Security AI Skills

Use when recalling prior techniques at recon/weaponize, or recording a confirmed finding at report — cross-engagement pattern memory ranked by impact

Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships. Use when modeling least-privilege access, cross-account assumptions,…

Verify that existing work is ready to merge, release, or hand off using an explicit evidence contract. Use when a request asks to verify, validate, prove, check readiness, run the relevant tests, or…

Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.

Patch .NET assemblies to bypass license checks — IL bytecode patching, method replacement, strong name removal, anti-tamper NOP. Works on raw bytes without requiring dnlib/Mono.Cecil at runtime.

Use when tasks require freshdesk approval router with credential-aware preflight, deterministic execution, validation gates, and handoff-ready artifacts.

Frontend UI design system selector and implementation guide covering Glassmorphism, Liquid Glass (Apple-style), Neubrutalism, and Claymorphism. Use when building UI components, choosing a visual…

Governs an exact current binary-fault-triage assessment result and recorded validation-readiness handoff for separate isolated-lab review. Use when checking defensive authority, isolation, budget,…

Save what matters at the end of a session so the next session picks up exactly where you left off. Or restore context at the start of a new session so nothing is lost between them.

Dockerfile security linting and best practice validation using Hadolint with 100+ built-in rules aligned to CIS Docker Benchmark. Use when: (1) Analyzing Dockerfiles for security misconfigurations and…

Test for regulatory compliance: GDPR/CMP consent verification, Google Consent Mode v2, Global Privacy Control (GPC), CCPA/US state opt-out, EU AI Act Article 50 transparency, Better Ads Standards, and…

Turn an Issue into a clear, actionable engineering task. Used for requirement clarification, scope confirmation, and acceptance-criteria definition.

Security vulnerabilities in AI-generated code and LLM applications, covering OWASP Top 10 for LLMs, secure coding patterns, and AI-specific threat modelsUse when "ai code security, llm…

Existing project health scan — audits Infrastructure, Security, Quality, and Harness setup. Read-only. Use when: '/project-check', 'project health check', 'project audit', 'what\'s missing', 'analyze…

Migrate Python OpenAI Agents SDK applications to Pydantic AI and, when warranted, Pydantic AI Harness. Use for `agents.Agent`, `Runner`, function tools, handoffs, guardrails, sessions, human approval,…

Recover the original logic from code protected by a virtualization obfuscator — VMProtect, Themida/WinLicense, Code Virtualizer, or a custom opcode VM — by locating the VM dispatcher,…

Jira integration via acli CLI. Use when user says '/jira', 'check Jira board', 'create Jira ticket', 'move ticket to done', 'search Jira', 'sync blockers from Jira', 'what's in the sprint', 'Jira…

使用纳瓦尔·拉维坎特式的重新定义、欲望审计、特定知识和杠杆框架澄清职业、创业、财富、幸福、自由与人生选择。用于识别错误问题、冲突欲望、独特竞争力、AI替代风险、许可依赖、边际成本和长期复利方向。

Fan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report. Each pass is isolated so one axis…

Gets independent reviews of a change from two or three different models or providers and loops on fixes until they agree. Use when the user says jury, panel review, second opinions, ask other models,…

Use when stuck, contradictory, blocked, or incomplete Hermes updates must be diagnosed across Git state, remotes, running processes, caches, and installed versions before recovery.

当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用，进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景：搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。

Post-Ship Growth Intelligence — track how your shipped product is performing. Use when user wants to check growth metrics, SEO trajectory, uptime, deploy frequency, or overall project health over…

AI safety, guardrails (NeMo, Llama Guard), bias audit, EU AI Act / Keamanan AI, guardrail (NeMo, Llama Guard), dan tata kelola AI.

WordPress REST API review and development guidance. Use when reviewing custom REST routes, permission_callback logic, schema design, WP_REST_Request handling, response structure, versioning,…

All-in-one ComPDF workflow for document conversion, OCR, data extraction, PDF editing, protection, compression, and watermarking. Use for any ComPDF Server API request that processes PDF, Office,…

Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or…

EKS cluster reconnaissance and environment discovery — reports the raw FACTS of a cluster and its environment. Detects compute (Karpenter, MNG, Auto Mode, Fargate, nodes/AMI), networking (VPC/CNI,…

List all APIs from mitmproxy traffic capture. Use when user asks to see APIs, endpoints, or wants an overview of captured HTTP traffic for a website or app.

When the user wants to create email sequences for developers including onboarding, product updates, re-engagement, or changelog communications. Trigger phrases include "developer emails," "onboarding…

Register AI agents on-chain using the ERC-8004 Trustless Agents standard. Manage agent identity as NFTs, build reputation through feedback, and request third-party validation.

Casting personas: rapid generation from diverse inputs, registry-based persistence and lifecycle, data-driven evolution, inter-agent sync. Not for UI walkthroughs (Echo) or user research (Field).

Configures JWT Bearer authentication for .NET APIs. Includes token generation, validation, refresh tokens, and user context extraction from claims.

Use when auditing Go code involving TLS configuration, certificate validation, JWT token parsing, SAML assertion verification, webhook signature checking, or cryptographic operations. Covers…

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from…

Specialist orchestrating codex exec / Antigravity CLI through dual paradigms — COMPETE (multi-variant comparison, select best) and COLLABORATE (decompose tasks across engines, integrate). Supports…

Anti-forensics is the offensive counterpart to digital forensics.

Business logic, race conditions, and AI security analysis

Translate PRD intent, roadmap asks, or product discussions into an implementation-ready capability plan that exposes constraints, invariants, interfaces, and unresolved decisions before multi-service…

Comprehensive workflow to prepare a project for public open-source release. Handles licensing, username normalization, code integrity checks, and documentation generation.

Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is…

Incident-response playbook (PB-001) for brute-force, password-spraying and credential-stuffing attacks against SSH, PAM, Windows logon and web logins; use when Wazuh raises authentication-failure…

Generate a complete product manifest of a codebase — every file, route, endpoint, database table, component, hook, and feature inventoried in a single structured document. Use when you need to…

Use when handling any form submission, AJAX request, admin-post action, settings page, link that triggers an action, or any other user-initiated request in a WordPress plugin or theme. Generates…

Chief Technology Officer (CTO) orchestrator for architecture governance, build-vs-buy decisions, tech debt management, engineering standards, platform strategy, and security posture. Orchestrates…

Derives security requirements from a named threat.

Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for…

When the user wants to create, initialize, or prepare one Agentic SEO project with the standard local project structure, blank brain templates, content directories, and initial log entry.

Run a product multi-point inspection — assess a shipping product (app, website, or feature) as-built across 10 stations and produce a red/yellow/green inspection report with a prioritized work order.…

Create, read, transition, and comment on Jira issues via the Jira REST API v3.

Recognize and design against the cost of attention fragmentation — the disproportionate damage that even small interruptions do to focused work. Use when designing notification systems, evaluating…