Loading...
Loading...
Found 107 Skills
Threat modeling methodologies (STRIDE, DREAD), attack trees, threat modeling as code, and integration with SDLC for proactive security design
AI-native software development lifecycle that replaces traditional SDLC. Triggers on "plan and build", "break this into tasks", "build this feature end-to-end", "sprint plan this", "absolute-human this", or any multi-step development task. Decomposes work into dependency-graphed sub-tasks, executes in parallel waves with TDD verification, and tracks progress on a persistent board. Handles features, refactors, greenfield projects, and migrations.
Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments.
Zero-config SDLC onboarding. Detects project environment, asks what the developer wants to do, and recommends skills organized by workflow phase. Activate when a user starts a new project, asks "how do I get started," or has no other SDLC skills installed.
Design composable agentic primitives for flexible workflows. Use when creating reusable workflow building blocks, designing SDLC primitives, or building agent operations that can be combined in different ways.
Orchestrates multiple skills to achieve high-level goals. Acts as the brain of the ecosystem to coordinate complex workflows across the SDLC.
Detect common Python vulnerabilities such as SQL injection, unsafe deserialization, and hardcoded secrets. Use as part of a secure SDLC for Python projects.
Bring existing tracker issues up to standard without implementing anything — applies missing SDLC labels, clarifies laconic issues (analyzing attached screenshots), posts a read-only implementation-prep analysis, and flags feature issues lacking a covering spec (optionally authoring one with --write-missing-specs). Single issue by id, or a batch (default — last ~25 open, worst-described first). Idempotent and claim-aware. Use for "triage the backlog", "clean up issue 123".
Autonomously turn a brief or FR issue into a spec landed on a ready PR — runs om-spec-writing --autonomous (defaults posted for override), attaches UI mockups and current-app screenshots as PR evidence when a browser provider exists, applies full SDLC labels, and emits PR/spec markers for chaining into om-auto-implement-spec. Use for "write a spec for X and open a PR", "spec this issue".
Review Code
Use when you already have a components map and multiple module pages, and now need to converge business modules (products <= 6), fix the entry points for operation, troubleshooting and rollback (ops), and implement DoD access control and incremental Discover (Delta Discover, stale expiration detection) to ensure the knowledge base is usable and maintainable.
Bug-to-test pipeline: reproduce the bug as a failing test first, then fix. The regression test lives forever.