lassejlv Skills
A personal skill set: backend security audit, AWS and GCP account cleanup, project roadmaps and commit messages
- 70 ★ on the repository
- Last commit
Broad access
Why this level
- The cloud cleanup skills delete AWS and GCP account resources on your confirmation and deleted resources do not return
- The `gitty` skill can commit and push changes and `use-aws` works with your account profiles
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/lassejlv-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The cloud cleanup skills delete AWS and GCP account resources on your confirmation and deleted resources do not return
- The `gitty` skill can commit and push changes and `use-aws` works with your account profiles
This is third-party code. Review the repository files before installing.
What it does
The repository gathers the author's personal skills into one multi-skill package installed with `npx skills add lassejlv/skills`. `--list` prints the names, `--skill <name>` picks one and `--skill '*'` installs everything. The set holds about thirty skills for development, clouds and interfaces. For backend and cloud: `backend-security-audit` reviews code, auth, data access, secrets, integrations, dependencies and deployment settings for confirmed vulnerabilities; `use-aws` works with AWS accounts through profile-aware CLI workflows, read-only first; `aws-account-cleanup` and `gcp-account-cleanup` build a dry-run resource inventory and delete only after explicit confirmation; `minimize-api-responses` helps return each caller only the fields it needs and may access. For projects and code: `project-orientation-sweep` maps an unfamiliar repository and picks checks, `project-roadmap` writes a roadmap with phases, dependencies and exit criteria, `gitty` generates and commits messages through Codex, Claude Code or OpenCode, `clean-codebase` coordinates eight cleanup agents across duplication, types, dead code and cycles, and `legal-policy-drafter` drafts Terms of Service and a Privacy Policy from a codebase. There are also skills for interfaces, Rust apps on GPUI and the embeddable Termy terminal.
Who it is for. TypeScript and Rust developers who work with AWS and Google Cloud and want ready skills for audit, cleanup and planning.
Good fit when
- Before a backend release you need a code review for confirmed vulnerabilities: auth, secrets, file uploads, webhooks
- A test AWS account or GCP project is full of resources and they have to be inventoried in dry-run and deleted with confirmations
- The project is unfamiliar and the agent must map it and choose checks before editing
- A product needs a roadmap with phases and exit criteria drawn from the real repository
- Commit messages should be generated from changes through `gitty`
Not a fit when
- You need a single skill: copying its folder is simpler than installing the whole set
- You need automatic cleanup of a production account with no confirmations: the cleanup skills run only behind explicit gates
- You do not use Codex, Claude Code or OpenCode: some skills follow their format
- You need a separately maintained product with a release history: this is a personal collection
Example request
Run backend-security-audit on this repository and show confirmed findings with file pathsLimitations
- This is the author's personal collection: some skills are narrow, for example `libtermy-implementation` and `paper-to-gpui` matter only when working with Termy and GPUI.
- The AWS and GCP cleanup skills delete resources: dry-run and inventory come first and deletion follows only explicit confirmations, but you grant the tokens and permissions.
- The repository states no license: GitHub did not detect one, so terms of use are worth confirming with the author.
- The `backend-security-audit` skill is a defensive review of your own code and does not replace an independent pentest.
How to disable. Delete the folders you no longer need from the agent skills directory, for example `~/.claude/skills/`. Skills installed through `npx skills` are removed with the same `skills` tooling, and cloud resources removed by cleanup are not restored.
FAQ
How do I install the skills?
Run `npx skills add lassejlv/skills --skill '*'` for all or `--skill <name>` for one. See the list first with `npx skills add lassejlv/skills --list`.
Is AWS and GCP account cleanup safe?
The skills first build a dry-run inventory and delete resources only after explicit confirmations. Confirmations and permissions stay with you, and deleted resources do not come back.
What does backend-security-audit check?
Code, auth, data access, secrets, integrations, dependencies, file uploads, webhooks, background jobs and deployment settings. Only confirmed findings are wanted.
Which skills cover interfaces?
`plain-design-engineer`, `no-vibe-code`, `use-design-system`, `create-ui-kit-from-website` and `build-planetscale-landing-pages`: they set a visual direction and catch generic design patterns.
What is clean-codebase?
A skill that coordinates eight agents, each hunting its own target: duplication, types, dead code, cycles, error handling, legacy paths and slop. Findings rely on evidence.
Discussion
No questions or reviews yet.
Related
SkillsTwelve standalone skills for development: an agent loop with planning and review, pull request handling, TDD and email triage.
Catalog of 46 versioned skills for code review, releases, CI and landing pages, installed as the lstack plugin or through npx.
Skill and agent manager with a lock file: installs one set into Claude Code, Codex, Cursor and others and keeps your edits.
Nine personal engineering skills: an idea-to-PR chain, standards search, a sandboxed review loop and wizard pages for changes
jnsahaj skills
jnsahaj/skills
Eight skills for code review, draft pull requests and bug triage one cause at a time, waiting for your go-ahead.
lencx skills
lencx-skills
Two skills for Claude Code and Codex: keel works through architecture questions, coding-protocol keeps code edits inside the task
README in short
The README calls the repository a multi-skill package of personal skills and shows install: list, a single skill, all at once and install by full URL. A list of skills with a description each follows, from AWS and GCP cleanup to interface and GPUI skills.
README badge
Original SKILL.md
--- name: backend-security-audit description: Defensive backend security review for source code, API servers, auth flows, database access, dependency configuration, secrets handling, file uploads, webhooks, background jobs, and deployment settings. Use when Codex is asked to audit, review, deep research, harden, or find vulnerabilities in a user's own backend or authorized codebase, and to report findings before making fixes. --- # Backend Security Audit ## Overview Perform a defensive, evidence-led backend security audit. Find as many real vulnerabilities and risky patterns as possible, report them clearly to the user, then ask whether to implement fixes. Use this only on systems the user owns or is authorized to assess. Do not provide exploit payloads, attack playbooks, or instructions for compromising third-party systems. ## Audit Workflow 1. Establish scope from the repository: - Identify backend entry points, framework, package manager, runtime, API routes, middleware, auth/session libraries, database layer, background jobs, file storage, webhook handlers, and deployment files. - Read project docs, environment examples, schema files, route definitions, middleware, and dependency manifests before judging individual files. - Prefer `rg` and `rg --files` for discovery. 2. Load the checklist when needed: - Read `references/audit-checklist.md` before the detailed pass, or when the backend uses unfamiliar patterns. - Use it as coverage guidance, not as a substitute for code-specific reasoning. 3. Trace trust boundaries: - For each external input path, follow data from request, queue message, webhook, file upload, CLI job, or third-party callback into validation, authorization, persistence, side effects, and responses. - Pay special attention to paths that cross user, tenant, organization, admin, payment, or internal-service boundaries. 4. Verify findings against code: - Report a finding only when there is concrete evidence in the code or configuration. - Include file references and the relevant behavior. Avoid vague claims like "may be vulnerable" unless the uncertainty is explicitly explained. - Separate confirmed vulnerabilities from hardening recommendations. 5. Assess severity: