A registry of agent skills with test results.

Use this skill when performing code reviews, security audits, architecture reviews, vulnerability analysis, or evaluating code quality. Trigger on keywords: code review, review, audit, security, vulnerability, OWASP, SQL injection, XSS, architecture review, refactor suggestion, quality check, static analysis.

When the user wants a security audit, vulnerability assessment, or security hardening of their codebase. Use when the user says "security review," "security audit," "check for vulnerabilities," "is this secure," "pen test," "OWASP," "find security issues," "harden this," "check for leaks," "secrets scan," or before deploying any user-facing application. Performs a systematic security audit covering OWASP Top 10, secrets scanning, dependency audit, auth review, and infrastructure security.

Reviews code diffs and files for security vulnerabilities (OWASP Top 10), error handling, complexity, naming conventions, and performance issues. Use when the user asks to review a PR, pull request, diff, merge request, or code changes.

Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, LLM Top 10 (2025), and Agentic AI security (2026).

Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for vulnerabilities', 'pentest the code', 'OWASP check', or any variation of wanting a security assessment.

Security vulnerability expert covering OWASP Top 10 and common security issues. Use when conducting security audits or reviewing code for vulnerabilities.

Security audit skill. Use when asked to "audit security", "check for vulnerabilities", "security review", "pentest", or when evaluating code that handles auth, user input, secrets, or external data. Runs a phased scan covering OWASP Top 10 and STRIDE threat modeling.

Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.

Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".

Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.

Security vulnerability detection and remediation specialist. Use PROACTIVELY after writing code that handles user input, authentication, API endpoints, or sensitive data. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.

Auto-invoke when reviewing authentication, authorization, input handling, data exposure, or any user-facing code. Enforces OWASP top 10 awareness and security-first thinking.

Review code for bugs, security vulnerabilities, performance issues, and maintainability. Trigger with "review this code", "check this PR", "look at this diff", "is this code safe?", or when the user shares code and asks for feedback.

Performs a security-focused review of code or a diff, hunting for injection, broken authentication/authorization, insecure crypto, hardcoded secrets, unsafe deserialization, SSRF, path traversal, and missing input validation, with exploit scenarios and concrete fixes ranked by severity. Use this skill when the user asks to "do a security review", "audit this code for vulnerabilities", "is this code secure", "check for security issues before deploy", "review this auth/crypto code", or wants a sec

Security review - OWASP, auth, secrets, input validation.

Quick security pass over a change or module covering secrets, injection, auth and access checks, unsafe deserialization, dependency and config risks, with evidence. Use before merging code that handles input, auth, files or money.

Comprehensive code review covering security vulnerabilities, performance bottlenecks, best practices, and refactoring opportunities. Use when user requests code review, security audit, or performance analysis.

Security-focused code review checklist and automated scanning patterns. Use when reviewing pull requests for security issues, auditing authentication/authorization code, checking for OWASP Top 10 vulnerabilities, or validating input sanitization. Covers SQL injection prevention, XSS protection, CSRF tokens, authentication flow review, secrets detection, dependency vulnerability scanning, and secure coding patterns for Python (FastAPI) and React. Does NOT cover deployment security (use docker-bes

Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.

Conducts structured, senior-level code reviews with categorized, actionable feedback — and fixes issues before presenting output to the user. Trigger when user says "review this code", "check my PR", "look over this function", "give me feedback on this implementation", "audit this before deploy", "simplify this", or "review these changes". Covers correctness, security (OWASP 2025), performance, maintainability, DRY violations, test coverage, and technical debt. The review loop runs before output