Menu
Performs a rapid security sweep for secrets, API keys, and common vulnerabilities using cross-platform platform tools.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Audit and upgrade an EXISTING website or app to premium quality without a rewrite. Use when the user asks to redesign, revamp, refresh, polish, improve, modernize, or de-slop an existing frontend or codebase — it identifies generic AI design patterns and applies high-end standards while preserving functionality and the current stack (any CSS framework or vanilla CSS). Triggers: redesign, revamp, upgrade UI, improve design, polish existing site, make it look better, modernize, 리디자인, 리뉴얼, 개선, 다듬기, 손보기, リデザイン, 改善, 刷新. Do NOT use for building a NEW interface from scratch — use the frontend-design skill for that.
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.
Carve guardrail-adjacent items out of scope with safe alternatives before risk-adjacent work starts, then run the safe remainder at full strength in a fresh subagent that only ever sees the carved prompt, never the risky input. Use when a task includes stealth, scraping, privacy, IP, policy, licensing, security, or other safety-adjacent material that could be silently dropped, over-elaborated, or needlessly diluted. Fires on the impulse, not only the topic: the moment you notice yourself about to hedge, soften, silently skip, or brace for a refusal, carve before you execute.
Run repeated build -> QA -> retro -> re0-work cycles while preserving learning and letting code die. Use for long agentic projects where progress must be measured by quality-cleared templates, reusable modules, and eliminated anti-patterns rather than hours spent or features accumulated.
Audit any eval, metric, experiment, or benchmark for leakage — does external ground-truth enter independently, or are the model, scorer, and designer just confirming a result no outside truth ever produced? Use before trusting any 'how we'll know it worked' — an A/B, a holdout, a score, a validation — and whenever a result feels too clean or self-confirming. Walks an 8-pattern leakage taxonomy and returns only the patterns that fire, each with an independence fix. Read-only.
Read the live cycle state and return the single highest-leverage next best action, not a menu. Use when a project is between phases, the author asks what to do next, too many valid threads are open, or the work needs re-entry into frame, build, drive, retro, hate, re0-work, or ship.
| name | security-scan |
| description | Performs a rapid security sweep for secrets, API keys, and common vulnerabilities using cross-platform platform tools. |
| triggers | security scan, 보안 점검, 취약점 점검, scan for secrets, check keys |
This skill performs a fast, grep-based security scan of the repository. It focuses on identifying hardcoded secrets and common misconfigurations.
Trigger this skill before any git push or after significant code changes.
The following patterns are scanned using the grep_search platform tool:
| Category | Pattern | Description |
|---|---|---|
| Secrets | sk-[a-zA-Z0-9]{48} | OpenAI API Keys |
| Secrets | ghp_[a-zA-Z0-9]{36} | GitHub Personal Access Tokens |
| Secrets | AKIA[0-9A-Z]{16} | AWS Access Key IDs |
| Config | \.env$ | Unencrypted environment files |
| Vulnerability | eval\( | Dangerous eval usage |
| Vulnerability | dangerouslySetInnerHTML | Potential XSS (React) |
This skill uses the platform-native grep_search API, which is optimized for Windows, Mac, and Linux. No extra binary installation (like rg) is required.
// Step 1: Detect current OS (via env-check)
// Step 2: Use grep_search with absolute path
grep_search({
Query: "sk-[a-zA-Z0-9]{48}",
SearchPath: "/absolute/path/to/project",
IsRegex: true
});
If a match is found: