Security AI Skills

OWASP security patterns, secrets management, security testing

Build production-ready Web3 applications, smart contracts, and decentralized systems. Implements DeFi protocols, NFT platforms, DAOs, and enterprise blockchain integrations. Use PROACTIVELY for smart…

Securely manage passwords and sensitive data in your tests

Reference data, not a reviewer. Audit React Native, Expo, iOS, Android for accessibility. Review accessibilityLabel, accessibilityRole, accessibilityHint, touch targets (44x44pt min), screen reader…

Provides patterns to configure Spring Boot Actuator for production-grade monitoring, health probes, secured management endpoints, and Micrometer metrics across JVM services. Use when setting up…

Security specialist perspective for the weekly review. Focuses on XSS/CSRF, authorization boundaries, input validation, secrets handling, and dependency CVEs.

Technical documentation patterns for READMEs, ADRs, API docs (OpenAPI 3.1), changelogs, and writing style guides. Use when creating project documentation, writing architecture decisions, documenting…

Use this skill when you need evidence-bounded chaos-testing analysis and validation preparation; triggers include 混沌测试 and chaos-testing.

Guide file upload restriction bypass during authorized penetration testing.

Acunetix integration. Manage data, records, and automate workflows. Use when the user wants to interact with Acunetix data.

Governs supplied reconnaissance job manifests with exact authority and scope binding, contact receipts, bounded waves and budgets, controlled retries, tested stop controls, custody, and defensive…

Using lib-systemplane, the hot-reload runtime-config plane (Postgres LISTEN/NOTIFY or MongoDB change streams), in two modes. Sweep Mode detects DIY config reload (SIGHUP, fsnotify, viper, pgx LISTEN),…

Plan, implement, or review google cloud waf operational excellence work in an existing codebase with compatibility, security, and verification controls. Use when the user explicitly requests google…

Reviews Claude Code agent definition files for tool-access security, triggering quality, and system prompt clarity. Use when reviewing changes to agents/<name>.md or agents/<name>/AGENT.md, whether…

Enumerate and abuse Active Directory Certificate Services with Certipy and Certify — the ESC1 through ESC16 escalation paths, vulnerable template and CA configurations, NTLM relay to web enrollment,…

Plan fixes from audit findings. Clusters findings into work packages, orders Now, Next, Later, and with approval writes Library PRDs, IRDs, knowledge docs, and draft contracts.

Integrating OWASP ZAP/Burp Suite/Nuclei, planning penetration tests, executing DAST, and scanning for vulnerabilities. For runtime vulnerability validation. Complements Sentinel static analysis.

Migrates LLM observability from Langfuse into Arize AX — historical trace import via OTLP (LF output→output.value, sessionId→session.id), datasets, and prompts (latest or versions + labels). Use when…

Use when the user asks about client SonicWall firewalls through NSM SaaS or MySonicWall: grades every firewall for firmware, end of support, PSIRT advisories, licence expiry, admin TOTP and SSL-VPN…

Draft a single Threads post or a multi-post thread using a 2026 Threads hook formula (warm contrarian, data-point, build-in-public, quote-post, mini-list, relatable, listicle, story, curiosity-gap,…

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy…

Use when gathering requirements, creating use cases, writing user stories, defining acceptance criteria, and conducting requirements analysis. Includes requirements elicitation techniques,…

Use when the user asks 'is my site secure', 'run a security audit', 'check for vulnerabilities', 'was my site hacked', or 'fix the vulnerable plugins'. Runs the Respira security audit, reads its…

Interact with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or…

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and…

Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR cases; adding investigative comments and notes;…

Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex. Use when the user asks to create, write, rewrite, improve, compress, clean up, or prepare a goal prompt, goal condition,…

Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (*…

Pre-release verification checklist. Validates features, tests, docs, security, and quality gates before shipping. Delegates to the Centinela (QA) agent.

Use when reviewing an incoming GitHub pull request — runs the multi-level (L1-L5) audit against the PR's real diff range, posts findings as one batched review (inline, summary, or local-only), offers…

[omh] Hermes backend workflow: prepare server, API, and data-layer contracts — auth boundary, error paths, response shape, and schema/migration discipline — before implementation. Use when the user…

Routes AWS networking requests to the correct service skill for implementation. Covers Route 53 (DNS, health checks, routing policies, Resolver, DNS Firewall), CloudFront (caching, edge, OAC, mTLS,…

Printing Press CLI for Cloudflare accounts, zones, DNS, Workers, Pages, R2, tunnels, Zero Trust, and agent infrastructure operations.

Multi-dimensional code review across correctness, security, performance, and maintainability with confidence-gated reporting and remediation loops.

Azure AD / Entra ID 攻击方法论。当目标使用 Microsoft 365/Azure 云环境、发现 Azure AD 认证流程、或获取到 Azure 凭据时使用。覆盖初始访问（Password Spray/Phishing）、令牌窃取、Service Principal 滥用、条件访问绕过、跨租户攻击

An example private skill — replace me. Use when demonstrating that org-private skills load, override, and stay inside your network. Produces this description in /v1/skills with source:private.

Software supply-chain defensive security reference: SBOM generation and verification (SPDX / CycloneDX), dependency-confusion defense, malicious-package triage playbook, SLSA provenance levels,…

Use when the user mentions SPM resolution failures, "no such module" errors, duplicate symbol linker errors, version conflicts between packages, or Swift 6 package compatibility issues.

Read X (Twitter) posts, search, timelines and user profiles via the official xurl CLI.

Build internal developer platforms (IDPs) with self-service infrastructure, golden paths, and developer portals using Backstage, Crossplane, and score.

Local text-to-speech via sherpa-onnx (offline, no cloud)

Reconnaissance agent for target enumeration. Use for subdomain discovery, port scanning, service fingerprinting, tech stack identification, and OSINT gathering. Specify scope and depth: 'passive' for…

When the user struggles with a task that a known skill could handle, suggest installing it.

Context preservation, tiered summarization, resumability

GitHub Actions workflow templates, matrix builds, caching, and monorepo CI strategies

Version pinning, vulnerability scanning, monorepo patterns, and upgrade workflows

识别用户意图类型（dev/fix/analyze/audit/self-fix/chat/resume/other），采用前置识别 + 三问法。Free 层可用。

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the…

Use when turning an approved domain_map.yaml and skill_spec.md into a full-library skill tree or explicitly auditing its structure and dependencies. For agreed batches and source-driven guidance…

Fast PARALLEL wiki lookup engine over wiki/techniques + wiki/payloads + wiki/tools + wiki/cheatsheets for a surface/service/vuln-class. Two modes - quick (one qmd search, cheap, fire constantly) and…

Audit a pull request diff for common security concerns (input validation, sanitization, authentication and authorization, secrets management, unsafe dependencies, and related risks) and fold findings…