owasp-security-audit

Frame A/B tests with falsifiable hypothesis, variants, pre-committed primary/secondary/guardrail metrics, MDE, sample size (formula shown), duration spanning a weekly cycle, peek policy, pre-committed decision rule, validity risks with mitigations, and ethics review. Mermaid diagrams with optional PNG export.

1 skill

Write, audit, or split acceptance criteria for a user story. Given/When/Then (Gherkin) default + rule-based + mixed formats. Systematic coverage (happy path + negative + edge + boundary + a11y + optional performance/security/data/integration). INVEST at story + AC level. SPIDR split (Spike / Path / Interface / Data / Rule) when story too big. Scenario outlines for parametric data. Mermaid coverage pie + split diagrams with optional PNG export.

1 skill

Define accessibility requirements against WCAG 2.2 AA (default), AAA, EN 301 549, EAA, Section 508, ADA. Produces per-feature Given/When/Then criteria, assistive-technology support matrix per platform, combined automated + manual + AT + user-testing plan, and remediation priority for existing products. Not a conformance audit. Mermaid diagrams with optional PNG export.

1 skill

Write, review, supersede, or index Architecture Decision Records. Michael Nygard format (default) + Y-statement alternative. Immutable once accepted — supersession chain preserves old ADRs. Status lifecycle (Proposed / Accepted / Deprecated / Superseded). ADR log with chronological index + supersession chains visible. Review mode flags stale ADRs + missing consequences. Integrates with traceability-matrix. Mermaid timeline with optional PNG export.

1 skill

Bottom-up thematic clustering of unstructured items (research notes, interview quotes, brainstorm ideas, feedback) using the KJ method. Discovers emergent themes with evidence traceability, identifies patterns/tensions/gaps, flags outliers, and prioritizes clusters by signal strength. Mermaid diagrams with optional PNG export.

1 skill

Algorithm design pre-implementation: problem + inputs/outputs + constraints, ≥2 candidate approaches compared on time+space+stability+in-place+parallelism, chosen approach with loop/data/global invariants, language-neutral pseudocode, correctness argument (invariant / induction / preservation / reduction), edge-case catalog, worst/avg/space complexity, numerical + concurrency concerns, property-based + boundary + performance + fuzz tests, parallelization + out-of-core + streaming variants.

1 skill

Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses

200 skills · 98 commands · 71 agents · 1 MCP server · hooks

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

Design fluency for frontend development. 1 skill with 24 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.

1 skill · 4 agents · hooks

Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails

3 skills · 1 command · 1 agent

5 skills + 35 modes + Material Passport pipeline. Includes v3.6.7 cross-model audit gate and v3.6.8 generator-evaluator contract.

5 skills · 16 commands · 4 agents · hooks

Install the "AAS Security Engineer" editorial skill bundle for Claude Code.

12 skills