security-audit
Security scan for secrets, risky files, and vulnerable dependencies.
Discover Documentation skills, compare source repositories and read the instructions for each workflow.
Security scan for secrets, risky files, and vulnerable dependencies.
Tailwind CSS 4.1+ patterns. Use when styling components, responsive design, container queries, masks, shadows, or animations. (project)
Next.js 16.1+ App Router patterns. Use when working with pages, routing, caching, params, or middleware.
React 19.3+ patterns. Use for forms, async data, pre-rendering, transitions, refs, context, metadata.
Drizzle ORM patterns for Neon PostgreSQL. Use when creating tables, schemas, migrations, or database queries.
Shiki 3+ syntax highlighting. Use when highlighting code blocks, MDX content, or building code editors.
Motion v12+ animation patterns. Use when adding animations, transitions, gestures, layout animations, or accessibility-aware motion.
Modern CSS features. Use for @function, style queries, range comparisons, if(), relative colors. (project)
Zustand 5+ state management. Use when creating stores, selectors, middleware, or persisting state.
Zod 4+ validation patterns. Use when validating forms, API responses, env vars, or inferring types from schemas.
PDF-RAG API reference. REQUIRED after any failed curl/jq to localhost:8000 (404, null, jq error). Also use when uncertain about endpoint path or response shape.
Use when implementing auth in Nuxt apps with @onmax/nuxt-better-auth - provides useUserSession composable, server auth helpers, route protection, and Better Auth plugins integration.
Use when building with Reka UI (headless Vue components) - provides component API, accessibility patterns, composition (asChild), controlled/uncontrolled state, virtualization, and styling integration. Formerly...
Use when building styled UI with @nuxt/ui v4 components (Button, Modal, Form, Table, etc.) - provides ready-to-use components with Tailwind Variants theming. Use vue skill for raw component patterns, reka-ui fo...
Identify dangerous-but-tempting API patterns in React/Next.js/Supabase. Finds "footguns" - APIs that look safe but fail silently or have dangerous defaults. Inspired by Trail of Bits methodology.
WCAG 2.1 accessibility auditing for web applications. Checks color contrast, ARIA usage, keyboard navigation, form labels, and screen reader compatibility.
Audit codebase stability guardrails - tests, ESLint, pre-commit hooks, CI/CD, dead code detection with Knip. Finds unused files, exports, and dependencies. Use /codebase-stability-audit:run to start.
Verify that security fixes actually resolve the vulnerability without introducing new issues. Reviews fix commits against original findings. Inspired by Trail of Bits methodology.
Complete security audits with 120+ checks for web applications. Covers OWASP Top 10 2025, Supabase RLS bypass attacks (40+ vectors), API enumeration, Realtime channel leaks, payment security, timing attacks, an...
Performance auditing for web applications. Analyzes bundle size, React rendering, database queries, network patterns, and assets. Provides actionable recommendations with effort estimates.
MVP development toolkit using BMAD methodology. Transform ideas into working products through structured phases - product brief, technical spec, sprint planning, and iterative development. Optimized for vibe co...
Professional codebase setup for developers migrating from Lovable, Bolt, or v0. Provides feature-based architecture scaffolding, naming convention checks, and config-driven pattern migration.
Supabase-specific tools for authentication, Row Level Security, RPC generation, and migration validation. Built for developers using Supabase as their backend.
Complete market analysis toolkit using McKinsey consulting frameworks. Perform competitive research, market sizing, trend analysis, and strategic positioning. Generates actionable insights for product decisions...
The default order uses GitHub repository stars from our indexed data. Stars belong to the source repository and may be shared by multiple skills. They indicate repository interest, not skill installs or an independent quality score.