Security AI Skills

Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt,…

Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages. Runs a CVE security audit. Fetches changelogs, summarizes breaking changes with Gemini, and opens one PR per risk group (patch,…

Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use…

OPS on-demand: This skill should be used when the user asks to "audit AWS", "unused AWS resources", or…

Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially,…

Update the title and body of one or more pull requests.

Clean messy CSV files: fix headers, trim whitespace, normalise dates and drop duplicate rows before analysis.

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and…

Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup. Use when the…

Use when bypassing EDR/AV to run a payload — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasion

Validate, lint, audit, or check Fluent Bit configs (INPUT, FILTER, OUTPUT, tag routing).

Read, search, and organize emails via the himalaya CLI (IMAP/SMTP). Use when the user asks to check email, search messages, list folders, download attachments, or manage email flags and folders.

Review PRD.md for gaps, contradictions and unverifiable claims, write an improved PRD.md and record the findings in PRD-REVIEW.md.

Make an approved, scoped change and prove the affected behavior. Use when a request asks to implement, build, add, or land a feature that already has an agreed approach. Do not use to explore, review,…

Exploits Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. Covers GPO enumeration (GPOHound, BloodHound, PowerView), exploitation via immediate…

Automated .NET/C# decompilation and security analysis. Uses ilspycmd for batch decompilation with manual IL fallback. Detects obfuscators (ConfuserEx, .NET Reactor, Babel) and scans for license logic,…

Scans code for security vulnerabilities, detects dangerous patterns, and ensures security decisions are documented. Use when running security scans, auditing code, or checking for OWASP issues,…

Tracks web application assessment coverage across endpoints, inputs, roles, authentication states, and test families, preventing untested or blocked work from being reported as clean. Use when…

Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA). Use when: (1) Enforcing security and compliance policies across infrastructure and applications, (2) Validating…

Dependency upgrades: outdated/vulnerable deps planned into semver waves (patch/minor batched, majors gated and changelog-read), applied incrementally with lockfiles regenerated and tests green after…

Dependency upgrades: outdated/vulnerable deps planned into semver waves (patch/minor batched, majors gated and changelog-read), applied incrementally with lockfiles regenerated and tests green after…

Manage the advisor trade lifecycle from order entry through settlement, covering block trading, allocation, pre-trade compliance, custodian routing, and error correction. Use when the user asks about…

The transparency content type — turn what's actually happening inside the business into founder/personal-brand content that builds trust: build-in-public updates, founder story, how-it's-made content,…

Plan, implement, or review azure role selector work in an existing codebase with compatibility, security, and verification controls. Use when the user explicitly requests azure role selector work.

Use when implementing logging, error tracking, or monitoring in Frappe v14-v16. Covers frappe.logger() for file-based logging, frappe.log_error() for Error Log DocType entries, request logging, Sentry…

Monitor and investigate EU DORA compliance posture using Dynatrace Compliance Assistant. Covers compliance score, CIF health, incident lifecycle, and ICT risk inputs (vulnerabilities, security…

Fullstack development toolkit with project scaffolding for Next.js/FastAPI/MERN/Django stacks and code quality analysis. Use when scaffolding new projects, analyzing codebase quality, or implementing…

Use this skill when a PR diff contains changes to dependency manifest files (package.json, .csproj, Cargo.toml, go.mod, requirements.txt, etc.) or when reviewing Renovate/Dependabot bot PRs. Evaluates…

Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash auth…

Find duplicate ownership, hidden second sources of truth, and contract drift in layered codebases. Use when reviewing normalization, validation, defaulting, canonicalization, persistence mapping,…

When the user wants to programmatically manage Google Business Profiles at scale via API, automate GBP updates, build GBP management tools, or integrate GBP data into their systems. Also use when the…

Sweep the open `<issue-tracker>` backlog for issues that could be labelled as good first issues. Classifies each candidate as READY (propose the GFI label), NEAR-MISS (surface edits to make it…

Detects signature replay vulnerabilities in smart contracts — affecting 19.63% of signature-using contracts. Covers five replay types (same-chain, cross-chain, cross-contract, nonce-skip,…

Use when a top-level, read-only Hermes health audit is needed across installation, updates, gateways, cron, profiles, skills, repositories, credential posture, persistence, and cost signals.

当目标存在文件上传（头像/附件/证件）、下载/导出、导入（Excel/CSV/XML）、预览（PDF/Office）、图片/音视频处理、压缩包解压打包、在线编辑器/终端等功能时调用。负责任意文件上传getshell、路径穿越、任意文件读取/删除、LFI/RFI、Zip Slip、CSV注入/公式注入、ImageMagick/FFmpeg攻击深度挖掘。

Cline's system prompt includes a timestamp that may be recomputed per request, invalidating the system-prompt cache.

Usar para modelar amenazas con metodología STRIDE. También: análisis de amenazas, STRIDE, superficie de ataque, vectores de ataque, modelado de amenazas.

The moment DNS moves and for the thirty days after — verifies the cutover (DNS propagation, certificate, http and www redirects, the noindex, robots and sitemap on the live host, every redirect the…

Audit and fix agent readiness: the Lighthouse Agentic Browsing fraction, accessibility tree for agents, robots.txt and Content-Signal for AI agents, WAF treatment of agent traffic, llms.txt, Markdown…

Configure encryption at rest, in transit, and key management aligned with LGPD Art. 46 (security duty) and the ANPD's Guia de Segurança da Informação para ATPP. Use when user asks 'criptografia LGPD',…

Designs or reviews relational, document, key-value, graph, or search data models with ownership, invariants, access paths, migrations, consistency, retention, privacy, and recovery behavior. Use for…

OAuth 2.0, JWT, SSO, MFA, NextAuth/Clerk/Supabase Auth implementation patterns

Performs a container and Kubernetes security review against the CIS Docker Benchmark v1.6.0, CIS Kubernetes Benchmark v1.9.0, and NIST SP 800-190. Auto-invoked when reviewing Dockerfiles, Kubernetes…

United Arab Emirates Governance, Risk & Compliance advisor — a jurisdiction-first compliance router. In the UAE, WHERE an organization sits determines its law: mainland (Federal PDPL, Decree-Law…

Assess a live EKS cluster's NGINX/Ingress estate and plan migration to Gateway API, the AWS Load Balancer Controller (ALB Ingress), or AWS Transform (ATX). Discovers ingress controllers and routes,…

Systematically review pull requests, feature implementations, and code changes to ensure quality, maintainability, security, and adherence to best practices. Use when reviewing code before merging,…

Find SQL Injection vulnerabilities in captured traffic. Use when user asks about database security, injection attacks, or data extraction.

Computer connector for exposing local services to remote sandboxes via authenticated ngrok tunnels. Use when user mentions "computer use", "tunnel", "ngrok", "expose local", or needs to bridge local…

Create an anonymous Starknet wallet via Typhoon and interact with Starknet contracts. Privacy-focused wallet creation for agents requiring anonymity.

Assessing standards, regulatory controls, and legal-document coverage with cited evidence and proposed wording. Use for OWASP/WCAG/SOC2/PCI/HIPAA or ToS/privacy/DPA reviews; not legal advice or code…

Copilot agent for database schema design, ER diagrams, normalization, DDL generation, and performance optimization Trigger terms: database design, schema design, ER diagram, normalization, DDL,…