custom-builtin-functions
Create a custom builtin function to be used in the Rego policy engine
chrome-policy-creation
Guide for adding new enterprise policies to Chromium. Complete guide for policy definitions, pref mapping, and writing tests.
Driving h5i
A **box** is a disposable development environment: a git worktree on its own branch, confined by a pinned, fail-closed policy. Code, toolchain, dev server and agent run inside it. Nothing reaches the host except what you export.
product-architect
Complete product development system with 31 specialized agents and 23 frameworks. Use when user asks to build a product, write a PRD, create a roadmap, plan an MVP, design an app, do a security audit, create a financial model, plan hiring, launch a product, set up operations, prepare for IPO, or write a compliance policy. Also triggers on help me plan, product strategy, go-to-market, fundraising, pitch deck, unit economics, competitive analysis, user personas, sprint planning, SOP, checklist for, or how do I start a company. Do NOT use for general knowledge questions, coding tutorials, or creative writing unrelated to product development.
laravel-permission-development
Build and work with Spatie Laravel Permission features, including roles, permissions, middleware, policies, teams, and Blade directives.
firewall-auditor
Audit UniFi firewall policies for conflicts, redundancies, security gaps, and best practices. Use when asked to review firewall rules, check for security issues, audit network policies, or optimize firewall configuration.
ash-framework
Ash Framework patterns â resources, actions, domains, policies, AshPhoenix forms, LiveView, AshPostgres migrations. Use when editing Ash resources, changes, checks, types, validations, or domain code interfaces.
Adding a new skill to vibesubin
This doc is canonical. If ADDING-A-SKILL.md and CLAUDE.md ever disagree on skill-authoring mechanics, CLAUDE.md wins on policy (what invariants exist) and this file wins on mechanics (what files and sections are needed). Both must stay in sync on category caps (10 + 1).
azadvertizer
[AzAdvertizer](https://www.azadvertizer.net) (by Julian Hayward) tracks Azure governance capabilities â Policies, Initiatives (policy sets), and RBAC Roles â and publishes them as **downloadable CSV exports**. There is **no API**. This skill turns those CSVs into deterministic offline lookups: f
skills-hub
Use this skill when the user wants to discover, inspect, install, or apply Skills Hub presets, kits, AGENTS.md policies, or skill packages for a project. It guides the agent to use the Skills Hub CLI to search presets, inspect their policy and selected skills, install them as kit artifacts, and apply them with optional temporary skill overrides after user confirmation.
ipaship-audit
Use when auditing iOS/Android app submissions for compliance with Apple App Store Review Guidelines or Google Play Developer Policies. Scan .ipa, .apk, or .zip files against official store policies, generate structured compliance reports, and identify violations with remediation steps.
crossplane-renderer
Renders and validates Crossplane compositions with security and policy checks. Automatically activates when testing compositions, rendering examples, or validating resources with Polaris, kube-linter, and Datree. Works standalone or as part of complete KCL validation workflow.
Tork Governance
AI agent governance for MCP: PII detection, policy enforcement, compliance, and kill switch.
api-fetch-wrapper
The case that breaks first in production â a skill that hits an external service. This example covers the four things every such skill needs: secret handling, retry policy, error normalisation, and no-leak-on-failure logging.
UniFi Access MCP
Manage UniFi Access doors, credentials, policies, visitors, and events via MCP.
config-hardener
Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses.
amortized-algorithms
Use when analyzing sequences of data-structure operations with aggregate analysis, accounting credits, potential functions, binary counters, multipop stacks, dynamic tables, resizing policies, or amortized versus average-case reasoning
Lex
Episodic memory and architectural policy for AI agents. Frames, Atlas, and Policy.
symbiont
AI-native agent runtime with typestate-enforced ORGA reasoning loop, Cedar policy authorization, CommunicationPolicyGate for inter-agent governance, ToolClad declarative tool contracts, knowledge bridge, zero-trust security, multi-tier sandboxing, webhook verification, markdown memory, skill scanning, metrics, scheduling, symbi init/run/up CLI, and a declarative DSL
Io.Github.Dewars30/Fulcrum
AI governance MCP server for policy enforcement, cost control, and observability.
role-skill-boundary-audit
Audit where governance instructions belong (Role.md, skill, global policy, workflow docs, memory, or an agent-boundary change); enforce minimal verbosity in roles and skills. Diagnostic by default.
mcaf-ci-cd
Design or refine CI/CD workflows, quality gates, release flow, and safe AI-assisted pipeline authoring. Use when adding or changing build pipelines, release stages, IaC-driven environments, or deployment rollback policy.
apim-bicep
Guide for building Bicep files for Azure API Management (APIM) and related Azure services. Use when users want to create, modify, or understand Bicep templates for APIM instances, APIs, backends, subscriptions, policies, products, loggers, diagnostics, and MCP servers. This skill provides Bicep syntax, patterns from Azure Verified Modules, and examples from this repository.
Aegis — AI Agent Governance
Policy-based governance for AI agent tool calls. YAML policy, approval gates, audit logging.
laravel-best-practices
Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
aci-change-deploy
Safe ACI policy change deployment - ServiceNow CR lifecycle, pre/post-change fault baselines, APIC policy application, automatic rollback on fault delta, and GAIT audit trail. Use when deploying ACI policy changes, creating tenants or EPGs, pushing config to APIC, or running a change window with rollback protection.
adr-authoring
Defines the canonical MADR format, lifecycle rules, numbering policy, and SAD catalog contract for standalone ADRs under specs/adrs/.
ella-core-api
Query and manage a live Ella Core 5G private network instance via its REST API. Use when the user asks about subscribers, data usage, QoS policies, radios, data networks, routes, NAT, flow reports, audit logs, operator configuration, or any runtime state of the Ella Core network. Also use when the user asks to provision, update, or delete network resources.
policy-authoring
Conventions and patterns for creating policy authoring types in the Azure API Management policy toolkit. Use this skill when creating or modifying config records in src/Authoring/Configs/ or adding methods to section context interfaces.
architecture-documentation
C4 architecture model, security architecture, Mermaid diagrams, SECURITY_ARCHITECTURE.md, and comprehensive documentation per Hack23 Secure Development Policy
policy
Author MCP tool-call policy rules without hand-editing access.json
manage-governance
Manage governance policies for skills in config/governance.yaml. Set, remove, or list usage policies.
domain-routing
Use when deciding where a knowledge card should live in the knowledge tree, choosing a major domain and subdomain, designing routing policy, or diagnosing why a card was routed to the wrong folder. Reads the repository routing guide and policy before deciding.
Io.Github.Imran Siddique/Agentos
Build and manage policy-compliant AI agents with safety enforcement and compliance checking
Policycheck
AI seller verification and policy risk analysis for any online store.
MCPower Security Proxy
Security proxy that wraps MCP servers with real-time monitoring and policy enforcement
zap-permit-policy-authoring
Author typed authorization policies with @zap-studio/permit using createPolicy, allow/deny/when, condition combinators, has/hasRole, and mergePolicies vs mergePoliciesAny decision strategies.
dropping-and-adding-support-for-python-versions
Keeps supported Python versions aligned across CI, configs, and docs. Use when adding a new Python version or dropping an end-of-life version per the official Python support policy.
symfony:api-platform-filters
Deliver robust API Platform contracts in Symfony with explicit operations, mapping, and policy-safe behavior. Use for api platform filters tasks.
sample-creator
Guide for creating new Azure API Management (APIM) usage samples in this repository. Use when users want to create a new sample folder under `samples/` that demonstrates APIM policies, API configurations, or integration patterns. This skill provides the required folder structure, file templates, naming conventions, and step-by-step guidance based on the `samples/_TEMPLATE` structure.
Altmetric Mcp
MCP server for Altmetric APIs - track research attention across news, policy, social media, and more
expense-report
File and validate employee expense reports according to Contoso company policy. Use when asked about expense submissions, reimbursement rules, receipt requirements, spending limits, or expense categories.
deterministic-agent-control-protocol
Govern tool execution through the Deterministic Agent Control Protocol policy gateway
ThinkNEO Control Plane
Enterprise AI governance: spend, guardrails, policy, budgets, compliance, and provider health.
mcaf-adr-writing
Create or update an ADR under `docs/ADR/` for architectural decisions, dependency changes, data-model changes, or cross-cutting policy shifts. Use when the user asks to write, update, or document an ADR, record a design decision, capture architecture trade-offs, or justify a repo-wide technical policy.
rlmgrep-usage
Default repo search policy: whenever you need to search or read through files or directories, start with rlmgrep. Use rg/grep first only for strict literal/regex exhaustiveness or very large raw scans. Includes scoping and high-signal rlmgrep flag patterns.
Yault AESP
Crypto payments for the agent economy — policy-gated vault operations under human control
azure-active-directory-b2c
Expert knowledge for Azure Active Directory B2C development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when designing B2C user flows/custom policies, MFA/IdP sign-in, app/API registration, CI/CD deployment, or logging, and other Azure Active Directory B2C related development tasks. Not for Azure Information Protection (use azure-information-protection), Azure Security (use azure-security), Azure Role-based access control (use azure-rbac), Azure Sentinel (use azure-sentinel).
add-policy
Use when adding, modifying, or reviewing VS Code configuration policies. Covers the full policy lifecycle from registration to export to platform-specific artifacts. Run on ANY change that adds a `policy:` field to a configuration property.
ai-agent-posture
Use this skill when asked to audit, assess, or report on AI agent security posture across Copilot Studio and Microsoft 365 Copilot agents. Triggers on keywords like "AI agent posture", "agent security audit", "Copilot Studio agents", "agent inventory", "agent authentication", "unauthenticated agents", "agent tools", "MCP tools on agents", "agent knowledge sources", "XPIA risk", "agent sprawl", "AI agent risk", "agent governance", or when investigating AI agent configurations, access policies, tool permissions, or credential exposure. This skill queries the AIAgentsInfo table in Advanced Hunting to produce a comprehensive security posture assessment covering agent inventory, authentication gaps, access control misconfigurations, MCP tool proliferation, knowledge source exposure, XPIA email exfiltration risk, hard-coded credential detection, HTTP request risks, creator governance, and agent sprawl analysis. Supports inline chat and markdown file output.