Security AI Skills

Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.

Threat-intel signal ingest — converts a CVE + affected-asset + claim payload into a queued engagement-scope row for the validation pipeline.

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing…

Security patterns and OWASP guidelines. Triggers on: security review, OWASP, XSS, SQL injection, CSRF, authentication, authorization, secrets management, input validation, secure coding.

When the user needs to choose between technologies, frameworks, or tools — or says "which framework should I use", "compare X vs Y", "should we migrate from X to Y", "what database should I use",…

Exploit CORS (Cross-Origin Resource Sharing) misconfigurations during authorized penetration testing.

Comprehensive DevOps engineering practices for Kubernetes, CI/CD, Bash scripting, Ansible, and cloud infrastructure.

Analyze CVE reachability in software repositories by examining how vulnerable dependencies are imported and used. Determines whether vulnerable components, classes, or functions are reachable from…

Maps an authorized AI system's externally observable models, retrieval paths, agent tools, guardrails, endpoints, and privileged consumers. Use when scoping an AI security assessment or building an…

Configure phone number settings including caller ID, call forwarding, messaging enablement, and connection assignments. This skill provides REST API (curl) examples.

Using lib-observability/assert, Lerian's runtime assertion package, in two modes. Sweep Mode detects panic()/log.Fatal zero-panic violations, DIY invariant checks, hand-rolled domain predicates, and…

Environment variable validation, security scanning, and management for Next.js, Vite, React, and Node.js applications

Produce cyber threat intelligence by pivoting on indicators to find related infrastructure, tracking actors and campaigns, enriching and contextualizing IOCs, applying attribution discipline and…

Commit and push the user's shared Claude config to the `~/.claude-config` sync repo, rebasing first so a push never buries work from another machine. Bootstraps the repo when it is missing. Never…

Deep architectural context building for security audits. Use when conducting security reviews, building codebase understanding, mapping trust boundaries, or preparing for vulnerability analysis.…

Create production-ready Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets following best practices and security standards. Use when generating Kubernetes YAML manifests, creating…

Review full-stack code for bugs, security vulnerabilities, performance issues, accessibility gaps, and CLAUDE.md compliance. Enforces TypeScript strict mode, input validation, GPU-accelerated…

Read-only repo health audit: Wasp Nest setup, agent readiness, CI, tests, lint, lockfiles, secrets, governance. Writes contract-shaped foundation findings and measures. Never edits the repo.

Proactively search for security threats, vulnerabilities, and suspicious patterns in applications and infrastructure before they cause damage. Use when conducting security audits, identifying…

Use when working with comprehensive review full review

Draft a short punchy Facebook Page post, or a longer story post, using a 2026 Facebook hook formula (one-line opinion, tiny number, ask-the-page question, this-or-that, useful tip, story post) picked…

Zoom WebSockets for real-time event notifications via persistent connection. Alternative to webhooks with lower latency, bidirectional communication, and enhanced security. Use when you need real-time…

Creates, runs, and analyzes Arize experiments for evaluating and comparing model performance. Covers experiment CRUD, exporting runs, comparing results, and evaluation workflows using the ax CLI. Use…

Every runZero query, plus a local SQLite copy of your whole attack surface that diffs over time, joins assets to vulnerabilities offline, and costs zero API quota to re-slice. Trigger phrases: `list…

bkend.ai operational guides, troubleshooting, and platform comparison. Covers migration guides, performance optimization, testing strategy, common error solutions, and FAQ. Triggers: migration,…

Build or improve SaaS admin dashboards, internal admin panels, user/customer screens, tenant/workspace screens, plan/payment/log views, sidebar layouts, metrics, filters, tables, support tools, and…

Enforce MCP server integration with external centralized identity providers. Use when building, configuring, or reviewing MCP server authentication against external IdPs like Keycloak.

Use this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register…

Write or improve UX microcopy — button labels, error and empty states, tooltips, form labels, notifications, and confirmations — so it's clear, concise, action-oriented, and on-voice. Trigger when…

Create production-ready FastAPI projects with async patterns, dependency injection, and comprehensive error handling. Use when building new FastAPI applications or setting up backend API projects.

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment -…

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds…

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public,…

[omh] Application threat model workflow: turn a system's components and data flows into assets, trust boundaries, attack scenarios, controls, and the security test that proves each control holds. Use…

Django 安全最佳实践、身份验证（Authentication）、授权（Authorization）、CSRF 防护、SQL 注入防御、XSS 防御以及安全部署配置。

阿里云渗透测试方法论。当目标使用阿里云服务、发现 oss-*.aliyuncs.com 资产、获取阿里云 AccessKey（LTAI 开头）、在 ECS 实例内部可访问 100.100.100.200 元数据、或需要对阿里云 RAM/ECS/OSS/RDS/ACK/FC 等服务进行安全评估时使用。覆盖 RAM 提权、ECS 接管、OSS Bucket 利用、RDS 数据库攻击、ACK…

AI/LLM defensive security reference: prompt-injection defense, OWASP LLM Top 10 defensive mapping, MCP and agentic tool-call hardening, training-data poisoning detection, model-output validation and…

Use when implementing or debugging ANY network connection, API call, or socket in an Apple app. Covers URLSession, Network.framework, NetworkConnection, connection diagnostics.

Build, modify, or review Stripe Apps and extensions using the relevant documentation and reference guides. Use for custom Stripe Dashboard UI, stripe-app.yaml, @stripe/ui-extension-sdk,…

Create, manage, and deploy Helm charts for Kubernetes package management. Build reusable chart templates, manage releases, configure values, and use Helm repositories. Use when packaging Kubernetes…

Best practices for using the oracle CLI (prompt + file bundling, engines, sessions, and file attachment patterns).

Expert knowledge for Azure Container Storage development including troubleshooting, decision making, limits & quotas, security, and configuration. Use when configuring Elastic SAN-backed pools, CMK…

React web development with hooks, React Query, Zustand

Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.

Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind.…

API Documentation: OpenAPI/Swagger specs, Postman collections, API reference patterns, and client SDK docs

Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps and low-value tests by running internal reviews and a peer review in parallel…

On-demand senior red-team lead advisor. Call at a decision point or obstacle to get wiki-grounded direction instead of hammering blindly. Dispatches a fresh RTL subagent that reads the engagement…

Use when building Spring Cloud Gateway 5 on Spring Boot 4, including WebFlux or Web MVC routes, edge authentication, trusted headers, rate limits, timeouts, and resilience. Do not use for ordinary…

Evaluates whether a triaged GitHub issue is eligible for the factory auto-implement queue. Use during issue triage after the primary triage pass is complete.

One-command dev loop boot. Spins up portless (named HTTPS subdomain), emulate (stateful API mocks), the project's dev server, and an agent-browser session, all keyed to the current git branch. Use…