Security AI Skills

AI Agent 系统安全测试方法论。当目标系统使用 AI Agent 执行工具调用、多 Agent 协作、 或自主决策时触发。覆盖 OWASP Agentic AI Security Top 10 (ASI01-ASI10): 目标劫持、工具滥用、身份权限、供应链、代码执行、记忆投毒、多 Agent 通信、 级联故障、人机信任利用、失控 Agent。

You are an API mocking expert specializing in realistic mock services for development, testing, and demos. Design mocks that simulate real API behavior and enable parallel development.

Mine GitLab for secrets, CI tokens when subdomain found.

HSM-backed secret management for AI agents. Store API keys (including Bankr `bk_` keys), passwords, and credentials in an encrypted vault; retrieve them at runtime via MCP without keeping secrets in…

Implement Datadog monitoring and APM for infrastructure and applications. Configure agents, create dashboards, set up alerts, and implement distributed tracing. Use when implementing enterprise…

Use the mcporter CLI to list, configure, auth, and call MCP servers/tools directly (HTTP or stdio), including ad-hoc servers, config edits, and CLI/type generation.

GraphQL API security specialist. Use for introspection analysis, query complexity attacks, injection testing, authorization bypass, and batching abuse on GraphQL endpoints.

One-shot Base-token investigation - runs any subset of six onchain-security checks (rug-scan, contract-audit, deployer-trace, holder-concentration, honeypot, lp-lock) into one verdict. Keyless core.

Generate CI/CD configuration for automated builds, tests, and distribution of iOS/macOS apps. Use when setting up GitHub Actions, Xcode Cloud, or fastlane for continuous integration, TestFlight, or…

Microsoft Teams bots and AI agents - Claude/OpenAI, Adaptive Cards, Graph API

Inspect Check Point security policies, threat intelligence, gateways, and SASE through its MCP integrations. Use for Check Point platform questions or workflows.

System exploitation testing - Active Directory attacks, privilege escalation (Linux/Windows), and exploit development.

Identify error-prone APIs, dangerous configuration, and footgun designs that enable security mistakes. Use for API ergonomics, misuse resistance, secure defaults, or pit-of-success reviews; use…

This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF",…

When the user needs a security assessment — threat modeling, vulnerability review, auth flow audit, dependency scanning, or says "is this secure", "review for vulnerabilities", "threat model",…

Creates GitHub pull requests with pre-flight validation, conventional title formatting, and structured summary generation. Runs parallel checks (tests, lint, type-check, security) before opening.…

Exploit Windows token privileges for local privilege escalation to SYSTEM.

Comprehensive API security testing based on OWASP API Security Top 10 including broken authentication, injection attacks, rate limiting, BOLA/BFLA vulnerabilities, and automated security scanning with…

Assesses supplied defensive evidence for prevention, visibility, detection, containment, and recovery coverage against opaque command-channel scenarios. Use when reviewing command-and-control exposure…

Generate stories where ordinary people become crucial through their structural position in systems. Use when you want protagonists who aren't chosen ones but accidental pivots, when mundane jobs…

This skill should be used when the user asks to "review the security architecture", "check authentication patterns", "evaluate trust boundaries", "review encryption implementation", "assess…

Proactively harden a cloud account or organization before an incident — prioritizing IAM and identity risk over checkbox findings, closing the exposures that become attack paths (public storage,…

Finish a Magpie upgrade in one run. Checks this machine and this project against the installed version and shows one short plan. Applies it after an explicit approval, leaving the sandbox only for…

Suede AI Onboarding Skills: time to value, ranked friction audits, first-value flows, empty states, checklists, and measurement. Use when asked "users sign up but never activate" or to improve…

Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use when upgrading framework versions, updating major dependencies, or managing…

Routes Oracle Fusion, CPQ, Knowledge Management, Risk and Security, and Fusion BOSS REST API calls to the correct OAuth-backed client instructions and scripts.

Audit codebases, infrastructure, AND agentic AI systems for security issues. Covers traditional security (dependencies, secrets, OWASP web top 10, SSL/TLS, file permissions) PLUS agentic security…

Audits CORS configuration security. Detects wildcard origins, credentials with wildcards, dynamic origin reflection, missing preflight handling, and overly permissive policies.

Agents should invoke this skill whenever they write or edit code in permanent files, including source, scripts, tests, examples, migrations, notebooks, and configuration-as-code. Apply it before and…

DeFi自動マーケットメーカー（AMM）スマートコントラクトセキュリティ監査パターン。フラッシュローン、スリッページ、サンドイッチング攻撃、価格操作、再入攻撃、不正確な整数演算をカバー。

Deliberating decisions and founder priorities through multi-perspective, named-expert, and YC-style advisory lenses. Use for verdicts, office hours, or expert critique; not implementation.

Harden a ServiceNow instance — password complexity, session timeout, MFA enforcement, input sanitization for XSS/injection, security properties, syslog events, and security health checks.

CLI to manage emails via IMAP/SMTP. Use himalaya to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME…

Design relational database schemas from requirements and generate migrations, TypeScript/Python types, seed data, RLS policies, and indexes. Handles multi-tenancy, soft deletes, audit trails,…

Use when asked to audit, score, or health-check a WordPress site or page. Runs SEO, AEO, readability, accessibility, performance, RankMath, and Core Web Vitals analyzers and presents a unified report…

Use when execution quality must be screened against a benchmark and every screening decision retained as tamper-evident evidence under MiFID II Article 27 and FINRA Rule 5310. A screen that flags…

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or…

Google Chat: Send a message to a space.

SSH triage: Remote Login, launchd sshd, pre-auth closes, stale sessions.

Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\SYSTEM: token impersonation via…

Migrate a .NET 9 project or solution to .NET 10 and resolve all breaking changes. USE FOR: upgrading TargetFramework from net9.0 to net10.0, fixing build errors after updating the .NET 10 SDK,…

Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness…

AI 系统数据安全测试方法论。当需要评估 LLM/AI 系统的数据泄露风险、训练数据安全、 或 RAG/向量库数据完整性时触发。覆盖: System Prompt 泄露(元 Prompt/角色扮演/关键字定位)、 训练数据推导与提取、成员推断攻击、模型反演攻击、RAG 数据投毒、API 信息泄露、 级联幻觉攻击、外部数据源信息泄露。

Use when designing or auditing an LLM Agent that automates medical-imaging research tasks such as literature and dataset discovery, protocol planning, evidence-grounded RAG, analysis orchestration,…

Sets up QA testing processes: test strategies, Google Testing Standards test cases, P0-P4 bug tracking, quality metrics, progress reports, autonomous execution via master prompts, and OWASP security…

Set up, authenticate, and run external coding agents (Claude Code, Codex) via the Agent Client Protocol

Detect hardcoded passwords in HTML forms, JavaScript, and API responses.

Use when the user wants a comprehensive project-wide audit, full health check, or scan across all domains.

Use eBPF for deep kernel-level observability — trace syscalls, network flows, and application behavior without code changes using Cilium, Tetragon, and bpftrace.

Use CodexBar CLI local cost usage to summarize per-model usage for Codex or Claude, including the current (most recent) model or a full model breakdown. Trigger when asked for model-level usage/cost…

Make sure email actually reaches inboxes. Use this skill when setting up email authentication (SPF, DKIM, DMARC), diagnosing emails landing in spam, planning a domain reputation strategy, monitoring…