AI Agent Skills

Use when writing or reviewing any API endpoint that retrieves, updates, or deletes a record by user-supplied ID. Triggers on route handlers with :id params, controller f…

Poison a RAG/knowledge-base pipeline so retrieved content hijacks the model (indirect prompt injection at scale) or exfiltrates data. Load when the app does retrieval ov…

Guides building evaluation harnesses, regression test suites, and runtime guardrails for LLM agents. Use when a user asks to "evaluate this agent," "write test cases for…

Use when setting up PHPCS with WordPress Coding Standards (WPCS), configuring phpcs.xml.dist, running phpcs/phpcbf, fixing sniff violations, adding PHPCS to CI (GitHub A…

Supply chain security gate. MUST be invoked BEFORE running any install command (npm install, pip install, gem install), before editing manifest/lock files (package.json,…

A baseline skill that the security scanner must report as completely clean. Used as a false-positive gate.

Vets and continuously verifies the integrity and provenance of agent skills installed with qvr. Use when a user cares about skill security, trust, signing, tampering, or…

Full audit readiness assessment against Zealynx security framework. Goes check-by-check through every framework check for your vertical. Produces .zealynx-run.json for i…

Deep analysis of a single security check against local Solidity code. Use with framework check IDs like AC-01, LN-02, VT-03. Also works during manual assessment to get A…

Quick security scan of Solidity smart contracts. Analyzes code against real audit findings from 4,500+ Solodit references across 39 DeFi verticals. Use when reviewing So…

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code…

Coordinate SEO, LLM-readable site architecture, UX, content, monitoring, security, and external authority work as a task-plan-driven sequence. Use this skill when the us…