memnos

Production-grade engineering skills, sub-agents and commands (upstream: addyosmani/agent-skills, MIT; pinned, not copied)

25 skills · 4 agents

25-skill pentest pack: ROE/authorization + scope gate first, then header/TLS/CORS/secret/dependency/code scans, OWASP Top 10 mapping and exec-readable reporting (upstream: jeremylongshore/claude-code-plugins-plus-skills, MIT; pinned, not copied)

26 skills · 2 commands

C4-model architecture documentation agents (context/container/component/code) (upstream: wshobson/agents, MIT; pinned, not copied)

1 command · 4 agents

Multi-perspective code, architecture and security review agents (upstream: wshobson/agents, MIT; pinned, not copied)

2 commands · 3 agents

Security-focused review of diffs and PRs (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

1 skill · 1 command · 1 agent

Auto recall + save, MCP tools and /memnos for your self-hosted memnos server (embedded Postgres by default).

1 command · 1 MCP server · hooks

Semgrep/CodeQL-driven static analysis (needs semgrep installed) (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

3 skills

Opt-in QA skills for frontend, backend and REST APIs (Tommy-authored).

3 skills

Build deep code context before auditing (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

1 skill · 1 agent

Spot error-prone APIs, dangerous defaults and footguns (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

1 skill · 1 agent

Tommy orchestrator with memnos memory on by default. Skill bundles are opt-in.

1 MCP server · hooks

Opt-in HLD and LLD design reviewers (Tommy-authored).

2 skills

Opt-in penetration-testing pack: ROE/authorization gate runs first, then header/TLS/CORS/dependency/code scans, OWASP-mapped reporting, and two Tommy-authored skills for the gaps passive scans can't see: internal live-Kubernetes-cluster testing, and dynamic active-exploitation testing via the self-hosted Strix CLI (working PoCs, not just flagged patterns). Not included in tommy-all.

2 skills

Audit GitHub Actions that run AI agents (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

1 skill

Audit npm/PyPI/Go dependencies for supply-chain risk (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

1 skill

Opt-in explainer skill: plain English with a real-world scenario (Tommy-authored).

1 skill

Find other instances of a bug across the codebase (upstream: trailofbits/skills, CC-BY-SA-4.0; pinned, not copied)

1 skill

One install for everything Tommy curates: memory plus all skill bundles. tommy-pentest is separate and not included.

Architecture review stack: C4 documentation and multi-perspective design review.

Opt-in engineering lifecycle bundle: spec, plan, build, TDD, review and ship skills plus sub-agents (upstream agent-skills, MIT, pinned).

PR/MR review stack: differential security review, context building and variant analysis.

Security review stack: sharp edges, supply chain, CI agent actions and static analysis.