Security AI Skills

Use this skill when a system enters the Risk Management Framework, or its categorization is missing, inherited from another system or out of date, and someone asks "categorize the system", "what is…

Use when leading teams, making strategic decisions, managing stakeholder alignment, crisis management, and orchestrating complex projects. Includes decision-making frameworks, leadership styles, team…

Creates, reads, updates, and deletes Arize AI integrations that store LLM provider credentials used by evaluators and other Arize features. Supports any LLM provider (e.g. OpenAI, Anthropic, Azure…

Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing.…

Google Model Armor: Sanitize a user prompt through a Model Armor template.

Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.

Hyperflow ship phase. Use when the user is ready to release — verbs like ship, push, release, deploy, "cut a release", "ready to push". Runs pre-push gates (lint + typecheck + build + tests + security…

在添加身份验证、处理用户输入、操作机密信息（Secrets）、创建 API 端点以及实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。

GCP 云环境攻击方法论。当目标使用 Google Cloud Platform、发现 GCP Service Account/Metadata/Storage Bucket 时使用。覆盖 Metadata 服务利用、Service Account 密钥窃取、IAM 提权、GKE 逃逸、Storage Bucket 枚举

Manage IAM users, roles, and policies. Implement least-privilege access and security best practices. Use when configuring AWS identity and access management.

Remote-control tmux sessions for interactive CLIs by sending keystrokes and scraping pane output.

Analyzes validation gaps in data flows. Takes traced flows and identifies where checks are missing, insufficient, or bypassable. The 'interaction reasoning' step — finds bugs that exist in the gaps…

Expert knowledge for Azure Data Science Virtual Machines development including troubleshooting, decision making, architecture & design patterns, security, configuration, integrations & coding…

Create Jira/Asana/Linear tickets optimized for Claude Code execution - AI-native ticket writing

Full-desktop automation for targets that have no browser and no API at all — a legacy Java-based NMS client, a vendor's Windows-only configuration utility, a terminal emulator with no scriptable…

You are a workflow automation expert specializing in creating efficient CI/CD pipelines, GitHub Actions workflows, and automated development processes. Design automation that reduces manual work,…

Security: review git changes for vulnerabilities, threat-model a system's attack surface, audit supply-chain risks.

Fixes GitHub issues using parallel analysis agents for root cause investigation, code exploration, and regression detection. Reads issue context from gh CLI, searches codebase and memory for related…

Use this skill when you need evidence-bounded disaster-recovery-testing analysis and validation preparation; triggers include 灾备测试 and disaster-recovery-testing.

Pre-launch checklist for shipping a new website or web app. Scope: analytics (GA4, PostHog, Google Search Console, Ahrefs), DNS, TLS and backups, legal and CNIL/GDPR compliance, security headers, SEO…

Regenerate copilot-instructions.md for GitHub Copilot with vendor-specific content only

Turn the current session into a chief-of-staff thread that runs a war room of three role slots — surveyor, executor, auditor — and routes per-branch work to durable, reusable child agents. Use when…

Garante que uma tarefa só seja declarada concluída após evidência proporcional, cobrindo comportamento, qualidade e documentação.

Detects authorization flaws: IDOR, missing ownership or tenant scoping, role checks that fail open, privilege escalation, unauthenticated admin actions, mass assignment, and token/session claims…

Secure Kafka and AMQ Streams deployments with encryption, authentication, and authorization. Use when building, reviewing, or auditing Kafka broker configuration, AMQ Streams custom resources, or…

Supabase backend-as-a-service development patterns — Row Level Security (RLS) on all public tables, Edge Functions with Deno runtime, PostgreSQL with auto-generated APIs, authentication with JWT and…

Bucle de verificación para proyectos Quarkus: build, análisis estático, pruebas con cobertura, escaneos de seguridad, compilación nativa y revisión de diff antes del lanzamiento o PR.

Agent skill for code-review-swarm - invoke with $agent-code-review-swarm

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to…

Google Model Armor: Sanitize a model response through a Model Armor template.

Generates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6 authentication flows, sets up Spring Data JPA repositories, and configures reactive WebFlux endpoints.…

Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when…

Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

Calibrate a new dataset from live RTSP camera streams via the AutoMagicCalib REST API. Use when the user provides RTSP URLs or asks to calibrate live cameras; VIOS records clips, AMC ingests them,…

使用 AgentShield 扫描 Claude Code 配置（.claude/ 目录）中的安全漏洞、配置错误和注入风险。检查 CLAUDE.md、settings.json、MCP 服务端、钩子（Hooks）和智能体（Agents）定义。

GCP 云环境渗透测试总体方法论。当目标使用 Google Cloud Platform、发现 GCP 相关资产（GCS Bucket/Compute Engine/Cloud Functions/GKE）、获取 GCP 凭据（Service Account Key/OAuth Token/Metadata Token）、或需要对 GCP…

Hunt WP plugins via REST, exploit CVEs when version known.

Build and deploy serverless functions on AWS Lambda. Configure triggers, manage permissions, and optimize performance. Use when implementing serverless applications.

Manage Trello boards, lists, and cards via the Trello REST API.

Focused PoC builder for SAST candidates. Receives a SPECIFIC candidate vulnerability that survived adversarial validation. Writes a PoC, compiles, runs with ASan, confirms or rejects. Use via /sast…

迭代执行流水线校验阶段。对 implement 产出的代码做四维度并行校验（架构 / 安全 / CodeReview / 测试覆盖）， 再按汇总结果原地修复（fullstack 需求按受影响文件路径分派 backend-developer / frontend-developer）。 每个维度通过独立 subagent 执行，日志写入独立 process-validate-*.log。…

TypeScript strict mode with eslint and jest

Use this skill when the user asks about Linux process injection, using ptrace for injection, LD_PRELOAD injection, writing to procfs, remote access via process_vm_writev, seccomp notify injection,…

Audit authentication flows for security vulnerabilities

GDPR data handling, audit logging, data classification, retention policies, and consent management for regulatory compliance.

Confines file edits to one directory until lifted: an Edit, Write, MultiEdit and NotebookEdit hook refuses any path whose real location, symlinks followed, falls outside the frozen dir. Argument: the…

Verify fix commits address audit findings without new bugs

Regenerate .cursorrules for Cursor with preserved team directives

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card…

Inspect, safely test, and assess one Runx skill package for capability, trust, and operator readiness. Use when deciding whether to adopt, improve, reject, install, or publish a skill; its…

Agents should invoke this skill for Linux server security reviews, SSH hardening, firewall/open-port audits, user/permission checks, exposed services, or host hardening requests. Produces…