Security AI Skills

Login, signup, password reset, SSO, MFA, and authentication UX patterns.

Compressed code review - one line per finding with location, problem and fix. Use for /caveman-review, "review this PR", or "review the diff".

Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including…

Answer any question about Qwen Code usage, features, configuration, and troubleshooting by referencing the official user documentation. Also helps users view or modify their settings.json. Invoke with…

Reviews Pull Requests that add or modify compliance frameworks. Trigger: When reviewing PRs with compliance framework changes, CIS/NIST/PCI-DSS additions, or compliance JSON files.

Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on…

Detect tool misuse and unexpected code execution via dialogue testing. Use when the agent exposes file, code-execution, or network tools.

Update the guide's threat intelligence through AgentSec Triage, research new coding-agent and MCP security advisories, and synchronize the security feed. Use for threat database refreshes or mise a…

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity…

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity…

Manage {{KIRO_DIR}}/steering/ as persistent project knowledge

Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs…

Golang semantic code intelligence via `gopls`, the official Go language server — go-to-definition, find references, call/implementation hierarchy, workspace symbol search, package API discovery,…

Shifts Layer 3 model selection to cost-optimized alternatives when economy mode is active.

Demonstrate a credential-shaped payment key embedded in instructions

Capture authenticated product screenshots through the repository-owned Playwright CDP script and archive them in the invoking loop's Memory. Use when content needs truthful UI evidence, reusable…

Roadmap parsing, analysis, and mutation operations for ROADMAP.md. Handles phase and milestone lifecycle including add, insert (decimal), remove, complete, and requirements coverage analysis.

AI/ML 基础设施安全测试。当目标涉及 Jupyter Notebook/JupyterHub/JupyterLab、MLflow、Ray Dashboard、Kubeflow、Gradio/Streamlit 应用、vLLM/TGI/Ollama 推理服务、或任何机器学习平台时使用。当发现端口…

Design or change standalone module entities, relations, encryption maps, migrations, snapshots, locking, and atomic writes. Use for "add entity", "database model", "migration", "encrypt this field",…

Use when taking an existing in-repo GAIA agent to a published, day-one-usable hub package — porting a legacy agent under hub/agents/<id>/, deciding whether an agent should ship at all, or answering…

Agent 工作台迁移。把任意项目整理成 Claude Code / Codex / Grok 三端一致、可长期维护的 Agent 工作台：审计规则文件、识别真源、统一命名并生成 bridge。 触发方式：/dbs-agent-migration、/agent迁移、「迁移到 Codex」「迁移到 Claude Code」「迁移到 Grok」「统一 AGENTS.md」「整理 skill…

Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Use for test, review, security audit, OWASP, coverage, lint work, and…

Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.

Picoclaw runtime traffic monitoring baseline for lightweight AI gateway proxy inspection, egress detection, and posture integration.

Use when preparing, publishing, or checking readiness for a Kotlin library release, including verifying its gradle-maven-publish-plugin prerequisite, reconciling changelogs and API snapshots, and…

Review Python code for quality, security, and best practices

Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription…

Feishu knowledge base navigation. Activate when user mentions knowledge base, wiki, or wiki links.

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing,…

代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践

Run the adversarial verification loop — implement, then hand the change to a fresh checker that did not write it, fix what it finds, and re-dispatch until APPROVE. Use before claiming any behavioural…

AST-based code graph for fast symbol lookup, dependency analysis, and blast radius via codebase-memory-mcp MCP server

Use when setting up Data Connect, writing GraphQL queries/mutations, configuring generated SDKs, handling offline, or applying security rules.

Bulk-extract many pages from one site or section. Use for "crawl", "everything under /docs", or content spanning linked pages.

Code review — analyze quality, detect bugs, ensure best practices with actionable feedback. Triggers: code review, quality check, bug detection

Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue),…

Upgrades dependencies in reversible batches with version-specific compatibility and regression checks.

Brainstorm Elixir/Phoenix features — explore ideas, compare approaches, gather requirements. Use when vague idea, not sure how to approach, or want to discuss before plan.

Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security…

Use when working with n8n workflows in any capacity. The always-on protocol for the n8n-skills plugin, loaded by the SessionStart hook every session. Routes to the right skill, summarizes every n8n…

Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test…

A Watch Skill command failed, video download broke, ffmpeg or yt-dlp is missing, a provider returned an error, local vision stopped, or the user asks "why can't it watch this" or "repair my setup".…

Run osv-scanner via the mantis_osv_scanner MCP server for SCA (vulnerable dependency) findings

System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement

SOLUTIONING GATE — validates cohesion across planning artifacts before any implementation begins. Cross-references PRD (or tech-spec), architecture document, and epics/stories for coverage consistency…

Find hard-coded user-facing strings in a frontend codebase and move them to a translation file.

Use when the user asks to review a skill, analyze skill quality, update or align a skill version, compare local state against a newer variant, or run a repeatable keep/enable/hide/disable/archive…

SAP BTP Connectivity skill covering Destination Service, Connectivity Service, Cloud Connector, Connectivity Proxy, and Transparent Proxy for Kubernetes. Use when configuring destinations (HTTP, RFC,…

Review code changes for bugs, security issues, performance problems, and style violations. Use when asked to review code, a PR, or recent changes.

Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection,…

Google Workspace Admin SDK: Audit logs and usage reports.