Security skills for AI agents (316 skills)

Skills for security and penetration testing: vulnerability review, code audits, threat analysis and compliance.

Every skill below uses the SKILL.md standard, so it installs on Claude Code, Codex, Hermes Agent and DeepSeek (Deep Code). Open a skill to read it and grab the install command.

1password – Set up op CLI, sign in, and read or inject secrets.
007 – Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident…
a11y-audit – Accessibility audit skill for scanning, fixing, and verifying WCAG 2.2 Level A and AA compliance across React…
401-403-bypass-techniques – Use when protected HTTP routes return 401 or 403.
accessibility-compliance-accessibility-audit – Audit pages and user journeys against a declared WCAG scope. Use when identifying keyboard, screen-reader, focus or…
accesslint-audit – Find and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or page, produce a prioritized…
accesslint-diff – Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes…
accesslint-scan – Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix…
accounting-audit-system-builder – Routes an accounting or audit request to the right module skill, from software selection through monthly closing…
anti-reversing-techniques – Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill…
bb-local-toolkit – Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source…
antinet-security-scan – 信息安全分析师与软件开发工程师在搭建文档处理流水线时，当需要拦截违规文件或外部URL，请挂载此技能作为强制前置安检，自动输出 pass/reject 判定与详细合规扫描报告，一键守住零信任安全底线。
bug-bounty – Master bug bounty orchestrator — full pipeline: recon, pre-hunt learning, vulnerability hunting (30+ classes), A-to-B…
attack-tree-construction – Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense…
cache-attack – Poison CDN cache or deceive when X-Cache header is detected.
aso – When the user wants to audit or optimize an App Store or Google Play listing. Also use when the user mentions 'ASO…
cms-detection – Identify CMS, frameworks, and server technology stacks on live hosts.
ai-security – Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning…
cors-credential-wordpress – Exploit WP CORS credential reflection for data theft.
aims-audit – /compliance-os:aims-audit [scope] — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before…
agenttrace-session-audit – Audit local AI coding-agent sessions with agenttrace for cost, tool failures, latency, anomalies, health, diffs, and…
agy-auto – Configure agy-auto PreToolUse security gate to run Antigravity CLI (agy) unattended with layered policy controls…
deep-invade – Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.
email-security – DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis
enterprise-vpn-attack – External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix…
ai-engineering-toolkit – Overview of six AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG…
error-log-mining – Mine error_log for creds, paths, SQL when leak hunt finds.
atlassian-admin – Atlassian Administrator for managing and organizing Atlassian products (Jira, Confluence, Bitbucket, Trello), users…
firebase-supabase-attack – Exploit Firebase/Supabase for data via JS config leak probe.
ai-security-hardening – Harden AI/LLM deployments against prompt injection, data exfiltration, model theft, and supply chain attacks.
flask-werkzeug-attack – Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
gitlab-public-recon – Mine GitLab for secrets, CI tokens when subdomain found.
http2-header-impersonation – Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.
hunt-auth-bypass – Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW /…
antigravity-workflows – Use when asked to ship a SaaS MVP, audit application security, build an AI agent, run browser QA, or design a domain…
hunt-business-logic – Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking…
security-and-hardening – Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user…
hunt-cache-poison – Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host…
hunt-cicd – Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{…
api-security – Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization…
hunt-csrf – Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants —…
hunt-django – Hunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation.
hunt-fastapi – Hunt FastAPI-specific vulnerabilities: dependency injection gaps, Pydantic coercion, and OpenAPI mining.
geopandas – Guidance and local audit tools for Python workflows that directly use GeoPandas GeoSeries, GeoDataFrame, spatial…
security-best-practices – Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the…
hunt-graphql – Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID…
hunt-grpc – Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication /…
domain-intel – Passive recon of subdomains, SSL certs, WHOIS, and DNS.
security-ownership-map – Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and…
hunt-host-header – Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host…
attack-tree-construction – Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense…
ciso-advisor – Security leadership for growth-stage companies. Risk quantification in dollars, compliance roadmap (SOC 2/ISO…
security-threat-model – Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and…
hunt-idor – Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
audit-context-building – Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug…
audit-log – Audit trail register: timestamp, user, module, record, action, field changed, old and new value, and the reason for…
audit-logging – Implement centralized audit logging and SIEM integration. Configure log retention and security monitoring. Use when…
audit-preparation – Audit preparation register: required document, period covered, request and receipt dates, preparer and reviewer…
audit-skills – Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious…
hunt-laravel – Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars)…
hunt-llm-ai – Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling…
hunt-mcp-security – Hunt Model Context Protocol (MCP) vulnerabilities in AI-tool integration systems.
aws-security-audit – Comprehensive AWS security posture assessment using AWS CLI and security best practices
hunt-misc – Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
hunt-nestjs – Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.
k8s-security-policies – Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade…
godmode – Jailbreak LLMs: Parseltongue, GODMODE, ULTRAPLINIAN.
compliance-readiness – /compliance-os:compliance-readiness [program] — Multi-framework compliance officer 6-question forcing interrogation of…
hunt-oauth – Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
hunt-prototype-pollution – Hunt client-side and server-side prototype pollution for XSS, auth bypass, and RCE.
hunt-race-condition – Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2…
hunt-rce – Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
hunt-sharepoint – Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration…
dependency-auditor – Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts…
hunt-springboot – Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring…
pci-compliance – Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when…
hunt-sqli – Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection…
hunt-ssrf – Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne…
fda-qsr-audit-prep – /compliance-os:fda-qsr-audit-prep [scope] — FDA 21 CFR 820 (QSR / QMSR) audit 6-question forcing interrogation…
hunt-supabase – Hunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row…
hunt-websocket – Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS…
broken-authentication – Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication…
brooks-audit – Architecture audit that maps module dependencies, checks layering integrity, and flags structural decay across a…
gdpr-audit-prep – /compliance-os:gdpr-audit-prep [scope] — GDPR audit 6-question Article-cited forcing interrogation. Use before annual…
hunt-xss – Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.
hunt-xxe – Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc…
bugs-are-annoying – Adversarial code auditor that hunts down bugs, logic errors, and security flaws. Use for deep correctness passes, not…
iot-camera-recon – Attack cameras via RTSP, ONVIF, Axis config when 554 open.
burpsuite-project-parser – Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or…
js-secrets-extraction – Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
jwt-attack – Decode, forge, brute JWTs when Bearer auth header is seen.
helm-chart-builder – Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw — chart…
meme-coin-audit – Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass)…
changelog-entry – Generate a properly formatted CHANGELOG.md entry in Keep a Changelog format from a commit range or PR. Groups changes…
mid-engagement-ir-detection – Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a…
oss-forensics – GitHub supply-chain forensics: recovery, IOCs, reporting.
cis-benchmarks – Audit and remediate CIS benchmark violations.
incident-response – Use when a security incident has been detected or declared and needs classification, triage, escalation path…
information-security-manager-iso27001 – ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use when designing an…
ops-proxyns – Kernel-level proxy protection via proxy-ns — forces ALL traffic (TCP/UDP/DNS) through Tor using Linux network…
claude-settings-audit – Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project…
origin-ip-discovery – Discover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.
client-secret-exposure-audit – Audit a deployed web app for secrets exposed to the browser: hardcoded API keys/tokens in JS, secrets in HTML…
osint-methodology – Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the…
cloudflare-security-audit – Audit authorized codebases for exploitable vulnerabilities using scoped reconnaissance, adversarial review…
isms-audit-expert – Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control…
iso13485-audit-prep – /compliance-os:iso13485-audit-prep [scope] — ISO 13485 QMS audit 6-question forcing interrogation. Design controls +…
pentest-playbook – 7-phase pentest pipeline from passive recon to exploitation.
iso27001-audit-prep – /compliance-os:iso27001-audit-prep [scope] — ISO 27001 ISMS audit readiness 6-question forcing interrogation. Use…
iso42001-specialist – ISO/IEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three…
phpinfo-to-rce – Chain phpinfo to RCE via exec check when info.php exposed.
iso42001-specialist – ISO/IEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three…
port-mass-scan – Port scan /8-/24 with Masscan+RustScan and nmap banners.
codebase-audit-pre-push – Deep audit before GitHub push: removes junk files, dead code, security holes, and optimization issues. Checks every…
codebase-cleanup-deps-audit – You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain…
port-service-discovery – Nmap scan for MySQL, Redis, FTP, SSH, internal API services.
recon-playbook – Use when starting or restructuring an authorized external web and API assessment.
recon-sector – Parameterized sector recon using sector database.
recon-sector-expansion – Multi-sector batch domain expansion — identify untested/under-tested sectors, generate candidate company domains…
container-scanning – Scan container images for vulnerabilities using Trivy, Grype, and cloud-native tools.
container-security-hardening – Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning…
s3-minio-content-type-xss – Exploit public bucket Content-Type override for stored XSS on target origin.
qutip – Simulate and audit closed and open quantum-system models with QuTiP 5, including deterministic, trajectory…
sast-configuration – Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code…
scada-hikvision-isapi – Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.
sector-recon-methodology – Pick sectors, compile targets, batch recon for campaigns.
security-arsenal – Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and…
source-leak-hunt – Mass scan for exposed env files, backups, and git configs.
cross-chain-relayer-audit – Cross-chain relayer bridge audit register: message hash verifications, replay protection nonces, validator quorum, and…
cross-platform-contract-propagation-audit – Use when auditing whether a field, enum, flag, or API contract propagates consistently across storage, services…
security-requirement-extraction – Derive security requirements from threat models and business context. Use when translating threats into actionable…
staging-subdomain-hunt – Hunt staging via crt.sh when production is WAF-hardened.
subdomain-enumeration – Map subdomains via crt.sh and subfinder at recon kickoff.
scholar-evaluation – Provides qualitative-first, evidence-traceable developmental review of scholarly works and audit low-stakes…
subdomain-takeover-hunt – Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
cyber-audit – Run read-only exposure checks for security advisories and write a structured local audit report.
signed-audit-trails-recipe – Step-by-step cookbook for setting up cryptographically signed audit trails on Claude Code tool calls. Use when…
supply-chain-attack-recon – External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion…
darkmoon-pentest – Start, follow and triage authorized autonomous AI pentest runs on a self-hosted Darkmoon Pro instance through its MCP…
dast-scanning – Perform dynamic application security testing with OWASP ZAP, Burp Suite, and Nikto.
tls-fingerprint-impersonation – Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
database-security – Authorized database security assessment across PostgreSQL, MySQL, MSSQL, MongoDB, and Redis: exposure, authorization…
vhost-enumeration – Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.
solidity-security – Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity…
vmware-vcenter-attack – VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain…
web-enumeration – Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect
sherlock – Find accounts for a username across 400+ platforms.
dependency-management-deps-audit – You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain…
dependency-scanning – Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check.
web2-recon – Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx)…
web3-audit – Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one…
shap – Explain and audit machine-learning predictions with SHAP. Use for selecting SHAP explainers and maskers, computing and…
wordpress-plugin-hunt – Hunt WP plugins via REST, exploit CVEs when version known.
stride-analysis-patterns – Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat…
wp-mass-recon – Batch WP recon: users, CORS, XMLRPC, leaks across domains.
digital-forensics – Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response…
wp-plugin-cve-hunt – Systematic approach to finding and testing CVEs for identified WordPress plugins. Covers plugin discovery, version…
wstg-web-pentest – Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with…
procurement-optimizer – Use when running an annual SaaS audit, doing category-level spend review, or rationalizing the supplier base — when…
xmlrpc-exploitation – Exploit XMLRPC multicall, pingback for brute force and SSRF.
zimbra-attack – Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.
threat-mitigation-mapping – Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments…
qms-audit-expert – ISO 13485 internal audit expertise for medical device QMS. Covers audit planning, execution, nonconformity…
red-team – Use when planning or executing authorized red team engagements, attack path analysis, or offensive security…
ethical-hacking-methodology – Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five…
unbroker – Remove your info from data-broker sites, by name or phone.
wcag-audit-patterns – Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and remediation guidance. Use when…
rfp-responder – Use when an RFP, RFI, RFQ, security questionnaire, vendor questionnaire, or proposal request arrives and the team…
web-pentest – Authorized web pentest: recon, proof-based exploits, report.
file-path-traversal – Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary…
find-bugs – Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review…
firebase – Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup…
firewall-config – Configure iptables, nftables, and cloud firewalls. Implement network segmentation and traffic filtering. Use when…
firmware-analyst – Expert firmware analyst specializing in embedded systems, IoT security, and hardware reverse engineering.
firmware-pentest – Firmware penetration testing following the OWASP FSTM nine-stage flow: extraction, EMBA automation, Firmadyne/QEMU…
fixing-accessibility – Audit and fix HTML accessibility issues including ARIA labels, keyboard navigation, focus management, color contrast…
fixing-metadata – Audit and fix HTML metadata including page titles, meta descriptions, canonical URLs, Open Graph tags, Twitter cards…
security-guidance – PreToolUse security-anti-pattern hook for Claude Code. Catches 12 common security risks (command injection, XSS, SQL…
security-pen-testing – Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks…
frontend-mobile-security-xss-scan – Inspect frontend code for XSS injection points, unsafe DOM manipulation, and missing sanitization.
frontend-security-coder – Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side…
geo-audit – Full website GEO+SEO audit with parallel subagent delegation.
geo-platform-optimizer – Platform-specific AI search optimization — audit and optimize for Google AI Overviews, ChatGPT, Perplexity, Gemini…
geo-proposal – Auto-generate a professional, client-ready GEO service proposal from audit data.
geo-report – Generate a professional, client-facing GEO report combining all audit results into a single deliverable with scores…
geo-schema – Schema.org structured data audit and generation optimized for AI discoverability — detect, validate, and generate…
geo-technical – Technical SEO audit with GEO-specific checks — crawlability, indexability, security, performance, SSR, and AI crawler…
senior-secops – Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure…
senior-security – Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick…
hardware-security – Authorized hardware and embedded interface security research: UART/JTAG discovery, debug-pad triage, secure-boot…
skill-security-auditor – Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill…
hipaa-compliance – Implement HIPAA security and privacy rules. Configure PHI protections and BAA requirements. Use when handling…
soc2-audit-prep – /compliance-os:soc2-audit-prep [scope] — SOC 2 Type II readiness 6-question forcing interrogation. Observation-period…
soc2-compliance – Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit…
hunt-auth-bypass – Hunting skill for auth bypass vulnerabilities.
hunt-business-logic – Hunting skill for business logic vulnerabilities.
hunt-cache-poison – Hunting skill for cache poison vulnerabilities.
hunt-cicd – Hunt CI/CD pipeline vulnerabilities
hunt-csrf – Hunting skill for csrf vulnerabilities.
hunt-dom – Hunt client-side DOM vulnerabilities
hunt-fintech-graphql – Hunt fintech-specific GraphQL vulnerabilities
hunt-graphql – Hunting skill for graphql vulnerabilities.
hunt-grpc – Hunt gRPC vulnerabilities
hunt-idor – Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
hunt-laravel – Hunt Laravel specific vulnerabilities
hunt-misc – Hunting skill for misc vulnerabilities. Reference for authorized role, token and workflow-boundary reviews. Historical…
hunt-nextjs – Hunt Next.js specific vulnerabilities
hunt-nodejs – Hunt Node.js specific vulnerabilities
hunt-oauth – Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
hunt-race-condition – Hunting skill for race condition vulnerabilities.
hunt-rag-vector – Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses)
hunt-rce – Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
hunt-session – Hunt Session Management vulnerabilities
hunt-springboot – Hunt Spring Boot specific vulnerabilities
hunt-sqli – Hunting skill for sqli vulnerabilities.
hunt-ssrf – Hunting skill for ssrf vulnerabilities.
hunt-subdomain – Hunting skill for subdomain takeover vulnerabilities.
hunt-websocket – Hunt WebSocket vulnerabilities
hunt-xss – Hunting skill for xss vulnerabilities.
hunt-xxe – Hunting skill for xxe vulnerabilities.
incident-response – Handle security incidents with IR playbooks and procedures.
iso27001-compliance – Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when…
tech-stack-evaluator – Technology stack evaluation and comparison with TCO analysis, security assessment, and ecosystem health scoring. Use…
threat-detection – Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers…
k8s-security-policies – Guide for NetworkPolicy, RBAC, and Pod Security Admission/Standards (PodSecurityPolicy was removed in Kubernetes1.25)…
laravel-expert – Senior Laravel Engineer role for production-grade, maintainable, and idiomatic Laravel solutions. Focuses on clean…
laravel-security-audit – Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure…
linkerd-patterns – Production patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes.
lintlang-audit – Audit named agent instructions, tool definitions, and supported Python prompts with local LintLang checks; return…
llm-app-security – Secure LLM-powered applications with input validation, output controls, tenant isolation, and abuse prevention.
llm-security – Authorized security assessment of LLM applications and AI agents: prompt injection, tool abuse, RAG exposure, memory…
local-legal-seo-audit – Audit and improve local SEO for law firms, attorneys, forensic experts and legal/professional services sites with…
logic-fix-all – Autonomous repository-wide audit-and-fix pipeline: health → review → locate/explain → fix → diff-verify → iterate…
loopy – Discover, find, compare, audit, repair, adapt, craft, run, debrief, and prepare repeatable AI-agent loops for…
luna – Reviews code for objective correctness, security, and reliability.
macos-reverse – Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security…
malware-analysis – Analyze suspected malware through static, dynamic, and behavioral techniques: IOC extraction, YARA/Sigma rule…
malware-analyst – Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters…
marketplace-rbac-audit – Audit multi-role marketplace authorization across roles, resource ownership, tenant boundaries, and order-state…
markstream-migration – Audit and migrate an existing Markdown renderer to Markstream while preserving custom renderers, security policy…
meme-coin-audit – Meme coin and token security audit
memory-forensics – Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response…
metasploit-framework – ⚠️ AUTHORIZED USE ONLY > This skill is for educational purposes or authorized security assessments only. > You must…
mid-engagement-ir-detection – Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a…
mobile-reverse – Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation…
mobile-security-coder – Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific…
model-supply-chain-security – Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls…
network-engineer – Expert network engineer specializing in modern cloud networking, security architectures, and performance optimization.
odoo-security-rules – Expert in Odoo access control: ir.model.access.csv, record rules (ir.rule), groups, and multi-company security patterns.
offensive-osint – Operational arsenal for authorized external red-team and bug-bounty recon.
openclaw-security-hardening – Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network…
ot-ics – Authorized OT/ICS security assessment: Purdue-model zoning review, PLC/SCADA exposure, industrial protocol discovery…
outreachgenie-list-audit – Audit saved OutreachGenie prospect lists against an outreach flow for missing template values, text limits and…
patch-diff-exploit – Locate vulnerability fixes in vendor patches, diff binaries across versions, and build N-day PoCs. Attack-side…
pentest-checklist – Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough…
pentest-commands – Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation…
pentest-tools – Operate 20+ penetration-testing tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, and more) through structured workflows…
production-audit – Audit a shipped repo for production-readiness gaps across RLS, webhooks, secrets, grants, Stripe idempotency, mobile…
production-code-audit – Audit an explicitly scoped codebase for evidenced security, correctness and performance issues; implement authorized…
project-skill-audit – Audit a project and recommend the highest-value skills to add or update.
protocol-reverse-engineering – Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research…
pwn-chain – Go from reverse engineering to a working exploit: stack/heap/kernel pwn workflows with pwntools, libc-database, ROP…
recon-scope-triage – Triage ASM/recon output for ownership before testing
red-team-tools – Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance…
saas-security-posture – Audit and harden your SaaS tool stack
sast-configuration – Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive…
sast-scanning – Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube.
scanning-tools – Master essential security scanning tools for network discovery, vulnerability assessment, web application testing…
security-and-hardening – Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external…
security-arsenal – Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and…
security-audit – Comprehensive security auditing workflow covering web application testing, API security, penetration testing…
security-auditor – Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks.
security-automation – Automate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR…
security-bluebook-builder – Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using…
security-checklist – Review a scoped architecture against evidence-based network, identity, data, secrets, dependency and incident-response…
security-compliance-compliance-check – You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2…
security-requirement-extraction – Derive security requirements from threat models and business context. Use when translating threats into actionable…
security-scanning-security-dependencies – You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain…
security-scanning-security-hardening – Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
security-scanning-security-sast – Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks
semgrep-rule-creator – Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing…
sharp-edges – Review misuse-prone security APIs, configuration defaults, cryptographic interfaces and authentication ergonomics…
skill-audit – Pre-install review framework for AI agent skills: inspect complete content, permissions, dependencies and suspicious…
skill-security-audit – Audit an Agent Skill, MCP server, connector, or desktop extension before installation by tracing code, dependencies…
skill-skill – Write, upgrade or audit a Claude skill so it changes what gets generated: forcing functions, triggerable descriptions…
soc2-compliance – Implement SOC 2 Trust Services Criteria. Configure security, availability, and processing integrity controls. Use when…
solidity-security – Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.
soroban-contract-audit – Soroban smart contract security audit register: authorization checks, panic pathways, integer overflows, and storage…
soroban-oracle-data-feed-audit – DeFi price oracle integration and safety audit register: heartbeat bounds, stale price threshold reversion, and TWAP…
src-hunter – Bug-bounty/SRC vulnerability-hunting workflow: five-phase methodology (intake, recon, enumeration, hunt, report) with…
stellar-asset-clawback-compliance – Regulated Stellar asset clawback architecture register: issuer authorization flags, claimable balance revocations, and…
supply-chain-attack-recon – Authorized read-only review of public software supply-chain exposure
supply-chain-risk-auditor – Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack…
supply-chain-security – Software supply-chain security assessment: SBOM generation, SCA scanning, CI/CD pipeline review, container image…
swiftui-performance-audit – Audit SwiftUI performance issues from code review and profiling evidence.
threat-hunting – Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident…
threat-intelligence – Authorized OSINT and cyber threat intelligence: enriching IOCs, campaigns, impersonation, scams, and threat-actor…
threat-mitigation-mapping – Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments…
threat-modeling – Conduct threat modeling using STRIDE methodology. Identify threats, assess risks, and design security controls. Use…
threat-modeling-expert – Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA…
top-web-vulnerabilities – Provide an illustrative, overlapping reference for common web application vulnerability patterns organized by…
usage-engineer – Cut wasted tokens in coding-agent sessions: compact long logs, stop identical retries, check stale project maps, and…
vendor-management – Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when…
vercel-optimize – Audit deployed Vercel apps for cost and performance issues using metrics, project config, code scans, and…
vulnerability-scanner – Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk…
vulnerability-scanning – Scan systems and dependencies for CVEs and security vulnerabilities.
waf-setup – Deploy and tune Web Application Firewalls. Configure rules for OWASP Top 10 protection. Use when protecting web…
wcag-audit-patterns – Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies.
web-security-testing – Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication…
web2-recon – Web2 recon pipeline
web3-audit – Smart contract security audit
windows-hardening – Harden Windows servers per security baselines and CIS benchmarks. Configure Group Policy, Windows Defender, and…
windows-privilege-escalation – Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows…
xss-html-injection – Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML…
zero-trust – Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous…
zeroize-audit – Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler…