Security AI Skills

Create, generate, update, repair, trim, or split minimal AGENTS.md files for repository roots and confirmed nested modules using progressive disclosure. Use for missing, bloated, contradictory, or…

Systematically audit Solidity smart contract codebases for security vulnerabilities using a 4-phase approach - load a vulnerability cheatsheet, sweep code with grep and semantic analysis,…

Reference guide for connecting popular APIs to Home Assistant via Node-RED, YAML, or custom integrations. Covers authentication, endpoints, and complete working examples for: energy APIs (Tibber,…

Turn a finished or nearly finished Skill, plugin, repository, micro-tool, research utility, or AI project into a credible public launch that can earn real users and feedback. Use when the work exists…

Create, audit or refresh evidence-grounded interactive software diagrams from source, schemas, config, or requirements; deliver offline HTML, graph JSON and SVG.

Skill hub for the solana-ai-kit Claude Code plugin. Routes the bundled go-to-market skills and the opt-in add-on catalog, and points to upstream marketplaces (and the install.sh full install) for…

Audit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 16 other rule categories (300+ rules), returns an…

Local A2A (Agent-to-Agent) protocol documentation (latest). Use for agent communication, task management, streaming, push notifications, and enterprise-ready agent interoperability.

System prompt for an AI agent with Browser Use browser automation and Inkbox email. Drop this into your agent loop to get browser automation and email tools out of the box.

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP…

Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology. Use when asked to audit a smart contract repo from a URL or local path,…

Comprehensive project planning and documentation generator for software projects. Creates structured requirements documents, system design documents, and task breakdown plans with implementation…

Use this skill whenever the user wants to create, improve, optimize, review, or rewrite a resume, CV, curriculum vitae, or hoja de vida. Triggers include: any mention of 'resume', 'CV', 'curriculum',…

Whole site or product — a full web accessibility (a11y) audit against WCAG 2.2, following the WCAG-EM methodology. Defines scope, samples representative pages and flows, runs the automated tier…

Access Control knowledge base. Provides ACL, RBAC, ABAC, ReBAC models, multi-tenancy patterns, and PHP implementations (Symfony Voters, Laravel Gates) for security audits and generation.

Application Security Engineer role bundle for security design, testing, and code review of applications. Orchestrates new application reviews, PR security reviews, API security assessments, and AI…

Supabase integration specialist. Handles database schema, authentication, Row Level Security (RLS), real-time subscriptions, and storage. Connects existing UI to real backend. Only called AFTER UI…

Evaluate a GitHub repository from an outside contributor's perspective using PR throughput, external-author proxies, response evidence, governance, and contribution fit. Use when deciding whether a…

Shared review rules for automated PR reviews and local manual reviews. Triggered by review commands.

Challenges AI-generated plans, code, designs, and decisions before you commit. Pairs with any other skill as a review layer. Uses pre-mortem analysis, inversion thinking, and Socratic questioning to…

Use when users request Android competitor research, systematic feature or interface mapping, evidence screenshots, interaction coverage, comparison-ready product dossiers, or Android system-boundary…

Manage code snippets in ByteStash snippet storage service. This skill should be used when the user asks to "save a snippet", "search snippets", "find code", "share snippet", "organize snippets", "list…

Use when: 审核产品调研、市场分析、增长报告或 PRD 中的关键结论是否有可追溯证据，核对来源、日期、推断与冲突 Do NOT use when: 只需评审 PRD 的完整性和表达（用 pm-prd-review）、仅需撰写新报告而非审查现有主张

Use this skill whenever the user needs to manage VMs in VMware/vSphere/ESXi — it's the entry point for all VM operations. Directly handles: power on/off, clone, snapshot, migrate, deploy from OVA or…

Review and explain verified deployed EVM smart contracts from a contract address and chain. Use when a user asks to break down what a Solidity contract does, map its architecture and source files,…

Audit a body of competitive content - battlecards, sales decks, comparison and alternatives pages, enablement, training, help-center copy - against current evidence, and produce the inventory of…

Starknet account abstraction correctness and security guidance for validate/execute paths, nonces, signatures, and session policies.

Store security scan findings to SQLite and compare against answer sheets or other scan runs. Use when asked to "store findings", "save scan results", "compare against answer sheet", "benchmark scan",…

Use when documenting architecture, understanding system structure, creating diagrams, or analyzing component relationships. Focuses on interfaces and high-level design. Triggers on: 'use architecture…

Production-grade patterns for ASP.NET Core Identity in Razor Pages and web apps. Covers setup, customization, security hardening, auth flows, roles/claims, external providers, and integration best…

Inventory the integrations, service keys, legacy private apps, and internal tooling that call HubSpot APIs, and flag anything on legacy v1-v4 endpoints or legacy app architecture ahead of HubSpot's…

RESTful API design, error handling, versioning, and best practices. Use when designing APIs, reviewing endpoints, implementing error responses, or setting up API structure. Triggers on "design API",…

Checks the third-party security audit status of a skill published to a skills registry (skills.sh) across every cached surface, decides whether a failing finding is real or points at content already…

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score…

Foundation library for the DCC Model Context Protocol (MCP) ecosystem. Provides Rust-powered action management, skills system, IPC transport, MCP Streamable HTTP server (2025-03-26 spec, with…

Build, debug, review, and explain Malaysia payment gateway integrations. Use when implementing checkout, payment links, hosted payment pages, redirects, callbacks, webhooks, HMAC/signature…

Full health and security audit for Rails apps, the review a principal engineer would do. Runs rubycritic, Brakeman, bundler-audit and ruby_audit, triages every finding with the LLM as judge, brings an…

Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist.

Blueprint workflow to scaffold agent-oriented documentation with progressive disclosure and executable contracts.

Review an MCP server's security, privacy, permissions, and launch risks before use. Use for a supplied MCP repository or hosted MCP endpoint, or an explicit safety comparison. Produces an…

Advanced 5G/6G telecom attacks covering 5G Core (SBA) exploitation, IMSI catcher evolution (5G Stingray), SIP/Diameter protocol attacks, Open RAN vulnerabilities, network slicing abuse, and early 6G…

Run a Well-Architected Framework (WAF) review against Azure resources in scope. Use when asked about best practices, architecture review, WAF assessment, or pillar compliance (Reliability, Security,…

Systematic code review guidance covering best practices, security, performance, and maintainability. Use when reviewing code, checking PRs, or analyzing code quality.

Audit a Gradle project against the official Gradle best practices, report findings, and propose code changes to bring the build into compliance. Use this skill whenever the user wants to check, audit,…

Use when analyzing components for vulnerabilities (Phase 2 - Parallel Analysis)

Stop coding agents from shipping generic UI. Use UIZZE's 800,000+ real web and iOS screens to build product-specific interfaces, define a design contract, cover required states, and run a hard finish…

Design, create, or validate saved and transient Vapi voice assistants. Use for new phone or web agents, production system prompts and first messages, saved-versus-transient architecture,…

Use when authoring, reviewing, or debugging Blueprint Factory input used by `gen/generate.sh --config`, especially when adding environments, shared platforms, environment platforms, hub changes, or…

Generate and configure DevExpress Blazor AI Chat (DxAIChat) — an AI-powered chat UI for Blazor apps. Use for building conversational assistants, integrating providers (OpenAI, Azure OpenAI, Ollama, or…

Comprehensive code review covering Functionality, Security (OWASP), Performance, and Maintainability. Includes good/bad examples.

AI agent security platform — audit skills, scan for threats, and run 24/7 protection with 9,700+ detection rules