All Claude Skills

Every skill the game draws from, 80 in all. They are grouped by family: the axis along which they collide. The denser the family, the harder it is to tell its skills apart, which is the whole reason the game exists.

Security7 skills

dependency-updater (softaworks)Works over a project's dependency manifest — detecting the language, applying the safe minor and patch bumps on its own, pausing on major versions, and running that ecosystem's vulnerability audit (npm audit, pip-audit, govulncheck, cargo audit and the like) to flag known-vulnerable packages. It secures the supply chain around your code, not the code itself: it does not scan your own source for bugs, write detection rules, or reason about a design's threats.
secure-error-handling (harperaa)A secure-coding pattern for the error path: return generic, environment-aware messages to users while logging the detail server-side, so a stack trace, database error, or file path never hands an attacker a map of your system. It shapes how failures are surfaced — not a scanner that finds the leaks for you, and narrower than a full security review: it does not cover auth, input validation, or the other vulnerability classes, only how errors are reported.
security-review (affaan-m/ecc)Helps developers implement secure features by listing concrete checks and recommended patterns for authentication, input handling, secret management, API endpoints, and payment or sensitive flows. Unlike similarly named tools that scan code or produce vulnerability audits, this one focuses on design-time guidance and implementation checklists — it does not run automated SAST, assign severity scores, or perform penetration-style audits of diffs.
security-review (waybarrios/opencode-power-pack)Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
security-reviewer (jeffallan)Performs end-to-end security examinations of code, infrastructure, dependencies and secrets and compiles a prioritized audit report that assigns severity to each finding and lists concrete remediation steps. Unlike tools that only add inline comments, check authentication patterns, or scan a branch diff, this one is aimed at producing a compliance-aware, prioritized audit document rather than a quick pre-merge or single-file review.
semgrep-rule-creator (trailofbits)Authors a custom Semgrep static-analysis rule for one specific bug or vulnerability pattern — building the match (or a taint-mode source-to-sink data flow), then the paired vulnerable-and-safe test cases that keep false positives in check. Its output is a reusable detection rule, not a finished audit: it does not run existing Semgrep rulesets over your repo, triage the findings a scan produces, or review a diff by hand.
what-leaked-about-you (useosint)Checks an email, username, phone, or name against curated data-breach services — Have I Been Pwned, DeHashed, IntelX and the like — to enumerate which breaches an identity appears in and read what those records reveal, chiefly the list of services the person actually used. It is breach-exposure reconnaissance about a person, not a codebase tool: it does not scan your repository for hardcoded secrets, and it never uses a leaked password to access anything — reading the exposure is the whole job.

SEO6 skills

Visual6 skills

Documents5 skills

Accessibility4 skills

Data4 skills

Design4 skills

Dev Workflow4 skills

Docs4 skills

Engineering4 skills

Extend4 skills

Product4 skills

QA4 skills

Release4 skills

Research4 skills

Testing4 skills

Workflow4 skills

Meta2 skills

Web2 skills

Reading the list is not the same as knowing which one to reach for.