Security AI Skills

Diagnose a failing CI run against an 11-pattern playbook. Classifies the failure, cites the relevant memory entry, proposes the exact fix command — but NEVER applies without explicit user approval.…

On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability…

Design, audit, and verify configuration, environment separation, secrets, BYOK flows, key rotation, config schema validation, and drift checks across local, dev, staging, and production. Use when…

Use this skill when you need to design evidence-bounded API failure and rejection scenarios; triggers include API 负向测试 and API negative testing.

Linux local privilege escalation enumeration and attack surface mapping.

Unpack Tauri desktop apps — extract embedded web assets (HTML/JS/CSS), Tauri config, IPC command map, and frontend license logic.

Processes PDF files. Extracts text and tables, fills forms, merges and splits documents, batch-processes files, converts to images, and generates PDFs programmatically. Use when working with .pdf…

Audits supplied sanitized Kerberos governance evidence for policy, protection, monitoring, and evidence-handling exposure without contacting live systems. Use when reviewing a defensive Kerberos…

Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models…

Run an opt-in strict maintainability review for giant files, spaghetti growth, misplaced logic, weak boundaries, unnecessary abstractions, and missed structural simplifications. Use for a…

When the user wants to plan, map, or restructure their website's page hierarchy, navigation, URL structure, or internal linking. Also use when the user mentions "sitemap," "site map," "visual…

Apply security-conscious thinking when generating or modifying code. Enforces trust boundary awareness, input validation, injection prevention, secrets management, and defense-in-depth authorization.…

API design specialist for REST, GraphQL, gRPC, versioning strategies, and developer experienceUse when "api design, rest, graphql, grpc, openapi, swagger, versioning, pagination, rate limiting,…

Systematically identify and analyze persistence mechanisms on Linux systems during DFIR investigations -- sweep systemd units, cron jobs, shell initialization, SSH config, kernel modules, LD_PRELOAD,…

Work with the knowledge base — ingest documents, run semantic search, manage collections, add a sync connector (Google Drive, S3), change a parser or an ingestion setting. Use when populating or…

1Password CLI integration — retrieve secrets, manage vaults, inject credentials into scripts without hardcoding.

Import new `<security-list>` reports into `<tracker>`: find threads not yet tracked, propose the imports (default: import unless rejected), create each tracker in `Needs triage`, and draft a receipt…

Triage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login…

WordPress site and codebase onboarding review for Codex. Use when inheriting a repo, classifying an unfamiliar WordPress stack, mapping architectural hotspots, or deciding which WordPress review skill…

Audit technical SEO across crawlability, indexability, security, URLs, mobile, Core Web Vitals, rendering, structured data, and IndexNow. Use when the user asks for a technical SEO audit or about…

Cross-session cognitive persistence via Neural Memory MCP. Use when needing semantic recall of past decisions / errors / insights across projects — distinct from session-bridge (file-based,…

Rewrites English text so it reads as written by a person, without AI writing tics. Removes machine language patterns and AI slop, restores semantic entropy, and injects voice and personality. Use when…

generate release notes for changes since a given tag

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest…

Drupal State API — storing and retrieving runtime state that persists across requests but is not configuration.

MCP server and client development — scaffold, implement tools/resources/prompts, validate schemas, debug protocol compliance, and deploy with auth and rate limiting.

Attacks against Trusted Execution Environments (TEEs) and confidential computing platforms — Intel SGX (Foreshadow/SGAxe/LVI/ÆPIC Leak), Intel TDX, AMD SEV/SEV-ES/SEV-SNP (CrossLine/BadRAM), Azure…

Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need…

HSM-backed secret management for AI agents — store, retrieve, rotate, and share secrets via the 1Claw vault without exposing them in context.

Tjeneste-til-tjeneste-autentisering med TokenX token exchange i Nais

Use this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and…

Product management companion tuned for financial services (banking, payments, insurance, capital markets). Activate for FS product work: writing a vision/PRFAQ, creating requirements/BRD/PRD,…

Use when scoping or specifying an e-commerce platform, payment, API, security, AI, data protection, integration, and remediation audit for SMEs or cross-border digital trade programmes.

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure,…

Syncs skill metadata to AGENTS.md Auto-invoke sections. Trigger: When updating skill metadata (metadata.scope/metadata.auto_invoke), regenerating Auto-invoke tables, or running…

Use when designing GraphQL schemas, implementing Apollo Federation, or building real-time subscriptions. Invoke for schema design, resolvers with DataLoader, query optimization, federation directives.

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

Create and manage Starknet wallets for AI agents. Transfer tokens, check balances, manage session keys, deploy accounts, and interact with smart contracts using native Account Abstraction.

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365…

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins…

Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use…

Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE chains.

二进制漏洞利用工具集参考。涵盖调试工具（GDB/GEF/pwndbg/r2）、利用开发框架（pwntools/ROPgadget/one_gadget）、反编译工具（Ghidra/IDA/Binary Ninja）、动态分析工具（ltrace/strace/valgrind）。当 Agent 需要选择合适的二进制分析工具、了解工具使用方法、或搭建利用开发环境时触发。

Coordinate multi-step work across services the user has authorized through Aident Loadout, using live action schemas, connection checks, cost preflight, and explicit approval for side effects.

Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.

Use when ANY iOS or macOS build fails, a crash log needs diagnosing, a test run crashes, Xcode misbehaves, or an environment issue blocks work before code is the suspect. Covers build failures,…

Create and manage Jenkins CI/CD pipelines, configure agents, manage plugins, and automate builds. Use when working with Jenkins servers, creating Jenkinsfiles, or setting up build automation for…

Search GIF providers with CLI/TUI, download results, and extract stills/sheets.

Expert TSA cybersecurity compliance advisor for critical infrastructure owners and operators. Use this skill whenever a user asks about TSA Security Directives for pipelines, freight railroads,…

TDD iteration loops using Claude Code Stop hooks - runs tests after each response, feeds failures back automatically

Establish and operate scoped SSH sessions for authorized remote command execution with full evidence capture. Use when the operator provides SSH-accessible targets/credentials and Codex must execute…