Security AI Skills

Audit HTTP security headers for any URL and receive a grade (A+ to F) with specific recommendations for missing headers

Use when exporting and distributing Godot games — export presets, platform settings, CI/CD with GitHub Actions

Schema awareness - read before coding, type generation, prevent column errors

AWS CloudWatch monitoring — metrics, alarms, log queries, VPC flow log analysis, network performance. Use when checking AWS alarms, analyzing VPC flow logs, investigating network latency, or…

Daniel-mode fast-track auto-approves Checkpoint 1-8 when Trust ≥ 80, fastTrack on, Design doc exists. Else L2 + manual gates. Triggers: pdca fast-track, skip checkpoints, auto approve

Create or review an AGENTS.md file so coding agents get stable repo-local instructions: environment setup, testing, style, security boundaries, PR policy, and handoff rules. Use when a repo lacks…

Provide Phoenix, LiveView, Ecto, OTP, or Oban examples. Use when asked for sample code, a walkthrough, a proper implementation, or expected workflow output. Pair with domain skills. NOT for debugging,…

Offensive testing of perimeter network appliances and VPN crypto — IKE/IPsec (aggressive-mode, transform/DH enum, NAT-T), Check Point SIC/OPSEC, safe firmware/patch-level inference for…

Displays chronological events and activity through timelines, activity feeds, Gantt charts, and calendar interfaces. Use when showing historical events, project schedules, social feeds, notifications,…

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use…

Find typos and repeated words in documentation without changing technical terms or code.

Engineer and audit SIEM detection rules — log source coverage, Sigma / KQL / SPL / Elastic query authoring, MITRE ATT&CK mapping, false-positive tuning, and detection-as-code workflows. Use when the…

Manage Google Keep notes.

Single-pass codebase analysis leveraging a 1M-token context window for comprehensive security scanning, architecture review, and dependency auditing. Loads entire codebases for cross-file pattern…

Implement secure coding practices following OWASP Top 10. Use when preventing security vulnerabilities, implementing authentication, securing APIs, or conducting security reviews. Triggers on OWASP,…

Network reconnaissance, host discovery, port scanning, and OS fingerprinting. Produces a port/service map that the orchestrator uses to route to service-specific enumeration skills.

Run authorized network reconnaissance with Nmap on Windows (or Linux). Host discovery, port/service/version scanning, OS detection, and safe NSE scripts, parsed into a severity-ranked defensive…

Expert guidelines for blockchain development including CosmWasm, Cosmos, and cross-chain patterns

Mobile development knowledge reference covering iOS (SwiftUI), Android (Jetpack Compose), React Native, and Flutter. Use when building mobile apps, working with cross-platform frameworks, or…

Assembles supplied validated artifacts, immutable final findings, scope, methods, coverage, limitations, contradictions, and evidence indexes into a complete review-ready engagement package without…

Penetration testing framework for exploit development, vulnerability validation, and authorized security assessments using Metasploit Framework. Use when: (1) Validating vulnerabilities in authorized…

Guide the design and maintenance of recordkeeping programs under SEC Rules 17a-3, 17a-4, and 204-2. Use when the user asks about document retention schedules, how long to keep trade records or…

Generate story concepts using a genre-first approach. Use when starting a new project, when brainstorming ideas, when a concept needs strengthening, or when you want to ensure emotional impact drives…

Reverse engineer Unity games and apps built with IL2CPP or Mono, using Il2CppDumper, Il2CppInspector, and dnSpy. Use when an APK or IPA contains global-metadata.dat, libil2cpp.so, UnityFramework, or…

Read-only review of one repository's GitHub Actions workflows and recent run history against the ASF Infra workflow-optimization practices. Produces a prioritised plan to cut runner use; never edits…

Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates quality against templates,…

Guide for implementing MongoDB - a document database platform with CRUD operations, aggregation pipelines, indexing, replication, sharding, search capabilities, and comprehensive security. Use when…

Scan code changes for security vulnerabilities using STRIDE threat modeling, validate findings for exploitability, and output structured results for downstream patch generation. Supports PR review,…

Review one exact GitHub pull-request head from bounded changed-file patches and check evidence, producing source-line findings without posting or claiming tests ran.

Analyzes PHP code for access control issues. Detects inline role checks, hardcoded permissions, mixed ACL/RBAC models, missing Voter/Policy pattern, and authorization logic in controllers.

Prioritizes patches and manages remediation SLAs using SSVC 2.1 decision outcomes, EPSS v3 trend analysis, and CISA KEV catalog cross-referencing. Covers SLA frameworks by severity tier, compensating…

Assess an existing app (VMware/EC2) by source code analysis for the replatform vs rearchitect decision, and execute the approved migration onto Amazon ECS. Scope: assessment, strategy decision,…

Download PDF from ScienceDirect articles. Requires institutional or subscriber access.

Fix CVE-2025-32433 in Erlang/OTP SSH server - unauthenticated connection message execution vulnerability. Use when tasked with fixing the SSH state machine vulnerability that allows pre-auth command…

Refracting thinking by challenging assumptions, combining cross-domain knowledge, and shifting perspectives to reframe problems. Use for stuck situations or paradigm shifts. Does not write code.

Deep dependency management workflow—inventory, upgrade policy, security patches, licensing, lockfiles, and supply-chain hygiene. Use when upgrading frameworks, resolving CVEs, or standardizing how…

CI/CD pipeline and software supply chain compromise covering Jenkins (script console, Jenkinsfile injection, shared library abuse, CVE-2024-23897 args4j), GitLab CI/CD (runner abuse, .gitlab-ci.yml…

Use when the user asks to audit, inventory or back up client FortiGate firewalls, or read FortiManager or FortiGate Cloud: grades every FortiGate in a devices file for firmware, SSL-VPN exposure,…

Run bounded, read-only Splunk SPL searches through splunkctl and return compact, evidence-backed results without exposing credentials or flooding context.

Navigate the buyer's procurement gauntlet from 'you're selected' to signature: map it early, pre-bake the artifact pack, run security, legal and privacy reviews in parallel on a mutual close plan, and…

A credential driven from a place or by a client it has never used - a long-lived key calling from an unfamiliar ASN, a workload role used from an address that is not the instance's own or its NAT…

Enforce authentication and authorization at the API gateway for AI systems. Use when designing, building, or reviewing API gateways that front inference engines, LLM APIs, or AI model endpoints.

Use when a plugin extends WooCommerce - reading or writing orders, customer data, or hooking checkout, REST, or the Store API. Sanitizes input with wc_clean, gates shop actions with WooCommerce…

Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the…

当用户明确要求发布项目到 GitHub、创建 GitHub Release 或生成 Release Notes 时使用。根据版本历史整理发布说明；仅要求预览时不执行发布。

Packages a completed design cycle (.design artifacts + decisions + screenshots) into a stakeholder-shareable artifact - self-contained HTML, print-styled PDF (Paged.js-compatible), or a Notion page.…

Use expo-secure-store for secrets (tokens, API keys) backed by iOS Keychain. Use when the user says 'secure storage', 'Keychain', 'store token', 'API key storage'.

Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging,…

Runs a local OpenClaw agent non-interactively and returns its structured response. Use when the user asks to delegate a bounded task to the OpenClaw main agent.

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest…