All authors
Claude Skills by youlianvr
github.com/youlianvr269 skills0 installs0 views
- ChallengePre-mortem plan analysis. Imagine the plan failed 12 months from now and work backwards to find the weaknesses. Surfaces assumptions, dependencies, and execution risks before committing resources. Use when before significant resource commitment, before presenting to a board or investors, when feedback has been one-sidedly positive, or when there is pressure to move fast and figure it out later.Votes: 0GitHub stars: 15
- Human ReviewPresent rendered HTML, Markdown, or a task-relevant local application view in the supported workspace Preview route for owner inspection. Use when seeing the rendered appearance or interaction materially helps review a user-facing artifact or UI; feedback and decisions remain in conversation or ask_questions.Votes: 0GitHub stars: 15
- Relevance ScanTargeted prior-art and workspace-context lookup when an answer, decision, artifact or skill may already exist. Use for explicit "what already exists?" questions and before creating reusable workspace guidance, a skill or script; locate the owning source, check its scope and currentness, and avoid broad scans when the task has a clear direct route. Check `skills/` for unclear skill discovery.Votes: 0GitHub stars: 15
- RoastUse when someone asks to roast an idea, pressure-test or stress-test an idea, validate a business idea, "convene the panel", get a brutal second opinion before building something, or says "/roast". Spins up a 5-angle panel (Critic, Champion, Analyst, Investigator, Customer) that attacks the idea from every angle, then a Judge returns one GO / RESHAPE / KILL verdict with the cheapest test to de-risk it.Votes: 0GitHub stars: 15
- Self LearningCapture a hard-won golden path from a completed task into a reusable procedure or workspace memory. Use when preserving non-obvious operational workflows, debugging lessons, or recurring environment procedures that meet intake criteria.Votes: 0GitHub stars: 15
- Self ReflectionPost-task reflection: extract proven lessons, record failure patterns and root causes, evaluate whether changes represent genuine utility or unnecessary complexity, and route findings to memory or existing skill updates.Votes: 0GitHub stars: 15
- Think Like HumanThink and talk like a human, not a calculator. Ask "why is this needed", see the meaning and benefits, suggest what to turn a thing into, invent features with human logic, remove excess, don't show off, don't lie. Triggers: "think like a human", "you're a human", "like a human", "why do I need this", "what's the point", "what can we turn it into", "what features", "what would you do as a human".Votes: 0GitHub stars: 15
- VerifyExercise the real app, API, CLI, or document artifact and collect observable evidence; unit tests alone do not count as end-to-end verification. Includes structural and delivery hygiene checks before handoff.Votes: 0GitHub stars: 15
- SecurityAuthorized offensive and defensive security assessments, one router over per-surface playbooks: API, cloud/K8s, code audit & SAST review, database, digital forensics, EDR bypass, email, firmware, LLM/AI, malware analysis, OT/ICS, patch-diff exploitation, pwn and attack chains, supply chain, threat hunting, Windows AD, Wi-Fi, SDR radio, thick clients, hardware — plus pentest-tools. Use when the task is an authorized security assessment or code vulnerability review.Votes: 0GitHub stars: 15
- Api SecurityUse for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.Votes: 0GitHub stars: 15
- Attack ChainUse for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.Votes: 0GitHub stars: 15
- Cloud K8sUse for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.Votes: 0GitHub stars: 15
- Code AuditUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.Votes: 0GitHub stars: 15
- Database SecurityUse for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.Votes: 0GitHub stars: 15
- Digital ForensicsUse for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.Votes: 0GitHub stars: 15
- Edr Bypass ReReverse engineer defense implementations to red team targeted bypass. First reverse EDR / Defender / AV hook tables, ETW providers, AMSI implementations, then write targeted unhook / indirect syscall / ETW patch / call stack spoof. Maps to MITRE ATT&CK T1562 Defense Evasion. Trigger keywords: EDR bypass, AV bypass, unhook, direct syscall, indirect syscall, Hell's Gate, Halo's Gate, Tartarus Gate, ETW patch, AMSI patch, call stack spoofing, hardware breakpoint Blindside, MITRE T1562, ntdll unh...Votes: 0GitHub stars: 15
- Email SecurityUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.Votes: 0GitHub stars: 15
- Firmware PentestFirmware / IoT penetration chain. From getting a .bin / .img blob to completing the full loop: reverse engineering -> extraction -> emulation -> exploitation. Methodology follows OWASP FSTM nine phases; toolchain centers on binwalk v3, unblob, EMBA, Firmadyne, AFL++. Applicable scenarios: router/camera/smart-home firmware audit, firmware upgrade package reversing, IoT CVE reproduction, embedded 0day discovery. Trigger keywords: firmware, IoT, binwalk, unblob, UART, JTAG, squashfs, UBI, JFFS2,...Votes: 0GitHub stars: 15
- Hardware SecurityUse for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.Votes: 0GitHub stars: 15
- Identity FederationUse for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.Votes: 0GitHub stars: 15
- Llm SecurityUse for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.Votes: 0GitHub stars: 15
- Malware AnalysisUse when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.Votes: 0GitHub stars: 15
- Ot IcsUse for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.Votes: 0GitHub stars: 15
- Patch Diff ExploitN-day patch diff to exploit. Reverse-engineer vulnerability points from vendor-published patches, write PoC, create usable attack modules. Applicable scenarios: known CVE number but only patch no PoC, SRC/red team needs to strike assets not updated in time, N-day weaponization, Patch Tuesday tracking. Core method: get before/after binaries → align symbols → binary diff → look at new security checks to reverse-engineer bug class → write PoC to trigger vulnerability. Trigger keywords: N-day, Nd...Votes: 0GitHub stars: 15
- Pentest ToolsActive penetration testing toolchain. Covers reconnaissance, port scanning, vulnerability scanning, web pentest, SQL injection, directory brute-force, password cracking. Exposes 20+ security tools to the AI agent via MCP server (pentestMCP / mcp-security-hub). Trigger keywords: pentest, port scan, Nmap, vuln scan, Nuclei, SQL injection, SQLMap, directory brute, FFUF, password crack, Hashcat, recon, subdomain, web pentest, ZAP, Burp.Votes: 0GitHub stars: 15
- Pwn ChainFull-chain engineering methodology from reverse engineering to working exploit. Applicable scenarios: got binary + vulnerability point + target environment, need to write a stably working exploit (not just a script that only reproduces locally and crashes remotely). Covers three directions: stack overflow / heap exploitation / kernel pwn. Emphasizes the engineering gap between "CTF local pass to real remote stable exploit": libc version mismatch, heap spray timing, SMEP/SMAP/KASLR, stack alig...Votes: 0GitHub stars: 15
- Radio SdrUse for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.Votes: 0GitHub stars: 15
- Security Best PracticesPerform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.Votes: 0GitHub stars: 15
- Security Ownership MapAnalyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists o...Votes: 0GitHub stars: 15
- Security Threat ModelRepository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.Votes: 0GitHub stars: 15
- Supply Chain SecurityUse for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.Votes: 0GitHub stars: 15
- Thick ClientUse for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.Votes: 0GitHub stars: 15
- Threat HuntingUse for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.Votes: 0GitHub stars: 15
- Wifi WirelessUse for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.Votes: 0GitHub stars: 15
- Windows AdUse for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.Votes: 0GitHub stars: 15
- ShipDelivering changes safely: release preparation, dependency audits and scoped updates, secrets hygiene, changelog generation, Git conventions and worktrees, GitHub Actions, PR comment handling and CI repair, Cloudflare and Vercel deploys, technical-change and technical-debt tracking, operational runbooks. One contract; parts under parts/.Votes: 0GitHub stars: 15
- Changelog GeneratorProduce consistent, auditable release notes from Conventional Commits. Separates commit parsing, semantic-bump logic, and changelog rendering for automated releases with editorial control. Use when cutting a release, generating CHANGELOG.md from git history, computing the next semantic version from commits, automating release notes in CI, or planning a hotfix/rollback. Examples: 'generate the changelog for v1.4.0', 'what version bump do these commits require', 'we need an emergency hotfix pro...Votes: 0GitHub stars: 15
- Cloudflare DeployDeploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare.Votes: 0GitHub stars: 15
- Dependency AuditorAudit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19'.Votes: 0GitHub stars: 15
- Dependency UpdateRead release notes/changelogs, update a defined dependency scope, handle breaking changes, and verify. Explicit-only; no broad update-everything by inference.Votes: 0GitHub stars: 15
- Env Secrets ManagerManage environment-variable hygiene and secrets safety across local development and production. Practical auditing, drift awareness, rotation readiness. Use when auditing .env files for committed secrets, planning a credential rotation, debugging missing-env-var production incidents, or hardening a new project against secrets leakage.Votes: 0GitHub stars: 15
- Gh Address CommentsHelp address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in.Votes: 0GitHub stars: 15
- Gh Fix CiUse when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use `gh` to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL.Votes: 0GitHub stars: 15
- Git Worktree ManagerRun parallel feature work safely with Git worktrees. Standardizes branch isolation, port allocation, environment sync, and cleanup so each worktree behaves like an independent local app. Optimized for multi-agent workflows where each agent or terminal session owns one worktree. Use when running multiple feature branches simultaneously, isolating experimental work, or coordinating multi-agent development across the same repo.Votes: 0GitHub stars: 15
- GitStandardized Git operations: conventional commits, branch naming, workflow rules. Create commits with auto-detected type/scope, manage branches, run workflow operations. Use when committing changes, managing branches, or any git workflow task.Votes: 0GitHub stars: 15
- ReleasePrepare a named version: preflight, version consistency, build/package, smoke test, checksums and notes, and release readiness. Covers both our own projects (subtree publication) and external packages. Publishing, tagging and deploying need separate authorization. Explicit-only.Votes: 0GitHub stars: 15
- Runbook GeneratorGenerate operational runbooks from a service name — deployment, incident response, maintenance, and rollback workflows. Templated structure customizable per environment. Use when documenting on-call procedures for a new service, standardizing incident response across teams, or producing runbooks before launching to production.Votes: 0GitHub stars: 15
- Tc TrackerTrack a technical change as a Memora node: what changed, why, how it was tested, and where the work stands so a later session can resume. Use when the owner asks to track a change, keep an audit trail, hand work off, or produce release notes beyond commit subjects.Votes: 0GitHub stars: 15
- Tech Debt TrackerScan a codebase for technical debt, score and prioritize it, and keep the backlog as Memora nodes with dated snapshots. Use when the owner mentions tech debt, code quality, refactoring priority, cleanup sprints, code health or modernization planning.Votes: 0GitHub stars: 15
- Vercel DeployDeploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".Votes: 0GitHub stars: 15