analyzing-dotnet-performance · analyzing-dotnet-performance verified and signed

Scans .NET code for ~50 performance anti-patterns across async, memory, strings, collections, LINQ, regex, serialization, and I/O with tiered severity classification. Use when analyzing .NET code for optimization opportunities, reviewing hot paths, or auditing allocation-heavy patterns.

security-review · security-review verified and signed

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for

sandbox-sdk · sandbox-sdk verified and signed

Build sandboxed applications for secure code execution. Load when building AI code execution, code interpreters, CI/CD systems, interactive dev environments, or executing untrusted code. Covers Sandbox SDK lifecycle, commands, files, code interpreter, and preview URLs. Biases towards retrieval from

docker-sandboxes-lifecycle · docker-sandboxes-lifecycle verified and signed

Use this skill when creating, running, reattaching to, listing, stopping, or removing Docker Sandboxes (the standalone `sbx` CLI that runs AI coding agents in isolated microVMs), even if the user just says they want to "run claude in a sandbox", "isolate an agent from my repo", "give an agent its ow

codacy/codacy-analysis-cli-action · Codacy Analysis CLI verified and signed

Execute Codacy code analysis using your remote Codacy configuration

attack-path-analysis · attack-path-analysis verified and signed

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

daytona · daytona verified and signed

Creates and manages isolated cloud sandboxes (secure code execution environments with dedicated runtimes) on the Daytona platform. Use when a task needs an isolated runtime, sandbox, secure compute, or Daytona SDK/API/CLI operations. Covers Python, TypeScript, Java, Go, and Ruby SDKs.

coderabbit · coderabbit verified and signed

Your code review partner. CodeRabbit provides external validation using a specialized AI architecture and 40+ integrated static analyzers—offering a different perspective that catches bugs, security vulnerabilities, logic errors, and edge cases. Context-aware analysis via AST parsing and codegraph r

· Vibgrate website read, tools not yet checked

Vibgrate scans your repository on your machine. It shows how far your stack has fallen behind, finds dependencies with known vulnerabilities, and gives your coding agent focused context from the code you actually run. Free, no account, raw source is not uploaded.

fallow_analyze · fallow-skills found in code, not yet checked

Run Fallow on the project: dead code, unused dependencies, duplication, complexity, circular dependencies and boundaries. Shows a dashboard to the user and returns the score and the top findings, each with a command that verifies it. Use it before cleanup or refactoring work, and to answer questions