Security AI Skills

Configure inbound API webhooks end to end. Use when the user needs a webhook/callback URL, provides webhook auth or sample payloads, defines provider events, or routes webhook.received deliveries into…

Expert guidance on Hummingbird 2 web framework. Use when developers mention: (1) Hummingbird, HB, or Hummingbird 2, (2) Swift web server or HTTP server, (3) server-side Swift routing or middleware,…

Author Sysdig Secure Posture custom controls (Rego) and custom policies, and emit Terraform via the Sysdig provider. Use when the user wants to "write a posture rule," "create a custom CSPM control,"…

Map incidents, control checks and SCA results to ISO 27001:2022, PCI DSS v4.0.1, NIST SP 800-53r5 and CIS Controls v8.1 and write auditor-ready evidence statements; use for compliance checks, audit…

Orient and mine an open-source repository for threat-model production phases 3.1–3.2. USE WHEN starting a threat model or surveying security posture before modeling. Reads README, top-level docs,…

Review a Confluent agent skill in this repo against the Agent Skills spec (agentskills.io), Confluent conventions in CLAUDE.md, the PR template gates, and the evals-as-contract rule. Use this skill…

Kubernetes Service 与 Ingress

Investigate escalated MFA-fatigue (push bombing) alerts from Entra ID sign-in logs. Reconstructs the denial-to-success timeline, attributes the source infrastructure, inspects post-authentication…

Analyzes Orca Security alerts with timeline visualization, risk assessment, and progressive disclosure. Use when user asks to triage, analyze, explain, summarize, investigate, or check an Orca alert…

Secure AI-powered products and infrastructure. Use when integrating LLM APIs, deploying model-serving infrastructure, building agent workflows, connecting MCP servers, or reviewing AI system…

Expert knowledge in mobile app development for iOS, Android, and cross-platform solutions

Canonical reference for Claude Code plugin artifact schemas, hook events, frontmatter fields, and naming conventions. Used to inject domain knowledge into Codex audit prompts. To update it from the…

PHP development intelligence. 12 domains, 8 stacks, 300+ entries. Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check PHP code. Domains: pattern,…

Use when scheduling WordPress cron events with wp_schedule_event / wp_schedule_single_event or writing the callback that runs on a cron hook. Treats cron callbacks as running without a logged-in user,…

Use when verifying AI-generated content, validating claims, checking source credibility, implementing evidence-based reasoning, and preventing AI hallucinations. Includes source verification,…

Technical copyediting workflow that replaces corporate jargon with plain English, removes synthetic AI phrasing, and resolves paragraph-level readability and grammar issues.

Finds oversized files, binary bloat, and accidental artifact commits in a repo — large files currently tracked, large blobs hiding in git history, LFS migration candidates, asset directories growing…

Run a structured rigor audit on prioritization decisions, scored backlogs, RICE/ICE/MoSCoW outputs, or roadmap orderings. Produces a severity-rated issue list with concrete fixes — catches invented…

Use when mapping AI agent operations to SOC 2, ISO 27001, HIPAA, audit logs, control testing, attestations, and compliance evidence, including drill-cadence evidence, approval-completeness (PI1.1) gap…

Component consistency audit covering state coverage, hierarchy, and patterns. Use when the user asks for a component audit, a component review, or a check of UI consistency.

Shared workflow package for the solution-debranding-plan, solution-debranding-apply, and solution-debranding-verify skills. Holds the stage contracts, references, scripts, and evidence rules they all…

Implement Google Play required account deletion: in-app AND on website. Use when the user says 'account deletion android', 'delete account play', 'play account deletion requirement'.

Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix…

Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use when upgrading framework versions, updating major dependencies, or managing…

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase…

Terraform IaC expert for providers, modules, state management, and planning

Create and maintain GitHub Agentic Workflows (gh-aw) for Prowler. Trigger: When creating agentic workflows, modifying gh-aw frontmatter, configuring safe-outputs, setting up MCP servers in workflows,…

Detect error propagation, chain failures, and single-point breakdowns that cascade across agent workflows.

가장 최근 윤문 결과를 2차로 다시 다듬는다 — 특정 카테고리·문단·강도 조정도 가능. humanize-korean strict 윤문(Phase B)을 기존 run_id에 재실행해 잔존 finding을 처리한다. 트리거 — "/humanize-redo".

Run one unattended IMPLEMENTATION iteration of the autonomous value-creation loop — steward any in-flight PR, fix interrupts (red CI / security / human bugs), or else build ONE queued `idea` issue on…

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps,…

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or…

Create, search, and manage Bear notes via grizzly CLI.

Review multiplayer authority, RPCs, sessions, authorization, replication, inventory, economy, purchases, retries, and replay. Use when server or backend state is the security boundary.

Investigate agent behavior and audit memory structure, organization, and skills; make evidence-backed repairs.

Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric…

Presentation creation, editing, and analysis. When Claude needs to work with presentations (.pptx files) for: (1) Creating new presentations, (2) Modifying or editing content, (3) Working with…

Analytical thinking patterns for comprehensive evaluation, code audits, security analysis, and performance reviews. Provides structured templates for thorough investigation with extended thinking…

Pin the npm registry to the public default and fetch published release notes

按最佳实践创建或更新 CLAUDE.md，帮助 AI agent 更快理解项目。Use when users want to create, update, audit, or improve a CLAUDE.md file.

Answers questions about the G-Cloud 15 Lot 3 (Cloud Support) rate card: its DDaT job families, roles and role levels, the pricing rules (maximum UK and offshore day rates, £50 minimum, 7.5-hour day,…

Owns legal, contracts, intellectual property, regulatory compliance, privacy, security governance, enterprise risk, and audit readiness. Use this to review a contract or commitment, assess regulatory…

CTF Web 挑战的总体方法论。当面对 CTF 靶场、xbow benchmark、Web 安全挑战赛时使用。包含挑战类型快速识别、攻击策略选择决策树、常见出题模式、何时切换方向的判断标准。与 exploit/ 下的具体漏洞技能配合使用

Operate CC Safety Net: explain why a command was blocked, triage false positives, configure custom rulebooks, manage agent CLI integrations, and diagnose protection.

Use when the user requests React Doctor or a React code-health audit, or when a concrete React diagnostic question would benefit from its scan. Not a default step after React changes or before…

模式提取与失效解药分析。当发现多条记忆在讲同一个教训，或发现自己在一而再再而三地犯同样的错误时使用。

Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping),…

500+ item EVM smart contract audit system across 19 domains. Runs parallel specialist agents, synthesizes findings, and files GitHub issues. Separate from the security skill — this is for auditing…

Use when structuring Roblox game code: where scripts go (ServerScriptService, ReplicatedStorage, StarterPlayerScripts), Script vs LocalScript and RunContext, a module loader or framework (Knit or…

Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and…