Security AI Skills

Usar para generar Software Bill of Materials para cumplimiento del CRA. También: Software Bill of Materials, inventario de componentes, CycloneDX, SPDX, cadena de suministro.

Read-only audit of a developer machine for npm/PyPI supply-chain compromise. Checks for known IOCs from the 2025-2026 wave — Shai-Hulud 2.0 (Nov 2025), Mini Shai-Hulud / TeamPCP (May 2026), Axios DPRK…

Guide for using Apollo MCP Server to connect AI agents with GraphQL APIs. Use this skill when: (1) setting up or configuring Apollo MCP Server, (2) defining MCP tools from GraphQL operations, (3)…

Audits and improves GitHub repository quality — README structure, community health files, .github directory setup, issue/PR templates, metadata, releases, and branch hygiene. Use this skill whenever…

Matomo Reporting API extension. Self-hosted or Matomo Cloud analytics as a GA4 alternative or complement. Organic traffic, landing pages, device / country breakdowns, referrers, search keywords.…

Delegation policy for a multi-model agent stack where the main loop runs on a scarce top-tier model (e.g. Claude Fable) and cheaper/unlimited tiers do the mechanical work. The main loop owns…

Treat configuration and feature flags as typed, validated inputs with a lifecycle — read once at startup, parse to types, fail fast on missing or malformed values, no scattered env reads or…

Reviews REST and GraphQL APIs against the OWASP API Security Top 10:2023. Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication,…

Use when advising on UAE corporate law, including mainland LLC and PJSC structures under Federal Decree-Law 32/2021, 100% foreign ownership rules, free zone entity types (DIFC, ADGM, DMCC, JAFZA, and…

Add, upgrade, or migrate third-party dependencies safely — read the changelog for the exact version jump, isolate the change, run full verification, and keep rollback ready. Trigger this when the task…

Export desensitized governance summary markdown for sharing or machine switch.

gRPC services in Go beyond the basics: proto design, status codes and error details, interceptors, deadlines, streaming, health checks, and graceful shutdown. Use when: "gRPC service", "proto design",…

全面的代码审查技能，分析代码质量、识别问题、安全漏洞，并提供带严重性评级的改进建议。

Master API documentation with OpenAPI 3.1, AI-powered tools, and modern developer experience practices. Create interactive docs, generate SDKs, and build comprehensive developer portals. Use…

Cairo smart-contract testing with snforge. Trigger on "write tests", "add unit tests", "fuzz test", "integration test", "test this contract", "regression test". Guides test strategy, cheatcode usage,…

Email operations via IMAP/SMTP. Trigger for inbox checking, reading, drafting, or sending emails. Requires `.config/email.json` setup.

Engineering observability and reliability: SLO/SLI design, distributed tracing, alerting, dashboards, capacity planning, toil automation, reliability review. Use for instrumentation or SLO definition.

Single-agent security scanner that groups vulnerabilities into 4 category sweeps (Injection, Access Control, Logic, and Network/CORS). Each sweep is gated by architecture detection. No subagent…

Pre-deployment validation of Cisco IOS/IOS-XE configuration — catching missing saves, mismatched ACLs, overlapping subnets, duplicate IPs, missing route-maps, and dangerous commands before they cause…

Cloudflare Tunnel API for secure tunnels. Use when user mentions "Cloudflare tunnel", "argo tunnel", or secure connectivity.

Monitor and improve Microsoft Defender for Cloud Secure Score. Tracks score trends, identifies quick wins to improve the score, checks Defender plan coverage, and highlights critical security…

Huawei Cloud CTS (Cloud Trace Service / 云审计服务) management and audit analysis via the hcloud CLI. Covers tracker lifecycle (list/create/delete), audit trace query and analysis (filter by time/user/…

Deep-dive API security analysis (REST, GraphQL, WebSocket, gRPC, OAuth, Cache)

Audit Kafka security configuration across the codebase and live cluster using the Lenses MCP server. Checks authentication (SASL), encryption (SSL/TLS), authorisation (ACLs), secrets management and…

Generate and validate manifest.json with optimal permissions for Chrome MV3 extensions. Analyzes code to determine minimum permissions. Use when: manifest, permissions, manifest.json.

Run a comprehensive code review

Security audit for LLM and GenAI applications using OWASP Top 10 for LLM Apps 2025. Assess prompt injection, data leakage, supply chain, and 7 more critical vulnerabilities.

github should become a local, searchable operational workspace, not only an endpoint wrapper. Use for 1183 operation/source entries against https://api.github.com.

Close the runtime loop on a Sysdig-detected threat: turn the investigation context into proposed response actions, analyse the blast radius on the affected workload, and execute (or file) the actions…

管理组织、账号、角色、用户组及身份同步。

Perform phase 3.3 deep analysis of an in-scope attack surface for a threat model. USE WHEN the orientation brief is ready and code must be read to derive the §1.7 per-input trust table and…

Linux network tools and diagnostics

AI 人格操作系统运行时聊天指令。将 11 个指令路由到对应操作 — 状态仪表盘（含健康指标）、显示人格（展示 SOUL.md 身份）、显示记忆（展示 MEMORY.md 内容）、健康检查（运行诊断脚本）、安全审计（运行安全验证）、显示配置（验证配置文件）、帮助（指令参考）、检查点（保存上下文快照）、顾问开/关（切换主动模式）、切换预设（更改人格配置）。支持自然语言变体识别，如"系统状态"对应…

Security vulnerability detection and remediation for Python codebases. Identifies SQL injection, hardcoded secrets, weak cryptography, and other OWASP vulnerabilities.

Stellar smart contract development (Rust, soroban-sdk). Entry point with project setup, contract anatomy, and build/deploy workflow, routing to three companion files in this directory — development.md…

Use when a WordPress plugin or theme accepts file uploads, processes $_FILES, saves user-provided files, or generates file paths from input. Uses wp_handle_upload and wp_check_filetype_and_ext with a…

Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies for Python applications.

Initialize and maintain per-project runtime context (env, secrets, snapshots). Prefer invoking via research-workflow. TRIGGER when: new run needs env setup, preflight before experiment/eval, runtime…

RESTful and GraphQL API design skill with endpoint patterns, request/response schemas, versioning, pagination, filtering, error handling, and API documentation.

WebSocket tests require @SpringBootTest(RANDOM_PORT) and async message handling — @WebMvcTest won't work. Timeout and session leak traps are common. Read before testing STOMP or WebSocket. Triggers:…

Full website SEO audit — crawls up to 500 pages, detects business type, spawns up to 15 parallel specialist agents (8 always + 7 conditional), generates SEO Health Score (0-100) with enterprise HTML…

Opinionated defaults for the lower-stakes structural conventions every project has to pick — branch strategy, directory layout, dependency pinning, path portability. The companion to…

Use when connecting cloud storage (AWS S3 / S3-compatible or Google Cloud Storage) to Roboflow to mirror images into a workspace — creating storage credentials, defining datasources (bucket-mirror…

The foundation step for the whole Web Anatomy pack. Optional context setup. Use when the user says set up Web Anatomy, create context, start a landing page project, capture product context, benchmark…

Publish oh-my-opencode to npm by triggering the GitHub Actions publish workflow and verifying its artifacts. Ship-only: never runs pre-publish-review or re-reviews merged code unless the user…

Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF,…

Integrates with the official LabArchives ELN REST-like API and Inventory API v1. Supports regional endpoint selection, signed-request construction, user authorization and UID flows, local LA container…

Autonomous AI code generation safety guardrail register: static AST analysis, forbidden import filters, and zero-day vulnerability checks.

Test Planning and Quality Assurance prompt that generates comprehensive test strategies, task breakdowns, and quality validation plans for GitHub projects.

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK…

Add DeltaChat channel integration via @deltachat/stdio-rpc-server. Native adapter — no Chat SDK bridge. Email-based messaging with end-to-end encryption.