1,457 agent tools in this category, ranked by GitHub stars for now. Hands-on test results will replace this ranking as they finish.
The three most-starred tools here. Not tested together yet.
Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.
npx skills add DietrichGebert/ponytail --skill ponytail-auditHarvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report.
npx skills add DietrichGebert/ponytail --skill ponytail-debtHardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or externa
npx skills add addyosmani/agent-skills --skill security-and-hardening| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| ponytail-audit Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first. SkillInstall · skills CLI | 190,107 | — | ||
| ponytail-debt Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report. SkillInstall · skills CLI | 190,107 | — | ||
| security-and-hardening Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, SkillInstall · skills CLI | 117,009 | — | ||
| deal-with-security-advisory Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, SkillInstall · skills CLI | 113,555 | — | ||
| html-ppt-knowledge-arch-blueprint OpenDesign's incident retro: the daemon-restart data bug, the root cause, the fix, and the systemic follow-ups. Built as a decision-grade product mana SkillInstall · skills CLI | 107,474 | — | ||
| html-ppt-testing-safety-alert A hospital data-governance briefing: patient-data risk, the control framework, accountability, and the approval the board must give. Built as a decisi SkillInstall · skills CLI | 107,474 | — | ||
| digicert-automation Automate Digicert tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,395 | — | ||
| security-research Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, cla SkillInstall · skills CLI | 70,891 | — | ||
| accesslint-audit Find and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or page, produce a prioritized written report, no edits) and fix (aud SkillInstall · skills CLI | 49,642 | — | ||
| accesslint-diff Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [name] to dif SkillInstall · skills CLI | 49,642 | — | ||
| accesslint-scan Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing. SkillInstall · skills CLI | 49,642 | — | ||
| api-security-testing API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best pra SkillInstall · skills CLI | 49,642 | — | ||
| backend-security-coder Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security imp SkillInstall · skills CLI | 49,642 | — | ||
| burp-suite-testing Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, re SkillInstall · skills CLI | 49,642 | — | ||
| cc-skill-security-review This skill guides review of security practices and potential vulnerabilities; no checklist ensures all code is secure. Use when implementing authentic SkillInstall · skills CLI | 49,642 | — | ||
| dependency-management-deps-audit You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependenci SkillInstall · skills CLI | 49,642 | — | ||
| django-access-review Use when reviewing Django or DRF access control: trace authorization flows, IDOR risks, object permissions, query scoping and tenant isolation before SkillInstall · skills CLI | 49,642 | — | ||
| fixing-accessibility Audit and fix HTML accessibility issues including ARIA labels, keyboard navigation, focus management, color contrast, and form errors. Use when adding SkillInstall · skills CLI | 49,642 | — | ||
| frontend-security-coder Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. SkillInstall · skills CLI | 49,642 | — | ||
| fsi-compliance-checker Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0.1 and MAS TRM (Singapore financial regulator), producing a SkillInstall · skills CLI | 49,642 | — | ||
| pci-compliance Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification. SkillInstall · skills CLI | 49,642 | — | ||
| sast-configuration Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple pro SkillInstall · skills CLI | 49,642 | — | ||
| screen-reader-testing Practical guide to testing web applications with screen readers for comprehensive accessibility validation. SkillInstall · skills CLI | 49,642 | — | ||
| security-auditor Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. SkillInstall · skills CLI | 49,642 | — | ||
| security-requirement-extraction Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security use SkillInstall · skills CLI | 49,642 | — | ||
| skill-security-audit Audit an Agent Skill, MCP server, connector, or desktop extension before installation by tracing code, dependencies, permissions, credentials, data fl SkillInstall · skills CLI | 49,642 | — | ||
| threat-modeling-expert Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirem SkillInstall · skills CLI | 49,642 | — | ||
| top-web-vulnerabilities Provide an illustrative, overlapping reference for common web application vulnerability patterns organized by category. This skill enables systematic SkillInstall · skills CLI | 49,642 | — | ||
| ui-a11y Audit a component or page for accessibility issues and fix them SkillInstall · skills CLI | 49,642 | — | ||
| vulnerability-scanner Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization. SkillInstall · skills CLI | 49,642 | — | ||
| wcag-audit-patterns Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies. SkillInstall · skills CLI | 49,642 | — | ||
| web-security-testing Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues. SkillInstall · skills CLI | 49,642 | — | ||
| attack-tree-construction Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security ris SkillInstall · skills CLI | 42,470 | — | ||
| gdpr-data-handling Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU SkillInstall · skills CLI | 42,470 | — | ||
| incident-runbook-templates Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a serv SkillInstall · skills CLI | 42,470 | — | ||
| postmortem-writing Write effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem SkillInstall · skills CLI | 42,470 | — | ||
| protocol-reverse-engineering Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing netw SkillInstall · skills CLI | 42,470 | — | ||
| sast-configuration Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security sca SkillInstall · skills CLI | 42,470 | — | ||
| solidity-security Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contrac SkillInstall · skills CLI | 42,470 | — | ||
| stride-analysis-patterns Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating secu SkillInstall · skills CLI | 42,470 | — | ||
| threat-mitigation-mapping Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or va SkillInstall · skills CLI | 42,470 | — | ||
| audit-integrity Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, o SkillInstall · skills CLI | 41,117 | — | ||
| data-breach-blast-radius Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a re SkillInstall · skills CLI | 41,117 | — | ||
| gdpr-compliant Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authent SkillInstall · skills CLI | 41,117 | — | ||
| achieving-cmmc-level-2-compliance Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requireme SkillInstall · skills CLI | 36,058 | — | ||
| building-soc-metrics-and-kpi-tracking Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, an SkillInstall · skills CLI | 36,058 | — | ||
| building-soc-playbook-for-ransomware Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with speci SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-actor-profile-from-osint Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicator SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-feed-aggregation-with-misp Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intell SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-hunt-hypothesis-framework Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates t SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-intelligence-enrichment-in-splunk Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them agains SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-intelligence-feed-integration Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms int SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-intelligence-platform Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system wit SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-aging-and-sla-tracking Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days cri SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-dashboard-with-defectdojo Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-exception-tracking-system Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic ex SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-scanning-workflow Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of sec SkillInstall · skills CLI | 36,058 | — | ||
| bypassing-authentication-with-forced-browsing Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during auth SkillInstall · skills CLI | 36,058 | — | ||
| coercing-authentication-with-coercer-petitpotam Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz mod SkillInstall · skills CLI | 36,058 | — | ||
| collecting-indicators-of-compromise Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blockin SkillInstall · skills CLI | 36,058 | — | ||
| collecting-open-source-intelligence Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available SkillInstall · skills CLI | 36,058 | — | ||
| collecting-threat-intelligence-with-misp Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events a SkillInstall · skills CLI | 36,058 | — | ||
| collecting-volatile-evidence-from-compromised-host Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running proce SkillInstall · skills CLI | 36,058 | — | ||
| conducting-api-security-testing Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validatio SkillInstall · skills CLI | 36,058 | — | ||
| conducting-cloud-incident-response Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP A SkillInstall · skills CLI | 36,058 | — | ||
| conducting-cloud-penetration-testing This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understandin SkillInstall · skills CLI | 36,058 | — | ||
| conducting-cyber-risk-assessment-with-nist-800-30 Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources SkillInstall · skills CLI | 36,058 | — | ||
| conducting-domain-persistence-with-dcsync Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, SkillInstall · skills CLI | 36,058 | — | ||
| conducting-external-reconnaissance-with-osint Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-active-directory-tiered-model Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, pri SkillInstall · skills CLI | 36,058 | — | ||
| configuring-aws-verified-access-for-ztna Configure AWS Verified Access to provide VPN-less zero trust network access to internal apps, combining identity trust providers (IAM Identity Center, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-certificate-authority-with-openssl Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-host-based-intrusion-detection Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security viol SkillInstall · skills CLI | 36,058 | — | ||
| configuring-hsm-for-key-storage Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-identity-aware-proxy-with-google-iap Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, a SkillInstall · skills CLI | 36,058 | — | ||
| configuring-ldap-security-hardening Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, chann SkillInstall · skills CLI | 36,058 | — | ||
| configuring-microsegmentation-for-zero-trust Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, prev SkillInstall · skills CLI | 36,058 | — | ||
| configuring-multi-factor-authentication-with-duo Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup SkillInstall · skills CLI | 36,058 | — | ||
| configuring-network-segmentation-with-vlans Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-oauth2-authorization-flow Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering SkillInstall · skills CLI | 36,058 | — | ||
| configuring-pfsense-firewall-rules Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic betwee SkillInstall · skills CLI | 36,058 | — | ||
| configuring-snort-ids-for-intrusion-detection Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and aler SkillInstall · skills CLI | 36,058 | — | ||
| configuring-suricata-for-network-monitoring Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic SkillInstall · skills CLI | 36,058 | — | ||
| configuring-tls-1-3-for-secure-communications Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with opens SkillInstall · skills CLI | 36,058 | — | ||
| configuring-windows-defender-advanced-settings Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, netw SkillInstall · skills CLI | 36,058 | — | ||
| configuring-windows-event-logging-for-detection Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigatio SkillInstall · skills CLI | 36,058 | — | ||
| configuring-zscaler-private-access-for-ztna Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application se SkillInstall · skills CLI | 36,058 | — | ||
| containing-active-breach Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short- SkillInstall · skills CLI | 36,058 | — | ||
| continuous-llm-red-teaming-with-promptfoo Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS pre SkillInstall · skills CLI | 36,058 | — | ||
| correlating-security-events-in-qradar Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi- SkillInstall · skills CLI | 36,058 | — | ||
| correlating-threat-campaigns Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute t SkillInstall · skills CLI | 36,058 | — | ||
| defending-llms-with-guardrails Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementar SkillInstall · skills CLI | 36,058 | — | ||
| deobfuscating-javascript-malware Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipul SkillInstall · skills CLI | 36,058 | — | ||
| deobfuscating-powershell-obfuscated-malware Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidd SkillInstall · skills CLI | 36,058 | — | ||
| deploying-active-directory-honeytokens Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (h SkillInstall · skills CLI | 36,058 | — | ||
| deploying-cloud-deception-with-decoy-resources Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the ins SkillInstall · skills CLI | 36,058 | — | ||
| deploying-cloudflare-access-for-zero-trust Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks SkillInstall · skills CLI | 36,058 | — | ||
| deploying-decoy-files-for-ransomware-detection Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy document SkillInstall · skills CLI | 36,058 | — | ||
| deploying-edr-agent-with-crowdstrike Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automa SkillInstall · skills CLI | 36,058 | — | ||
| deploying-honeytokens-and-canarytokens Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source SkillInstall · skills CLI | 36,058 | — | ||
| deploying-osquery-for-endpoint-monitoring Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, SkillInstall · skills CLI | 36,058 | — | ||
| deploying-palo-alto-prisma-access-zero-trust Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy SkillInstall · skills CLI | 36,058 | — | ||
| deploying-ransomware-canary-files Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, cre SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ai-model-prompt-injection-attacks Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, fla SkillInstall · skills CLI | 36,058 | — | ||
| detecting-anomalies-in-industrial-control-systems Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA SkillInstall · skills CLI | 36,058 | — | ||
| detecting-anomalous-authentication-patterns Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, cred SkillInstall · skills CLI | 36,058 | — | ||
| detecting-api-enumeration-attacks Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, paramet SkillInstall · skills CLI | 36,058 | — | ||
| detecting-arp-poisoning-in-network-traffic Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scr SkillInstall · skills CLI | 36,058 | — | ||
| detecting-attacks-on-historian-servers Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized quer SkillInstall · skills CLI | 36,058 | — | ||
| detecting-attacks-on-scada-systems This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on in SkillInstall · skills CLI | 36,058 | — | ||
| detecting-aws-cloudtrail-anomalies Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise SkillInstall · skills CLI | 36,058 | — | ||
| detecting-aws-guardduty-findings-automation Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine SkillInstall · skills CLI | 36,058 | — | ||
| detecting-aws-iam-privilege-escalation Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission SkillInstall · skills CLI | 36,058 | — | ||
| detecting-azure-lateral-movement Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomal SkillInstall · skills CLI | 36,058 | — | ||
| detecting-azure-service-principal-abuse Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel/Splunk) against Azure AD Audit and Sign-in Logs, cove SkillInstall · skills CLI | 36,058 | — | ||
| detecting-azure-storage-account-misconfigurations Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only SkillInstall · skills CLI | 36,058 | — | ||
| detecting-beaconing-patterns-with-zeek Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Panda SkillInstall · skills CLI | 36,058 | — | ||
| detecting-bluetooth-low-energy-attacks Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle int SkillInstall · skills CLI | 36,058 | — | ||
| detecting-broken-object-property-level-authorization Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass ass SkillInstall · skills CLI | 36,058 | — | ||
| detecting-business-email-compromise Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclos SkillInstall · skills CLI | 36,058 | — | ||
| detecting-business-email-compromise-with-ai Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and context SkillInstall · skills CLI | 36,058 | — | ||
| detecting-cloud-threats-with-guardduty Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-command-and-control-over-dns Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entrop SkillInstall · skills CLI | 36,058 | — | ||
| detecting-compromised-cloud-credentials Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffi SkillInstall · skills CLI | 36,058 | — | ||
| detecting-credential-dumping-techniques Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Wind SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dcsync-attack-in-active-directory Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dependency-confusion Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal packag SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dll-sideloading-attacks Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dnp3-protocol-anomalies Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol viol SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dns-exfiltration-with-dns-query-analysis Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single SkillInstall · skills CLI | 36,058 | — | ||
| detecting-entra-offensive-tools-in-graph-logs Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration t SkillInstall · skills CLI | 36,058 | — | ||
| detecting-evasion-techniques-in-endpoint-logs Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool di SkillInstall · skills CLI | 36,058 | — | ||
| detecting-exfiltration-over-dns-with-zeek Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or pa SkillInstall · skills CLI | 36,058 | — | ||
| detecting-fileless-attacks-on-endpoints Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. U SkillInstall · skills CLI | 36,058 | — | ||
| detecting-fileless-malware-techniques Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living- SkillInstall · skills CLI | 36,058 | — | ||
| detecting-golden-ticket-attacks-in-kerberos-logs Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies SkillInstall · skills CLI | 36,058 | — | ||
| detecting-golden-ticket-forgery Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal SkillInstall · skills CLI | 36,058 | — | ||
| detecting-insider-data-exfiltration-via-dlp Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoin SkillInstall · skills CLI | 36,058 | — | ||
| detecting-insider-threat-behaviors Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-c SkillInstall · skills CLI | 36,058 | — | ||
| detecting-insider-threat-with-ueba Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform pe SkillInstall · skills CLI | 36,058 | — | ||
| detecting-kerberoasting-attacks Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers r SkillInstall · skills CLI | 36,058 | — | ||
| detecting-lateral-movement-in-network Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zee SkillInstall · skills CLI | 36,058 | — | ||
| detecting-lateral-movement-with-splunk Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/P SkillInstall · skills CLI | 36,058 | — | ||
| detecting-lateral-movement-with-zeek Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerbe SkillInstall · skills CLI | 36,058 | — | ||
| detecting-living-off-the-land-attacks Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and par SkillInstall · skills CLI | 36,058 | — | ||
| detecting-living-off-the-land-with-lolbas Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and p SkillInstall · skills CLI | 36,058 | — | ||
| detecting-malicious-npm-packages Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-malicious-scheduled-tasks-with-sysmon Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), a SkillInstall · skills CLI | 36,058 | — | ||
| detecting-mimikatz-execution-patterns Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detectio SkillInstall · skills CLI | 36,058 | — | ||
| detecting-misconfigured-azure-storage Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violat SkillInstall · skills CLI | 36,058 | — | ||
| detecting-mobile-malware-behavior Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, an SkillInstall · skills CLI | 36,058 | — | ||
| detecting-modbus-command-injection-attacks Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frame SkillInstall · skills CLI | 36,058 | — | ||
| detecting-modbus-protocol-anomalies Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep pa SkillInstall · skills CLI | 36,058 | — | ||
| detecting-model-extraction-attacks Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal SkillInstall · skills CLI | 36,058 | — | ||
| detecting-network-anomalies-with-zeek Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous SkillInstall · skills CLI | 36,058 | — | ||
| detecting-network-scanning-with-ids-signatures Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ntlm-relay-with-event-correlation Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoni SkillInstall · skills CLI | 36,058 | — | ||
| detecting-oauth-token-theft Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refres SkillInstall · skills CLI | 36,058 | — | ||
| detecting-pass-the-hash-attacks Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected SkillInstall · skills CLI | 36,058 | — | ||
| detecting-pass-the-ticket-attacks Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection SkillInstall · skills CLI | 36,058 | — | ||
| detecting-port-scanning-with-fail2ban Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatica SkillInstall · skills CLI | 36,058 | — | ||
| detecting-privilege-escalation-attempts Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel ex SkillInstall · skills CLI | 36,058 | — | ||
| detecting-privilege-escalation-in-kubernetes-pods Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit SkillInstall · skills CLI | 36,058 | — | ||
| detecting-process-hollowing-technique Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR tele SkillInstall · skills CLI | 36,058 | — | ||
| detecting-process-injection-techniques Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-qr-code-phishing-with-email-security Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using imag SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ransomware-encryption-behavior Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scor SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ransomware-precursors-in-network Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control b SkillInstall · skills CLI | 36,058 | — | ||
| detecting-rdp-brute-force-attacks Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Ty SkillInstall · skills CLI | 36,058 | — | ||
| detecting-rootkit-activity Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network c SkillInstall · skills CLI | 36,058 | — | ||
| detecting-s3-data-exfiltration-attempts Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alert SkillInstall · skills CLI | 36,058 | — | ||
| detecting-secure-boot-bypass Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and h SkillInstall · skills CLI | 36,058 | — | ||
| detecting-serverless-function-injection Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source SkillInstall · skills CLI | 36,058 | — | ||
| detecting-service-account-abuse Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR/SIEM telemetry (Cro SkillInstall · skills CLI | 36,058 | — | ||
| detecting-shadow-api-endpoints Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysis against API gateways (Kong, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-shadow-it-cloud-usage Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python panda SkillInstall · skills CLI | 36,058 | — | ||
| detecting-spearphishing-with-email-gateway Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway ( SkillInstall · skills CLI | 36,058 | — | ||
| detecting-sql-injection-via-waf-logs Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to i SkillInstall · skills CLI | 36,058 | — | ||
| detecting-stuxnet-style-attacks Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipul SkillInstall · skills CLI | 36,058 | — | ||
| detecting-supply-chain-attacks-in-ci-cd Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expr SkillInstall · skills CLI | 36,058 | — | ||
| detecting-suspicious-oauth-application-consent Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to ident SkillInstall · skills CLI | 36,058 | — | ||
| detecting-suspicious-powershell-execution Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion us SkillInstall · skills CLI | 36,058 | — | ||
| detecting-t1003-credential-dumping-with-edr Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sy SkillInstall · skills CLI | 36,058 | — | ||
| detecting-t1055-process-injection-with-sysmon Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 1 SkillInstall · skills CLI | 36,058 | — | ||
| detecting-t1548-abuse-elevation-control-mechanism Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setui SkillInstall · skills CLI | 36,058 | — | ||
| detecting-typosquatting-packages Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proxim SkillInstall · skills CLI | 36,058 | — | ||
| detecting-typosquatting-packages-in-npm-pypi Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metr SkillInstall · skills CLI | 36,058 | — | ||
| detecting-wmi-persistence Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and SkillInstall · skills CLI | 36,058 | — | ||
| emulating-cloud-attacks-with-stratus-red-team Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-deto SkillInstall · skills CLI | 36,058 | — | ||
| eradicating-malware-from-infected-systems Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services SkillInstall · skills CLI | 36,058 | — | ||
| executing-active-directory-attack-simulation Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege path SkillInstall · skills CLI | 36,058 | — | ||
| owasp-security Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 1 SkillInstall · skills CLI | 33,462 | — | ||
| ai-security Use when assessing an AI/ML system or LLM agent for prompt injection, jailbreaks, model inversion, data poisoning or tool abuse. Maps findings to MITR SkillInstall · skills CLI | 29,745 | — | ||
| cloud-security Use when checking AWS, Azure or GCP for security misconfigurations: IAM privilege escalation, public buckets, open security groups, IaC gaps. Runs clo SkillInstall · skills CLI | 29,745 | — | ||
| security-guidance Use when installing or tuning the PreToolUse security hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserializati SkillInstall · skills CLI | 29,745 | — | ||
| security-pen-testing Authorized penetration testing of an app or API: vulnerability scans, OWASP Top 10 checks, dependency audits and a pentest report. Use whenever the us SkillInstall · skills CLI | 29,745 | — | ||
| senior-secops Find and fix application security problems: security reviews, CVE remediation, hardening, secrets and auth, SOC 2, PCI-DSS, HIPAA and GDPR checks. Use SkillInstall · skills CLI | 29,745 | — | ||
| senior-security Check if a design or code is secure: STRIDE threat model, DREAD risk scores, leaked secret scan. Use whenever the user asks what could be attacked, ho SkillInstall · skills CLI | 29,745 | — | ||
| security-best-practices Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests securi SkillInstall · skills CLI | 28,722 | — | ||
| security-ownership-map Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON SkillInstall · skills CLI | 28,722 | — | ||
| nocobase-app-plugin-authorization Design and implement NocoBase 3 business permissions: job responsibilities, pages, business actions, fields, record scopes, relations, team inheritanc SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authz-default-access Design, implement and verify default access for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authz-restriction-rules Design, implement and verify restriction rules for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authz-sharing-rules Design, implement and verify sharing rules for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,914 | — | ||
| assuredworkloads-environment-assessor Discover Google Cloud resource telemetry and effective Org Policies, evaluate brownfield workloads against sovereign data boundary and compliance stan SkillInstall · skills CLI | 24,122 | — | ||
| assuredworkloads-frameworks-navigator Acts as a Data Boundary Compliance Analyst that maps user compliance queries against Data Boundary Frameworks and cloud controls, validates matched re SkillInstall · skills CLI | 24,122 | — | ||
| cloud-armor-crs-rule-upgrader Upgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates e SkillInstall · skills CLI | 24,122 | — | ||
| gke-platform-security Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBA SkillInstall · skills CLI | 24,122 | — | ||
| gke-workload-security Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running securi SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-filestore-auditing Audits Filestore instances on Google Cloud across projects for disaster recovery readiness (missing or stale backups), security access governance (ove SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-scc-query Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Securi SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-scc-remediation Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-solution-multi-agent-security Designs, deploys, and secures Google Cloud Agent Gateway solutions. Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGEN SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-waf-security Evaluates Google Cloud workloads and provides actionable recommendations for identity management, access control, permissions and roles, network and p SkillInstall · skills CLI | 24,122 | — | ||
| skill-security-auditor Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection SkillInstall · skills CLI | 15,813 | — | ||
| secure-code-guardian Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implem SkillInstall · skills CLI | 12,349 | — | ||
| security-reviewer Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when SkillInstall · skills CLI | 12,349 | — | ||
| android-intent-security Audits, detects, and remediates Android Intent and component security vulnerabilities. Use this skill when auditing component configurations in Androi SkillInstall · skills CLI | 10,498 | — | ||
| android-permissions-security Audits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing AndroidManifest.xml, defining SkillInstall · skills CLI | 10,498 | — | ||
| play-policy-insights Automated auditor designed to verify Android applications against Google Play Policy domains. It cross-references static code analysis with Play Store SkillInstall · skills CLI | 10,498 | — | ||
| antinet-security-scan 信息安全分析师与软件开发工程师在搭建文档处理流水线时，当需要拦截违规文件或外部URL，请挂载此技能作为强制前置安检，自动输出 pass/reject 判定与详细合规扫描报告，一键守住零信任安全底线。 SkillInstall · skills CLI | 9,516 | — | ||
| security-scan 对进入系统的文件或 URL 执行安全与合规扫描，输出 pass/reject 判定与扫描报告，作为所有文档处理的强制前置关卡。 SkillInstall · skills CLI | 9,516 | — | ||
| audit-augmentation Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark SkillInstall · skills CLI | 8,169 | — | ||
| crypto-protocol-diagram Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and gen SkillInstall · skills CLI | 8,169 | — | ||
| cvss-scoring Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerabili SkillInstall · skills CLI | 8,169 | — | ||
| genotoxic Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary SkillInstall · skills CLI | 8,169 | — | ||
| graph-evolution Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detec SkillInstall · skills CLI | 8,169 | — | ||
| mermaid-to-proverif Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a Pro SkillInstall · skills CLI | 8,169 | — | ||
| slicing-code-context Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use whe SkillInstall · skills CLI | 8,169 | — | ||
| taint-trace Improves taint-analysis coverage and precision by using Trailmark graphs to repair native source, sink, sanitizer, propagation, and type models, then SkillInstall · skills CLI | 8,169 | — | ||
| trailmark Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagatio SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-finding-triage Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-review-gate Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-structural Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundarie SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-summary Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvani SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-variant-neighborhood Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared caller SkillInstall · skills CLI | 8,169 | — | ||
| variant-analysis Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic SkillInstall · skills CLI | 8,169 | — | ||
| vector-forge Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped muta SkillInstall · skills CLI | 8,169 | — | ||
| vulnerability-triage-brocards This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a find SkillInstall · skills CLI | 8,169 | — | ||
| wycheproof Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, E SkillInstall · skills CLI | 8,169 | — | ||
| yara-rule-authoring Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers nami SkillInstall · skills CLI | 8,169 | — | ||
| zeroize-audit Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysi SkillInstall · skills CLI | 8,169 | — | ||
| health Audits or prunes agent config, instruction drift, hooks or MCP, and AI maintainability. Use when Claude, Codex, or Pi setup looks wrong or guidance ne SkillInstall · skills CLI | 7,582 | — | ||
| hunt-api-misconfig Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, veri SkillInstall · skills CLI | 5,677 | — | ||
| hunt-aspnet Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, reques SkillInstall · skills CLI | 5,677 | — | ||
| hunt-ato Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predict SkillInstall · skills CLI | 5,677 | — | ||
| hunt-auth-bypass Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-20 SkillInstall · skills CLI | 5,677 | — | ||
| hunt-brute-force Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/em SkillInstall · skills CLI | 5,677 | — | ||
| hunt-business-logic Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), ne SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cache-poison Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / SkillInstall · skills CLI | 5,677 | — | ||
| hunt-captcha-bypass Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replay SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cicd Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poiso SkillInstall · skills CLI | 5,677 | — | ||
| hunt-clickjacking Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cloud-misconfig Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write) SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cors Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only SkillInstall · skills CLI | 5,677 | — | ||
| hunt-csrf Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Arg SkillInstall · skills CLI | 5,677 | — | ||
| hunt-deserialization Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.l SkillInstall · skills CLI | 5,677 | — | ||
| hunt-dispatch Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Us SkillInstall · skills CLI | 5,677 | — | ||
| hunt-dom Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service SkillInstall · skills CLI | 5,677 | — | ||
| hunt-exceptional-conditions Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and mak SkillInstall · skills CLI | 5,677 | — | ||
| hunt-file-upload Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double e SkillInstall · skills CLI | 5,677 | — | ||
| hunt-fintech-graphql Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio SkillInstall · skills CLI | 5,677 | — | ||
| hunt-forgot-password Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs inva SkillInstall · skills CLI | 5,677 | — | ||
| hunt-graphql Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM featur SkillInstall · skills CLI | 5,677 | — | ||
| hunt-grpc Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoi SkillInstall · skills CLI | 5,677 | — | ||
| hunt-host-header Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks ups SkillInstall · skills CLI | 5,677 | — | ||
| hunt-html-injection Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML SkillInstall · skills CLI | 5,677 | — | ||
| hunt-http-smuggling Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next b SkillInstall · skills CLI | 5,677 | — | ||
| hunt-sqli Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $ SkillInstall · skills CLI | 5,677 | — | ||
| hunt-ssrf Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exc SkillInstall · skills CLI | 5,677 | — | ||
| hunt-ssti Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thyme SkillInstall · skills CLI | 5,677 | — | ||
| hunt-subdomain Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-poo SkillInstall · skills CLI | 5,677 | — | ||
| hunt-tls-network Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/D SkillInstall · skills CLI | 5,677 | — | ||
| hunt-websocket Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentica SkillInstall · skills CLI | 5,677 | — | ||
| hunt-xss Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflect SkillInstall · skills CLI | 5,677 | — | ||
| hunt-xxe Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML As SkillInstall · skills CLI | 5,677 | — | ||
| meme-coin-audit Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze a SkillInstall · skills CLI | 5,677 | — | ||
| security-arsenal Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need s SkillInstall · skills CLI | 5,677 | — | ||
| vmware-vcenter-attack VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload SkillInstall · skills CLI | 5,677 | — | ||
| web2-recon Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, SkillInstall · skills CLI | 5,677 | — | ||
| web3-audit Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flas SkillInstall · skills CLI | 5,677 | — | ||
| audit-flow Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, comp SkillInstall · skills CLI | 4,708 | — | ||
| authentication-patterns Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mista SkillInstall · skills CLI | 4,708 | — | ||
| broken-authentication This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform crede SkillInstall · skills CLI | 4,708 | — | ||
| code-vuln-audit Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL SkillInstall · skills CLI | 4,708 | — | ||
| scanning-tools This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", " SkillInstall · skills CLI | 4,708 | — | ||
| secure-code-review Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities SkillInstall · skills CLI | 4,708 | — | ||
| sql-injection-testing This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL inj SkillInstall · skills CLI | 4,708 | — | ||
| top-web-vulnerabilities This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability SkillInstall · skills CLI | 4,708 | — | ||
| xss-html-injection This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws SkillInstall · skills CLI | 4,708 | — | ||
| security Security audit workflow - vulnerability scan → verification SkillInstall · skills CLI | 3,949 | — | ||
| security-reviewer Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposur SkillInstall · skills CLI | 3,816 | — | ||
| security-audit Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates SkillInstall · skills CLI | 3,742 | — | ||
| azure-compliance Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/complian SkillInstall · skills CLI | 3,201 | — | ||
| microsoft-azure-webjobs-extensions-authentication-events-dotnet Microsoft Entra Authentication Events SDK for .NET. Azure Functions triggers for custom authentication extensions. Use for token enrichment, custom cl SkillInstall · skills CLI | 3,201 | — | ||
| exposure-risk-quantification FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownershi SkillInstall · skills CLI | 3,025 | — | ||
| identity-provider-recon Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fi SkillInstall · skills CLI | 3,025 | — | ||
| warden Security engineer — IAM, secrets, threat modeling, hardening, auth, and supply chain security. SkillInstall · skills CLI | 2,918 | — | ||
| warden-audit Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for "security audit", "ch SkillInstall · skills CLI | 2,918 | — | ||
| warden-harden Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. SkillInstall · skills CLI | 2,918 | — | ||
| warden-iam Build IAM from scratch — roles, policies, service accounts with least privilege. Use when asked to "set up IAM", "create roles", "service accounts", o SkillInstall · skills CLI | 2,918 | — | ||
| warden-recon Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps. Use when aske SkillInstall · skills CLI | 2,918 | — | ||
| warden-scan Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured J SkillInstall · skills CLI | 2,918 | — | ||
| warden-threat Produce a threat model — assets, ranked threats, mitigations, accepted risks. Use when asked to "threat model this", "what could go wrong security-wis SkillInstall · skills CLI | 2,918 | — | ||
| security-hardening Application security covering input validation, auth, headers, secrets management, and dependency auditing SkillInstall · skills CLI | 2,836 | — | ||
| ai-ml-security AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model st SkillInstall · skills CLI | 2,655 | — | ||
| clickjacking Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, an SkillInstall · skills CLI | 2,655 | — | ||
| cmdi-command-injection Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band comman SkillInstall · skills CLI | 2,655 | — | ||
| code-obfuscation-deobfuscation Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, cont SkillInstall · skills CLI | 2,655 | — | ||
| container-escape-techniques Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, ca SkillInstall · skills CLI | 2,655 | — | ||
| cors-cross-origin-misconfiguration CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, a SkillInstall · skills CLI | 2,655 | — | ||
| crlf-injection CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/ SkillInstall · skills CLI | 2,655 | — | ||
| csp-bypass-advanced Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, truste SkillInstall · skills CLI | 2,655 | — | ||
| csrf-cross-site-request-forgery CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state hand SkillInstall · skills CLI | 2,655 | — | ||
| csv-formula-injection CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or repo SkillInstall · skills CLI | 2,655 | — | ||
| dangling-markup-injection Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF SkillInstall · skills CLI | 2,655 | — | ||
| defi-attack-patterns DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vuln SkillInstall · skills CLI | 2,655 | — | ||
| dependency-confusion Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading t SkillInstall · skills CLI | 2,655 | — | ||
| deserialization-insecure Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, o SkillInstall · skills CLI | 2,655 | — | ||
| dns-rebinding-attacks DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser SkillInstall · skills CLI | 2,655 | — | ||
| email-header-injection Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP me SkillInstall · skills CLI | 2,655 | — | ||
| expression-language-injection Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, C SkillInstall · skills CLI | 2,655 | — | ||
| file-access-vuln Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, pr SkillInstall · skills CLI | 2,655 | — | ||
| format-string-exploitation Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), SkillInstall · skills CLI | 2,655 | — | ||
| ghost-bits-cast-attack Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte SkillInstall · skills CLI | 2,655 | — | ||
| graphql-and-hidden-parameters GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and G SkillInstall · skills CLI | 2,655 | — | ||
| hash-attack-techniques Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in C SkillInstall · skills CLI | 2,655 | — | ||
| heap-exploitation Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leverag SkillInstall · skills CLI | 2,655 | — | ||
| http-host-header-attacks HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or acces SkillInstall · skills CLI | 2,655 | — | ||
| http-parameter-pollution HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and appli SkillInstall · skills CLI | 2,655 | — | ||
| http2-specific-attacks HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade s SkillInstall · skills CLI | 2,655 | — | ||
| idor-broken-object-authorization IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing obj SkillInstall · skills CLI | 2,655 | — | ||
| injection-checking Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows SkillInstall · skills CLI | 2,655 | — | ||
| insecure-source-code-management Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks duri SkillInstall · skills CLI | 2,655 | — | ||
| ios-pentesting-tricks iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipu SkillInstall · skills CLI | 2,655 | — | ||
| jndi-injection JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code pa SkillInstall · skills CLI | 2,655 | — | ||
| jwt-oauth-token-attacks JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-b SkillInstall · skills CLI | 2,655 | — | ||
| kernel-exploitation Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via SkillInstall · skills CLI | 2,655 | — | ||
| kubernetes-pentesting Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, SkillInstall · skills CLI | 2,655 | — | ||
| lattice-crypto-attacks Lattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack prob SkillInstall · skills CLI | 2,655 | — | ||
| linux-lateral-movement Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivot SkillInstall · skills CLI | 2,655 | — | ||
| linux-privilege-escalation Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, c SkillInstall · skills CLI | 2,655 | — | ||
| linux-security-bypass Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, SkillInstall · skills CLI | 2,655 | — | ||
| llm-prompt-injection LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfilt SkillInstall · skills CLI | 2,655 | — | ||
| macos-process-injection macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment var SkillInstall · skills CLI | 2,655 | — | ||
| macos-security-bypass macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-base SkillInstall · skills CLI | 2,655 | — | ||
| memory-forensics-volatility Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, co SkillInstall · skills CLI | 2,655 | — | ||
| mobile-ssl-pinning-bypass Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinnin SkillInstall · skills CLI | 2,655 | — | ||
| network-protocol-attacks Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 atta SkillInstall · skills CLI | 2,655 | — | ||
| nosql-injection NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic SkillInstall · skills CLI | 2,655 | — | ||
| ntlm-relay-coercion NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MS SkillInstall · skills CLI | 2,655 | — | ||
| oauth-oidc-misconfiguration OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback SkillInstall · skills CLI | 2,655 | — | ||
| open-redirect Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-contr SkillInstall · skills CLI | 2,655 | — | ||
| path-traversal-lfi Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose files SkillInstall · skills CLI | 2,655 | — | ||
| 360Guard 360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans i SkillInstall · skills CLI | 2,188 | — | ||
| access-lifecycle Use when preparing or running a user access review, checking that leavers lost their access, finding orphaned or ownerless service accounts, answering SkillInstall · skills CLI | 2,188 | — | ||
| acl-rule-analysis Vendor-agnostic ACL and firewall rule analysis with shadowed rule detection, overly permissive rule identification, unused rule discovery, redundant r SkillInstall · skills CLI | 2,188 | — | ||
| Agent Compliance & Security Assessment Comprehensive compliance and security self-assessment for AI agents. 14-check framework producing a structured threat model + compliance report with R SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-compliance AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Ge SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-enforce Enforce security policies on MCP tool calls and block dangerous operations at runtime. Use when: "block risky calls", "apply policy", "proxy", "runtim SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-registry MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-runtime AI runtime security monitoring — context graph analysis, runtime audit log correlation with CVE findings, and vulnerability analytics queries. Use whe SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-scan Open security platform for agentic infrastructure — checks packages for CVEs (OSV, NVD, EPSS, KEV), scans container images, verifies provenance, scans SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-scan-infra Scan infrastructure-as-code, cloud configurations, and find secrets. Use when: "check terraform", "scan kubernetes", "IaC", "find secrets", "scan dock SkillInstall · skills CLI | 2,188 | — | ||
| agent-decision-receipts Use when an autonomous agent takes a side-effecting action (deploy, delete, pay, grant access) that may need proving later, or for EU AI Act Art. 12 r SkillInstall · skills CLI | 2,188 | — | ||
| agent-security-hardening Security hardening patterns for production AI agents. Covers prompt injection defense (7 rules), data boundary enforcement, read-only defaults for ext SkillInstall · skills CLI | 2,188 | — | ||
| ai-act-readiness Use for /compliance-os:ai-act-readiness, or EU AI Act readiness questions during AI-system intake or before EU deployment. SkillInstall · skills CLI | 2,188 | — | ||
| openclaw-security-hardening Complete OpenClaw Agent Security Hardening - Protects against data leaks (storage security) and prompt injection (runtime security). Use for initial s SkillInstall · skills CLI | 2,188 | — | ||
| accessibility-compliance-accessibility-audit Audit applications for WCAG compliance, inclusive design, and assistive technology compatibility, then identify barriers and provide remediation guida SkillInstall · skills CLI | 2,003 | — | ||
| firmware-analyst Expert firmware analyst specializing in embedded systems, IoT security, and hardware reverse engineering. Masters firmware extraction, analysis, and v SkillInstall · skills CLI | 2,003 | — | ||
| frontend-mobile-security-xss-scan Detect and remediate XSS risks in React, Vue, Angular, and browser JavaScript. Use when inspecting injection sinks, untrusted markup, sanitization, or SkillInstall · skills CLI | 2,003 | — | ||
| frontend-security-coder Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. Use for frontend se SkillInstall · skills CLI | 2,003 | — | ||
| security-auditor Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat mo SkillInstall · skills CLI | 2,003 | — | ||
| security-compliance-compliance-check Check software systems against regulatory requirements such as GDPR, HIPAA, SOC 2, and PCI-DSS, performing compliance audits and providing implementat SkillInstall · skills CLI | 2,003 | — | ||
| security-scanning-security-dependencies Scan project dependencies across ecosystems for vulnerabilities, generate SBOMs, assess supply chain risk, and recommend remediation. Use when auditin SkillInstall · skills CLI | 2,003 | — | ||
| security-scanning-security-hardening Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls. SkillInstall · skills CLI | 2,003 | — | ||
| security-scanning-security-sast Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks SkillInstall · skills CLI | 2,003 | — | ||
| threat-modeling-expert Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirem SkillInstall · skills CLI | 2,003 | — | ||
| exposure Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers). Use when the user asks for a SkillInstall · skills CLI | 1,931 | — | ||
| osint Passive open-source reconnaissance and external exposure checks for a domain, IP address or organization, using OpenOSINT (DNS, RDAP, WHOIS, email aut SkillInstall · skills CLI | 1,931 | — | ||
| thinking-red-team For authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reprodu SkillInstall · skills CLI | 1,734 | — | ||
| security-patterns Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing sec SkillInstall · skills CLI | 1,424 | — | ||
| audit-skills 当用户要求审计 Java、.NET 或 PHP 源码/部署产物/反编译产物/安全发现，并需要默认脚本输出目录、报告输出目录、Java/.NET 反编译与反混淆参考、Java 组件 YAML 正则匹配扫描、确认漏洞判定标准、安全 Payload 和 BurpSuite 原始 HTTP 请求包证据时使用 SkillInstall · skills CLI | 1,044 | — | ||
| dep-auditor 审计 Node.js、Python、Go、Rust、JVM、Ruby 项目的依赖漏洞、版本健康度与许可证事实；当用户要求检查 package.json、lockfile、requirements、go.mod、Cargo.toml、pom.xml、Gemfile.lock，或生成不改依赖的中文审计报 SkillInstall · skills CLI | 909 | — | ||
| security-audit 代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践 SkillInstall · skills CLI | 909 | — | ||
| security-audit Java security checklist covering OWASP Top 10, input validation, injection prevention, and secure coding. Works with Spring, Quarkus, Jakarta EE, and SkillInstall · skills CLI | 773 | — | ||
| security-audit 全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏 SkillInstall · skills CLI | 737 | — | ||
| rails-security-multitenancy Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use SkillInstall · skills CLI | 732 | — | ||
| review-security Perform a read-only, evidence-based security review of web, API, backend, React, React Native, mobile, dependency, CI/CD, and infrastructure changes. SkillInstall · skills CLI | 710 | — | ||
| secure-software Threat-model, design, implement, and verify security controls in web, API, backend, React, and React Native software. Use when building authentication SkillInstall · skills CLI | 710 | — | ||
| vps-security-hardening VPS 安全加固自动化 Skill。通过 SSH 登录 VPS 并执行完整的安全策略配置。 触发场景： - "加固VPS安全"、"VPS安全配置"、"新VPS初始化" - "配置SSH安全"、"修改SSH端口"、"禁用root密码登录" - "VPS安全加固"、"服务器安全设置"、"hardenin SkillInstall · skills CLI | 697 | — | ||
| pr-security-review Security review of one PR's diff against its base branch — high-confidence, exploitable vulnerabilities only (injection, auth bypass, crypto and secre SkillInstall · skills CLI | 674 | — | ||
| 02-vulnerability-scanner Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting SkillInstall · skills CLI | 572 | — | ||
| 12-log-analysis Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, an SkillInstall · skills CLI | 572 | — | ||
| 13-crypto-analysis SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code SkillInstall · skills CLI | 572 | — | ||
| 15-blue-team-defense System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improveme SkillInstall · skills CLI | 572 | — | ||
| 16-ai-llm-security LLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supp SkillInstall · skills CLI | 572 | — | ||
| 17-mobile-security Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and tra SkillInstall · skills CLI | 572 | — | ||
| 18-ot-ics-security Operational Technology and industrial control system security — Purdue model segmentation, industrial protocol analysis (Modbus, DNP3, S7, EtherNet/IP SkillInstall · skills CLI | 572 | — | ||
| 19-grc-compliance Governance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap an SkillInstall · skills CLI | 572 | — |
Filters apply to the top 400 of 1,457 tools by stars. Full list for agents: sec-appsec.json