Security Best Practices
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Honest Output Auditor
Use when the user asks for honesty, a hard audit, a skill audit, best work, no half-finished output, when a deliverable was rejected, or before finalizing high-stakes creative, product, code, or operational work.
Cli Creator
Build a composable CLI from API docs, an OpenAPI spec, existing curl examples, an SDK, a web app, an admin tool, or a local script. Use when the user wants an agent-friendly command-line tool that can run from any repo, expose composable read/write commands, return stable JSON, manage auth, and pair with a companion skill.
Seo Audit
Audit websites, web apps, and local dev servers for technical SEO, crawlability, indexability, metadata, structured data, sitemap and robots hygiene, content coverage, freshness, and basic performance.
Define Goal
Help the user define a concrete, measurable goal before starting work, especially when they ask to use the goal tool, create a goal, set an objective, clarify success criteria, or turn a fuzzy intention into a quantitative outcome. Use this skill for goal creation and goal refinement only; it does not manage durable snapshots, decision logs, or long-running execution artifacts.
Codex Improvement Loop
Use when a broad codebase improvement, UI/UX revamp, release hardening pass, multi-PR cleanup, or "boil the ocean" request needs decomposition, worker/reviewer coordination, PR sequencing, and visible loop state.
Changelog Generator
Create user-facing changelogs and release notes from git history by identifying meaningful changes, filtering internal noise, grouping by user impact, and preserving an evidence trail back to commits.
Security Threat Model
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security…
Security Ownership Map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks f…