Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Aws Iam Policy Analysis

  by @wgpsec

  AWS IAM / Resource Policy 分析方法论。当目标涉及 AWS 云服务且提供了 IAM Policy、Resource Policy、Lambda 代码、CloudFormation 模板等策略文件时使用。覆盖 IAM Policy 危险模式识别、Resource Policy Principal 分析、Condition 键绕过模式、服务信任关系图推导。发现 AWS 策略文件（json/yaml）、*.amazonaws.com…

• Gcp Pentesting

  by @wgpsec

  GCP 云环境渗透测试总体方法论。当目标使用 Google Cloud Platform、发现 GCP 相关资产（GCS Bucket/Compute Engine/Cloud Functions/GKE）、获取 GCP 凭据（Service Account Key/OAuth Token/Metadata Token）、或需要对 GCP 环境进行安全评估时使用。提供从未授权枚举到提权、后渗透、GCP-to-Workspace 穿越的全流程决策树。覆盖…

• Aliyun Pentesting

  by @wgpsec

  阿里云渗透测试方法论。当目标使用阿里云服务、发现 oss-*.aliyuncs.com 资产、获取阿里云 AccessKey（LTAI 开头）、在 ECS 实例内部可访问 100.100.100.200 元数据、或需要对阿里云 RAM/ECS/OSS/RDS/ACK/FC 等服务进行安全评估时使用。覆盖 RAM 提权、ECS 接管、OSS Bucket 利用、RDS 数据库攻击、ACK 容器集群、FC 函数计算、SLB 负载均衡、日志服务、KMS 密钥管理

• K8s Ingress Nightmare

  by @wgpsec

  IngressNightmare (CVE-2025-1974) — Kubernetes Ingress-NGINX Admission Controller 未授权 RCE。当目标 K8s 集群使用 ingress-nginx、发现 443/8443 端口的 admission webhook、或通过 Pod 网络可达 admission controller 时使用。涵盖漏洞原理、利用条件判断、PoC 使用、后续横向移动。

• Aws Pentesting

  by @wgpsec

  AWS 云环境渗透测试总体方法论。当目标使用 AWS 云服务、发现 AWS 相关资产（S3 Bucket/EC2 实例/Lambda 函数/CloudFront 分发）、获取 AWS 凭据（AK/SK/Session Token/IAM Role）、或需要对 AWS 环境进行安全评估时使用。提供从未授权枚举到提权、后渗透、持久化的全流程攻击决策树，引导到专项技能深入。覆盖 47+ AWS 服务攻击面

• Gcp Exploit

  by @wgpsec

  GCP 云环境攻击方法论。当目标使用 Google Cloud Platform、发现 GCP Service Account/Metadata/Storage Bucket 时使用。覆盖 Metadata 服务利用、Service Account 密钥窃取、IAM 提权、GKE 逃逸、Storage Bucket 枚举

• Azure Ad Attack

  by @wgpsec

  Azure AD / Entra ID 攻击方法论。当目标使用 Microsoft 365/Azure 云环境、发现 Azure AD 认证流程、或获取到 Azure 凭据时使用。覆盖初始访问（Password Spray/Phishing）、令牌窃取、Service Principal 滥用、条件访问绕过、跨租户攻击

• Prompt Jailbreak

  by @wgpsec

  AI/LLM Prompt 越狱技术。当目标系统包含 AI 聊天机器人、AI Agent 或任何基于 LLM 的对话系统时使用。覆盖角色扮演、编码绕过、多语言切换、上下文窗口攻击、逻辑链递进、系统提示覆盖等越狱方法

• Java Serialization Audit

  by @wgpsec

  Java 源码序列化类漏洞审计。当在 Java 白盒审计中需要检测序列化/反序列化相关漏洞时触发。 覆盖 3 类风险: Java 原生反序列化(ObjectInputStream/Gadget Chain/ysoserial)、 XXE(DocumentBuilderFactory/SAXParser/XMLInputFactory/TransformerFactory/SchemaFactory 五种解析器)、 模板注入…

• Java Framework Audit

  by @wgpsec

  Java 框架特定漏洞源码审计。当在 Java 白盒审计中需要检测框架层面的已知漏洞模式时触发。 覆盖 5 大框架/组件: Spring 全家桶(SpEL/Actuator/参数绑定/Spring Cloud Gateway)、 Struts2(OGNL/ActionMapping/Content-Type 解析)、Shiro(RememberMe 反序列化/URI 绕过)、 FastJSON/Jackson/Gson(反序列化…

• Gcp Workspace Pivot

  by @wgpsec

  GCP 到 Google Workspace 的穿越攻击方法论。当已获取 GCP Service Account 或 Project 权限并发现目标组织使用 Google Workspace、需要从云平台穿越到企业邮件/文档/管理控制台、或发现 Domain-Wide Delegation 配置时使用。覆盖 Domain-Wide Delegation 滥用、OAuth 范围利用、Workspace API…

• Java Injection Audit

  by @wgpsec

  Java 源码注入类漏洞审计。当在 Java 白盒审计中需要检测注入类漏洞时触发。 覆盖 6 种注入: SQL 注入(JDBC/MyBatis/Hibernate/JPA)、命令注入(Runtime.exec/ProcessBuilder)、 SSRF(HttpURLConnection/OkHttp/RestTemplate)、LDAP 注入、SpEL/OGNL 表达式注入、NoSQL 注入(MongoDB)。 需要…

• Java Auth Config Audit

  by @wgpsec

  Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发。 覆盖 6 类风险: 认证绕过(Spring Security/Shiro Filter 链 URI 解析差异)、 越权(IDOR/水平越权/垂直越权)、JWT 安全(算法混淆/密钥泄露/Claims 验证)、 加密配置(弱算法/硬编码密钥/不安全随机数)、信息泄露(错误堆栈/Actuator/Debug 模式)、…

• Java Frontend Audit

  by @wgpsec

  Java 源码前端安全类漏洞审计。当在 Java 白盒审计中需要检测前端安全漏洞时触发。 覆盖 5 类风险: XSS(JSP/Thymeleaf/FreeMarker 输出转义)、CSRF(Spring Security/自定义 Token)、 开放重定向(sendRedirect/forward)、CRLF 注入(Header/Cookie)、Session 管理(固定/超时/并发)。 需要 java-audit-pipeline 提供的数据流证据。

• K8s Webhook Abuse

  by @wgpsec

  Kubernetes Admission Webhook 滥用与策略引擎利用。当集群存在 Kyverno/OPA Gatekeeper/自定义 Webhook、DNS 扫描发现 kyverno-svc 或 gatekeeper 服务、或需要从 Mutating Webhook 提取注入的 Secret 时使用。核心手法：伪造 AdmissionReview 请求。任何在 K8s 中发现 Webhook 服务或策略引擎的场景都应使用此技能

• Java File Audit

  by @wgpsec

  Java 源码文件操作类漏洞审计。当在 Java 白盒审计中需要检测文件相关漏洞时触发。 覆盖 5 类文件风险: 任意文件上传(MultipartFile/Servlet Part/类型绕过)、任意文件读取(NIO/IO流/路径穿越)、 任意文件写入(覆盖配置/WebShell落地)、归档提取漏洞(ZipInputStream/Zip Slip)、文件删除/重命名竞争。 需要 java-audit-pipeline 提供的数据流证据。

• Java Exploit Chain

  by @wgpsec

  Java 白盒审计漏洞利用链组装。当需要将 Java 审计中发现的多个漏洞组合为完整攻击路径、 或需要评估 Maven/Gradle 依赖中的已知 CVE 对项目的实际影响时触发。 核心: 单个中低危漏洞通过组合可升级为高危/Critical 利用链。 覆盖: 信息泄露→认证绕过→RCE 的典型链路、Gadget Chain 分析方法(ysoserial/marshalsec)、 Maven 依赖 CVE 审计与实际可利用性评估。

• Mcp Security

  by @wgpsec

  MCP (Model Context Protocol) 协议安全测试方法论。当目标环境使用 MCP Server 集成外部工具、 需要评估 MCP 工具描述安全性、或测试 Agent 通过 MCP 调用工具时的安全边界时触发。 覆盖: 工具描述投毒、地毯式骗局(动态篡改)、指令覆盖(Shadow Tool)、隐藏指令(ANSI/Unicode)、 跨 Server 攻击、Token 窃取、Schema 操纵、上下文溢出。

• Php Injection Audit

  by @wgpsec

  PHP 源码注入类漏洞审计。当在 PHP 白盒审计中需要检测注入类漏洞时触发。 覆盖 6 种注入: SQL 注入(PDO/MySQLi/ORM)、NoSQL 注入(MongoDB)、 命令注入(system/exec/passthru)、LDAP 注入、表达式注入(eval/preg_replace /e)、SSRF。 需要 php-audit-pipeline 提供的数据流证据(EVID_*)作为审计输入。

• Php Serialization Audit

  by @wgpsec

  PHP 源码序列化与模板类漏洞审计。当在 PHP 白盒审计中需要检测反序列化、XML 解析或模板注入漏洞时触发。 覆盖 3 类风险: PHP 反序列化(unserialize/phar 反序列化/POP 链构造)、 XXE(XML 外部实体注入/libxml 配置)、SSTI(模板注入/Twig/Blade/Smarty 引擎)。 需要 php-audit-pipeline 提供的数据流证据。

• Php File Audit

  by @wgpsec

  PHP 源码文件操作类漏洞审计。当在 PHP 白盒审计中需要检测文件相关漏洞时触发。 覆盖 5 类文件风险: 任意文件上传(类型绕过/路径穿越/二次渲染)、任意文件读取(include/fread/路径穿越)、 任意文件写入(日志注入/配置覆盖)、文件系统竞争(TOCTOU/符号链接)、归档提取漏洞(Zip Slip)。 需要 php-audit-pipeline 提供的数据流证据。

• Php Frontend Audit

  by @wgpsec

  PHP 源码前端交互类漏洞审计。当在 PHP 白盒审计中需要检测前端安全相关漏洞时触发。 覆盖 5 类前端风险: XSS(反射/存储/DOM)、CSRF(Token 验证缺失)、 开放重定向(header Location 可控)、CRLF 注入(HTTP 响应拆分)、会话与 Cookie 安全(固定/劫持/属性)。 需要 php-audit-pipeline 提供的数据流证据。

• Agent Security

  by @wgpsec

  AI Agent 系统安全测试方法论。当目标系统使用 AI Agent 执行工具调用、多 Agent 协作、 或自主决策时触发。覆盖 OWASP Agentic AI Security Top 10 (ASI01-ASI10): 目标劫持、工具滥用、身份权限、供应链、代码执行、记忆投毒、多 Agent 通信、 级联故障、人机信任利用、失控 Agent。

• Php Auth Config Audit

  by @wgpsec

  PHP 源码认证、配置与逻辑类漏洞审计。当在 PHP 白盒审计中需要检测认证绕过、 权限控制、安全配置、密码学误用或业务逻辑漏洞时触发。 覆盖 5 类风险: 认证绕过(硬编码凭据/弱比较/JWT 缺陷)、授权失控(IDOR/水平越权)、 安全配置(CORS/错误暴露/调试模式)、密码学误用(弱哈希/ECB/硬编码密钥)、业务逻辑(竞争条件/支付篡改)。

• Ai Data Security

  by @wgpsec

  AI 系统数据安全测试方法论。当需要评估 LLM/AI 系统的数据泄露风险、训练数据安全、 或 RAG/向量库数据完整性时触发。覆盖: System Prompt 泄露(元 Prompt/角色扮演/关键字定位)、 训练数据推导与提取、成员推断攻击、模型反演攻击、RAG 数据投毒、API 信息泄露、 级联幻觉攻击、外部数据源信息泄露。

• Ai Identity Security

  by @wgpsec

  AI 系统身份与权限安全测试方法论。当目标系统涉及 Agent 身份认证、多 Agent 权限管理、 角色设定安全、会话管理、或 MCP/API 凭据管控时触发。 覆盖: 角色逃逸(假定场景/假定角色/遗忘法/目标劫持)、权限失控(Action 越权/MCP 未授权资源获取)、 多 Agent 身份伪造、会话劫持、凭据泄露与滥用。

• K8s Network Recon

  by @wgpsec

  Kubernetes 集群内网络侦察与服务发现。当已获得 Pod Shell、需要发现集群内其他服务、执行 K8s 内网扫描时使用。覆盖 DNS PTR 反查、SRV 记录枚举、AXFR 域传输、K8Spider 使用。任何在 Pod 中需要横向侦察、寻找隐藏服务、确定攻击目标的场景都应使用此技能，即使用户没有明确提到 DNS

• Prompt Injection

  by @wgpsec

  AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 #1 漏洞类别

• Prompt Leak

  by @wgpsec

  AI/LLM 系统提示词泄露技术。当目标是基于 LLM 的应用且想获取其系统提示词、配置信息、工具列表、知识库内容时使用。AI Bug Bounty、红队评估、竞品分析的关键第一步

• Cross Domain Attack Chain

  by @wgpsec

  Web 与 AI 跨域攻击链方法论。当目标系统同时包含传统 Web 应用和 AI/LLM 组件、 需要评估 Web 漏洞对 AI 系统的影响或 AI 漏洞对 Web 系统的影响时触发。 覆盖双向攻击链: Web→AI(XSS 窃取对话/SSRF 调用模型 API/SQLi 污染 RAG/文件上传 RAG 投毒) 和 AI→Web(注入生成存储型 XSS/Agent 执行 SQL 命令/工具读取敏感文件/沙箱逃逸 RCE)。

• K8s Istio Bypass

  by @wgpsec

  Istio Service Mesh 安全策略绕过。当目标 K8s 集群使用 Istio、请求被 AuthorizationPolicy 拒绝（403 RBAC denied）、或发现 Envoy sidecar 时使用。核心手法：UID 1337 绕过 Envoy。任何在 K8s 中遇到 Istio 策略阻拦、Service Mesh 限制、或 Envoy 相关安全控制的场景都应使用此技能

• K8s Sidecar Attack

  by @wgpsec

  Kubernetes Sidecar 容器流量劫持与敏感信息窃取。当目标 Pod 存在 Istio/Envoy/Linkerd sidecar、题目提到'隐形旁观者'或'共享网络'、或需要从 Pod 内部嗅探流量时使用。覆盖 tcpdump 抓包、sidecar 明文流量捕获、共享网络命名空间利用。只要在 K8s Pod 中发现有 sidecar 或多容器共存的迹象，就应使用此技能

• K8s Storage Exploit

  by @wgpsec

  Kubernetes 存储与文件共享利用。当 Pod 挂载了 NFS/EFS/PV/ConfigMap/Secret、发现 /efs 或 /mnt 目录、或 mount 输出中有远程文件系统时使用。覆盖 NFS 挂载利用、AWS EFS uid/gid 伪造、nfs-cat 免挂载读取、PV 敏感数据提取。只要在容器中发现任何远程挂载或共享存储，就应使用此技能

• Cot Injection

  by @wgpsec

  思维链 (Chain-of-Thought) 注入攻击方法论。当目标系统使用 ReAct/CoT 框架进行多步推理、 Agent 依赖中间推理结果做决策、或需要测试思维链完整性时触发。 覆盖: 思维链干扰注入(伪造中间 Agent 结果)、思维链操纵注入(跳过验证步骤直接调度敏感操作)、 查询注入(在数据查询 Agent 中注入恶意查询语句)。

• Php Exploit Chain

  by @wgpsec

  PHP 审计漏洞链组装方法论。当已完成各分类漏洞审计、需要评估多个漏洞组合利用的可行性时触发。 覆盖: 文件写入→文件包含→RCE 链、反序列化→敏感操作链、SQL 注入→文件写入链、 SSRF→内部服务链、信息泄露→权限提升链。同时包含 Composer 依赖 CVE 扫描方法。

• Missing Protections Finder

  by @zubair-trabzada

  Identifies critical clauses and protections that should be in a contract but are missing, with urgency ratings and ready-to-insert language

• Radiology Research Agent

  by @huang-sir1

  Use when designing or auditing an LLM Agent that automates medical-imaging research tasks such as literature and dataset discovery, protocol planning, evidence-grounded RAG, analysis orchestration, reporting checks, manuscript…

• Radiology Federated Learning

  by @huang-sir1

  Use when multiple imaging centers cannot pool raw data and need a federated-learning research design. Chooses horizontal, vertical, split, or personalized federation; plans aggregation, non-IID handling, site weighting, secure…

• Git Notes

  by @NeoLabHQ

  Use when adding metadata to commits without changing history, tracking review status, test results, code quality annotations, or supplementing commit messages post-hoc - provides git notes commands and patterns for attaching…

• Create Hook

  by @NeoLabHQ

  Create and configure git hooks with intelligent project analysis, suggestions, and automated testing

• Decay

  by @NeoLabHQ

  Manage evidence freshness by identifying stale decisions and providing governance actions

• Analyse

  by @NeoLabHQ

  Auto-selects best Kaizen method (Gemba Walk, Value Stream, or Muda) for target

• Reset

  by @NeoLabHQ

  Reset the FPF reasoning cycle to start fresh

• Auditrechte

  by @Klotzkette

  Für Auditrechte: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: auditrechte.

• Dependency Management Deps Audit

  by @rmyndharis

  You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide…

• Docs Architect

  by @rmyndharis

  Creates comprehensive technical documentation from existing codebases. Analyzes architecture, design patterns, and implementation details to produce long-form technical manuals and ebooks. Use PROACTIVELY for system…

• Security Review

  by @codeaholicguy

  AI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or…

• Deep Audit

  by @pedrohcgs

  Comprehensive adversarial audit of a theory, proof, math/econ paper, codebase, or set of claims — decompose into components, fan out independent skeptics that must return CONCRETE defects, adjudicate every finding with a…

• Agb Auditrechte

  by @Klotzkette

  Für Auditrechte: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: agb-auditrechte.

• Data Modeling

  by @cbrock84

  Designs the warehouse and semantic layer — source-to-mart structure, dimensional modeling, grain, slowly changing dimensions, and the metric layer analytics reads through. Use this to design or restructure a warehouse, model a…

• Chief Information Officer

  by @cbrock84

  The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering. Use this to set IT priorities, decide what IT owns versus engineering, structure IT spend or an…

• Identity Lifecycle Administration

  by @cbrock84

  Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Use this to set up or fix joiner-mover-leaver, deprovision someone completely, clean up…

• Endpoint Management

  by @cbrock84

  Manages laptops, desktops and mobile devices — enrollment, configuration, patching, software distribution, and lost or compromised devices. Use this to set up device management, standardize builds, roll out software or an OS…

• Link

  by @nateherkai

  Use when someone asks to link a project, file, folder, or important context into AGENTS.md or their AIOS routing, or says "link this into my AIOS" or "add this to my routing".

• Verify Cc Safety Net

  by @kenryu42

  Launch and drive the real cc-safety-net CLI — the hook decision path, explain, status/doctor, logs, and the local policy GUI — against an isolated home, capturing evidence. Use when a change needs proof in the running app, not…

• Ccsn Find Simplifications

  by @kenryu42

  Use when working in the cc-safety-net repo to find non-obvious simplification candidates: dead, duplicated, speculative, over-built, or contract-exceeding surfaces in the shell parser, analyzer, guards, secret protection,…

• Release Notes

  by @kenryu42

  Generate and publish concise, evidence-based notes in the body of the latest existing GitHub Release. Use only when the user explicitly invokes `$release-notes` or explicitly asks to update the latest existing GitHub Release…

• Ccsn No Comments

  by @kenryu42

  Use in the cc-safety-net repo when `bun run lint:comments` or `bun run check` reports a comment, a stale comment-allowlist entry, or a file it cannot parse, and before writing a code comment there. Moves what each comment says…

• Cc Safety Net

  by @kenryu42

  Operate CC Safety Net: explain why a command was blocked, triage false positives, configure custom rulebooks, manage agent CLI integrations, and diagnose protection.

• Weekly Audit Patterns

  by @amd

  The non-obvious invariants of the proactive nightly Claude audit workflow (.github/workflows/claude-nightly-audit.yml): the day-of-week mode selector, the two-key dedup scheme (cluster_key per defect, dedup_key per location)…

• Security Assessment

  by @amd

  Assess a reported security vulnerability in GAIA and fill a PSIRT / JIRA triage: decide if it is valid & exploitable, whether it needs a CVE + bulletin, and produce the CVSS 4.0 score, CWE, and CVE description. Use when triaging…

• Github Issue Response

  by @amd

  Respond to a GitHub issue, PR comment, discussion reply, or review on amd/gaia. Use when writing any reply that will be posted to GitHub — triaging a bug report, answering a usage question, responding to a feature request,…

• Porting Agent To Hub

  by @amd

  Use when taking an existing in-repo GAIA agent to a published, day-one-usable hub package — porting a legacy agent under hub/agents/<id>/, deciding whether an agent should ship at all, or answering why an agent 'is not ready to…

• Gate

  by @plugin87

  Run the one-command quality gate and report the real N/N result. Use before claiming any build/review is done.

• Mantis Pipeline Adapter

  by @google

  Interactively guides the design and implementation of custom deterministic orchestrator harnesses. Use when a user wants to build their own pipeline to wrap and run Mantis skills reliably. Don't use for executing the default…

• Mantis Patch

  by @google

  Generates minimal security fixes using transactional isolation (shadow directories or file backups), applies patches, and verifies them. Use when security findings are successfully reproduced and need patches applied and…

• Mantis Calibrate

  by @google

  Calculates the final risk score based on empirical evidence and architectural impact. Use when findings have been fully processed by previous stages and you need to append final risk scores to the finding files. Don't use for…

• Mantis Advise

  by @google

  Proactive security advisor and architectural remediation assistant for secure code development. Use to query threat models, historical vulnerability lineages, verified patch patterns, triaged false positives, and learned…

• Mantis History

  by @google

  Analyzes the repository's version control system (VCS) history to extract past vulnerabilities, security fixes, and vulnerability patterns. Use as an initial pre-processing step to build a historical vulnerabilities database…

• Mantis Launch

  by @google

  Launches automated vulnerability review campaigns on target files or repositories. Use to initiate Mantis vulnerability review pipelines with automated preflight checks, environment auto-configuration, and runtime overrides…

• Mantis Configure

  by @google

  Configures and validates Mantis pipeline environments, sandbox mechanisms, and AI models. Use to set up workflow.json, auto-detect host capabilities, switch between sandboxes (static-only, gvisor, microsandbox, gce), select AI…

• Mantis Summarize

  by @google

  Pre-processes the repository by generating security-focused summaries (mantis-summary.md) for each directory to make planning and research more efficient. Use when starting a review campaign to map the codebase before threat…

• Mantis Plan

  by @google

  Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap…

• Mantis Critic

  by @google

  Assesses the production viability of findings, filtering out debug-only features and assertion traps. Use when findings have been validated and you need to confirm they are triggerable in production release builds (with…

• Mantis Threat Model

  by @google

  Synthesizes trust boundaries, attack surfaces, and attacker profiles into a living threat model. Use as Stage B of the Knowledge Base generation process, reading architecture and entity definitions from the KB. Don't use for…

• Mantis Chain

  by @google

  Analyzes individual security findings to identify and construct complex exploit chains. Use after validation stages to see if multiple low-severity bugs can be combined into a higher impact vulnerability. Don't use for initial…

• Mantis Architecture

  by @google

  Synthesizes raw learnings and codebase analysis into an interlinked Markdown Knowledge Base (KB). Use at the beginning of a loop to build or update architecture.md, entities, and vulnerabilities. Don't use for generating threat…

• Mantis Reflect

  by @google

  Extracts learnings from execution trajectories at the end of a Mantis loop. Use to parse agent conversations, extract successes, failures, and false assumptions, and append them to workspace/learnings.jsonl. Don't use for…

• Mantis Structural Index

  by @google

  Builds a content-addressed semantic-unit index from source code for structural context. Use when a pinned or live codebase is available and structural cross-reference data would improve research quality. Don't use for findings…

• Mantis Meta Agent

  by @google

  Acts as the persistent supervisor, launching and monitoring the automated review campaign. Use when running a long-running, continuous security review campaign that needs autonomous coordination. Don't use for executing…

• Mantis Researcher

  by @google

  Audits production source code files based on the strategy in workspace/plan.json. Use when a review plan exists and you need to perform static analysis and deep-dive reviews of targeted files. Don't use for planning,…

• Mantis Report

  by @google

  Generates a human-readable security review packet compiled from confirmed findings and exploit chains. Use at the end of a review cycle to produce stakeholder-facing documentation. Don't use for auditing code or verifying…

• Mantis Dedupe

  by @google

  Consolidates raw security findings to eliminate redundant reports. Use when raw findings have been generated by the researcher and need consolidation before review. Don't use for initial code auditing or patch generation.

• Mantis Reproduce

  by @google

  Generates and runs crash reproducers to verify security flaws. Use when viable findings exist and you need to write and execute a script or payload to verify the crash. Don't use for code auditing or patching.

• Mantis Review

  by @google

  Independently reviews findings and filters out false positives. Use when consolidated findings need validation against the actual source code. Don't use for reproducing crashes or patching code.

• Grok Build Cli

  by @Pluviobyte

  Invoke the locally installed Grok Build CLI from Codex and return Grok's response. Use whenever the user asks Codex to call, consult, run, or delegate a prompt to Grok or Grok Build, including Grok web/X searches and agentic…

• Dbs Agent Migration

  by @Pluviobyte

  Agent 工作台迁移。把任意项目整理成 Claude Code / Codex / Grok 三端一致、可长期维护的 Agent 工作台：审计规则文件、识别真源、统一命名并生成 bridge。 触发方式：/dbs-agent-migration、/agent迁移、「迁移到 Codex」「迁移到 Claude Code」「迁移到 Grok」「统一 AGENTS.md」「整理 skill bridge」「我的 Agent 工作台很乱」「帮我统一…

• Cicd Automation Workflow Automate

  by @rmyndharis

  You are a workflow automation expert specializing in creating efficient CI/CD pipelines, GitHub Actions workflows, and automated development processes. Design automation that reduces manual work, improves consistency, and…

• Codebase Cleanup Deps Audit

  by @rmyndharis

  You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide…

• Anti Reversing Techniques

  by @rmyndharis

  Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or understanding software…

• Api Testing Observability Api Mock

  by @rmyndharis

  You are an API mocking expert specializing in realistic mock services for development, testing, and demos. Design mocks that simulate real API behavior and enable parallel development.

• Code Reviewer

  by @rmyndharis

  Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review…

• Blockchain Developer

  by @rmyndharis

  Build production-ready Web3 applications, smart contracts, and decentralized systems. Implements DeFi protocols, NFT platforms, DAOs, and enterprise blockchain integrations. Use PROACTIVELY for smart contracts, Web3 apps, DeFi…

• Api Documenter

  by @rmyndharis

  Master API documentation with OpenAPI 3.1, AI-powered tools, and modern developer experience practices. Create interactive docs, generate SDKs, and build comprehensive developer portals. Use PROACTIVELY for API documentation or…

• Backend Security Coder

  by @rmyndharis

  Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

• Comprehensive Review Full Review

  by @rmyndharis

  Use when working with comprehensive review full review

• Hephaestus Upload

  by @agentlas-ai

  Use when the user types $hephaestus-upload, /hep-upload, or /agentlas-upload, or asks to upload, publish, or list an Agentlas agent or team. Ask Cloud (private) vs Agentlas Hub (public) FIRST, then publish through the bundled…

• Agentlas Upload

  by @agentlas-ai

  Use when the user types /agentlas-upload, /agentlas upload, $hephaestus-upload, or /hep-upload to scan, gate, and publish an agent/team package to Agentlas Cloud (private) or Agentlas Hub (public).

• Memory Ticketing

  by @agentlas-ai

  Use when adding Memory Events, Memory Tickets, memory-map.json, vault-references.json, PM Soul memory ownership, or Memory Curator routing to an agent repo.

• Agentlas Auto Activation

  by @agentlas-ai

  Use when adding or auditing local runtime behavior that turns a project folder into an Agentlas-aware workspace with .agentlas memory and sitemap files.