Security AI Skills

A Kerberos or NTLM artifact presented to reach a host - a service ticket used with no request behind it, RC4 forced on a service whose baseline is AES, one source walking an account to many hosts, a…

Apply when reviewing or writing GitLab CI (.gitlab-ci.yml), Tekton pipeline/task YAML, or Containerfiles/Dockerfiles used in CI builds. Detects common misconfigurations that expose secrets, weaken…

Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit…

Git workflow and version control skill covering branching strategies, commit conventions, merge conflict resolution, and collaborative development patterns.

Use when building or reviewing native Android apps with Kotlin, Compose, architecture, Room/DataStore persistence, offline sync, or test-driven development; use mobile-platform-operations for store…

Triage, redact, clean up, and resolve OpenClaw GitHub Secret Scanning alerts in issues or PRs.

Translate PRD intent, roadmap asks, or product discussions into an implementation-ready capability plan that exposes constraints, invariants, interfaces, and unresolved decisions before multi-service…

Audit an Anthropic Cookbook notebook based on a rubric. Use whenever a notebook review or audit is requested.

Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using…

Pytest testing patterns for Python. Trigger: When writing or refactoring pytest tests (fixtures, mocking, parametrize, markers). For Prowler-specific API/SDK testing conventions, also use…

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when…

Execute DeFi operations on Starknet including token swaps via avnu aggregator, DCA recurring buys, STRK staking, and lending/borrowing. Supports gasless transactions.

This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze…

Domain routing and boundary guidance for authorized file operation vulnerability testing, including path traversal, arbitrary file read/write/upload, and LFI/RFI. Use when a task belongs to the file…

Optimize for search engine visibility and ranking. Use when asked to "improve SEO", "optimize for search", "fix meta tags", "add structured data", "sitemap optimization", or "search engine…

A test skill with prompt injection patterns

OAuth 2.0 / SSO / OpenID Connect 认证流程攻击。当目标有「使用 Google/GitHub/微信 登录」按钮、redirect_uri 参数、authorization_code 流程、或 /.well-known/openid-configuration 端点时使用。覆盖 redirect_uri 劫持、state 缺失 CSRF、token 泄露、scope…

Use when the user wants to audit test quality, find flaky test patterns, speed up test execution, or prepare for Swift Testing migration.

Configure CircleCI workflows and orbs for continuous integration and deployment. Create config.yml pipelines, use orbs for reusable configurations, and optimize build performance. Use when working…

This skill should be used whenever the user mentions a "semantic model", "data model", or "dataset", or asks to "build", "model", "design", "optimize", "review", or "audit" one, or to "add a measure",…

Control Eight Sleep pods (status, temperature, alarms, schedules).

End-to-end playbook for moving a Laravel or static site from a Forge/DigitalOcean server to Laravel Cloud, from preflight to decommissioning the old droplet. Use when asked to "move a site to Laravel…

Mandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No…

Expert SWIFT Customer Security Programme (CSP) advisor covering the Customer Security Controls Framework (CSCF v2026). Use this skill whenever a user asks about SWIFT CSP, CSCF controls, SWIFT…

Built-in OpenAPI support for .NET 10 applications. Covers document generation, transformers, TypedResults metadata, security schemes, XML comments, build-time generation, and multiple document…

Flutter development with Riverpod state management, Freezed, go_router, and mocktail testing

Check agent-produced plans, tests, or code against the owner's actual intent. Find missing meaning, unrequested work, stale truth, unreachable decisions, unsupported completion claims, and…

Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.

Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection. Use when building systems requiring…

Improve code across four axes (cleanup, performance, security, architecture) by scanning and fixing, or applying a pushed audit report. Use when the user wants to refactor, optimize, harden, or remove…

Credential exposure detection, OAuth flow validation, API key management testing, and data sanitization verification for n8n workflows. Use when validating n8n workflow security.

Umbrella skill for all Convex development patterns. Routes to specific skills like convex-functions, convex-realtime, convex-agents, etc.

Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth…

Google Slides: Read and write presentations.

Use when an application issues and validates its own first-party JWT access and refresh tokens, including authentication filters, password encoding, RBAC, and method security. For JWTs issued by…

Blocks destructive shell commands once invoked: a PreToolUse Bash guard denies rm -rf outside temp dirs, force pushes and remote branch deletes, git reset --hard, DROP TABLE / DROP DATABASE /…

Offline credential and file recovery with hashcat and john. Use when any skill captures hashes (NTLM, Kerberos TGS/AS-REP, shadow, MSCACHE2) or encrypted files (ZIP, Office, PDF, KeePass, SSH key, 7z,…

Use when looking up CVE identifiers, EDB-IDs, public exploit references, or product/version matches in Exploit-DB for vulnerability research or authorized security assessment.

AbuselPDB integration. Manage data, records, and automate workflows. Use when the user wants to interact with AbuselPDB data.

Manage Google Workspace via the `gws` CLI — Drive, Gmail, Calendar, Sheets, Docs, Chat, Admin, Tasks, Meet, Slides, Forms, Contacts, and every other Workspace API. Use when: (1) listing, uploading,…

Multi-agent adversarial-verification orchestration for high-confidence conclusions. Fan-out finders, then verify every finding through a three-prism panel (exploitability / correctness / refutation)…

Audits supplied evidence when passwords, hashes, private keys, browser or vault entries, cloud CLI credentials, application secrets, tokens, or credential-bearing artifacts may be exposed. Use for…

Multi-language static application security testing using Horusec with support for 18+ programming languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history, and…

Creating Helm charts to Lerian conventions via ring:helm: standardized chart structure, full env-var coverage from .env.example, security defaults (runAsNonRoot, readOnlyRootFilesystem),…

Answer "who did what" security questions from Audit Trail — deletions, config changes, login activity, permission changes, actions from a specific user or IP.

Decide whether an agent skill, plugin, or MCP server is safe to install into an AI coding agent, where its content is loaded into a model's context and its config can run on startup. Use when…

Triage a security scanner's multi-finding output (via a scan-format adapter; ASVS is the reference), bucket each finding, and apply only the operator's confirmed decisions. Publishes the report as a…

Use whenever answering anything version-sensitive — library/framework/SDK APIs, package versions, model IDs, pricing, CLI flags, config, or "latest/newest" anything. Verify against current sources…

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing…

开卷答题教练：教初中开卷考试的方法——考前怎么给教材建索引，考场上怎么快速定位，怎么把材料和教材原文组织成得分点；适用于道德与法治、历史、生物、地理等采用开卷形式的中考科目。 触发语示例："开卷考试怎么准备""道法开卷怎么做索引""考场上翻书来不及怎么办""开卷题的答案怎么组织才得分"。…

Route one question or source event through a supplied knowledge catalog to validated source, owner, escalation, and follow-up skill references. Use for evidence discovery and ownership routing, not…