Security AI Skills

DDD tactical patterns for complex business modeling including entities, value objects, aggregates, domain services, repositories, specifications, and bounded contexts. Python dataclass implementations…

Use this skill when you need evidence-bounded pipeline stages, feedback latency, resources, flakiness, caching/sharding, and rollback boundaries; triggers include CI 测试流水线 and CI test pipeline.

Exploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities during authorized penetration testing.

Assesses a freshly compromised host quietly before acting — who/where/what's here/what's watching/what's around — using local reads and living-off-the-land so the SOC never sees the recon. Use right…

Plan, implement, or review google cloud waf performance optimization work in an existing codebase with compatibility, security, and verification controls. Use when the user explicitly requests google…

Comprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices

Reviews Claude configuration files for security, structure, and prompt engineering quality. Use when reviewing changes to CLAUDE.md, agents, prompts, commands, hooks, or settings. Routes each file…

Exploit CI/CD pipeline misconfigurations and OIDC federation weaknesses across GitHub Actions, GitLab CI, and Jenkins -- poisoned workflows, secret exfiltration, runner compromise, overly broad OIDC…

Immutable double-entry ledgers, TigerBeetle, and balance reconciliation / Buku besar double-entry permanen, TigerBeetle, dan rekonsiliasi saldo.

Prepare HCM LDAP user-account-option creation, updates, deletion and redesign requests using the target FSM template, and route supported option changes through validated Data Loader imports.

Audit a codebase the way Legion Code Inc. does: foundation health, duplication and dead code, framework-deep security, quality, and a remediation plan, delivered as a branded brief.

Migrates LLM observability from LangSmith into Arize AX — historical trace import via OTLP (LS outputs→output.value, session/thread→session.id), datasets, and Prompt Hub prompts (latest or versions).…

统一管理平台、账号与多组 API Key，维护有效期和启用状态，安全同步到 zsh 或用户会话环境，并提供脱敏 Dashboard；用户说“管理环境变量”“rotate API keys”时使用。

Install and maintain defensive security hooks and CI gates for authorized SaaS projects. Use when asked to add pre-commit hooks, pre-push hooks, CI security scans, GitHub Actions hardening, secret…

Use when the user says 'analyze my wordpress site', 'what is running on my site', 'site dna', or 'what plugins are on my site'. Detects every page builder, audits active versus dead-weight plugins,…

Diagnose Gateway, config, secrets, channels, and port failures with read-only one-liners.

Agent skill for authentication - invoke with $agent-authentication

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating…

Persistent world-model harness that stress-tests ideas, strategies, and investments against 11 time horizons from 6 months to 50 years, each a deep analysis of geopolitics, tech, economics, society,…

Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user…

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use…

Operate trusted local GJC sessions through a reviewed broker-bound CLI allowlist with single-use human approval.

Azure Cloud 到本地 AD 的横向移动方法论。当已获取 Azure/Entra ID 权限并需要穿越到本地 Active Directory 环境、发现目标使用 Azure AD Connect/Cloud Sync/PTA/Federation 等混合身份架构、或需要利用 PRT/Certificate/Cookie 等凭据进行 Cloud-to-OnPrem 横向时使用。覆盖 14…

Reset the FPF reasoning cycle to start fresh

Read entity states and call services on your Home Assistant instance. Service calls are confirmed first. Trigger phrases: home assistant, smart home, turn on the light.

Test pyramid strategy, coverage targets, test patterns, and quality metrics reference. Agent-extending skill that amplifies manager-develop test-creation and quality-validation work with…

Configure zero-downtime deployment strategies including blue-green, canary, and rolling deployments. Implement traffic shifting, health checks, and rollback procedures. Use when implementing…

Connect to a WordPress site via WP-CLI over SSH or the REST API. Check CLI, test SSH, set up auth, verify access, save config. Use whenever the user wants to connect to a WordPress site, set up WP-CLI…

Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an existing skill or SKILL.md file. Also use when…

Security report generation agent. Use for compiling findings into formal penetration test reports, executive summaries, technical write-ups, and bug bounty submissions. Provide the findings directory…

Expert knowledge for Azure AI Custom Vision development including best practices, decision making, limits & quotas, security, integrations & coding patterns, and deployment. Use when exporting Custom…

Shopify app development - Remix, Admin API, checkout extensions

Provide Phoenix, LiveView, Ecto, OTP, or Oban examples. Use when asked for sample code, a walkthrough, a proper implementation, or expected workflow output. Pair with domain skills. NOT for debugging,…

External recon and OSINT pipeline - subdomain enum, live host discovery, URL crawl, JS analysis, nuclei scan. Outputs to Attack-surface.md and scope/. Queries wiki before each phase. Use when starting…

Audit a product or tech spec pull request diff for high-level security concerns (threat surface, authentication and authorization model, trust boundaries, sensitive data handling, secrets and key…

Nightly memory consolidation: prunes stale entries, merges duplicates, resolves contradictions, rebuilds the MEMORY.md index. Use when memory files accumulated over many sessions need cleanup. New…

Use this skill when you need evidence-bounded circuit-breaker-testing analysis and validation preparation; triggers include 熔断器测试 and circuit-breaker-testing.

Exploit JWT (JSON Web Token) vulnerabilities during authorized penetration testing.

Maps human-layer exposure from client-supplied and passive public evidence at cohort, role, process, channel, and relationship level. Use when preparing or defending an authorized social-engineering…

Plan, implement, or review google cloud waf reliability work in an existing codebase with compatibility, security, and verification controls. Use when the user explicitly requests google cloud waf…

Harden configuration and defaults for safer deployment. Use when a mid-level developer needs to reduce misconfig risks.

Attack and enumerate Active Directory environments using Kerberos attacks (Kerberoasting, ASREPRoasting), credential dumping (DCSync, Mimikatz), lateral movement (PtH, PtT), and BloodHound analysis.…

Prepare HCM role-provisioning-rule creation, updates, deletion and redesign from user requirements or FSM templates; validate and import supported changes through Data Loader.

Evidence-backed, read-only security audit of Svelte 4/5 and SvelteKit 2 apps, any stack. Versions vs advisories, load leaks, actions, remote functions, hooks, XSS, CSRF, adapters.

Cleaning up the skill ecosystem: auditing the agent roster for overlap and inactivity, proposing merges and sunset plans. Propose-only. Not for ecosystem strategy (Darwin) or code YAGNI (Void).

RTOS penetration testing — VxWorks WDB debug agent (Urgent/11), QNX microkernel, FreeRTOS+TCP CVEs, ThreadX/Azure RTOS, Zephyr, Mbed OS, TI-RTOS, MicroC/OS, NuttX, RIOT, Contiki

FastAPI patterns for async APIs, dependency injection, Pydantic request and response models, OpenAPI docs, tests, security, and production readiness.

Guides agents through region-specific data compliance, residency, sovereignty, and transfer design. Use when data products must operate across jurisdictions such as Europe, the USA, India, Saudi…

Techniques for writing effective fuzzing harnesses across languages. Use when creating new fuzz targets or improving existing harness code.

World-class Java and Spring Boot development skill for enterprise applications, microservices, and cloud-native systems. Expertise in Spring Framework, Spring Boot 3.x, Spring Cloud, JPA/Hibernate,…