Skill
a11y-pass
Catch the accessibility failures that ship in almost every AI-built UI. Use after building any interactive component.
@archive228Install SkillAgent Orchestration
Skill
/owasp-review
Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
Install
$ npx -y skills add Archive228/loopkit --skill owasp-review --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/owasp-review
Context preview
The summary Claude sees to decide when to auto-load this skill.
Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
SKILL.md
owasp-review.SKILL.mdname: owasp-review description: Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls. when_to_use: new endpoint, auth/session change, user input, raw query, file upload, deserialization
OWASP Review
Check the diff for each, with the exact line:
- **Injection** — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
- **Broken access control** — does it verify the user OWNS the resource, not just that they're logged in?
- **Auth** — secrets in code? tokens without expiry? password compare not constant-time?
- **SSRF** — user-controlled URL fetched server-side without an allowlist.
- **Sensitive data** — PII/secrets logged, returned in errors, or sent unencrypted.
- **Deserialization** — untrusted input into pickle/yaml.load/eval.
- **Dependency** — a new package with known CVEs or no maintenance.
Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".
Ships withloopkit
33 battle-tested skills + minimal .claude harness for any coding agent (Claude Code, Cursor, Codex, Gemini CLI).
Get the whole plugin
Other skills on loopkit.
@archive228Install SkillSkill
active-memory-reminder
Before compaction Loopkit extracts decisions into claude-decisions.json (machine-readable). Read it alongside claude-progress.txt…
@archive228Install SkillSkill
adversarial-verify
Review a diff against the goal spec assuming the code is BROKEN. The reviewer
@archive228Install SkillSkill
authz-check
Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.
@archive228Install SkillSkill
bisect-regression
Find the exact commit that introduced a bug. Use when something worked before and broke, and you don't know which change did it.
@archive228Install SkillSkill
broken-window-check
Before picking new work, smoke-test the last "completed" feature. If it's broken, revert and re-open it before touching anything…
@archive228Install Skill