Security AI Skills

Drupal security for routes, controllers, forms, and queries. Add route permissions, access checks, CSRF protection, XSS prevention, SQL injection prevention, and secure file upload validation.

Advanced injection attacks beyond SQL - covering OS command injection, LDAP injection, NoSQL injection, template injection (SSTI), XPath injection, and comprehensive filter bypass techniques.

Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up…

Add or review RustFS `tracing` events with the repository field shape, level policy, privacy boundaries, and guardrails. Use when a change adds or edits a tracing macro/instrumentation site or the…

Use for Google Workspace integrations with OAuth, Calendar, Meet, FreeBusy, Drive, Sheets, webhooks, least-privilege scopes, encrypted refresh tokens, idempotent writes, reconciliation jobs, consent…

Kompakt output-stil som kutter fyllord og beholder teknisk substans — spar output-tokens uten å miste nøyaktighet.

Load this skill before implementing a fix for a barrier that may originate in a shared component, design system, renderer, or external dependency rather than this project's own code. Decide whether…

Power Pages (External Portals). Use when: building portals, web roles, table permissions, Liquid templating, entity lists, entity forms, web forms, Microsoft Entra ID B2C authentication, portal…

Use when designing HTTP APIs with OpenAPI, versioning, authentication, rate limits, idempotency, error contracts, observability requirements, and choosing REST, webhooks, SSE, or WebSocket delivery.

Use service mesh patterns for AI inference traffic management, mTLS, canary releases, policy enforcement, and cross-cluster resilience.

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate…

Plans and executes GKE cluster creation, provisioning, and production readiness audits using pre-defined templates (Autopilot, Standard Regional, GPU/AI Inference, AI Hypercompute). Use when creating…

Data pipeline expert for ETL, Apache Spark, Airflow, dbt, and data quality

React 19 patterns with React Compiler. Trigger: When writing React 19 components/hooks in .tsx (React Compiler rules, hook patterns, refs as props). If using Next.js App Router/Server Actions, also…

MCP (Model Context Protocol) server and client engineering. Protocol design, schemas, transports, extensions, security, and migration.

Register AI agents on-chain using the ERC-8004 Trustless Agents standard. Manage agent identity as NFTs, build reputation through feedback, and request third-party validation.

Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a gap report before deploying OpenMed on PHI. Use when the user is about to process protected health information,…

Run holistic pedagogical review on lecture slides. Checks narrative arc, student prerequisites, worked examples, notation clarity, and deck pacing.

Connect an OAuth 2.0 service (Gmail, Google APIs, etc.) using the built-in oauth_authorize tool — get a click-to-authorize link, auto-capture the code, and seal the tokens. Use whenever the operator…

Set up read-only PostgreSQL access for agents. Use only when the user explicitly invokes /create-readonly-db-role.

Formats text according to specified style guidelines. A clean example skill with no security issues.

PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types…

密码重置与用户注册/越权修改方法论。当目标存在忘记密码/密码重置、验证码回显、校验绕过、任意用户密码修改、越权注册（registersysuser、goedituser 等接口）、thinkphp 商城登录短信验证码等场景时使用。覆盖密码重置链路分析、验证码回显/爆破、短信验证码绕过、任意用户密码修改与越权注册、spring 类 .do 接口鉴权绕过（login_tologin.do…

Manage evidence freshness by identifying stale decisions and providing governance actions

Build, test, and deploy applications using GitHub Actions workflows. Create CI/CD pipelines, configure runners, manage secrets, and automate software delivery. Use when working with GitHub…

Gemini CLI for one-shot Q&A, summaries, and generation.

Deprecated compatibility entry for Authentication Page construction. This page is now maintained in Pagina; install and use page-builder to build a new Authentication Page.

Business Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse,…

Expert TISAX (Trusted Information Security Assessment Exchange) advisor for the automotive supply chain — the ENX/VDA assessment regime that OEMs like VW, BMW, and Mercedes-Benz require from suppliers…

Censys lookups: hosts, certificates, services on the public internet

Google Gemini CLI code review with Gemini 2.5 Pro, 1M token context, CI/CD integration

Adversarial review and fix loop for code, specs, plans, and migration manifests.

Re-validates every previously-confirmed finding against its current target — detects drift (patched, mitigated, re-introduced). Cron-driven weekly sweep across the org's validated finding tree.

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.

Webhook testing, schedule validation, event-driven triggers, and polling mechanism testing for n8n workflows. Use when testing how workflows are triggered.

Kubernetes operations: debugging, security, RBAC, and infrastructure tooling.

Start here for GitHub work: issues, pull requests, releases, projects, actions, security alerts, teams and wikis.

PHP 组件版本漏洞检测工具。扫描 composer.json / composer.lock 或 jar/包元信息，匹配已知漏洞规则并输出报告（包含可能的触发点分析框架）。

Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution,…

Google Tasks: Manage task lists and tasks.

Implement secure API authentication with JWT, OAuth 2.0, API keys, and session management. Use when securing APIs, managing tokens, or implementing user authentication flows.

Vulnerability-research loop toward a novel CVE. Target triage -> attack-surface map -> ranked hypotheses -> investigate (RE / fuzz / audit) -> a finding deepens the loop, a dead-end pivots to a new…

Use when starting a frontend review engagement or when the user asks for an initial assessment ("triage", "day 0", "what's the state of this repo"). Reads package.json, README, gh issues, and produces…

Validate, lint, audit, or check Terragrunt .hcl/terragrunt.hcl files, stacks, modules, compliance.

Perform security audits for the Adobe Dispatcher Apache HTTP Server module and Apache HTTPD in AEM 6.5 / AMS workflows only, with AMS-specific hardening verification.

Chain patterns for multi-phase pipelines: MCP detection, handoff files, checkpoint-resume, worktree agents, CronCreate monitoring. Use when building or debugging a pipeline skill.

Architecture Decision Records (ADR) documentation practice. Use when documenting architectural decisions, recording technical trade-offs, creating decision logs, or establishing architectural…

Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.

Symbolic execution and constraint solving with angr, Z3, Unicorn, and Qiling. Activate when license logic, crackmes, or VM input puzzles need automated path exploration and input synthesis.

Processes Word document files (.docx). Creates, edits, annotates, tracks revisions, analyzes OOXML structure, and preserves formatting for contracts, policies, academic papers, and business documents.…

Audits supplied sanitized directory-service governance evidence for durable control and persistence exposure without contacting live systems. Use when reviewing defensive directory control, baseline,…