Security AI Skills

服务上线前的 AI 安全审查，聚焦需要理解代码语义和业务逻辑的安全问题。 覆盖注入防护、认证授权、敏感数据处理、配置安全、业务安全 5 个维度。 适用于 JS/TS 前端、TS/Python 后端项目。 CI/CD 自动化检测（依赖漏洞、敏感信息 grep）不在本 skill 范围内，由流水线承担。 触发词：安全审计、安全检查、上线前检查、有没有漏洞、security audit。…

Provides structured incident containment strategies mapped to NIST SP 800-61 Rev 2 and MITRE ATT&CK techniques. Auto-invoked when a confirmed incident requires isolation decisions, credential…

Review TypeScript and Node code. Use for SvelteKit types, tsconfig, ESM, Zod boundaries, testing, or npm package builds. Read README.md for the guide map.

Generate structured CSV security audit reports from vulnerability data with proper filtering, formatting, and field mapping.

全面的安全分析，识别OWASP Top 10漏洞、检测硬编码密钥和审查安全配置。

Confidential ERC20 payments on Starknet using Tongo protocol. Fund, transfer, withdraw, and rollover encrypted token balances with zero-knowledge proofs. Use when the user needs privacy-preserving…

Navigating the skill ecosystem and guiding onboarding. Lists agents, recommends best fit for tasks. Don't use for task execution (Nexus), agent design (Architect).

ASP.NET Core Data Protection API patterns for encryption, key management, and secure data handling in web applications. Use when protecting sensitive data at rest or in transit, managing encryption…

Project documentation lifecycle for PHP/Laravel and Node/TypeScript/React projects — bootstrapping essential docs, naming and folder conventions, freshness, and cleanup of AI-generated junk and stale…

Review ServiceNow server-side scripts for ES5 violations, ACL/injection/XSS issues, N+1 queries, missing setLimit/error handling, hard-coded sys_ids, and business-rule recursion risks.

Copilot agent that assists with project planning, scheduling, risk management, and progress tracking for software development projects Trigger terms: project management, project plan, WBS, Gantt…

Use when auditing Go code involving HTTP client requests, webhook callbacks, URL handling, HTML template rendering in Go web frameworks, or CSRF protection. Covers CWE-918/352/79. Keywords: SSRF,…

Performing repetitive enumeration across many targets - Running batch vulnerability scans on multiple hosts - Monitoring for changes in target environment - Executing attack chains that require…

Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore,…

SAP role & authorization document for a project — one editable HTML workbook (cover with checks, business roles, technical PFCG roles, business role × T-code matrix F/C/D, user × role assignment,…

Use when the user asks to list, search, or inspect ConnectWise Control (ScreenConnect) remote-support and access sessions, run a command on a guest machine, rename or tag sessions, manage instance…

Harden an existing prototype for real use, including failure states, accessibility, security boundaries, and maintainability.

Standardize MotherDuck delivery for consultancies and agencies across client engagements with reusable provisioning, isolation, and handoff patterns.

Perform strict 7-dimension peer review analyzing correctness, tests, performance, architecture, security, style, and diff cleanliness. Activate when user mentions "review", "revisar", "peer review",…

Establish who the caller is — session cookies, bearer tokens, refresh, and OAuth/OIDC flows — and put each where it belongs. Use when adding or changing login, logout, signup, session handling, token…

Secure the administrative interface of model registries. Use when building, deploying, or reviewing model registry access controls and admin interfaces.

Node.js package management - install, update, run scripts

Use when handling passwords, API keys, tokens, or third-party credentials in a WordPress plugin or theme. Hashes passwords with wp_hash_password / wp_check_password, generates tokens with…

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who…

Use when implementing complete CRUD operations, including Create, Read, Update, Delete patterns with proper validation, error handling, and business logic. Includes soft delete, restore, bulk…

Power Platform DevOps and Platform Engineer (Parvez). Use when: provisioning environments, setting up service principals, configuring GitHub Actions CI/CD, Azure Key Vault for secrets, Managed…

实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP…

Use when exploring unfamiliar code, mapping architecture, finding symbols or relationships, tracing callers, callees, data flow or dependencies, assessing impact, auditing dead or complex code, or…

Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction. Use when investigating recently-accessed…

Produce a scannable review brief for a branch or PR so the maintainer can approve without reading the whole diff. Use when the user asks "how do I review this", "summarize the changes", "what should I…

Master index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT.

Prowler documentation style guide and writing standards. Trigger: When writing documentation for Prowler features, tutorials, or guides.

Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration,…

Optimize for search engine visibility and ranking. Use when asked to "improve SEO", "optimize for search", "fix meta tags", "add structured data", "sitemap optimization", or "search engine…

Detect data exfiltration via URL path encoding and chained web_fetch navigation. Covers fake trusted UI injection, letter-level URL path exfiltration, and multi-hop navigation hijacking. Use when the…

Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity…

Use when the user explicitly wants autonomous progress without routine clarification stops: "plow ahead", "do not stop", "use your best judgment", "keep going until done", "finish while I am away",…

Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to…

Provides gRPC usage guidelines, protobuf organization, and production-ready patterns for Golang microservices. Use when implementing, reviewing, or debugging gRPC servers/clients, writing proto files,…

Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a migration skill. Load during any phase that writes a terraform/ directory — first as the "what to emit"…

Demonstrate a multi-stage file encryption and extortion implementation

Host security hardening and risk-tolerance configuration for Bitterbot deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, Bitterbot…

RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding…

HTTP 请求走私高级利用方法论。扩展 cache-poisoning-smuggling 的走私部分。当已确认存在 CL.TE/TE.CL/TE.TE/H2.CL 走私时使用。覆盖链式利用（窃取凭据、绕过 ACL、投毒 Web 缓存、XSS 其他用户）和 HTTP/2 降级走私

Assess a reported security vulnerability in GAIA and fill a PSIRT / JIRA triage: decide if it is valid & exploitable, whether it needs a CVE + bulletin, and produce the CVSS 4.0 score, CWE, and CVE…

Use when the user mentions GRDB performance review, slow GRDB queries, app-group database setup audit, a ValueObservation that stopped updating, or pre-release GRDB scan.

Implement change management processes. Configure CAB reviews, change windows, and rollback procedures. Use when managing production changes.

CloudBase CLI (tcb, 云开发CLI, Tencent CloudBase命令行) resource management skill. Use when deploying cloud functions, CloudRun, storage, NoSQL/MySQL, static hosting, permissions, CORS/domains via tcb; for…

Tavily web search, content extraction, and research tools.

Expert ISO 42001 AI Management System (AIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 42001:2023, AI governance, AI management systems, AI risk assessment, AI system…

Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks to add a note, list notes, search notes, or manage note folders.