Audits WordPress plugin or theme PHP code for the most common security mistakes — missing nonce checks, capability checks, input sanitization, output escaping, unslashing, SQL preparation, AJAX nopriv exposure, file/path traversal, and unsafe redirects. Use when reviewing pull requests, before releasing a plugin, when the user asks "is this secure", or when handling code that touches $_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / $_SERVER, admin-ajax / admin-post, REST endpoints, options, user meta, custom DB queries, or file uploads.
The English summary is being prepared. Showing the original description.
nvdigitalsolutions/mcp-ai-wpoos☆ 7Updated Oct 20, 2026
Audits WordPress plugin/theme code for secret-handling and credential issues — hardcoded API keys, DB credentials, or signing secrets in source; weak randomness (rand, mt_rand, uniqid) used for security tokens, password reset links, nonces, or session IDs; password storage with md5/sha1/crypt instead of password_hash; insecure cookie flags (missing Secure, HttpOnly, SameSite) on sensitive cookies; secrets logged via error_log / var_dump in production code paths. Use before plugin release, when reviewing auth/registration/login features, when integrating third-party APIs, or when the user mentions "API key", "token", "session", "password reset".
The English summary is being prepared. Showing the original description.
nvdigitalsolutions/mcp-ai-wpoos☆ 7Updated Oct 20, 2026
Review code for quality, simplicity, and maintainability. Identifies unnecessary abstractions, duplicated logic, oversized functions, missing error handling, and naming issues — then fixes them automatically before presenting the result.
The English summary is being prepared. Showing the original description.
nvdigitalsolutions/mcp-ai-wpoos☆ 7Updated Oct 20, 2026
Examine every existing page on the site, build a semantic map across pillars, and add missing internal links so the site becomes a semantic graph anchored on clear topical pillars. Use this skill whenever the user asks to "add internal links", "build internal linking", "build a semantic graph", "link related pages", "strengthen topical authority", "fix orphan pages", "add pillar linking", or wants hub-and-spoke linking between pillars, hubs, and supporting content. Output is an edit list (proposed link insertions) plus optionally direct edits to page source files.
The English summary is being prepared. Showing the original description.
zhizdev/overgrow☆ 7Updated May 2, 2026
Given the product offering and existing page inventory, create new core landing and resource pages (homepage refresh, features, solutions, pricing, comparison, resource hubs, about) that capture core product intent using the query-fanout pattern. Use this skill whenever the user asks to "spawn pages", "generate landing pages", "create marketing pages", "build a pricing page", "add a solutions page", "build out the site", "fill in missing pages", or wants new top-level marketing/product pages. Output is one new page per route in the project's native file format (component or markdown), matching the existing page style and framework idiom.
The English summary is being prepared. Showing the original description.
zhizdev/overgrow☆ 7Updated May 2, 2026
Given the product and the existing page inventory, identify missing blog topics and generate new blog posts that capture search/AI intent using the query-fanout pattern. Use this skill whenever the user asks to "spawn blogs", "generate blog posts", "expand the blog", "build out a content cluster", "write blog ideas", "cover more search intents", "query fanout for blogs", or wants new long-form content that supports existing pillars. Output is one new post per topic in the project's existing post format (markdown, MDX, component, or CMS migration note), with frontmatter shape mirrored from an existing post.
The English summary is being prepared. Showing the original description.
zhizdev/overgrow☆ 7Updated May 2, 2026
Use when comparing prompt changes against a fixed evaluation set: record actual model settings, required checks, missing results, judge limitations and case-level regression evidence.
The English summary is being prepared. Showing the original description.
ranbot-ai/awesome-skills☆ 7Updated Oct 19, 2026
Routes an accounting or audit request to the right module skill, from software selection through monthly closing, asking only what is missing. Use for books of accounts or audit files.
The English summary is being prepared. Showing the original description.
ranbot-ai/awesome-skills☆ 7Updated Oct 19, 2026
Build or update the shared product-marketing context: product, audience, positioning, competitors, jobs-to-be-done, objections, customer language, proof and goals. Use before downstream execution when context is missing.
The English summary is being prepared. Showing the original description.
unempyd/revenueos☆ 7Updated Sep 14, 2026
Use when the user asks to "package our proof points", "build reusable stat cards and case snippets", or "put proof where each pillar makes its claim"; turns claims-ledger-approved proofs into reusable proof modules — stat cards, case snippets, testimonial blocks, comparison proofs — each pinned to a message-house pillar and the ledger claim ID it substantiates, and flags any pillar making a claim with no approved proof behind it. Never adjudicates a proof: unverified or ledger-absent proofs are marked '[needs source]' and routed to the claims candidates. Not for adjudicating or substantiating claims — use offer-claims-registry; not for fabricating a benchmark to fill a gap — a missing proof is flagged, not invented; not for scoring narrative quality — use narrative-quality-auditor. 证据模块/证据卡/客户案例/主张对齐
The English summary is being prepared. Showing the original description.
unempyd/revenueos☆ 7Updated Sep 14, 2026
Use when the user asks to "run my launch day", "build a launch day runbook / war room", or "decide CONTINUE or ROLLBACK after the push"; produces a pre-conditions gate check (launch-readiness-auditor SHIP verdict + the authoritative date in launch-registry — missing either stops the skill), a dated hour-blocked runbook with owners (morning irreversible pushes, daytime monitoring loop, evening consolidation), a forced observation-window verdict after every irreversible action against pre-declared kill criteria, a P0-P3 incident ladder with rollback playbooks, and T-0 status lines for the registry proposal protocol. Not for channel submission content and platform rules — use community-launch-runner; not for media replies — use press-media-relations. 发布日runbook/作战室/观察窗/回滚裁决/发布日指挥
The English summary is being prepared. Showing the original description.
unempyd/revenueos☆ 7Updated Sep 14, 2026
Use when the user asks to "find content gaps", "竞品写了什么", or "还应该写什么"; builds a competitor-relative coverage map of missing topics, keyword gaps, and editorial-calendar opportunities. Not for raw keyword demand discovery — use keyword-research. 内容缺口/选题规划
The English summary is being prepared. Showing the original description.
unempyd/revenueos☆ 7Updated Sep 14, 2026
Run a source-grounded paid-advertising audit for one or more of Google, Meta, YouTube, LinkedIn, TikTok, Microsoft, Apple, Amazon, Reddit, Pinterest, Snapchat, and X. Use for full ad checks, account health reviews, paid-media diagnostics, partial audits after authentication or worker failure, missing-platform weighting, beta-feature eligibility and scoring, spend audits, tracking audits, or prioritized opportunities and risks.
The English summary is being prepared. Showing the original description.
unempyd/revenueos☆ 7Updated Sep 14, 2026
Guide for MSBuild extensibility: CustomBefore/CustomAfter hooks, wildcard imports with alphabetic ordering, import gating with control properties, NuGet package build extension layout (build/buildTransitive), and the MicrosoftCommonPropsHasBeenImported guard. Only activate in MSBuild/.NET build context. USE FOR: diagnosing and fixing MSBuild import and hook patterns, reviewing and fixing extension point anti-patterns in Directory.Build files, fixing missing Exists() guards on imports that break fresh clones, fixing NuGet package hooks being silently dropped instead of appended, making build targets extensible for other projects, injecting custom logic into the build pipeline, creating NuGet packages that extend the build, conditionally disabling imports. DO NOT USE FOR: target authoring patterns (use target-authoring), props vs targets placement (use directory-build-organization), general anti-patterns (use msbuild-antipatterns), non-MSBuild build systems.
The English summary is being prepared. Showing the original description.
bouclem/skills☆ 7Updated May 31, 2026
Fix MSBuild targets that generate files during the build but those files are missing from compilation or output. Only activate in MSBuild/.NET build context. USE FOR: generated source files not compiling (CS0246 for a type that should exist), custom build tasks that create files but they are invisible to subsequent targets, globs not capturing build-generated files because they expand at evaluation time before execution creates them, ensuring generated files are cleaned by the Clean target. Covers correct BeforeTargets timing (CoreCompile, BeforeBuild, AssignTargetPaths), adding to Compile/FileWrites item groups, using $(IntermediateOutputPath) instead of hardcoded obj/ paths. DO NOT USE FOR: C# source generators that already work via the Roslyn pipeline, T4 design-time generation that runs in Visual Studio, non-MSBuild build systems. INVOKES: no tools — pure knowledge skill.
The English summary is being prepared. Showing the original description.
bouclem/skills☆ 7Updated May 31, 2026
Use when controlling NVIDIA Broadcast through MCP to apply effects, process local media, select devices, or change camera resolution, or when Broadcast is missing or too old to expose the gateway and the user wants it installed; not for Broadcast app settings outside the MCP gateway.
The English summary is being prepared. Showing the original description.
NousResearch/hermes-nvidia☆ 7Updated Oct 14, 2026
Checks design/ADR docs for consistency and missing decisions.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026
Detects mass assignment via create/update($request->all()), unguarded models, and missing authorization on mutating controller actions in Laravel.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026
Detect missing loading/error/empty state handling that could trap users in spinners or disabled states.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026
Detect missing validation plans (how to verify the design is correct) in design documents and ADRs.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026
Detects route data fetched in useEffect instead of loaders, server/client API leaks across loader boundaries, and missing HydrateFallback in React Router v7 framework mode.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026
Detect primitive obsession and missing domain/brand types; check that state is modeled via discriminated unions.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026
Detect breaking API contract changes, DTO modifications without compatibility handling, and missing tests for changed API boundaries.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026
Detects over-permissive Firestore/Storage rules (allow read, write: if true / auth-only without ownership), missing auth checks on writes, and admin SDK private key exposure to client bundles.
The English summary is being prepared. Showing the original description.
s977043/river-review☆ 7Updated Oct 20, 2026