architect
Use for design-level judgement: requirements, quality attributes, trade-offs, ADR, contracts, resilience, security,…
@shafthqInstall SkillTesting
Skill
/security-audit
Use when auditing a repository we own. A second pass confirms.
Claude Code
$ npx -y skills add ShaftHQ/SHAFT_ENGINE --skill security-audit --agent claude-code
Codex
$ npx skills add ShaftHQ/SHAFT_ENGINE --skill security-audit -a codex -y
Cursor
$ npx skills add ShaftHQ/SHAFT_ENGINE --skill security-audit -a cursor -y
Gemini CLI
$ npx skills add ShaftHQ/SHAFT_ENGINE --skill security-audit -a gemini-cli -y
GitHub Copilot
$ npx skills add ShaftHQ/SHAFT_ENGINE --skill security-audit -a github-copilot -y
OpenCode
$ npx skills add ShaftHQ/SHAFT_ENGINE --skill security-audit -a opencode -y
Windsurf
$ npx skills add ShaftHQ/SHAFT_ENGINE --skill security-audit -a windsurf -y
SKILL.md
security-audit.SKILL.mdname: security-audit description: >- Use when auditing a repository we own. A second pass confirms. license: MIT permissions: - read
Security audit
On demand only. This skill is not part of the always-loaded router.
License check 2026-11-10: the studied Cloudflare skill was MIT. This file is original and does not copy that skill.
Scope
Audit only a repository the owner names and that we are allowed to change. If the target is not a repository we own, stop. Do not produce attack steps.
Findings
A finding is unconfirmed until a second pass by someone other than the writer verifies it. The writer cannot confirm their own finding.
Do not include exploit procedures, payloads, or covert access steps.
Classifier: [verify.py](verify.py).
Ships withshaft-engine
One Java engine for web, mobile, API, CLI, database, and desktop. Drivers, waits, and evidence are handled. Every run ends in an Allure report.
42125 skills
Stars on GitHub
Momentum
- stars in total
- 421
Other skills on shaft-engine.
@shafthqInstall Skillchaos-engine
Canonical provider-neutral skill router and working contract. Use at the start of every task, on every host, in every main thread…
@shafthqInstall Skillci-cd
Use when PR merge waits are long or CI/CD is being designed, audited, or sped up: targets, PR/main/nightly tiers, opt-in labels,…
@shafthqInstall Skillcolibri
Frontier MoE through a disk/RAM/VRAM hierarchy via the optional Colibri process. Use when a large-model offline job needs…
@shafthqInstall Skilldocs-hygiene
Use when editing source-of-truth docs or status tables: three sources, Done / In progress / Not started, and live hour formulas.…
@shafthqInstall SkillMore skills from other plugins.
api-review
Produce the "Playwright 1.xx API Review" artifact for a range of commits - the public API additions and the breaking or behavior…
@microsoftInstall Skill
promptfoo-evals
Write, refine, run, and QA promptfoo evaluation suites: promptfooconfig.yaml, prompts, providers, vars, tests, assertions,…
@promptfooInstall Skilldeepeval
DeepEval evaluation workflow for AI agents and LLM applications. TRIGGER when the user wants to evaluate or improve an AI agent,…
@confident-aiInstall SkillQuestions about security-audit.
- Which coding agents can use security-audit?
- security-audit installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.