Audit third-party dependencies for known security advisories in any ecosystem — reads every lockfile, uses the native audit tool where one exists and the OSV database otherwise, and files one deduplicated issue per vulnerable package with its upgrade path. For code-level security review use om-auto-sec-report. Use for "audit dependencies", "check for vulnerable packages", "security advisories".
Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.
Audit a spec before implementation — readiness gate, backward-compatibility check against BACKWARD_COMPATIBILITY.md, completeness, repo-rule compliance, risks, gaps — and leave a go/conditional/no-go report with a remediation plan. Read-only. Use for "is this spec ready", "pre-implement", "spec readiness", "BC analysis", "spec gap analysis".
Estimates the storage and memory impact of encrypting fields in collections with Queryable Encryption (QE) enabled. Do NOT use for collections that use Client-Side Field Level Encryption (CSFLE) instead of QE.
Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.
Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection with agent-browser. Use when a preview or production URL redirects to a Vercel login page, returns a protection 401 or 403, or needs short-lived Trusted Sources OIDC authentication instead of a static bypass secret or public exception.
Retune a skill corpus for a new model, measurement-first: mine the run archive for a baseline, establish a noise floor, audit the corpus adversarially, then cut in measured passes until a pre-registered bar clears. Requires a benchmark harness that can A/B two builds of the corpus; refuses without one.
83 related skills from elementalsouls/Claude-BugHunter, bundled because they share files.
78 related skills from zebbern/claude-code-guide, bundled because they share files.
Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find bloat", "what can I delete", /ponytail-audit.
Audit user-selected Markdown or text files for deterministic plain-language findings. Use only when the user explicitly invokes this skill.
Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules, and disabling dangerous commands. Use when deploying Redis to production, defining ACL users for an application, configuring TLS connections, locking down a Redis instance behind a firewall, or auditing a Redis deployment for security hardening.
Includes Agents Md, Blog Writing Guide, Brand Guidelines, Browse Local Sentry, Claude Settings Audit, Code Review, Code Simplifier, Commit, Create Branch, Django Access Review, Django Perf Review, Doc Coauthoring, Document Api Endpoint, Find Bugs, Gh Review Requests, Gha Security Review, Iterate Pr, Pr Link Issue, Pr Screenshots, Pr Writer, Presentation Creator, Prompt Optimizer, Secret Serialization, Security Model, Security Review, Skill Scanner, Skill Writer, Sred Project Organizer, Sred Work Summary, Triage Frontend Issues, Typing Exclusion Worker
Audit and fix HTML metadata including page titles, meta descriptions, canonical URLs, Open Graph tags, Twitter cards, favicons, JSON-LD structured data, and robots directives. Use when adding SEO metadata, fixing social share previews, reviewing Open Graph tags, setting up canonical URLs, or shipping new pages that need correct meta tags.
Audit and fix HTML accessibility issues including ARIA labels, keyboard navigation, focus management, color contrast, and form errors. Use when adding interactive controls, forms, dialogs, or reviewing WCAG compliance.
Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, request temporary access, or approve/deny pending PAM grants. Do NOT use for permanent IAM policy bindings, troubleshooting IAM permission errors, or general Google Cloud resource provisioning.
Audit and optimize landing pages for conversion rate. Use when the user asks about conversion rate optimization, CRO, landing page audits, improving sign-ups or sales, reducing bounce rate, A/B test ideas for pages, form optimization, or CTA optimization. Trigger phrases include "conversion rate", "CRO", "landing page audit", "why isn't my page converting", "improve conversions", "optimize my page", "reduce bounce rate", "CTA optimization", "form optimization", "above the fold".
Run a full technical and on-page SEO audit on any website or page. Use when the user says "audit my site", "SEO check", "technical SEO review", "site health", "check my SEO", "what's wrong with my site", or provides a URL and asks for SEO feedback.
Optimize signup and registration conversion funnels. Use when asked to improve signup rates, reduce form abandonment, audit registration flows, or optimize conversion funnels. Trigger phrases: "signup optimization", "registration flow", "form conversion", "signup CRO", "reduce abandonment", "signup funnel", "form optimization", "conversion rate optimization", "registration page".
Audit EVERY Google Search Console property at once — rank all sites by clicks and impressions with period-over-period deltas, then diff keywords per site to surface what is newly ranking, rising, dropping, lost, or ranking well without earning clicks. Built for agencies and multi-site owners. Use when asked to compare all sites, rank properties by traffic, find new keywords across a portfolio, or spot which site is down. Trigger phrases: "audit GSC", "all my sites", "rank my properties", "portfolio search performance", "which sites are down", "what new keywords are we ranking for", "client site performance", "GSC report across accounts". For ONE site's queries, pages, or index coverage, use the search-console skill instead.
Run a full-site SEO audit and return a scored, prioritized report. Use only for site-wide checks; use seo-page for one URL or seo-technical for a technical-only review.
Image optimization analysis for SEO and performance. Checks alt text, file sizes, formats, responsive images, lazy loading, CLS prevention, image SERP rankings (via DataForSEO), and image file optimization (WebP/AVIF conversion, IPTC/XMP metadata injection). Use when user says "image optimization", "alt text", "image SEO", "image size", "image audit", "optimize images", "image metadata", "image SERP", "convert to webp", or "image file optimize".
Evaluate page content for usefulness, E-E-A-T, readability, thinness, and AI citation readiness, plus last-mile draft cleanup (AI-typical phrasing and invisible Unicode watermark characters). Use for content-only analysis, not full-page technical checks.
Hreflang and international SEO audit, validation, and generation. Detects common mistakes, validates language/region codes, and generates correct hreflang implementations. Use when user says "hreflang", "i18n SEO", "international SEO", "multi-language", "multi-region", or "language tags".
Audit technical SEO across crawlability, indexability, security, URLs, mobile, Core Web Vitals, rendering, structured data, and IndexNow. Use when the user asks for a technical SEO audit or about crawling, indexing, rendering, or site speed. Exclude content strategy and backlinks.
