Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Code Mate Openclaw

  by @CherryHQ

  Runs a local OpenClaw agent non-interactively and returns its structured response. Use when the user asks to delegate a bounded task to the OpenClaw main agent.

• Code Mate Kimi Code

  by @CherryHQ

  Runs Kimi Code in non-interactive prompt mode and parses its event stream. Use when the user asks to delegate a bounded repository task to Kimi Code.

• Site Architecture

  by @coreyhaines31

  When the user wants to plan, map, or restructure their website's page hierarchy, navigation, URL structure, or internal linking. Also use when the user mentions "sitemap," "site map," "visual sitemap," "site structure," "page…

• Cli Anything Jumpserver

  by @HKUDS

  Stateful CLI harness for JumpServer bastion host management. Supports asset, user, permission, account, session, audit, and operations management via REST API, with both one-shot and interactive REPL modes.

• Calcom Api

  by @calcom

  Interact with the Cal.diy API v2 to manage scheduling, bookings, event types, availability, and calendars. Use this skill when building integrations that need to create or manage bookings, check availability, configure event…

• Bot Handoff

  by @vectorize-io

  Keep a durable record of work passed between Bots in the shared Hindsight memory bank. Use when handing work to another Bot, when picking up work another Bot started, and when a finding would help other Bots, including Bots that…

• Labarchive Integration

  by @K-Dense-AI

  Integrates with the official LabArchives ELN REST-like API and Inventory API v1. Supports regional endpoint selection, signed-request construction, user authorization and UID flows, local LA container validation, and verified…

• Contrib Pr

  by @prisma

  Open a high-quality external contributor PR against prisma/orm. Use when the user is an outside contributor (not a Prisma maintainer) and wants to submit a change as a pull request from a fork. Encodes the contribution flow from…

• Ai Code Generation Guardrails

  by @sickn33

  Autonomous AI code generation safety guardrail register: static AST analysis, forbidden import filters, and zero-day vulnerability checks.

• Ai Agent Tool Routing

  by @sickn33

  Autonomous AI agent tool router register: schema registration, runtime parameter coercion, idempotency keys, and error recovery policies.

• Agent Memory Discipline

  by @sickn33

  Rules for when an agent should recall from long-term memory before acting and when it should save decisions, corrections and failures afterwards. Works with any memory backend.

• Access Review

  by @sickn33

  Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.

• Ai Agent Security

  by @sickn33

  Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.

• Ai Red Teaming

  by @sickn33

  Run structured AI red team exercises for jailbreak resistance, data exfiltration risk, harmful output controls, and agent tool abuse resilience.

• Ai Inference Service Mesh

  by @sickn33

  Use service mesh patterns for AI inference traffic management, mTLS, canary releases, policy enforcement, and cross-cluster resilience.

• Ai Security Hardening

  by @sickn33

  Harden AI/LLM deployments against prompt injection, data exfiltration, model theft, and supply chain attacks.

• 007

  by @sickn33

  Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

• Active Directory Attacks

  by @sickn33

  Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team…

• Agentic Actions Auditor

  by @sickn33

  Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input…

• 20 Andruia Niche Intelligence

  by @sickn33

  Estratega de Inteligencia de Dominio de Andru.ia. Analiza el nicho específico de un proyecto para inyectar conocimientos, regulaciones y estándares únicos del sector. Actívalo tras definir el nicho.

• Acceptance Orchestrator

  by @sickn33

  Use when a coding task should be driven end-to-end from issue intake through implementation, review, deployment, and acceptance verification with minimal human re-intervention.

• Agents Md

  by @sickn33

  Create, revise, or audit AGENTS.md files from repository evidence, verified commands, and correctly scoped instructions without overwriting maintainer intent.

• Agent Memory

  by @sickn33

  A hybrid memory system that provides persistent, searchable knowledge management for AI agents.

• Rex

  by @sickn33

  Translates user intent into a precise, unambiguous specification and requirements.

• Aria

  by @sickn33

  Designs the data model, API contracts, and structural foundation of the system.

• Luna

  by @sickn33

  Reviews code for objective correctness, security, and reliability.

• Jobdanmark Search

  by @MadsLorentzen

  Make sure to use this skill whenever the user mentions anything related to Danish job listings, job search in Denmark, finding work in Denmark, or job vacancies on Jobdanmark — even if they don't explicitly mention…

• Exploratory Data Analysis

  by @K-Dense-AI

  Perform bounded, local exploratory analysis of explicitly supported scientific files. Use for redacted CSV/TSV/JSON profiles; optional NumPy, HDF5, FASTA/FASTQ, and basic image metadata inspection; missingness/leakage audits;…

• Geopandas

  by @K-Dense-AI

  Guidance and local audit tools for Python workflows that directly use GeoPandas GeoSeries, GeoDataFrame, spatial operations, or vector-data I/O.

• Benchling Integration

  by @K-Dense-AI

  Benchling Python SDK and REST API integration for registry entities, inventory, ELN entries, workflows, Benchling Apps, and Data Warehouse queries. Use when automating lab data with benchling-sdk or the v2 API.

• Hindsight Self Hosted

  by @vectorize-io

  Store team knowledge, project conventions, and learnings from tasks. Use to remember what works and recall context before new tasks. Connects to a self-hosted Hindsight server. (user)

• Protected Vercel Deployments

  by @vercel-labs

  Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection with agent-browser. Use when a preview or production URL redirects to a Vercel login page, returns a protection 401 or 403, or…

• Pentest Tools

  by @zhaoxuya520

  主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

• Src Hunter

  by @zhaoxuya520

  实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP…

• Llm Security

  by @zhaoxuya520

  Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

• Firmware Pentest

  by @zhaoxuya520

  固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。…

• Supply Chain Security

  by @zhaoxuya520

  Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

• Windows Ad

  by @zhaoxuya520

  Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.

• Ot Ics

  by @zhaoxuya520

  Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

• Email Security

  by @zhaoxuya520

  Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

• Nodejs Backend Patterns

  by @wshobson

  Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST…

• K8s Security Policies

  by @wshobson

  Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

• Dependency Upgrade

  by @wshobson

  Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use when upgrading framework versions, updating major dependencies, or managing breaking changes in libraries.

• Team Composition Patterns

  by @wshobson

  Design optimal agent team compositions with sizing heuristics, preset configurations, and agent type selection. Use this skill when deciding how many agents to spawn for a task, when choosing between a review team versus a…

• Task Coordination Strategies

  by @wshobson

  Decompose complex tasks, design dependency graphs, and coordinate multi-agent work with proper task descriptions and workload balancing. Use this skill when breaking down work for agent teams, managing task dependencies, or…

• Multi Reviewer Patterns

  by @wshobson

  Coordinate parallel code reviews across multiple quality dimensions with finding deduplication, severity calibration, and consolidated reporting. Use this skill when organizing multi-reviewer code reviews, calibrating finding…

• Solidity Security

  by @wshobson

  Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for…

• Auth Implementation Patterns

  by @wshobson

  Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security…

• Fastapi Templates

  by @wshobson

  Create production-ready FastAPI projects with async patterns, dependency injection, and comprehensive error handling. Use when building new FastAPI applications or setting up backend API projects.

• Code Review Excellence

  by @wshobson

  Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring…

• Codebase Memory Mcp

  by @github

  Use when exploring unfamiliar code, mapping architecture, finding symbols or relationships, tracing callers, callees, data flow or dependencies, assessing impact, auditing dead or complex code, or handling explicit Codebase…

• Breakdown Test

  by @github

  Test Planning and Quality Assurance prompt that generates comprehensive test strategies, task breakdowns, and quality validation plans for GitHub projects.

• Containerize Aspnetcore

  by @github

  Containerize an ASP.NET Core project by creating Dockerfile and .dockerfile files customized for the project.

• Create Agentsmd

  by @github

  Prompt for generating an AGENTS.md file for a repository

• Ask

  by @Yeachan-Heo

  Process-first advisor routing for Claude, Codex, Gemini, Antigravity, Grok, or Cursor via `omc ask`, with artifact capture and no raw CLI assembly

• Anti Ui Slop

  by @github

  Stop coding agents from shipping generic UI. Use UIZZE's 800,000+ real web and iOS screens to build product-specific interfaces, define a design contract, cover required states, and run a hard finish gate. Use when designing,…

• Azure Devops Cli

  by @github

  Manage Azure DevOps resources via CLI including projects, repos, pipelines, builds, pull requests, work items, artifacts, and service endpoints. Use when working with Azure DevOps, az commands, devops automation, CI/CD, or when…

• Audit Integrity

  by @github

  Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable…

• Azure Developer Cli

  by @github

  Design, create, review, migrate, or troubleshoot Azure Developer CLI (azd) projects using current Microsoft guidance. Use for azd, azure.yaml, AZD templates, Bicep or Terraform under infra, AZD environments and secrets, hooks,…

• Azure Container Registry Cli

  by @github

  Manage Azure Container Registry via the az acr CLI including registries, images, cloud builds, ACR Tasks, authentication, tokens, geo-replication, and networking. Use when working with ACR, az acr commands,…

• Arize Ai Provider Integration

  by @github

  Creates, reads, updates, and deletes Arize AI integrations that store LLM provider credentials used by evaluators and other Arize features. Supports any LLM provider (e.g. OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Vertex AI,…

• Arduino Azure Iot Edge Integration

  by @github

  Design and implement Arduino integration with Azure IoT Hub and IoT Edge, including secure provisioning, resilient telemetry, command handling, and production guardrails.

• Azure Resource Visualizer

  by @github

  Analyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources. Use this skill when the user asks for a diagram of their Azure resources or help in…

• Agent Owasp Compliance

  by @github

  Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance check against…

• Aws Well Architected Review

  by @github

  Perform an AWS Well-Architected Framework review of the current workload IaC and architecture, generating findings and GitHub issues for improvements.

• Break Trace

  by @anthropics

  Root-cause a reconciliation break to its source transaction or posting — follow the audit trail from the break row back to the originating entry on each side and state what differs and why. Use after gl-recon has classified a…

• Command Development

  by @anthropics

  This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file…

• Plugin Settings

  by @anthropics

  This skill should be used when the user asks about "plugin settings", "store plugin configuration", "user-configurable plugin", ".local.md files", "plugin state files", "read YAML frontmatter", "per-project plugin settings", or…

• Configure

  by @anthropics

  Check iMessage channel setup and review access policy. Use when the user asks to configure iMessage, asks "how do I set this up" or "who can reach me," or wants to know why texts aren't reaching the assistant.

• Reverse Skill Router

  by @zhaoxuya520

  Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct…

• Docs Generator

  by @zhaoxuya520

  Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering,…

• Competition Lsass Ticket Material

  by @zhaoxuya520

  Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP artifacts, and replayable credential extraction.…

• Competition Custom Protocol Replay

  by @zhaoxuya520

  Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol recovery, handshake reconstruction, framing, sequence control, checksums, stateful replay, and accepted-session…

• Competition Dpapi Credential Chain

  by @zhaoxuya520

  Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores, protected secrets, domain backup keys, and secret-to-acceptance replay chains. Use when…

• Competition Linux Credential Pivot

  by @zhaoxuya520

  Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service tokens, SSH material, cloud and container secrets, socket-level trust, and host-to-host pivot chains. Use when…

• Competition Identity Windows

  by @zhaoxuya520

  Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use…

• Competition Windows Pivot

  by @zhaoxuya520

  Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks…

• Case Review

  by @zhaoxuya520

  Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.

• Api Security

  by @zhaoxuya520

  Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.

• Cloud K8s

  by @zhaoxuya520

  Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.

• Code Audit

  by @zhaoxuya520

  Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

• Analyzing Threat Actor Ttps With Mitre Attack

  by @mukul975

  Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports…

• Analyzing Windows Shellbag Artifacts

  by @mukul975

  Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even…

• Analyzing Supply Chain Malware Artifacts

  by @mukul975

  Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

• Auditing Foundry Smart Contract Security

  by @mukul975

  Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to…

• Benchmarking Kubernetes With Kube Bench

  by @mukul975

  Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or…

• Auditing Kubernetes Rbac Privilege Escalation

  by @mukul975

  Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use…

• Auditing Mcp Servers For Tool Poisoning

  by @mukul975

  Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before…

• Auditing Entra Id With Aadinternals

  by @mukul975

  Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive…

• Attacking Oauth With Device Code Phishing

  by @mukul975

  Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services. Use for…

• Attacking Entra Id With Roadtools

  by @mukul975

  Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx. Use for authorized red-team enumeration of a tenant's directory objects or…

• Assessing Vector And Embedding Weaknesses

  by @mukul975

  Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when performing an authorized security assessment of a…

• Auditing Uefi Firmware With Chipsec

  by @mukul975

  Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.

• Auditing Tls Certificate Transparency Logs

  by @mukul975

  Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log…

• Automating Ioc Enrichment

  by @mukul975

  Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs.…

• Analyzing Sbom For Supply Chain Vulnerabilities

  by @mukul975

  Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs,…

• Analyzing Threat Intelligence Feeds

  by @mukul975

  Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality,…

• Building Adversary Infrastructure Tracking System

  by @mukul975

  Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map…

• Analyzing Threat Actor Ttps With Mitre Navigator

  by @mukul975

  Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize…

• Building Attack Pattern Library From Cti Reports

  by @mukul975

  Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1…