use diagramming-code.

Use when a crypto Mermaid sequenceDiagram needs a ProVerif model for secrecy, authentication, replay, or forward-secrecy checks. Not for remote, credential, publish, deploy, or irreversible changes.

Use when asked to implement, debug, validate, or explain an OAuth 2.1 flow: auth code with PKCE, client credentials, device, or refresh. Also for a failing token exchange. Not for irreversible work.

Use when graph-backed security analysis is needed: project SARIF or reviewer findings onto a program graph; build or query a multi-language graph; summarize Trailmark structure; map smart-contract entry points; compare two refs or snapshots; or hunt confirmed vulnerability variants with pattern or graph seeding. Select findings, build-program-graph, trailmark-structural, entry-point-analyzer, graph-evolution, or variant-hunt mode and supply its required inputs. Not for security-finding triage...

Use when a named security allegation needs a true-positive or false-positive verdict. Not for discovering bugs: use security-review. Not for adding controls: use security-hardening.

Use when a vulnerability or pattern and target language need a new Semgrep rule, or an existing rule needs porting to another language. Not for running scans: use semgrep-security-scan.

Use when a smart-contract project must become review-ready before an audit. Not for workflow: use smart-contract-secure-workflow. Not for guidelines: use smart-contract-guidelines-advisor.

Use when a smart-contract project needs architecture, testing, or a maturity scorecard. Use `guidelines` or `maturity` mode. Not for audits: use smart-contract-audit-prep.

Use when a smart-contract team invokes this before check-in or deployment. Not for audit prep: use smart-contract-audit-prep. Not for guidelines: use smart-contract-guidelines-advisor.

Use when a token implementation or integration needs standards, privilege, nonstandard-behavior, and defensive-integration analysis. Not for source or remote-system changes.

Use when exactly one concrete security finding with a source anchor needs a verdict before PoC work. Not for projecting batches of findings onto a graph: use project-findings-onto-graph.

Use when crypto implementations and a vector harness need mutation-driven cross-implementation test vector expansion. Not for Wycheproof: use wycheproof. Not for fuzzing: use fuzz-harness-writing.

Use when a vulnerability report, CVE, bug-bounty submission, or automated finding needs triage before deep verification. Don''t use for tasks that require source or remote-system changes.

Use when validating crypto against Project Wycheproof vectors, or explaining a disagreement with a vector. Not for vector creation: use vector-forge. Not for zeroization: use zeroize-audit.

Use when writing, reviewing, optimizing, validating, or migrating YARA or YARA-X malware-detection rules, including CRX or DEX rules. Not for network IDS or memory-forensics rules.

Use when auditing C, C++, or Rust secret-handling code to verify zeroization survives compiler optimization. Not for test vectors: use wycheproof.

Use when asked to audit or repair agent surfaces (plugins, agents, skills, CLAUDE.md/AGENTS.md, docs, prompts, commands, hooks) or improve one skill at depth. Not for agent grading: use skill-doctor.

Use when asked to create or refresh a personal mode skill and open a reviewable PR. Not for shared repo skills or work that skips human approval.

Use when the user names one book, course, paper, or source document and asks to distill it into a reusable skill. Not for a folder of sources: use map-corpus.

Use when prompt-doctrine is duplicated, drifted, or conflicting across output-style embeds and external harness AGENTS files. Not for editing the canonical baseline itself.

Use when asked to create a local agent-plugin directory tree or marketplace package. Not for remote, credential, publish, deploy, or irreversible changes.

Use when asked to deduplicate a skill tree, fold overlapping skills, or cut the skill count: analyze, gate per family, then fold. Not for prompt-doctrine cascades: use cascade-dedup.

Use when asked to generate a personal taste skill from local evidence. Not for applying an existing taste register: use the user-private spine skill.

Use when the user wants to compile taste and "this feels wrong" signals into machine-consumable tokens, rules, forbidden combinations, and examples. Not for remote or irreversible changes.

Use when changing the wording of a rule in a skill, prompt template, or agent instruction where the change is meant to alter model output.

Use when a human invokes the release gate to prove every ODIN plugin shares one canonical version. Not for editing release metadata or remote, credential, publish, deploy, or irreversible changes.

Use when a user requests an independent Codex or Gemini review of uncommitted code, a branch diff, or a specific commit. Don''t use for unconfirmed or unattended review sends, or source mutation.

Use when asked to run /model-retuning to retune a skill corpus for a new model, measurement-first. Not for static audits: use deslop.

Use when asked to improve, optimize, rewrite, tune, or port a prompt, skill, or tool description. Also for building prompt evals or auditing prompt text for dated instructions.

Use when asked to review a plugin for marketplace readiness via a read-only audit of published quality gates. Not for reviewing a PR or code diff: use review.

Use when the user runs /skill-benchmark to score skills, compare models, or gate a skill release. Modes: score (default) and gate. Not for editing skills: use agent-surface-forge.

Use when a user asks to scan, audit, or validate a skill for security issues. Not for source-code or infrastructure review: use security-review. Not for remote-system changes.

Use when a publisher wants a discoverable, integrity-protected agent-skill catalog served from a domain they control. Not for remote mutation or deployment. The publisher deploys.

Use when the user asks to discover, generate, refresh, or validate skills from the Trail of Bits Testing Handbook or appsec.guide. Not for tasks that require source or remote-system changes.

Use when authoring or restructuring an agent-consumed document, a SKILL.md or skill directory, writing skills, or deciding a skill split-or-monolith disclosure question. Not for prose style: use unslop.

Use when asked to validate a web app, CLI, API, or generated artifact against a source-blind behavior contract. Not for source or remote-system changes.

Use when the user runs /browser-qa for report-only QA results without entering a fix loop. Not for remote, credential, publish, deploy, or irreversible changes.

Use when asked to reproduce, profile, or verify CLI/TUI behavior. Produces a deterministic transcript or profile proof with session cleanup. Not for CLI design advice, use cli-for-agents.

Use when asked to verify or reproduce browser or Electron UI behavior with before-and-after evidence and no leftover processes. Not for remote, credential, publish, deploy, or irreversible changes.

Use when reviewing an evaluation, benchmark, or scoring harness for leakage, or a validation result that looks self-confirming. Modes: leakage, self-audit. Not for one claim: use verify-both-ways.

Use when asked to prove coverage, find missing cases, or enumerate state, decision, requirement, or behavior space. Not for round-based or single-property tests: use askme, property-test-authoring.

Use when a complete product needs production-like acceptance evidence against documented acceptance criteria. Not for single-component evaluation or evaluation without documented criteria.

Use when verification is looping, would re-run untouched code, or duplicates an established proof. Not for tasks that require source or remote-system changes.

Use when a test surface needs behavior-guarding coverage raised to a configured target with mutation kill evidence. Not for line-coverage inflation without mutation proof.