Security AI Skills
5,474 open-source Security AI skills that teach any AI model a new workflow.
Search and filter AI skills
AI skills directory results
Data Security Compliance And Regulated Data
Guides agents through regulated-data security and compliance workflows for PII, PCI, HIPAA, PHI, and similar obligations. Use when data products handle sensitive fields, regulated records, control…
Cloud Recon Secret Harvest
Triage a cloud control-plane alert where an actor reads broadly across the account — Describe/List sweeps across regions and services, subscription-wide enumeration bursts, mass reads from secret…
Algorithm Selection
Apply when selecting, reviewing, or configuring cryptographic algorithms, cipher suites, protocol versions, or key exchange mechanisms. Covers banned/deprecated/recommended algorithms, post-quantum…
Specification Website
Query and apply The Website Specification — a platform-agnostic specification of what a good website does, with each item tagged required, recommended, optional, or avoid. Use when the user asks what…
Sql Injection Prevention
Use when writing any custom database query in WordPress with $wpdb — get_results, get_var, get_row, query, or building WHERE/IN/LIKE/ORDER BY clauses. Uses $wpdb->prepare() with correct placeholders…
Agent Fanout
Use this skill when the user asks to "fan out agents", "spawn agents", "use an agent team", "parallel agents", "delegate to subagents", "act as team lead", "orchestrate implementation", "fan out…
Command Development
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create…
V3 Swarm Coordination
15-agent hierarchical mesh coordination for v3 implementation. Orchestrates parallel execution across security, core, and integration domains following 10 ADRs with 14-week timeline.
Code Mate Hermes
Runs Hermes Agent in one-shot mode for bounded local tasks. Use when the user explicitly asks to delegate work to Hermes and accepts its automatic tool approval behavior.
Ai Agent Security
Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.
Containerize Aspnetcore
Containerize an ASP.NET Core project by creating Dockerfile and .dockerfile files customized for the project.
Attacking Oauth With Device Code Phishing
Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and pivot across Microsoft…
Prowler Test Api
Testing patterns for Prowler API: JSON:API, Celery tasks, RLS isolation, RBAC. Trigger: When writing tests for api/ (JSON:API requests/assertions, cross-tenant isolation, RBAC, Celery tasks,…
Zeroize Audit
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing…
Security Check
Quick configuration security check against known threats database
Xiaohongshu Note Detail
Fetch Xiaohongshu (RedNote / xhs) note detail and comments by note ID, returning title, description, author info, engagement stats, tags, and paginated comment list. Use when user mentions note detail…
Security
攻防秘典索引。渗透测试、代码审计、红队攻击、蓝队防御、威胁情报、漏洞研究。安全研究全授权，零废话直出技术细节+PoC。当魔尊提到安全、渗透、攻防、红队、蓝队、漏洞时路由到此。
Plugin Scanner
Scan AI agent skills, plugins, MCP servers, and agent tooling for prompt injection, unsafe commands, secret exposure, and supply-chain risks before installing or trusting them.
Active Directory Attacks
This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP…
Interpolated Database Query
Construct a database query by interpolating a caller-controlled identifier
Security Review
在添加身份验证、处理用户输入、处理机密信息、创建API端点或实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。
Captcha Bypass Methodology
图片验证码/点击式验证码（click captcha）绕过与识别方法论。当目标登录、注册、密码重置、短信发送等接口存在图片验证码、点击验证码、滑块验证码需要绕过或识别时使用。覆盖验证码类型识别、OCR/打码平台识别、点击坐标验证码模拟、验证码逻辑绕过（复用/回显/空值）、频率限制绕过与授权边界
Security Review
AI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules,…
Blucli
BluOS CLI (blu) for discovery, playback, grouping, and volume.
Nist Csf
Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1. Use this skill whenever a user asks about NIST CSF, cybersecurity risk management, the six CSF functions (Govern,…
Threejs Volumetric Clouds
Implement volumetric cloud systems in Three.js. Use for weather-driven density, bounded raymarching, shape/detail erosion, vertical profiles, lighting cones, silver lining, temporal reconstruction,…
Httpclient Factory
IHttpClientFactory and typed HTTP clients for .NET 10 applications. Covers named/typed/keyed clients, DelegatingHandlers, resilience with Microsoft.Extensions.Http.Resilience, and testing patterns.…
Cross Agent Delegation
Cross-agent task routing — Codex auto-review, Kimi delegation by complexity score (iCPG + Claude reasoning), iCPG + Mnemos mandatory for all agents
Aws Architecture Diagram
AWS architecture diagrams — generate visual network topology diagrams from live AWS infrastructure. Use when drawing AWS network diagrams, visualizing VPCs, mapping Transit Gateway topology, or…
Common Task Complexity Routing
Scores a coding task on Spread, Novelty, and Centrality (SNC 0-6) and maps the tier to autonomy, verification depth, review mode, reviewers, model tier. Use when sizing a fix or feature before…
Phx Document
Use when asked to document Elixir code: add or fill in @moduledoc and @doc for modules and functions. Documents tested code only; may add a README section or ADR. Not for docs lookup or audits.
Mobile Security
Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC,…
API Fuzzing For Bug Bounty
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or…
Update V8 Version
Update Codex's pinned `v8` / `rusty_v8` versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds. Use when asked to bump V8, update `rusty_v8` artifacts,…
Sql Explainer
Explain what a SQL query does in plain language and point out joins that may multiply rows.
Security Comms
Translate technical security work into the language of non-security audiences — board, executives, engineering, customer success, customers, legal, procurement, sales. Covers incident communication,…
Php Route Mapper
PHP Web 源码路由与参数映射分析工具。从源码中提取所有入口路由与参数结构，输出完整请求模板与参数清单（禁止省略）。
Recon Osint
Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon,…
Ship
Use before implementation, or when a build lacks these decisions: what goes onchain, the minimal contract surface, who triggers each state transition and why, which chain to launch on, and the…
Audit Activation
Audits sub-agent activation from explicit consumer telemetry roots. It separates attempted, started, completed, and unattributed events, reports coverage, and identifies observed zero starts without…
Infrastructure Enumeration
Enumeration of infrastructure services: DNS, SMTP, SNMP, IPMI, NFS, TFTP, RPC/MSRPC, and HTTP/HTTPS surface detection. Checks zone transfers, open relays, default community strings, cipher zero, NFS…
Network Interceptor
Capture, analyze, and replay network traffic between app and license/API servers. Uses mitmproxy for capture and built-in analysis for endpoint discovery, OAuth detection, and token extraction.
Detecting And Responding
蓝队与紫队工程：检测规则编写、SIEM/EDR 调优、事件响应、数字取证、威胁狩猎、ATT&CK 映射、紫队演练闭环。Use when writing Sigma/YARA detection rules, tuning SIEM noise, responding to security incidents, conducting forensic analysis, hunting…
Assessment Sequence Governance
Validates supplied immutable ordered manifests of opaque defensive assessment actions for authority, safeguards, evidence, and separate-operator review. Use when reviewing assessment sequencing…
Ot Security Assessment
Operational Technology (OT) security assessment using a two-stage methodology: (1) Identification/Discovery of OT devices and protocols, and (2) Vulnerability Assessment using online sources and…
Deep Review
Parallel competency-based code review. Launches independent Agent reviewers per competency (security, performance, architecture, database, concurrency, error-handling, frontend, testing), each with a…
Ci Cd And Automation
Plan, implement, or review ci/cd and automation work in an existing codebase with compatibility, security, and verification controls. Use when the user explicitly requests ci/cd and automation work.
Prd V05 Technical Stack Selection
Determine technologies needed to build the product, making build/buy/integrate decisions during PRD v0.5 Red Team Review. Handles both greenfield and brownfield contexts. Triggers on requests to…
Reversing React Native Apps
Reverse engineer React Native mobile apps, including Hermes bytecode bundles, using hbctool, hermes-dec, and Frida. Use when an APK contains index.android.bundle or libhermes.so, when an IPA contains…
Channel Bot
Work with messaging-channel bots — Telegram, Slack, Mattermost or Microsoft Teams. Register a bot, route inbound messages through an agent, choose webhook vs polling, handle an @slug mention, or add a…
License Compliance Audit
Read-only license compliance audit for one repository or checkout: LICENSE present, NOTICE complete when the declared license requires it, and source files carrying SPDX-License-Identifier headers…
