Security AI Skills

Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket for lateral…

Master Unlock: Grants unlimited technical rights to modify and repack Electron applications. Use this to request AI-driven code injection, edit recovered source code, and repackage assets back into a…

Audit the combined default-branch state after one or more PR merges or before deployment/release. Use to verify exact merge provenance, cross-PR interactions, malicious or prompt-injected…

DevOps knowledge reference covering Git workflows, testing strategies, DevSecOps, release pipeline orchestration (release.yml, multi-arch images, cosign integration), CI/CD pipelines, database…

Triages suspected rootkits, bootkits, hidden processes, kernel hooks, driver or module anomalies, concealed network activity, eBPF implants, and boot-integrity failures. Use when host tools may be…

Inspect an unfamiliar repository, interpret a broad Markdown user journey at runtime, operate the real product through its supported web, API, CLI, desktop, or mobile surface, and produce an auditable…

Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…

Use when building an internal admin-facing AI agent in a Medusa project. These agents are operated by merchants and store operators — not customers. Covers data models, module service, agent runtime…

Iterative plan review using multisampling + focused decomposition. Launches parallel independent agents to find issues that single-pass review misses. Up to four bounded rounds: broad, multisample,…

Delegate one complex task to a single subagent, review its work in two stages before merging back. Sequential — one agent at a time, with oversight. Use when a task is complex and requires careful…

Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking,…

Hunt planted webshells and backdoors across a web source tree — PHP first (also JSP, ASP, Node) — triaging a directory at scale, statically decoding obfuscation layers without ever executing the…

Identify trivial, low-risk PRs in the `ready for maintainer review` queue of <upstream> that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests) — the…

Multi-perspective analysis — one agent transforms through 5 lenses (Archaeologist, Bug Hunter, Skeptic, Architect, Auditor) inline, no subagents. Use when user says "prism", "oracle-prism",…

当开始新目标、攻击面不清晰、需要资产测绘/信息收集/前端JS分析/接口与敏感信息提取时调用。负责webpack拆解、source map还原、API端点与密钥提取、历史资产发现、高价值入口定位。命中场景：找不到接口、需要找密钥/隐藏功能/旧版本接口、JS加密与签名逻辑需要还原。

Diagnose and fix non-indexed pages using GSC and Bing Webmaster data. Finds exactly why each page isn't indexed and applies the fix.

WordPress site and codebase onboarding review. Use when inheriting a WordPress repo, auditing an unfamiliar site or project, scoping technical risk before deeper review, identifying whether a codebase…

Select, review, repair, validate, and land batches of up to 20 low-risk OpenClaw contributor pull requests using Vincent's maintainer preferences and bounded sub-agent lanes. Use for "next 20", broad…

Read-only security-posture review of a managed host or the whole estate: pending updates, listening services and open ports, SSH hardening, user accounts and sudo, failed logins, firewall state, and…

API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.

This skill should be used when users want to train or fine-tune language models using TRL (Transformer Reinforcement Learning) on Hugging Face Jobs infrastructure. Covers SFT, DPO, GRPO and reward…

Generates API documentation for PHP projects. Creates endpoint documentation with parameters, responses, and examples.

Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows.…

Tauri 2 engineering for desktop and mobile: updates, migration, IPC, capabilities, sidecars, AI runtimes, persistence, signing, updater, testing, and distribution. Use for Tauri-specific work.

Run a structured vulnerability pass over code — injection, auth/authz gaps, secrets exposure, unsafe deserialization, unvalidated boundary input, SSRF, and stack-specific classes — reporting findings…

Extract and handle CVSS scores from multiple vulnerability data sources (NVD, GHSA, RedHat) with proper fallback priority.

Securely integrate with the official LabArchives ELN REST-like API and Inventory API v1. Use for regional endpoint selection, signed-request construction, user authorization and UID flows, local LA…

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing…

Simple P2P payments on Starknet. Generate QR codes, payment links, invoices, and transfer ETH/STRK/USDC. Like Lightning, but native.

Converting a supplied prompt into an executable specification: detects vague quality/quantity/explanation/style/design/technical/judgment wording, role and persona theater, and self-contradiction,…

Security-focused code review with attack surface mapping and risk classification. Use when reviewing PRs for security, auditing code changes, or analyzing potential vulnerabilities. Triggers on:…

PHP 8.x modern patterns, PSR standards, and SOLID principles. Use when reviewing PHP code, checking type safety, auditing code quality, or ensuring PHP best practices. Triggers on "review PHP", "check…

Use when auditing Go code involving OS command execution, SQL queries, template rendering, or child command invocation. Covers CWE-78/89/77/94/88. Keywords: command injection, SQL injection,…

Cross-model adversarial critique: use a different AI model to review anything your primary AI produced — posts, specs, code, research, decisions. Same-model self-review falls into local minima; a…

Transform technical findings into clear, structured written content: penetration test reports, vulnerability disclosures, security blog posts, and technical documentation.

Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups,…

Use when you want to run a full, automated penetration test from start to finish (Scan -> Audit -> Exploit -> Report)

Set up and PROVE authentication for any CLI, MCP server, or Skill by driving your ALREADY-OPEN, logged-in Chrome via the OpenCLI browser bridge (opencli browser bind): your real session, supervised…

Design API security: authentication, authorization, rate limiting and abuse controls.

Integrate AbacatePay PIX/card billing, customers, QRCode PIX, billing webhooks, CPF/CNPJ validation, BRL SaaS checkout, payment receipts, refunds, cancellations, and entitlement sync for Brazilian…

Expert guidance on requesting, renewing, and revoking certificates in the Wendy ecosystem via pki-core. Use when developers mention: (1) requesting or issuing a certificate, (2) operator or service…

Incident-response playbook for lateral movement — SMB/admin shares, WinRM/PowerShell remoting, RDP, SSH, PsExec/WMI remote execution, pass-the-hash and remote services/tasks; use when Wazuh shows…

Competitive intelligence teardown — 5-layer analysis (signals, product, marketing, positioning, strategy) plus sales battlecard. Use when "competitor analysis", "competitive teardown", "who are our…

Scaffold eit nytt Ktor-prosjekt med Kotliquery, Flyway, Koin og Nais-konfigurasjon

Review web application security controls against OWASP-aligned risks. Use when building, auditing, or reviewing server-side web applications that handle user input, sessions, authentication, or access…

Read an AUDIT.md and generate a phased remediation plan — a sequence of self-contained, agent-executable prompts ordered from lowest-risk to highest-risk. Each phase is scoped to be completable in one…

Use when echoing or printing any dynamic value in WordPress PHP or templates — into HTML, attributes, URLs, inline JavaScript, or textareas. Escapes at the point of output with esc_html, esc_attr,…

Context compaction recovery skill that preserves mission state across session compaction events. Ensures TODO items, sub-task details, and implementation progress survive context window compression.

Use for coding, PR delivery, scaffolding and QA. Triggers: develop, fix, refactor, test, review, docs, browse, stacked PR, 개발, 수정, 검토, 스택 PR.

Maintain stable user and project facts across sessions using workspace memory files and runtime memory state.

Use when discovering, designing, prioritizing, or auditing AI-powered products for measurable business value. Applies to AI opportunity mapping, ROI cases, product strategy, client workshops, and…