howshannon

Adversarial, attacker-minded security review of ANY untrusted code before you trust it — a GitHub repo, a Claude/agent skill, an MCP server, a plugin, an npm or pip package, or a snippet you are about to base your own skill on. ALWAYS run this BEFORE installing a skill or plugin, BEFORE connecting an MCP server, BEFORE running or importing third-party code, and BEFORE copying external code into a skill you are authoring. Trigger whenever the user says "is this repo safe", "check this skill/plugin/MCP for malware", "review before I install", "audit this code", "can I trust this", or asks you to clone, install, or build on someone else's repo. Assume the code is hostile until the review says otherwise.

Audit, grade, and rewrite generic AI-slop patterns in prose, social posts, UI/design, and code. Use when asked to de-slop writing, humanize AI copy, grade a draft, review a landing page or generated interface, remove vague claims and repetitive rhetoric, or inspect AI-written code for generic abstractions and happy-path-only logic. Do not use to determine whether AI authored something.