Loading...
Loading...
Found 75 Skills
Audit and fix filename and naming conventions for consistency. Use when reviewing file names, component names, or export naming across the codebase.
Use Codex CLI for sandboxed auditing, debugging, and autonomous prototyping
Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.
This skill provides systematic bug detection and discovery capabilities for VS Code extensions. Use when searching for hidden bugs, analyzing code for potential issues, investigating suspicious behavior, performing code audits, or proactively finding bugs before they manifest. Covers static analysis patterns, dynamic analysis techniques, code smell detection, and systematic codebase investigation.
Reviews PR changes against issue technical details and acceptance criteria, posts concise outcomes to PR and issue tracker, and routes autonomous next steps.
Coordinates code modernization: OSS replacement and bundle optimization workers
Research a topic thoroughly in this repo and return a structured summary with file references. Use when you need to understand how something works, find patterns across modules, or audit implementations.
Final code review and quality gate — run tests, check coverage, audit security, verify acceptance criteria from spec, and generate ship-ready report. Use when user says "review code", "quality check", "is it ready to ship", "final review", or after /deploy completes. Do NOT use for planning (use /plan) or building (use /build).
Deep line-by-line code review that finds all bugs, logic errors, redundancies, and issues. Traces call stacks, fixes everything, verifies 100%. Use when reviewing features, PRs, code changes, or auditing for bugs.
Runs full trailmark structural analysis with all pre-analysis passes (blast radius, taint propagation, privilege boundaries, complexity hotspots). Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots.
Identifies silent failures, inadequate error handling, and inappropriate fallback behavior in code. Zero tolerance for errors that occur without proper logging and user feedback. Triggers: When reviewing error handling, checking for silent failures, analyzing catch blocks. Examples: - "Review the error handling" -> audits all error handling in recent changes - "Check for silent failures" -> hunts for swallowed errors and empty catch blocks - "Analyze catch blocks in this PR" -> reviews every try-catch for adequacy - "Are there any hidden failures?" -> finds errors that get silently ignored
Find composition and state-lifting refactor opportunities in a React codebase. Audits for boolean-prop bloat, monolith components with variant explosion, sibling clusters that should share lego-brick subcomponents, render-prop slots that can't reach outside the box, and state synced between siblings via useEffect. Use when the user wants to improve react code, audit react components, find react refactor opportunities, run a react composition review, or asks "improve react", "audit react", "react architecture review".