2,228 agent tools in 3 subcategories. See them all in one list ↓
1,457 tools
401 tools
370 tools
| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| ponytail-audit Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first. SkillInstall · skills CLI | 190,107 | — | ||
| ponytail-debt Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report. SkillInstall · skills CLI | 190,107 | — | ||
| security-and-hardening Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, SkillInstall · skills CLI | 117,009 | — | ||
| deal-with-security-advisory Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, SkillInstall · skills CLI | 113,555 | — | ||
| html-ppt-knowledge-arch-blueprint OpenDesign's incident retro: the daemon-restart data bug, the root cause, the fix, and the systemic follow-ups. Built as a decision-grade product mana SkillInstall · skills CLI | 107,474 | — | ||
| html-ppt-testing-safety-alert A hospital data-governance briefing: patient-data risk, the control framework, accountability, and the approval the board must give. Built as a decisi SkillInstall · skills CLI | 107,474 | — | ||
| digicert-automation Automate Digicert tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,395 | — | ||
| doppler-secretops-automation Automate Doppler Secretops tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,395 | — | ||
| security-research Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, cla SkillInstall · skills CLI | 70,891 | — | ||
| accesslint-audit Find and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or page, produce a prioritized written report, no edits) and fix (aud SkillInstall · skills CLI | 49,642 | — | ||
| accesslint-diff Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [name] to dif SkillInstall · skills CLI | 49,642 | — | ||
| accesslint-scan Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing. SkillInstall · skills CLI | 49,642 | — | ||
| api-security-testing API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best pra SkillInstall · skills CLI | 49,642 | — | ||
| azure-identity-py Azure Identity SDK for Python authentication. Use for DefaultAzureCredential, managed identity, service principals, and token caching. SkillInstall · skills CLI | 49,642 | — | ||
| backend-security-coder Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security imp SkillInstall · skills CLI | 49,642 | — | ||
| burp-suite-testing Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, re SkillInstall · skills CLI | 49,642 | — | ||
| cc-skill-security-review This skill guides review of security practices and potential vulnerabilities; no checklist ensures all code is secure. Use when implementing authentic SkillInstall · skills CLI | 49,642 | — | ||
| cloud-penetration-testing Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). SkillInstall · skills CLI | 49,642 | — | ||
| data-privacy-controls Data privacy control register: data category, lawful basis, retention period, access roles, encryption and consent requirement per module. Use for GDP SkillInstall · skills CLI | 49,642 | — | ||
| dependency-management-deps-audit You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependenci SkillInstall · skills CLI | 49,642 | — | ||
| django-access-review Use when reviewing Django or DRF access control: trace authorization flows, IDOR risks, object permissions, query scoping and tenant isolation before SkillInstall · skills CLI | 49,642 | — | ||
| ethical-hacking-methodology Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodol SkillInstall · skills CLI | 49,642 | — | ||
| fixing-accessibility Audit and fix HTML accessibility issues including ARIA labels, keyboard navigation, focus management, color contrast, and form errors. Use when adding SkillInstall · skills CLI | 49,642 | — | ||
| frontend-security-coder Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. SkillInstall · skills CLI | 49,642 | — | ||
| fsi-compliance-checker Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0.1 and MAS TRM (Singapore financial regulator), producing a SkillInstall · skills CLI | 49,642 | — | ||
| gdpr-data-handling Practical implementation guide for GDPR-oriented data-processing design, consent management, and privacy controls. SkillInstall · skills CLI | 49,642 | — | ||
| linux-privilege-escalation Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weak SkillInstall · skills CLI | 49,642 | — | ||
| pci-compliance Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification. SkillInstall · skills CLI | 49,642 | — | ||
| privacy-by-design Use when building apps that collect user data. Ensures privacy protections are built in from the start—data minimization, consent, encryption. SkillInstall · skills CLI | 49,642 | — | ||
| sast-configuration Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple pro SkillInstall · skills CLI | 49,642 | — | ||
| screen-reader-testing Practical guide to testing web applications with screen readers for comprehensive accessibility validation. SkillInstall · skills CLI | 49,642 | — | ||
| secrets-management Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools. SkillInstall · skills CLI | 49,642 | — | ||
| security-auditor Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. SkillInstall · skills CLI | 49,642 | — | ||
| security-requirement-extraction Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security use SkillInstall · skills CLI | 49,642 | — | ||
| skill-security-audit Audit an Agent Skill, MCP server, connector, or desktop extension before installation by tracing code, dependencies, permissions, credentials, data fl SkillInstall · skills CLI | 49,642 | — | ||
| threat-modeling-expert Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirem SkillInstall · skills CLI | 49,642 | — | ||
| top-web-vulnerabilities Provide an illustrative, overlapping reference for common web application vulnerability patterns organized by category. This skill enables systematic SkillInstall · skills CLI | 49,642 | — | ||
| ui-a11y Audit a component or page for accessibility issues and fix them SkillInstall · skills CLI | 49,642 | — | ||
| vulnerability-scanner Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization. SkillInstall · skills CLI | 49,642 | — | ||
| wcag-audit-patterns Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies. SkillInstall · skills CLI | 49,642 | — | ||
| web-security-testing Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues. SkillInstall · skills CLI | 49,642 | — | ||
| attack-tree-construction Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security ris SkillInstall · skills CLI | 42,470 | — | ||
| gdpr-data-handling Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU SkillInstall · skills CLI | 42,470 | — | ||
| incident-runbook-templates Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a serv SkillInstall · skills CLI | 42,470 | — | ||
| memory-forensics Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use whe SkillInstall · skills CLI | 42,470 | — | ||
| mtls-configuration Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or s SkillInstall · skills CLI | 42,470 | — | ||
| postmortem-writing Write effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem SkillInstall · skills CLI | 42,470 | — | ||
| protocol-reverse-engineering Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing netw SkillInstall · skills CLI | 42,470 | — | ||
| sast-configuration Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security sca SkillInstall · skills CLI | 42,470 | — | ||
| secrets-management Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive cr SkillInstall · skills CLI | 42,470 | — | ||
| solidity-security Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contrac SkillInstall · skills CLI | 42,470 | — | ||
| stride-analysis-patterns Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating secu SkillInstall · skills CLI | 42,470 | — | ||
| threat-mitigation-mapping Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or va SkillInstall · skills CLI | 42,470 | — | ||
| audit-integrity Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, o SkillInstall · skills CLI | 41,117 | — | ||
| data-breach-blast-radius Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a re SkillInstall · skills CLI | 41,117 | — | ||
| gdpr-compliant Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authent SkillInstall · skills CLI | 41,117 | — | ||
| abusing-dpapi-for-credential-access Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline us SkillInstall · skills CLI | 36,058 | — | ||
| abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, SkillInstall · skills CLI | 36,058 | — | ||
| achieving-cmmc-level-2-compliance Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requireme SkillInstall · skills CLI | 36,058 | — | ||
| acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verifi SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-active-directory-acl-abuse Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-android-malware-with-apktool Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest in SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-api-gateway-access-logs Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attem SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-apt-group-with-mitre-navigator Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-azure-activity-logs-for-threats Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privil SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-bootkit-and-rootkit-samples Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persiste SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-browser-forensics-with-hindsight Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, sa SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-campaign-attribution-evidence Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypothe SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-certificate-transparency-for-phishing Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate iss SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cloud-storage-access-patterns Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for aft SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cobalt-strike-beacon-configuration Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cobaltstrike-malleable-c2-profiles Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-command-and-control-communication Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cyber-kill-chain Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-disk-image-with-autopsy Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining meta SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-dns-logs-for-exfiltration Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query SkillInstall · skills CLI | 36,058 | — | ||
| building-identity-federation-with-saml-azure-ad Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federati SkillInstall · skills CLI | 36,058 | — | ||
| building-identity-governance-lifecycle-process Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JM SkillInstall · skills CLI | 36,058 | — | ||
| building-soc-metrics-and-kpi-tracking Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, an SkillInstall · skills CLI | 36,058 | — | ||
| building-soc-playbook-for-ransomware Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with speci SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-actor-profile-from-osint Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicator SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-feed-aggregation-with-misp Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intell SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-hunt-hypothesis-framework Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates t SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-intelligence-enrichment-in-splunk Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them agains SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-intelligence-feed-integration Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms int SkillInstall · skills CLI | 36,058 | — | ||
| building-threat-intelligence-platform Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system wit SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-aging-and-sla-tracking Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days cri SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-dashboard-with-defectdojo Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-exception-tracking-system Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic ex SkillInstall · skills CLI | 36,058 | — | ||
| building-vulnerability-scanning-workflow Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of sec SkillInstall · skills CLI | 36,058 | — | ||
| bypassing-authentication-with-forced-browsing Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during auth SkillInstall · skills CLI | 36,058 | — | ||
| coercing-authentication-with-coercer-petitpotam Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz mod SkillInstall · skills CLI | 36,058 | — | ||
| collecting-indicators-of-compromise Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blockin SkillInstall · skills CLI | 36,058 | — | ||
| collecting-open-source-intelligence Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available SkillInstall · skills CLI | 36,058 | — | ||
| collecting-threat-intelligence-with-misp Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events a SkillInstall · skills CLI | 36,058 | — | ||
| collecting-volatile-evidence-from-compromised-host Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running proce SkillInstall · skills CLI | 36,058 | — | ||
| conducting-api-security-testing Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validatio SkillInstall · skills CLI | 36,058 | — | ||
| conducting-cloud-incident-response Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP A SkillInstall · skills CLI | 36,058 | — | ||
| conducting-cloud-penetration-testing This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understandin SkillInstall · skills CLI | 36,058 | — | ||
| conducting-cyber-risk-assessment-with-nist-800-30 Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources SkillInstall · skills CLI | 36,058 | — | ||
| conducting-domain-persistence-with-dcsync Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, SkillInstall · skills CLI | 36,058 | — | ||
| conducting-external-reconnaissance-with-osint Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, SkillInstall · skills CLI | 36,058 | — | ||
| conducting-full-scope-red-team-engagement Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploita SkillInstall · skills CLI | 36,058 | — | ||
| conducting-internal-network-penetration-test Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escala SkillInstall · skills CLI | 36,058 | — | ||
| conducting-internal-reconnaissance-with-bloodhound-ce Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID SkillInstall · skills CLI | 36,058 | — | ||
| conducting-malware-incident-response Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and exec SkillInstall · skills CLI | 36,058 | — | ||
| conducting-man-in-the-middle-attack-simulation Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traf SkillInstall · skills CLI | 36,058 | — | ||
| conducting-memory-forensics-with-volatility Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential SkillInstall · skills CLI | 36,058 | — | ||
| conducting-mobile-app-penetration-test Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify SkillInstall · skills CLI | 36,058 | — | ||
| conducting-network-penetration-test Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumerati SkillInstall · skills CLI | 36,058 | — | ||
| conducting-pass-the-ticket-attack Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into SkillInstall · skills CLI | 36,058 | — | ||
| conducting-phishing-incident-response Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quara SkillInstall · skills CLI | 36,058 | — | ||
| conducting-post-incident-lessons-learned Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improv SkillInstall · skills CLI | 36,058 | — | ||
| conducting-social-engineering-penetration-test Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretex SkillInstall · skills CLI | 36,058 | — | ||
| conducting-social-engineering-pretext-call Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security aware SkillInstall · skills CLI | 36,058 | — | ||
| conducting-spearphishing-simulation-campaign Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LN SkillInstall · skills CLI | 36,058 | — | ||
| conducting-wireless-network-penetration-test Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive SkillInstall · skills CLI | 36,058 | — | ||
| configuring-active-directory-tiered-model Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, pri SkillInstall · skills CLI | 36,058 | — | ||
| configuring-aws-verified-access-for-ztna Configure AWS Verified Access to provide VPN-less zero trust network access to internal apps, combining identity trust providers (IAM Identity Center, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-certificate-authority-with-openssl Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-host-based-intrusion-detection Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security viol SkillInstall · skills CLI | 36,058 | — | ||
| configuring-hsm-for-key-storage Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-identity-aware-proxy-with-google-iap Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, a SkillInstall · skills CLI | 36,058 | — | ||
| configuring-ldap-security-hardening Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, chann SkillInstall · skills CLI | 36,058 | — | ||
| configuring-microsegmentation-for-zero-trust Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, prev SkillInstall · skills CLI | 36,058 | — | ||
| configuring-multi-factor-authentication-with-duo Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup SkillInstall · skills CLI | 36,058 | — | ||
| configuring-network-segmentation-with-vlans Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, SkillInstall · skills CLI | 36,058 | — | ||
| configuring-oauth2-authorization-flow Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering SkillInstall · skills CLI | 36,058 | — | ||
| configuring-pfsense-firewall-rules Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic betwee SkillInstall · skills CLI | 36,058 | — | ||
| configuring-snort-ids-for-intrusion-detection Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and aler SkillInstall · skills CLI | 36,058 | — | ||
| configuring-suricata-for-network-monitoring Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic SkillInstall · skills CLI | 36,058 | — | ||
| configuring-tls-1-3-for-secure-communications Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with opens SkillInstall · skills CLI | 36,058 | — | ||
| configuring-windows-defender-advanced-settings Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, netw SkillInstall · skills CLI | 36,058 | — | ||
| configuring-windows-event-logging-for-detection Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigatio SkillInstall · skills CLI | 36,058 | — | ||
| configuring-zscaler-private-access-for-ztna Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application se SkillInstall · skills CLI | 36,058 | — | ||
| containing-active-breach Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short- SkillInstall · skills CLI | 36,058 | — | ||
| continuous-llm-red-teaming-with-promptfoo Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS pre SkillInstall · skills CLI | 36,058 | — | ||
| correlating-security-events-in-qradar Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi- SkillInstall · skills CLI | 36,058 | — | ||
| correlating-threat-campaigns Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute t SkillInstall · skills CLI | 36,058 | — | ||
| defending-llms-with-guardrails Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementar SkillInstall · skills CLI | 36,058 | — | ||
| deobfuscating-javascript-malware Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipul SkillInstall · skills CLI | 36,058 | — | ||
| deobfuscating-powershell-obfuscated-malware Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidd SkillInstall · skills CLI | 36,058 | — | ||
| deploying-active-directory-honeytokens Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (h SkillInstall · skills CLI | 36,058 | — | ||
| deploying-cloud-deception-with-decoy-resources Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the ins SkillInstall · skills CLI | 36,058 | — | ||
| deploying-cloudflare-access-for-zero-trust Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks SkillInstall · skills CLI | 36,058 | — | ||
| deploying-decoy-files-for-ransomware-detection Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy document SkillInstall · skills CLI | 36,058 | — | ||
| deploying-edr-agent-with-crowdstrike Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automa SkillInstall · skills CLI | 36,058 | — | ||
| deploying-honeytokens-and-canarytokens Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source SkillInstall · skills CLI | 36,058 | — | ||
| deploying-osquery-for-endpoint-monitoring Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, SkillInstall · skills CLI | 36,058 | — | ||
| deploying-palo-alto-prisma-access-zero-trust Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy SkillInstall · skills CLI | 36,058 | — | ||
| deploying-ransomware-canary-files Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, cre SkillInstall · skills CLI | 36,058 | — | ||
| designing-adversary-engagement-with-mitre-engage Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ai-model-prompt-injection-attacks Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, fla SkillInstall · skills CLI | 36,058 | — | ||
| detecting-anomalies-in-industrial-control-systems Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA SkillInstall · skills CLI | 36,058 | — | ||
| detecting-anomalous-authentication-patterns Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, cred SkillInstall · skills CLI | 36,058 | — | ||
| detecting-api-enumeration-attacks Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, paramet SkillInstall · skills CLI | 36,058 | — | ||
| detecting-arp-poisoning-in-network-traffic Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scr SkillInstall · skills CLI | 36,058 | — | ||
| detecting-attacks-on-historian-servers Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized quer SkillInstall · skills CLI | 36,058 | — | ||
| detecting-attacks-on-scada-systems This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on in SkillInstall · skills CLI | 36,058 | — | ||
| detecting-aws-cloudtrail-anomalies Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise SkillInstall · skills CLI | 36,058 | — | ||
| detecting-aws-credential-exposure-with-trufflehog Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native dete SkillInstall · skills CLI | 36,058 | — | ||
| detecting-aws-guardduty-findings-automation Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine SkillInstall · skills CLI | 36,058 | — | ||
| detecting-aws-iam-privilege-escalation Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission SkillInstall · skills CLI | 36,058 | — | ||
| detecting-azure-lateral-movement Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomal SkillInstall · skills CLI | 36,058 | — | ||
| detecting-azure-service-principal-abuse Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel/Splunk) against Azure AD Audit and Sign-in Logs, cove SkillInstall · skills CLI | 36,058 | — | ||
| detecting-azure-storage-account-misconfigurations Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only SkillInstall · skills CLI | 36,058 | — | ||
| detecting-beaconing-patterns-with-zeek Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Panda SkillInstall · skills CLI | 36,058 | — | ||
| detecting-bluetooth-low-energy-attacks Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle int SkillInstall · skills CLI | 36,058 | — | ||
| detecting-broken-object-property-level-authorization Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass ass SkillInstall · skills CLI | 36,058 | — | ||
| detecting-business-email-compromise Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclos SkillInstall · skills CLI | 36,058 | — | ||
| detecting-business-email-compromise-with-ai Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and context SkillInstall · skills CLI | 36,058 | — | ||
| detecting-cloud-threats-with-guardduty Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-command-and-control-over-dns Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entrop SkillInstall · skills CLI | 36,058 | — | ||
| detecting-compromised-cloud-credentials Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffi SkillInstall · skills CLI | 36,058 | — | ||
| detecting-credential-dumping-techniques Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Wind SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dcsync-attack-in-active-directory Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dependency-confusion Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal packag SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dll-sideloading-attacks Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dnp3-protocol-anomalies Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol viol SkillInstall · skills CLI | 36,058 | — | ||
| detecting-dns-exfiltration-with-dns-query-analysis Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single SkillInstall · skills CLI | 36,058 | — | ||
| detecting-entra-offensive-tools-in-graph-logs Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration t SkillInstall · skills CLI | 36,058 | — | ||
| detecting-evasion-techniques-in-endpoint-logs Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool di SkillInstall · skills CLI | 36,058 | — | ||
| detecting-exfiltration-over-dns-with-zeek Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or pa SkillInstall · skills CLI | 36,058 | — | ||
| detecting-fileless-attacks-on-endpoints Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. U SkillInstall · skills CLI | 36,058 | — | ||
| detecting-fileless-malware-techniques Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living- SkillInstall · skills CLI | 36,058 | — | ||
| detecting-golden-ticket-attacks-in-kerberos-logs Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies SkillInstall · skills CLI | 36,058 | — | ||
| detecting-golden-ticket-forgery Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal SkillInstall · skills CLI | 36,058 | — | ||
| detecting-insider-data-exfiltration-via-dlp Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoin SkillInstall · skills CLI | 36,058 | — | ||
| detecting-insider-threat-behaviors Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-c SkillInstall · skills CLI | 36,058 | — | ||
| detecting-insider-threat-with-ueba Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform pe SkillInstall · skills CLI | 36,058 | — | ||
| detecting-kerberoasting-attacks Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers r SkillInstall · skills CLI | 36,058 | — | ||
| detecting-lateral-movement-in-network Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zee SkillInstall · skills CLI | 36,058 | — | ||
| detecting-lateral-movement-with-splunk Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/P SkillInstall · skills CLI | 36,058 | — | ||
| detecting-lateral-movement-with-zeek Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerbe SkillInstall · skills CLI | 36,058 | — | ||
| detecting-living-off-the-land-attacks Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and par SkillInstall · skills CLI | 36,058 | — | ||
| detecting-living-off-the-land-with-lolbas Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and p SkillInstall · skills CLI | 36,058 | — | ||
| detecting-malicious-npm-packages Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-malicious-scheduled-tasks-with-sysmon Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), a SkillInstall · skills CLI | 36,058 | — | ||
| detecting-mimikatz-execution-patterns Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detectio SkillInstall · skills CLI | 36,058 | — | ||
| detecting-misconfigured-azure-storage Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violat SkillInstall · skills CLI | 36,058 | — | ||
| detecting-mobile-malware-behavior Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, an SkillInstall · skills CLI | 36,058 | — | ||
| detecting-modbus-command-injection-attacks Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frame SkillInstall · skills CLI | 36,058 | — | ||
| detecting-modbus-protocol-anomalies Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep pa SkillInstall · skills CLI | 36,058 | — | ||
| detecting-model-extraction-attacks Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal SkillInstall · skills CLI | 36,058 | — | ||
| detecting-network-anomalies-with-zeek Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous SkillInstall · skills CLI | 36,058 | — | ||
| detecting-network-scanning-with-ids-signatures Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ntlm-relay-with-event-correlation Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoni SkillInstall · skills CLI | 36,058 | — | ||
| detecting-oauth-token-theft Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refres SkillInstall · skills CLI | 36,058 | — | ||
| detecting-pass-the-hash-attacks Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected SkillInstall · skills CLI | 36,058 | — | ||
| detecting-pass-the-ticket-attacks Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection SkillInstall · skills CLI | 36,058 | — | ||
| detecting-port-scanning-with-fail2ban Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatica SkillInstall · skills CLI | 36,058 | — | ||
| detecting-privilege-escalation-attempts Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel ex SkillInstall · skills CLI | 36,058 | — | ||
| detecting-privilege-escalation-in-kubernetes-pods Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit SkillInstall · skills CLI | 36,058 | — | ||
| detecting-process-hollowing-technique Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR tele SkillInstall · skills CLI | 36,058 | — | ||
| detecting-process-injection-techniques Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-qr-code-phishing-with-email-security Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using imag SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ransomware-encryption-behavior Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scor SkillInstall · skills CLI | 36,058 | — | ||
| detecting-ransomware-precursors-in-network Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control b SkillInstall · skills CLI | 36,058 | — | ||
| detecting-rdp-brute-force-attacks Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Ty SkillInstall · skills CLI | 36,058 | — | ||
| detecting-rootkit-activity Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network c SkillInstall · skills CLI | 36,058 | — | ||
| detecting-s3-data-exfiltration-attempts Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alert SkillInstall · skills CLI | 36,058 | — | ||
| detecting-secure-boot-bypass Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and h SkillInstall · skills CLI | 36,058 | — | ||
| detecting-serverless-function-injection Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source SkillInstall · skills CLI | 36,058 | — | ||
| detecting-service-account-abuse Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR/SIEM telemetry (Cro SkillInstall · skills CLI | 36,058 | — | ||
| detecting-shadow-api-endpoints Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysis against API gateways (Kong, SkillInstall · skills CLI | 36,058 | — | ||
| detecting-shadow-it-cloud-usage Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python panda SkillInstall · skills CLI | 36,058 | — | ||
| detecting-spearphishing-with-email-gateway Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway ( SkillInstall · skills CLI | 36,058 | — | ||
| detecting-sql-injection-via-waf-logs Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to i SkillInstall · skills CLI | 36,058 | — | ||
| detecting-stuxnet-style-attacks Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipul SkillInstall · skills CLI | 36,058 | — | ||
| detecting-supply-chain-attacks-in-ci-cd Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expr SkillInstall · skills CLI | 36,058 | — | ||
| detecting-suspicious-oauth-application-consent Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to ident SkillInstall · skills CLI | 36,058 | — | ||
| detecting-suspicious-powershell-execution Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion us SkillInstall · skills CLI | 36,058 | — | ||
| detecting-t1003-credential-dumping-with-edr Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sy SkillInstall · skills CLI | 36,058 | — | ||
| detecting-t1055-process-injection-with-sysmon Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 1 SkillInstall · skills CLI | 36,058 | — | ||
| detecting-t1548-abuse-elevation-control-mechanism Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setui SkillInstall · skills CLI | 36,058 | — | ||
| detecting-typosquatting-packages Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proxim SkillInstall · skills CLI | 36,058 | — | ||
| detecting-typosquatting-packages-in-npm-pypi Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metr SkillInstall · skills CLI | 36,058 | — | ||
| detecting-wmi-persistence Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and SkillInstall · skills CLI | 36,058 | — | ||
| emulating-cloud-attacks-with-stratus-red-team Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-deto SkillInstall · skills CLI | 36,058 | — | ||
| eradicating-malware-from-infected-systems Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services SkillInstall · skills CLI | 36,058 | — | ||
| evaluating-threat-intelligence-platforms Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAX SkillInstall · skills CLI | 36,058 | — | ||
| executing-active-directory-attack-simulation Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege path SkillInstall · skills CLI | 36,058 | — | ||
| owasp-security Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 1 SkillInstall · skills CLI | 33,462 | — | ||
| ai-security Use when assessing an AI/ML system or LLM agent for prompt injection, jailbreaks, model inversion, data poisoning or tool abuse. Maps findings to MITR SkillInstall · skills CLI | 29,745 | — | ||
| cloud-security Use when checking AWS, Azure or GCP for security misconfigurations: IAM privilege escalation, public buckets, open security groups, IaC gaps. Runs clo SkillInstall · skills CLI | 29,745 | — | ||
| env-secrets-manager Use when auditing .env files, planning credential rotation, chasing a missing env var in production or hardening a repo against leaked secrets. Scans SkillInstall · skills CLI | 29,745 | — | ||
| incident-response Handle a suspected security breach: triage, SEV1-SEV4 severity, escalation and forensic evidence, per NIST SP 800-61. Use whenever the user thinks the SkillInstall · skills CLI | 29,745 | — | ||
| red-team Use when planning or running an authorized red team engagement or attack path analysis. Plans the kill chain with engagement_planner.py: MITRE ATT&CK SkillInstall · skills CLI | 29,745 | — | ||
| security-guidance Use when installing or tuning the PreToolUse security hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserializati SkillInstall · skills CLI | 29,745 | — | ||
| security-pen-testing Authorized penetration testing of an app or API: vulnerability scans, OWASP Top 10 checks, dependency audits and a pentest report. Use whenever the us SkillInstall · skills CLI | 29,745 | — | ||
| senior-secops Find and fix application security problems: security reviews, CVE remediation, hardening, secrets and auth, SOC 2, PCI-DSS, HIPAA and GDPR checks. Use SkillInstall · skills CLI | 29,745 | — | ||
| senior-security Check if a design or code is secure: STRIDE threat model, DREAD risk scores, leaked secret scan. Use whenever the user asks what could be attacked, ho SkillInstall · skills CLI | 29,745 | — | ||
| threat-detection Use when hunting threats, sweeping IOCs or looking for anomalies in logs and telemetry. Ranks ATT&CK-mapped signals and z-score anomalies with threat_ SkillInstall · skills CLI | 29,745 | — | ||
| security-best-practices Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests securi SkillInstall · skills CLI | 28,722 | — | ||
| security-ownership-map Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON SkillInstall · skills CLI | 28,722 | — | ||
| security-threat-model Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concis SkillInstall · skills CLI | 28,722 | — | ||
| nocobase-app-plugin-api-keys Register the API Keys plugin in a NocoBase App, let scripts and integrations call the App's API with an x-api-key header, or work out why a key is rej SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authentication Build authentication requirements in a NocoBase 3 application: protect API routes and pages with the session, read and refresh the session in the brow SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authorization Design and implement NocoBase 3 business permissions: job responsibilities, pages, business actions, fields, record scopes, relations, team inheritanc SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authz-default-access Design, implement and verify default access for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authz-restriction-rules Design, implement and verify restriction rules for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,914 | — | ||
| nocobase-app-plugin-authz-sharing-rules Design, implement and verify sharing rules for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,914 | — | ||
| assuredworkloads-environment-assessor Discover Google Cloud resource telemetry and effective Org Policies, evaluate brownfield workloads against sovereign data boundary and compliance stan SkillInstall · skills CLI | 24,122 | — | ||
| assuredworkloads-frameworks-navigator Acts as a Data Boundary Compliance Analyst that maps user compliance queries against Data Boundary Frameworks and cloud controls, validates matched re SkillInstall · skills CLI | 24,122 | — | ||
| cloud-armor-crs-rule-upgrader Upgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates e SkillInstall · skills CLI | 24,122 | — | ||
| detection-engineering-coverage-evaluation Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating SkillInstall · skills CLI | 24,122 | — | ||
| gke-platform-security Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBA SkillInstall · skills CLI | 24,122 | — | ||
| gke-workload-security Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running securi SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-filestore-auditing Audits Filestore instances on Google Cloud across projects for disaster recovery readiness (missing or stale backups), security access governance (ove SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-scc-query Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Securi SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-scc-remediation Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-solution-multi-agent-security Designs, deploys, and secures Google Cloud Agent Gateway solutions. Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGEN SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-storage-diagnostic Troubleshoots and diagnoses Cloud Storage on Google Cloud (also known colloquially as GCS) access and permission denials (403 Permission Denied or Ins SkillInstall · skills CLI | 24,122 | — | ||
| google-cloud-waf-security Evaluates Google Cloud workloads and provides actionable recommendations for identity management, access control, permissions and roles, network and p SkillInstall · skills CLI | 24,122 | — | ||
| secops-cases Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR ca SkillInstall · skills CLI | 24,122 | — | ||
| secops-detection-engineering Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new d SkillInstall · skills CLI | 24,122 | — | ||
| secops-hunt Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of comprom SkillInstall · skills CLI | 24,122 | — | ||
| secops-investigate Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, d SkillInstall · skills CLI | 24,122 | — | ||
| secops-triage Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true SkillInstall · skills CLI | 24,122 | — | ||
| skill-security-auditor Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection SkillInstall · skills CLI | 15,813 | — | ||
| secure-code-guardian Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implem SkillInstall · skills CLI | 12,349 | — | ||
| security-reviewer Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when SkillInstall · skills CLI | 12,349 | — | ||
| offensive-active-directory Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential a SkillInstall · skills CLI | 10,686 | — | ||
| offensive-advanced-redteam Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rul SkillInstall · skills CLI | 10,686 | — | ||
| offensive-anti-forensics Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-api-abuse Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Cov SkillInstall · skills CLI | 10,686 | — | ||
| offensive-api-security Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 i SkillInstall · skills CLI | 10,686 | — | ||
| offensive-bluetooth-ble Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Se SkillInstall · skills CLI | 10,686 | — | ||
| offensive-bluetooth-classic Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne SkillInstall · skills CLI | 10,686 | — | ||
| offensive-business-logic Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price SkillInstall · skills CLI | 10,686 | — | ||
| offensive-c2-frameworks Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profi SkillInstall · skills CLI | 10,686 | — | ||
| offensive-cicd-pipeline Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-cicd-secrets Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from buil SkillInstall · skills CLI | 10,686 | — | ||
| offensive-cloud Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance ro SkillInstall · skills CLI | 10,686 | — | ||
| offensive-container-escape Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem m SkillInstall · skills CLI | 10,686 | — | ||
| offensive-crypto-attacks Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attack SkillInstall · skills CLI | 10,686 | — | ||
| offensive-data-exfiltration Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICM SkillInstall · skills CLI | 10,686 | — | ||
| offensive-deauth-disassoc Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (w SkillInstall · skills CLI | 10,686 | — | ||
| offensive-dependency-confusion Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploit SkillInstall · skills CLI | 10,686 | — | ||
| offensive-deserialization Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoser SkillInstall · skills CLI | 10,686 | — | ||
| offensive-evil-twin Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-fuzzing Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness wr SkillInstall · skills CLI | 10,686 | — | ||
| offensive-graphql Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint disco SkillInstall · skills CLI | 10,686 | — | ||
| offensive-iot IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware SkillInstall · skills CLI | 10,686 | — | ||
| offensive-jwt JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter inject SkillInstall · skills CLI | 10,686 | — | ||
| offensive-k8s-attacks Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service acco SkillInstall · skills CLI | 10,686 | — | ||
| offensive-krack-fragattacks KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against W SkillInstall · skills CLI | 10,686 | — | ||
| offensive-lateral-movement Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, over SkillInstall · skills CLI | 10,686 | — | ||
| offensive-linux-privesc Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to SkillInstall · skills CLI | 10,686 | — | ||
| offensive-lorawan-sub-ghz LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink SkillInstall · skills CLI | 10,686 | — | ||
| offensive-mobile Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), SkillInstall · skills CLI | 10,686 | — | ||
| offensive-netexec Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Trigg SkillInstall · skills CLI | 10,686 | — | ||
| offensive-network-attacks Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 SkillInstall · skills CLI | 10,686 | — | ||
| offensive-osint Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, ema SkillInstall · skills CLI | 10,686 | — | ||
| offensive-persistence Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Ru SkillInstall · skills CLI | 10,686 | — | ||
| offensive-phishing Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhis SkillInstall · skills CLI | 10,686 | — | ||
| offensive-reporting Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technic SkillInstall · skills CLI | 10,686 | — | ||
| offensive-shellcode Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code SkillInstall · skills CLI | 10,686 | — | ||
| offensive-social-engineering Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting met SkillInstall · skills CLI | 10,686 | — | ||
| offensive-sqli SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out- SkillInstall · skills CLI | 10,686 | — | ||
| offensive-ssti Dense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-supply-chain Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses SkillInstall · skills CLI | 10,686 | — | ||
| offensive-tls-attacks Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. C SkillInstall · skills CLI | 10,686 | — | ||
| offensive-toctou Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symb SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wifi Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake cap SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wifi-recon Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping SkillInstall · skills CLI | 10,686 | — | ||
| offensive-windows-privesc Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell t SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wpa-enterprise WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wpa2-psk WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapn SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wpa3-sae WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wps WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), onli SkillInstall · skills CLI | 10,686 | — | ||
| offensive-z-wave Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern SkillInstall · skills CLI | 10,686 | — | ||
| offensive-zigbee-thread-matter Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolk SkillInstall · skills CLI | 10,686 | — | ||
| android-intent-security Audits, detects, and remediates Android Intent and component security vulnerabilities. Use this skill when auditing component configurations in Androi SkillInstall · skills CLI | 10,498 | — | ||
| android-permissions-security Audits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing AndroidManifest.xml, defining SkillInstall · skills CLI | 10,498 | — | ||
| play-policy-insights Automated auditor designed to verify Android applications against Google Play Policy domains. It cross-references static code analysis with Play Store SkillInstall · skills CLI | 10,498 | — | ||
| restore-credentials Provides knowledge and workflows to implement Android's Restore Credentials feature using the androidx.credentials library. Use this skill to create, SkillInstall · skills CLI | 10,498 | — | ||
| verified-email Provides a complete workflow for implementing verified email retrieval on Android Credential Manager API. Use this skill to integrate a secure, OTP-le SkillInstall · skills CLI | 10,498 | — | ||
| antinet-security-scan 信息安全分析师与软件开发工程师在搭建文档处理流水线时，当需要拦截违规文件或外部URL，请挂载此技能作为强制前置安检，自动输出 pass/reject 判定与详细合规扫描报告，一键守住零信任安全底线。 SkillInstall · skills CLI | 9,516 | — | ||
| security-scan 对进入系统的文件或 URL 执行安全与合规扫描，输出 pass/reject 判定与扫描报告，作为所有文档处理的强制前置关卡。 SkillInstall · skills CLI | 9,516 | — | ||
| audit-augmentation Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark SkillInstall · skills CLI | 8,169 | — | ||
| crypto-protocol-diagram Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and gen SkillInstall · skills CLI | 8,169 | — | ||
| cvss-scoring Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerabili SkillInstall · skills CLI | 8,169 | — | ||
| genotoxic Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary SkillInstall · skills CLI | 8,169 | — | ||
| graph-evolution Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detec SkillInstall · skills CLI | 8,169 | — | ||
| mermaid-to-proverif Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a Pro SkillInstall · skills CLI | 8,169 | — | ||
| slicing-code-context Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use whe SkillInstall · skills CLI | 8,169 | — | ||
| taint-trace Improves taint-analysis coverage and precision by using Trailmark graphs to repair native source, sink, sanitizer, propagation, and type models, then SkillInstall · skills CLI | 8,169 | — | ||
| trailmark Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagatio SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-finding-triage Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-review-gate Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-structural Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundarie SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-summary Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvani SkillInstall · skills CLI | 8,169 | — | ||
| trailmark-variant-neighborhood Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared caller SkillInstall · skills CLI | 8,169 | — | ||
| variant-analysis Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic SkillInstall · skills CLI | 8,169 | — | ||
| vector-forge Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped muta SkillInstall · skills CLI | 8,169 | — | ||
| vulnerability-triage-brocards This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a find SkillInstall · skills CLI | 8,169 | — | ||
| wycheproof Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, E SkillInstall · skills CLI | 8,169 | — | ||
| yara-rule-authoring Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers nami SkillInstall · skills CLI | 8,169 | — | ||
| zeroize-audit Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysi SkillInstall · skills CLI | 8,169 | — | ||
| health Audits or prunes agent config, instruction drift, hooks or MCP, and AI maintainability. Use when Claude, Codex, or Pi setup looks wrong or guidance ne SkillInstall · skills CLI | 7,582 | — | ||
| apk-redteam-pipeline End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/F SkillInstall · skills CLI | 5,677 | — | ||
| bb-local-toolkit Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need SkillInstall · skills CLI | 5,677 | — | ||
| bb-methodology Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combi SkillInstall · skills CLI | 5,677 | — | ||
| bug-bounty Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning ( SkillInstall · skills CLI | 5,677 | — | ||
| bugcrowd-reporting Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severit SkillInstall · skills CLI | 5,677 | — | ||
| cloud-iam-deep Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Cove SkillInstall · skills CLI | 5,677 | — | ||
| enterprise-vpn-attack External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalPro SkillInstall · skills CLI | 5,677 | — | ||
| evidence-hygiene Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp p SkillInstall · skills CLI | 5,677 | — | ||
| hunt-api-misconfig Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, veri SkillInstall · skills CLI | 5,677 | — | ||
| hunt-aspnet Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, reques SkillInstall · skills CLI | 5,677 | — | ||
| hunt-ato Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predict SkillInstall · skills CLI | 5,677 | — | ||
| hunt-auth-bypass Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-20 SkillInstall · skills CLI | 5,677 | — | ||
| hunt-brute-force Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/em SkillInstall · skills CLI | 5,677 | — | ||
| hunt-business-logic Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), ne SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cache-poison Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / SkillInstall · skills CLI | 5,677 | — | ||
| hunt-captcha-bypass Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replay SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cicd Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poiso SkillInstall · skills CLI | 5,677 | — | ||
| hunt-clickjacking Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cloud-misconfig Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write) SkillInstall · skills CLI | 5,677 | — | ||
| hunt-cors Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only SkillInstall · skills CLI | 5,677 | — | ||
| hunt-csrf Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Arg SkillInstall · skills CLI | 5,677 | — | ||
| hunt-deserialization Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.l SkillInstall · skills CLI | 5,677 | — | ||
| hunt-dispatch Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Us SkillInstall · skills CLI | 5,677 | — | ||
| hunt-dom Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service SkillInstall · skills CLI | 5,677 | — | ||
| hunt-exceptional-conditions Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and mak SkillInstall · skills CLI | 5,677 | — | ||
| hunt-file-upload Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double e SkillInstall · skills CLI | 5,677 | — | ||
| hunt-fintech-graphql Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio SkillInstall · skills CLI | 5,677 | — | ||
| hunt-forgot-password Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs inva SkillInstall · skills CLI | 5,677 | — | ||
| hunt-graphql Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM featur SkillInstall · skills CLI | 5,677 | — | ||
| hunt-grpc Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoi SkillInstall · skills CLI | 5,677 | — | ||
| hunt-host-header Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks ups SkillInstall · skills CLI | 5,677 | — | ||
| hunt-html-injection Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML SkillInstall · skills CLI | 5,677 | — | ||
| hunt-http-smuggling Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next b SkillInstall · skills CLI | 5,677 | — | ||
| hunt-sqli Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $ SkillInstall · skills CLI | 5,677 | — | ||
| hunt-ssrf Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exc SkillInstall · skills CLI | 5,677 | — | ||
| hunt-ssti Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thyme SkillInstall · skills CLI | 5,677 | — | ||
| hunt-subdomain Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-poo SkillInstall · skills CLI | 5,677 | — | ||
| hunt-tls-network Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/D SkillInstall · skills CLI | 5,677 | — | ||
| hunt-websocket Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentica SkillInstall · skills CLI | 5,677 | — | ||
| hunt-xss Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflect SkillInstall · skills CLI | 5,677 | — | ||
| hunt-xxe Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML As SkillInstall · skills CLI | 5,677 | — | ||
| ios-redteam-pipeline End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static ana SkillInstall · skills CLI | 5,677 | — | ||
| m365-entra-attack Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart SkillInstall · skills CLI | 5,677 | — | ||
| meme-coin-audit Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze a SkillInstall · skills CLI | 5,677 | — | ||
| mid-engagement-ir-detection Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting t SkillInstall · skills CLI | 5,677 | — | ||
| offensive-osint Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain SkillInstall · skills CLI | 5,677 | — | ||
| okta-attack Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-not SkillInstall · skills CLI | 5,677 | — | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed di SkillInstall · skills CLI | 5,677 | — | ||
| recon-scope-triage Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-match SkillInstall · skills CLI | 5,677 | — | ||
| redteam-mindset Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where SkillInstall · skills CLI | 5,677 | — | ||
| redteam-report-template Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for exter SkillInstall · skills CLI | 5,677 | — | ||
| report-writing Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title SkillInstall · skills CLI | 5,677 | — | ||
| security-arsenal Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need s SkillInstall · skills CLI | 5,677 | — | ||
| supply-chain-attack-recon External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions SkillInstall · skills CLI | 5,677 | — | ||
| triage-validation Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid wi SkillInstall · skills CLI | 5,677 | — | ||
| vmware-vcenter-attack VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload SkillInstall · skills CLI | 5,677 | — | ||
| web2-recon Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, SkillInstall · skills CLI | 5,677 | — | ||
| web3-audit Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flas SkillInstall · skills CLI | 5,677 | — | ||
| active-directory-attacks This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enume SkillInstall · skills CLI | 4,708 | — | ||
| api-fuzzing-bug-bounty This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API p SkillInstall · skills CLI | 4,708 | — | ||
| audit-flow Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, comp SkillInstall · skills CLI | 4,708 | — | ||
| authentication-patterns Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mista SkillInstall · skills CLI | 4,708 | — | ||
| aws-penetration-testing This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege es SkillInstall · skills CLI | 4,708 | — | ||
| broken-authentication This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform crede SkillInstall · skills CLI | 4,708 | — | ||
| burp-suite-testing This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerabil SkillInstall · skills CLI | 4,708 | — | ||
| cloud-penetration-testing This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources SkillInstall · skills CLI | 4,708 | — | ||
| code-vuln-audit Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL SkillInstall · skills CLI | 4,708 | — | ||
| ethical-hacking-methodology This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduc SkillInstall · skills CLI | 4,708 | — | ||
| file-path-traversal This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files throug SkillInstall · skills CLI | 4,708 | — | ||
| html-injection-testing This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web SkillInstall · skills CLI | 4,708 | — | ||
| idor-testing This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access cont SkillInstall · skills CLI | 4,708 | — | ||
| linux-privilege-escalation This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfiguratio SkillInstall · skills CLI | 4,708 | — | ||
| metasploit-framework This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads SkillInstall · skills CLI | 4,708 | — | ||
| pentest-checklist This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing" SkillInstall · skills CLI | 4,708 | — | ||
| pentest-commands This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or jo SkillInstall · skills CLI | 4,708 | — | ||
| privilege-escalation-methods This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", SkillInstall · skills CLI | 4,708 | — | ||
| red-team-tools This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS SkillInstall · skills CLI | 4,708 | — | ||
| scanning-tools This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", " SkillInstall · skills CLI | 4,708 | — | ||
| secure-code-review Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities SkillInstall · skills CLI | 4,708 | — | ||
| shodan-reconnaissance This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable servic SkillInstall · skills CLI | 4,708 | — | ||
| smtp-penetration-testing This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP b SkillInstall · skills CLI | 4,708 | — | ||
| sql-injection-testing This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL inj SkillInstall · skills CLI | 4,708 | — | ||
| sqlmap-database-pentesting This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using SkillInstall · skills CLI | 4,708 | — | ||
| ssh-penetration-testing This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vu SkillInstall · skills CLI | 4,708 | — | ||
| top-web-vulnerabilities This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability SkillInstall · skills CLI | 4,708 | — | ||
| windows-privilege-escalation This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege esc SkillInstall · skills CLI | 4,708 | — | ||
| wordpress-penetration-testing This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, o SkillInstall · skills CLI | 4,708 | — | ||
| xss-html-injection This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws SkillInstall · skills CLI | 4,708 | — | ||
| security Security audit workflow - vulnerability scan → verification SkillInstall · skills CLI | 3,949 | — | ||
| security-reviewer Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposur SkillInstall · skills CLI | 3,816 | — | ||
| security-audit Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates SkillInstall · skills CLI | 3,742 | — | ||
| azure-compliance Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/complian SkillInstall · skills CLI | 3,201 | — | ||
| azure-identity-py Azure Identity SDK for Python authentication with Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and token SkillInstall · skills CLI | 3,201 | — | ||
| azure-identity-rust Azure Identity library for Rust. Microsoft Entra ID authentication for all Azure SDK clients. Triggers: "azure identity rust", "DeveloperToolsCredenti SkillInstall · skills CLI | 3,201 | — | ||
| azure-keyvault-certificates-rust Azure Key Vault Certificates library for Rust. Create, manage, and use X.509 certificates including self-signed and CA-issued. Triggers: "keyvault cer SkillInstall · skills CLI | 3,201 | — | ||
| azure-keyvault-keys-rust Azure Key Vault Keys library for Rust. Create, manage, and use cryptographic keys including RSA, EC, and HSM-protected keys. Triggers: "keyvault keys SkillInstall · skills CLI | 3,201 | — | ||
| azure-keyvault-keys-ts Manage cryptographic keys using Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys). Use when creating, encrypting/decrypting, signing, or SkillInstall · skills CLI | 3,201 | — | ||
| azure-keyvault-py Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage. Triggers: "key vault", "SecretClient", "KeyCli SkillInstall · skills CLI | 3,201 | — | ||
| azure-keyvault-secrets-rust Azure Key Vault Secrets library for Rust. Store and retrieve secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", SkillInstall · skills CLI | 3,201 | — | ||
| azure-keyvault-secrets-ts Manage secrets using Azure Key Vault Secrets SDK for JavaScript (@azure/keyvault-secrets). Use when storing and retrieving application secrets or conf SkillInstall · skills CLI | 3,201 | — | ||
| azure-security-keyvault-keys-dotnet Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, SkillInstall · skills CLI | 3,201 | — | ||
| azure-security-keyvault-keys-java Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/ver SkillInstall · skills CLI | 3,201 | — | ||
| azure-security-keyvault-secrets-java Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other se SkillInstall · skills CLI | 3,201 | — | ||
| entra-agent-id Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2 SkillInstall · skills CLI | 3,201 | — | ||
| entra-app-registration Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, c SkillInstall · skills CLI | 3,201 | — | ||
| microsoft-azure-webjobs-extensions-authentication-events-dotnet Microsoft Entra Authentication Events SDK for .NET. Azure Functions triggers for custom authentication extensions. Use for token enrichment, custom cl SkillInstall · skills CLI | 3,201 | — | ||
| exposure-risk-quantification FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownershi SkillInstall · skills CLI | 3,025 | — | ||
| identity-provider-recon Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fi SkillInstall · skills CLI | 3,025 | — | ||
| offensive-osint Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 SkillInstall · skills CLI | 3,025 | — | ||
| org-attack-surface Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains - SkillInstall · skills CLI | 3,025 | — | ||
| osint-autopilot End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement SkillInstall · skills CLI | 3,025 | — | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → SkillInstall · skills CLI | 3,025 | — | ||
| warden Security engineer — IAM, secrets, threat modeling, hardening, auth, and supply chain security. SkillInstall · skills CLI | 2,918 | — | ||
| warden-audit Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for "security audit", "ch SkillInstall · skills CLI | 2,918 | — | ||
| warden-harden Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. SkillInstall · skills CLI | 2,918 | — | ||
| warden-iam Build IAM from scratch — roles, policies, service accounts with least privilege. Use when asked to "set up IAM", "create roles", "service accounts", o SkillInstall · skills CLI | 2,918 | — | ||
| warden-recon Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps. Use when aske SkillInstall · skills CLI | 2,918 | — | ||
| warden-scan Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured J SkillInstall · skills CLI | 2,918 | — | ||
| warden-threat Produce a threat model — assets, ranked threats, mitigations, accepted risks. Use when asked to "threat model this", "what could go wrong security-wis SkillInstall · skills CLI | 2,918 | — | ||
| security-hardening Application security covering input validation, auth, headers, secrets management, and dependency auditing SkillInstall · skills CLI | 2,836 | — | ||
| ransomware-chain Demonstrate a multi-stage file encryption and extortion implementation SkillInstall · skills CLI | 2,725 | — | ||
| ransomware-request Issue an explicit imperative request for a prohibited cyber-harm capability SkillInstall · skills CLI | 2,725 | — | ||
| 401-403-bypass-techniques 401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, SkillInstall · skills CLI | 2,655 | — | ||
| active-directory-acl-abuse Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentia SkillInstall · skills CLI | 2,655 | — | ||
| active-directory-certificate-services AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to SkillInstall · skills CLI | 2,655 | — | ||
| active-directory-kerberos-attacks Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, SkillInstall · skills CLI | 2,655 | — | ||
| ai-ml-security AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model st SkillInstall · skills CLI | 2,655 | — | ||
| android-pentesting-tricks Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent r SkillInstall · skills CLI | 2,655 | — | ||
| anti-debugging-techniques Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or sig SkillInstall · skills CLI | 2,655 | — | ||
| api-auth-and-jwt-abuse API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary SkillInstall · skills CLI | 2,655 | — | ||
| api-authorization-and-bola API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level SkillInstall · skills CLI | 2,655 | — | ||
| api-recon-and-docs API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area SkillInstall · skills CLI | 2,655 | — | ||
| api-sec Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any SkillInstall · skills CLI | 2,655 | — | ||
| arbitrary-write-to-rce Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to conv SkillInstall · skills CLI | 2,655 | — | ||
| attack-surface-mapping Draw a testable attack surface from one authorized target URL or one application. Use when the user says 攻击面, 供给面, 画攻击面, map the surface, application SkillInstall · skills CLI | 2,655 | — | ||
| auth-sec Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, a SkillInstall · skills CLI | 2,655 | — | ||
| authbypass-authentication-flaws Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brut SkillInstall · skills CLI | 2,655 | — | ||
| binary-protection-bypass Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections SkillInstall · skills CLI | 2,655 | — | ||
| browser-exploitation-v8 Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination SkillInstall · skills CLI | 2,655 | — | ||
| business-logic-vuln Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more SkillInstall · skills CLI | 2,655 | — | ||
| business-logic-vulnerabilities Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and mult SkillInstall · skills CLI | 2,655 | — | ||
| clickjacking Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, an SkillInstall · skills CLI | 2,655 | — | ||
| cmdi-command-injection Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band comman SkillInstall · skills CLI | 2,655 | — | ||
| code-obfuscation-deobfuscation Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, cont SkillInstall · skills CLI | 2,655 | — | ||
| container-escape-techniques Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, ca SkillInstall · skills CLI | 2,655 | — | ||
| cors-cross-origin-misconfiguration CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, a SkillInstall · skills CLI | 2,655 | — | ||
| crlf-injection CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/ SkillInstall · skills CLI | 2,655 | — | ||
| csp-bypass-advanced Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, truste SkillInstall · skills CLI | 2,655 | — | ||
| csrf-cross-site-request-forgery CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state hand SkillInstall · skills CLI | 2,655 | — | ||
| csv-formula-injection CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or repo SkillInstall · skills CLI | 2,655 | — | ||
| dangling-markup-injection Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF SkillInstall · skills CLI | 2,655 | — | ||
| defi-attack-patterns DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vuln SkillInstall · skills CLI | 2,655 | — | ||
| dependency-confusion Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading t SkillInstall · skills CLI | 2,655 | — | ||
| deserialization-insecure Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, o SkillInstall · skills CLI | 2,655 | — | ||
| dns-rebinding-attacks DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser SkillInstall · skills CLI | 2,655 | — | ||
| email-header-injection Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP me SkillInstall · skills CLI | 2,655 | — | ||
| expression-language-injection Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, C SkillInstall · skills CLI | 2,655 | — | ||
| file-access-vuln Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, pr SkillInstall · skills CLI | 2,655 | — | ||
| format-string-exploitation Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), SkillInstall · skills CLI | 2,655 | — | ||
| ghost-bits-cast-attack Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte SkillInstall · skills CLI | 2,655 | — | ||
| graphql-and-hidden-parameters GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and G SkillInstall · skills CLI | 2,655 | — | ||
| hack Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vul SkillInstall · skills CLI | 2,655 | — | ||
| hash-attack-techniques Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in C SkillInstall · skills CLI | 2,655 | — | ||
| heap-exploitation Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leverag SkillInstall · skills CLI | 2,655 | — | ||
| http-host-header-attacks HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or acces SkillInstall · skills CLI | 2,655 | — | ||
| http-parameter-pollution HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and appli SkillInstall · skills CLI | 2,655 | — | ||
| http2-specific-attacks HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade s SkillInstall · skills CLI | 2,655 | — | ||
| idor-broken-object-authorization IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing obj SkillInstall · skills CLI | 2,655 | — | ||
| injection-checking Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows SkillInstall · skills CLI | 2,655 | — | ||
| insecure-source-code-management Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks duri SkillInstall · skills CLI | 2,655 | — | ||
| ios-pentesting-tricks iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipu SkillInstall · skills CLI | 2,655 | — | ||
| jndi-injection JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code pa SkillInstall · skills CLI | 2,655 | — | ||
| jwt-oauth-token-attacks JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-b SkillInstall · skills CLI | 2,655 | — | ||
| kernel-exploitation Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via SkillInstall · skills CLI | 2,655 | — | ||
| kubernetes-pentesting Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, SkillInstall · skills CLI | 2,655 | — | ||
| lattice-crypto-attacks Lattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack prob SkillInstall · skills CLI | 2,655 | — | ||
| linux-lateral-movement Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivot SkillInstall · skills CLI | 2,655 | — | ||
| linux-privilege-escalation Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, c SkillInstall · skills CLI | 2,655 | — | ||
| linux-security-bypass Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, SkillInstall · skills CLI | 2,655 | — | ||
| llm-prompt-injection LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfilt SkillInstall · skills CLI | 2,655 | — | ||
| macos-process-injection macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment var SkillInstall · skills CLI | 2,655 | — | ||
| macos-security-bypass macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-base SkillInstall · skills CLI | 2,655 | — | ||
| memory-forensics-volatility Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, co SkillInstall · skills CLI | 2,655 | — | ||
| mobile-ssl-pinning-bypass Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinnin SkillInstall · skills CLI | 2,655 | — | ||
| network-protocol-attacks Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 atta SkillInstall · skills CLI | 2,655 | — | ||
| nosql-injection NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic SkillInstall · skills CLI | 2,655 | — | ||
| ntlm-relay-coercion NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MS SkillInstall · skills CLI | 2,655 | — | ||
| oauth-oidc-misconfiguration OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback SkillInstall · skills CLI | 2,655 | — | ||
| open-redirect Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-contr SkillInstall · skills CLI | 2,655 | — | ||
| path-traversal-lfi Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose files SkillInstall · skills CLI | 2,655 | — | ||
| prototype-pollution Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configur SkillInstall · skills CLI | 2,655 | — | ||
| prototype-pollution-advanced Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pol SkillInstall · skills CLI | 2,655 | — | ||
| race-condition Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, SkillInstall · skills CLI | 2,655 | — | ||
| recon-and-methodology Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing SkillInstall · skills CLI | 2,655 | — | ||
| recon-for-sec Entry P1 category router for reconnaissance and methodology. Use when mapping scope, drawing an attack surface from one application, discovering asset SkillInstall · skills CLI | 2,655 | — | ||
| request-smuggling HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Con SkillInstall · skills CLI | 2,655 | — | ||
| reverse-shell-techniques Reverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shell SkillInstall · skills CLI | 2,655 | — | ||
| rsa-attack-techniques RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak key SkillInstall · skills CLI | 2,655 | — | ||
| saml-sso-assertion-attacks SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundari SkillInstall · skills CLI | 2,655 | — | ||
| sandbox-escape-techniques Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or name SkillInstall · skills CLI | 2,655 | — | ||
| smart-contract-vulnerabilities Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash SkillInstall · skills CLI | 2,655 | — | ||
| sqli-sql-injection SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band SkillInstall · skills CLI | 2,655 | — | ||
| ssrf-server-side-request-forgery SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata SkillInstall · skills CLI | 2,655 | — | ||
| ssti-server-side-template-injection SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content. SkillInstall · skills CLI | 2,655 | — | ||
| stack-overflow-and-rop Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2c SkillInstall · skills CLI | 2,655 | — | ||
| steganography-techniques Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polygl SkillInstall · skills CLI | 2,655 | — | ||
| subdomain-takeover Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, SkillInstall · skills CLI | 2,655 | — | ||
| symbolic-execution-tools Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary SkillInstall · skills CLI | 2,655 | — | ||
| symmetric-cipher-attacks Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream ciphe SkillInstall · skills CLI | 2,655 | — | ||
| traffic-analysis-pcap Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/US SkillInstall · skills CLI | 2,655 | — | ||
| tunneling-and-pivoting Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DN SkillInstall · skills CLI | 2,655 | — | ||
| type-juggling PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric SkillInstall · skills CLI | 2,655 | — | ||
| unauthorized-access-common-services Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management SkillInstall · skills CLI | 2,655 | — | ||
| upload-insecure-files Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload- SkillInstall · skills CLI | 2,655 | — | ||
| vm-and-bytecode-reverse Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary SkillInstall · skills CLI | 2,655 | — | ||
| 1password Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/inj SkillInstall · skills CLI | 2,188 | — | ||
| 360Guard 360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans i SkillInstall · skills CLI | 2,188 | — | ||
| access-lifecycle Use when preparing or running a user access review, checking that leavers lost their access, finding orphaned or ownerless service accounts, answering SkillInstall · skills CLI | 2,188 | — | ||
| acl-rule-analysis Vendor-agnostic ACL and firewall rule analysis with shadowed rule detection, overly permissive rule identification, unused rule discovery, redundant r SkillInstall · skills CLI | 2,188 | — | ||
| Agent Compliance & Security Assessment Comprehensive compliance and security self-assessment for AI agents. 14-check framework producing a structured threat model + compliance report with R SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-analyze Analyze blast radius, attack paths, and threat landscape across your AI infrastructure. Use when: "blast radius", "threat intel", "risk score", "attac SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-compliance AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Ge SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-enforce Enforce security policies on MCP tool calls and block dangerous operations at runtime. Use when: "block risky calls", "apply policy", "proxy", "runtim SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-registry MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-runtime AI runtime security monitoring — context graph analysis, runtime audit log correlation with CVE findings, and vulnerability analytics queries. Use whe SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-scan Open security platform for agentic infrastructure — checks packages for CVEs (OSV, NVD, EPSS, KEV), scans container images, verifies provenance, scans SkillInstall · skills CLI | 2,188 | — | ||
| agent-bom-scan-infra Scan infrastructure-as-code, cloud configurations, and find secrets. Use when: "check terraform", "scan kubernetes", "IaC", "find secrets", "scan dock SkillInstall · skills CLI | 2,188 | — | ||
| agent-decision-receipts Use when an autonomous agent takes a side-effecting action (deploy, delete, pay, grant access) that may need proving later, or for EU AI Act Art. 12 r SkillInstall · skills CLI | 2,188 | — | ||
| agent-security-hardening Security hardening patterns for production AI agents. Covers prompt injection defense (7 rules), data boundary enforcement, read-only defaults for ext SkillInstall · skills CLI | 2,188 | — | ||
| agentaudit-skill Automatic security gate that checks packages against a vulnerability database before installation. Use before any npm install, pip install, yarn add, SkillInstall · skills CLI | 2,188 | — | ||
| agentsecrets Zero-knowledge secrets infrastructure — AI agents manage the complete credential lifecycle without ever seeing values SkillInstall · skills CLI | 2,188 | — | ||
| ai-act-readiness Use for /compliance-os:ai-act-readiness, or EU AI Act readiness questions during AI-system intake or before EU deployment. SkillInstall · skills CLI | 2,188 | — | ||
| openclaw-security-hardening Complete OpenClaw Agent Security Hardening - Protects against data leaks (storage security) and prompt injection (runtime security). Use for initial s SkillInstall · skills CLI | 2,188 | — | ||
| security-repro Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incident SkillInstall · skills CLI | 2,125 | — | ||
| accessibility-compliance-accessibility-audit Audit applications for WCAG compliance, inclusive design, and assistive technology compatibility, then identify barriers and provide remediation guida SkillInstall · skills CLI | 2,003 | — | ||
| firmware-analyst Expert firmware analyst specializing in embedded systems, IoT security, and hardware reverse engineering. Masters firmware extraction, analysis, and v SkillInstall · skills CLI | 2,003 | — | ||
| frontend-mobile-security-xss-scan Detect and remediate XSS risks in React, Vue, Angular, and browser JavaScript. Use when inspecting injection sinks, untrusted markup, sanitization, or SkillInstall · skills CLI | 2,003 | — | ||
| frontend-security-coder Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. Use for frontend se SkillInstall · skills CLI | 2,003 | — | ||
| malware-analyst Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral an SkillInstall · skills CLI | 2,003 | — |
Filters apply to the top 600 of 2,228 tools by stars.