Security & Auditing Skills

Blockscout MCP tool reference for on-chain data queries. Covers all 16 tools: address info, transactions, token transfers, NFTs, contract ABI/source, read-only calls, ENS resolution, and block data across 8+ chains. TRIGGER when: user asks about on-chain data, contract state, token balances, transaction history, ENS lookup, NFT holdings, or uses blockscout MCP tools. DO NOT TRIGGER when: user asks about crypto market prices or trading volume (use coingecko skill), or writing Solidity code (use solidity-audit skill).

Use when the user asks to design database schemas, plan data migrations, optimize queries, choose between SQL and NoSQL, or model data relationships.

Automated security auditing of project dependencies to identify known vulnerabilities.

UI/UX design patterns and design system architecture. TRIGGER when: working on component design, layout/grid decisions, design tokens, color palettes, typography, accessibility (WCAG), responsive design, TUI aesthetics, or creating DESIGN.md documentation. Covers React, Tailwind CSS, terminal UI, and mobile patterns with a monospace-first, constraint-based design philosophy. DO NOT TRIGGER when: writing React/TypeScript code logic (use droo-stack skill), building Raxol TUI framework features (use raxol skill), or working with CSS-in-JS runtime concerns (this skill covers design decisions, not runtime).

Generate a daily or weekly digest of activity across all connected sources. Use when catching up after time away, starting the day and wanting a summary of mentions and action items, or reviewing a week's decisions and document updates grouped by project.

Detailed coding patterns for a polyglot stack. TRIGGER when: working in Elixir, TypeScript, Go, Rust, Python, Lua, C, Zig, Shell/Bash, Noir, or chezmoi templates. Provides incorrect/correct examples that complement CLAUDE.md preferences. DO NOT TRIGGER when: working with Claude API or Anthropic SDK (use claude-api skill), Raxol TUI/agent framework patterns (use raxol skill), Solidity smart contracts (use solidity-audit skill), ZK circuit domain questions (use noir skill -- this skill only covers Noir language syntax), or NIF/SIMD domain questions (use native-code skill -- this skill only covers C and Zig language syntax).

ffmpeg upstream contributions (hand-written assembly in libavcodec/libavfilter/libswscale) and custom ffmpeg integration (building, embedding, calling libav APIs). Covers x8664 (SSE/AVX/AVX2/AVX-512) and AArch64 (NEON/SVE/SVE2) idioms specific to ffmpeg's x86inc.asm and aarch64/asm.S macro frameworks, the checkasm and FATE test harnesses, and the ffmpeg upstream patch workflow. TRIGGER when: editing .asm files under libav/x86/, .S files under libav/aarch64/ or libav/arm/, working with x86inc.asm, x86util.asm, or aarch64/asm.S macros, writing init.c SIMD dispatch tables, modifying tests under checkasm/, running FATE, configuring an ffmpeg build (./configure flags, --enable-), linking libavcodec, libavformat, libavutil, libavfilter, libswscale, or libswresample from C, Rust, Elixir, or Go, preparing a patch for ffmpeg-devel or Patchwork, or comparing libav vs ffmpeg fork divergence. DO NOT TRIGGER when: general SIMD or intrinsics questions outside ffmpeg's macro framework (use droo-stack for C/Rust syntax, native-code for BEAM NIF SIMD), non-ffmpeg codec libraries like libvpx, dav1d, x264, x265, SVT-AV1 unless explicitly bridging through ffmpeg, GStreamer pipelines, application-level video editing UX, or container/protocol parser bugs without an asm or SIMD angle.

Use when a product flow needs interface structure, component planning, interaction details, or screen-level UX shaping before implementation.

Use when you need to reduce LLM API spend, control token usage, route between models by cost/quality, implement prompt caching, or build cost observability for AI features. Triggers: 'my AI costs are too high', 'optimize token usage', 'which model should I use', 'LLM spend is out of control', 'implement prompt caching'. NOT for RAG pipeline design (use rag-architect). NOT for prompt writing quality (use senior-prompt-engineer).

NIF (Native Implemented Functions) development and SIMD patterns for Elixir/BEAM. TRIGGER when: writing NIFs in C or Rust (Rustler), using erlnif.h, Zig SIMD code for BEAM integration, tree-sitter grammar NIFs, or discussing native performance boundaries in Elixir. DO NOT TRIGGER when: general C/Zig/Rust language questions (use droo-stack), general Elixir patterns (use droo-stack), Raxol framework (use raxol skill).

Runs packages temporarily, creates isolated shell environments, and evaluates Nix expressions. Use when executing tools without installing, debugging derivations, or working with nixpkgs.

Zero-knowledge circuit design with Noir (Aztec's ZK DSL). TRIGGER when: working with .nr files, Nargo.toml, ZK circuits/proofs, Aztec contracts, zoir extension, or discussing zero-knowledge proof design. Covers circuit architecture, constraint optimization, ZK-specific security, and Aztec integration. DO NOT TRIGGER when: only Noir language syntax is needed (droo-stack handles that), or working with Solidity (use solidity-audit skill).

Scan for outdated dependencies and update them across Elixir, Rust, Node, Go, and Python ecosystems. TRIGGER when: user asks about outdated dependencies, "update deps", "dependency check", "what needs updating", or invokes "/patchbot". DO NOT TRIGGER when: user is working on patchbot agent code itself.

Identifies performance bottlenecks including N+1 queries, inefficient loops, memory leaks, and slow algorithms. Use when user mentions performance issues, slow code, optimization, or profiling.

Polymath split-brain research methodology. Maps the possibility space of open-ended problems by building a max-distance lens roster across three relatedness tiers (close/mid/far), composing polymath expert personas from the tiers, spawning N parallel sub-agents, then synthesizing their disagreements into a landscape map. TRIGGER when: the user explicitly invokes the technique ("polymath", "split-brain", "multiagency", "let's run agents to/for X", "remember our polymath multiagency"), OR when ALL of these are true: (a) the problem is research/strategy/framing-level, (b) the user has indicated framing uncertainty (not debugging), (c) the cost of picking the wrong frame is high, (d) the user has not already specified an approach. DO NOT TRIGGER when: debugging ("stuck on this regex/error/build/typo/merge conflict"), file/syntax lookups, single-answer questions, naming/styling micro-decisions, or anything where one direct answer would suffice. When the trigger match is ambiguous, ASK the user "split-brain this with ~10 polymath lenses, or just one targeted Agent?" -- one clarifying question is cheaper than 12 wasted spawns OR a missed framing discovery.

Generate pre-session project briefings with git activity, GitHub state, CI status, dependency health, and recall context. TRIGGER when: user asks for a "briefing", "what's the state of this project", "catch me up", "prep me", or invokes "/prepper". DO NOT TRIGGER when: user is working on prepper agent code itself.

Property-based and generative testing across the polyglot stack. TRIGGER when: user asks about property-based testing, generative testing, QuickCheck, Hypothesis, proptest, StreamData, fast-check, fuzzing test inputs, or finding edge cases that example tests miss. DO NOT TRIGGER when: user asks about TDD workflow (use tdd), mutation testing (use tdd), load testing (use performance-profiler), or security fuzzing (use security-audit).

Use when the user asks to design RAG pipelines, optimize retrieval strategies, choose embedding models, implement vector search, or build knowledge retrieval systems.

Raxol terminal framework for TUI apps and AI agents in Elixir. TRIGGER when: code imports Raxol modules (Raxol.Agent, Raxol.Headless, Raxol.Core), mix.exs lists :raxol or :raxolagent as dependency, user asks about building TUI apps or AI agents with Raxol, or working with Raxol headless/MCP tools. DO NOT TRIGGER when: general Elixir patterns (use droo-stack skill), Claude API / Anthropic SDK usage (use claude-api skill), or other TUI frameworks (Scenic, Termbox, etc.).

Agentic commerce for Raxol agents in Elixir: the raxolpayments + raxolearn packages (Xochi/Riddler/MPP/Permit2/x402 protocols, agent wallets, spend limits, stealth + privacy tiers, ZKSAR trust scores, and the ACP job lifecycle). TRIGGER when: mix.exs lists :raxolpayments or :raxolearn; code imports Raxol.Payments. or Raxol.Earn.; user asks about agent wallets, HTTP 402 auto-pay, Xochi/Riddler cross-chain transfers, stealth addresses / privacy tiers, ZKSAR attestations, spend gating, or the ACP (Agent Commerce Protocol) job state machine / offerings. DO NOT TRIGGER when: writing or auditing Solidity contracts (use solidity-auditor skill); general Ethereum tooling / RPC / explorer questions (use ethskills skill); ZK circuit design in Noir (use noir skill); the core Raxol agent/TUI framework (use raxol skill); the Symphony orchestrator (use raxol-symphony skill).

Symphony: the Raxol tracker-driven coding-agent orchestrator (raxolsymphony, pre-alpha). Turns tracker issues into autonomous agent runs in isolated workspaces, surfaces evidence (CI/PR/asciinema), and supports human-in-the-loop paused runs across six surfaces. TRIGGER when: mix.exs lists :raxolsymphony; code imports Raxol.Symphony.; there is a WORKFLOW.md driving an orchestrator; user asks about tracker-driven agent orchestration, Symphony runners (RaxolAgent/Codex), evidence capture, or paused-run resume with Raxol. DO NOT TRIGGER when: building a single Raxol agent or the core framework (use raxol skill); agent payments / ACP job sessions (use raxol-payments skill); generic multi-agent system design without Symphony (use agent-designer skill); the Claude Agent SDK (use claude-api).

Systematic refactoring methodology with safety guarantees for polyglot codebases. TRIGGER when: user asks to refactor code, restructure a module, split a monolith, do a large rename, extract a service, apply strangler fig, or plan a safe migration of existing code. Also when tech-debt-tracker findings need execution. DO NOT TRIGGER when: user is fixing a bug (use focused-fix), doing TDD on new code (use tdd), or finding tech debt without a plan to fix it (use tech-debt-tracker).

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

A universal self-improving agent that learns from ALL skill experiences. Uses multi-memory architecture (semantic + episodic + working) to continuously evolve the codebase. Auto-triggers on skill completion/error with hooks-based self-correction.