Security AI Skills

遇到任何 bug、测试失败或异常行为时使用，在提出修复方案之前执行

Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns,…

Detect tool misuse and unexpected code execution via dialogue testing. Use when the agent exposes file, code-execution, or network tools.

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365…

Create custom steering documents for specialized project contexts

[omh] Hermes backend workflow: prepare server, API, and data-layer contracts — auth boundary, error paths, response shape, and schema/migration discipline — before implementation. Use when the user…

Repurpose existing content into a native LinkedIn post. Take a tweet, thread, YouTube video, blog, or newsletter and rebuild it for LinkedIn: re-hook before the fold, expand to the 900 to 1300 char…

Analyze an input repeatedly without a termination condition

Participate in Moltbook — the social network for AI agents. Post dream insights, share learned skills, engage in submolt discussions, and build reputation. Use when your human asks you to post on…

AWS IAM 权限提升专项方法论。当已获取 AWS 凭据并需要提升权限、发现当前 IAM 用户/角色权限有限需要横向或纵向提权、或需要分析 IAM Policy 寻找提权路径时使用。覆盖 46 个 AWS 服务的提权技术，包括 PassRole 滥用、AssumeRole 链式提权、Lambda/EC2/ECS 计算服务提权、以及 NotAction 隐式权限利用

This skill provides comprehensive guidance for SAP Cloud Logging service on SAP BTP. Use when setting up Cloud Logging instances, configuring log ingestion from Cloud Foundry or Kyma runtimes,…

Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations

Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships. Use when modeling least-privilege access, cross-account assumptions,…

Document API changes, breaking changes, migration guides, and version history for APIs. Use when documenting API versioning, breaking changes, or creating API migration guides.

Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.

Security vulnerabilities in AI-generated code and LLM applications, covering OWASP Top 10 for LLMs, secure coding patterns, and AI-specific threat modelsUse when "ai code security, llm…

Recover the original logic from code protected by a virtualization obfuscator — VMProtect, Themida/WinLicense, Code Virtualizer, or a custom opcode VM — by locating the VM dispatcher,…

Post-Ship Growth Intelligence — track how your shipped product is performing. Use when user wants to check growth metrics, SEO trajectory, uptime, deploy frequency, or overall project health over…

When the user wants to create email sequences for developers including onboarding, product updates, re-engagement, or changelog communications. Trigger phrases include "developer emails," "onboarding…

Casting personas: rapid generation from diverse inputs, registry-based persistence and lifecycle, data-driven evolution, inter-agent sync. Not for UI walkthroughs (Echo) or user research (Field).

Specialist orchestrating codex exec / Antigravity CLI through dual paradigms — COMPETE (multi-variant comparison, select best) and COLLABORATE (decompose tasks across engines, integrate). Supports…

Anti-forensics is the offensive counterpart to digital forensics.

Business logic, race conditions, and AI security analysis

Compressed code review - one line per finding with location, problem and fix. Use for /caveman-review, "review this PR", or "review the diff".

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

Helps with Prowler repository CI and PR gates (GitHub Actions workflows). Trigger: When investigating CI checks failing on a PR, PR title validation, changelog gate/no-changelog label, conflict marker…

Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC…

输出规范:中文分析,思维链,漏洞报告模板,负结果,黑板状态总览,改动台账,死锁突破。 Use when reporting findings, maintaining change ledger, or formatting pentest output.

Detect command injection, eval/exec usage, remote execution, or arbitrary code loading.

Interpret validation errors and guide fixing them. Use when encountering validation errors, validation warnings, false positives, operator structure issues, or need help understanding validation…

Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux…

Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity…

Manage {{KIRO_DIR}}/steering/ as persistent project knowledge

Create security architecture diagrams using PlantUML syntax with identity, encryption, firewall, and compliance stencil icons. Best for IAM flows, zero-trust models, encryption pipelines, and threat…

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review…

Validate a filename extension without opening any filesystem path

Draw a testable attack surface from one authorized target URL or one application. Use when the user says 攻击面, 供给面, 画攻击面, map the surface, application recon, find the business host, JS inventory, or…

AWS 云环境渗透测试总体方法论。当目标使用 AWS 云服务、发现 AWS 相关资产（S3 Bucket/EC2 实例/Lambda 函数/CloudFront 分发）、获取 AWS 凭据（AK/SK/Session Token/IAM Role）、或需要对 AWS 环境进行安全评估时使用。提供从未授权枚举到提权、后渗透、持久化的全流程攻击决策树，引导到专项技能深入。覆盖 47+ AWS…

Read-only reference for the backend contracts that the frontend depends on, including routing, APIs, auth, layers, and module resolution.

Help users identify sources of durable competitive power, evaluate market threats, and design products that are uniquely differentiated rather than just better versions of existing tools.

Use when technical debt needs linked code or operational evidence, deduplication, first-seen provenance, or impact, effort, confidence, and cost-of-delay prioritization.

Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling

Zero-build frontend development for static apps, browser extensions, maps, and lightweight data-backed interfaces. Use when deployment must not require a build step.

Forges Kerberos tickets for domain persistence and privilege escalation. Covers Golden Ticket (krbtgt hash → forged TGT), Silver Ticket (service hash → forged TGS), Diamond Ticket…

Guidelines for implementing Auth0 authentication with best practices for security, rules, actions, and SDK integration

Locate the vulnerability a security patch fixes by diffing the pre- and post-patch binaries — using BinDiff, Diaphora, or ghidriff to find the changed functions, reading the added checks to recover…

CLI tool for configuring and monitoring Claude Code with a comprehensive collection of 600+ AI agents, 200+ custom commands, 55+ external service integrations (MCPs), 60+ settings, 39+ hooks, and 14+…

Safety guardrails — blocks destructive commands (rm -rf, DROP TABLE, force-push, git reset --hard) and optionally restricts file edits to a specific directory. Use when working on critical systems or…

Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when…

This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or…

API Design knowledge base. Provides REST constraints, Richardson Maturity Model, HTTP semantics, content negotiation, and GraphQL/gRPC comparison for API audits and generation.