songjianyang's xss-audit skill reviews a React, TypeScript or JavaScript codebase for cross-site scripting without changing any code. It works through 14 layers of checks, including HTML and attribute sinks, URLs, script-embedded JSON, SVG and MathML, markdown pipelines, sanitiser bypasses and Trusted Types, and follows the data path behind every risky-looking hit. Findings go into an xss-audit-report.md file, and the skill notes that static review alone cannot catch every case.
Audit Firebase security rulesThis skill reviews the security rules for Firestore and Cloud Storage, looking for weak spots, red-team style. Its checklist covers privilege escalation, role bypasses, mismatched create and update logic, resource exhaustion, type checks, and size limits. Each rule set gets a score from 1 to 5.Coding agentFirebaseSecurity
Audit the animations in a codebaseThis skill looks over the motion and animation code in a codebase without changing it. It ranks what to improve and writes standalone plans that other agents can carry out. The plans are confirmed with you before they are written.Coding agentAnimationFrontend
Check GitHub Actions workflows that run AI agents for injection risksTrail of Bits' agentic-actions-auditor skill reviews GitHub Actions workflows that call AI coding agents such as Claude Code Action, Codex, Gemini CLI or GitHub's AI Inference action. It finds the steps that start an agent, traces into shared actions and called workflows, and records how each is configured. It then reports places where text an outsider controls, like an issue title, can reach the agent, along with loose sandbox settings and allowlists that accept any user. It only reads workflow files and does not run them.Coding agentSecurityCI/CD
Azure ComplianceRuns Azure compliance and security audits with azqr and checks Key Vault secret expiration.Coding agentSecurityInfra
CodeQLRuns CodeQL static analysis with interprocedural dataflow and taint tracking across major languages.Coding agentSecurityTesting
ImpeccableDesigns, critiques, and polishes interfaces through audit, clarification, distillation, and craft reviews.Coding agentDesignFrontend
