thoughtbot's rails-audit-thoughtbot skill has a coding agent review a whole Ruby on Rails application using the firm's published guidance on testing and code design. It looks at RSpec tests, security issues, models, controllers, views, database use and general Ruby style. The result is a Markdown report sorted by area, with each finding rated from Critical down to Low.
Run a multi-phase security audit with independently checked findingsCloudflare's security audit skill helps a coding agent find vulnerabilities that cross a real trust boundary and report them with source evidence, a safe way to reproduce, a priority and the smallest fix. By default it only gives guidance for focused questions; a full audit runs only when you ask for one explicitly. A full run goes through six phases: reconnaissance, hunting waves by separate agents, validation of each candidate by a fresh verifier, schema-checked findings in JSON, an independent re-check of every record, and a final report. It must either finish with validated output or record that the run is incomplete and why.Coding agentApplication securityCode audit
Static XSS audit for React, TypeScript and JavaScript codesongjianyang's xss-audit skill reviews a React, TypeScript or JavaScript codebase for cross-site scripting without changing any code. It works through 14 layers of checks, including HTML and attribute sinks, URLs, script-embedded JSON, SVG and MathML, markdown pipelines, sanitiser bypasses and Trusted Types, and follows the data path behind every risky-looking hit. Findings go into an xss-audit-report.md file, and the skill notes that static review alone cannot catch every case.Coding agentSecurityFrontend
Audit the animations in a codebaseThis skill looks over the motion and animation code in a codebase without changing it. It ranks what to improve and writes standalone plans that other agents can carry out. The plans are confirmed with you before they are written.Coding agentAnimationFrontend
Investigate and fix flaky tests from real CI logsIntercom's fix-flaky-tests skill guides a coding agent through tests that pass on one run and fail on another. It works across frameworks such as RSpec, Jest, pytest and Go, and CI systems such as Buildkite, CircleCI and GitHub Actions, loading the right patterns for each. Its rules are strict: no skipping tests, no guessed causes, no diagnosis until the real CI error and backtrace are in hand, and no local test runs. A fix counts only once CI passes. It can edit code and open pull requests, so review its changes before you merge.Coding agenttestingCI
Review pull requests using Sentry's engineering checklistSentry's code-review skill gives an agent the checklist Sentry engineers use on pull requests. It covers runtime errors, performance traps such as N+1 queries, side effects, backward compatibility and security holes, then asks whether the design fits the existing architecture and whether tests cover the real requirements. It says which kinds of change, like schema or API contract changes, should go to a senior engineer, and how to word feedback politely and usefully.Coding agentSentryCode review
Review Rust code for idiom and safety (Morgan Linton, BeautifulRust)Morgan Linton's rust-review skill, from the BeautifulRust repository, reviews existing Rust code, from a single file to a crate or pull request. It runs the usual tools first when it can, then looks at idiomatic style, public interfaces, how errors are handled, unsafe code and long-term upkeep, most important first. The report sorts findings into must fix, should fix and consider, each naming the guideline involved and a concrete fix.Coding agentRustCode review
Run a multi-phase security audit with independently checked findings
Static XSS audit for React, TypeScript and JavaScript code
Audit the animations in a codebase
Investigate and fix flaky tests from real CI logs