Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Skill Security Audit

  by @agulli

  Audit the agent's own skill library for malicious, misconfigured, or untrusted SKILL.md files. Use when asked to review skills, audit the skill library, check for prompt injection in skills, or before adding skills from an…

• Dependency Audit

  by @agulli

  Audit project dependencies for vulnerabilities, license issues, and bloat. Use when asked to check dependencies, audit packages, find vulnerable libraries, or reduce bundle size.

• Security Hardening

  by @agulli

  Harden an application or service against common attack vectors. Use when asked to improve security posture, secure an API, harden a server, or prepare for a security review.

• Code Review

  by @agulli

  Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.

• Common Pentest Methodology

  by @HoangNguyen0403

  PTES-aligned penetration testing methodology for backend, frontend, and mobile. Provides attack taxonomy, exploit techniques per vulnerability class, and platform-specific test matrices. Use when executing pentest workflow,…

• Common Security Audit

  by @HoangNguyen0403

  Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular, Vue), and mobile (iOS, Android,…

• Quality Engineering Appium Mcp

  by @HoangNguyen0403

  Drives iOS/Android mobile devices via Appium MCP. Runs a preflight, picks local emulator/simulator/USB or a device cloud, captures screenshots/page source into a named evidence dir. Use for verifying mobile bugs, E2E tests, and…

• Common Security Standards

  by @HoangNguyen0403

  Enforce universal security protocols for safe, resilient software. Use when implementing authentication, encryption, authorization, input validation, secret management, or any security-sensitive feature across any language or…

• Common Owasp

  by @HoangNguyen0403

  OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024). Use when performing any security review, PR review, or codebase audit touching web, mobile, or API code.

• Common Task Complexity Routing

  by @HoangNguyen0403

  Scores a coding task on Spread, Novelty, and Centrality (SNC 0-6) and maps the tier to autonomy, verification depth, review mode, reviewers, model tier. Use when sizing a fix or feature before planning, choosing fast vs deep…

• Common Review Policy

  by @HoangNguyen0403

  Define a repository review policy fixing what each review pass checks, how severities rank, which paths are skipped, the nit cap, and who approves. Use when review findings feel inconsistent or noisy, or when tuning an automated…

• Cyber Evidence

  by @HoangNguyen0403

  Captures redacted, provenance-aware cybersecurity observations with shared status fields, independent ground truth, and honest limitations. Use when recording exercise evidence, findings, validation results, or security-review…

• Cyber Engagement Planning

  by @HoangNguyen0403

  Drafts bounded cybersecurity engagement plans with objectives, scope, exclusions, roles, authorization, runtime controls, evidence, stop criteria, and restart gates. Use when preparing an exercise or assessment plan before…

• Typescript Security

  by @HoangNguyen0403

  Secure server-side TypeScript input, auth tokens, and injection boundaries. Use for API/request validation, sanitization, secrets, and sensitive configuration; defer client-only React form validation and generic linting.

• Common Protocol Enforcement

  by @HoangNguyen0403

  Enforce Red-Team verification and adversarial protocol audit. Use only when verifying completion, performing self-scans, or checking protocol violations; do not activate for ordinary implementation, configuration, or unit-test…

• Common Code Review

  by @HoangNguyen0403

  Conduct high-quality, persona-driven code reviews. Use when reviewing PRs, critiquing code quality, or analyzing changes for team feedback.

• Common Exploit Verification

  by @HoangNguyen0403

  Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings,…

• Common Dast Tooling

  by @HoangNguyen0403

  Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use…

• Android Security

  by @HoangNguyen0403

  Secure Android data at rest and authentication secrets. Use for auth tokens, encrypted storage, and app-data isolation; defer WebView/Intent/FileProvider to android-legacy-security and TLS/certificate pinning to…

• Common Llm Security

  by @HoangNguyen0403

  OWASP LLM Top 10 (2025) audit checklist for AI applications, agent tools, RAG pipelines, and prompt construction. Use when performing any security review touching LLM client code, prompt templates, agent tools, or vector stores.

• Angular Security

  by @HoangNguyen0403

  Harden Angular apps against XSS, CSP violations, and unauthorized access. Use when implementing XSS protection, Content Security Policy, or auth guards in Angular.

• System

  by @transilienceai

  System exploitation testing - Active Directory attacks, privilege escalation (Linux/Windows), and exploit development.

• Firewall Review

  by @transilienceai

  Evidence-safe firewall ruleset audit reference specification — 22 documented detector patterns (17 vendor-agnostic plus 5 FortiGate-specific), a 15-check semantic catalogue, CIS Fortinet FortiGate Benchmark guidance, a custom…

• Authentication

  by @transilienceai

  Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.

• Web App Logic

  by @transilienceai

  Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.

• Server Side

  by @transilienceai

  Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection.

• Infrastructure

  by @transilienceai

  Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

• Injection

  by @transilienceai

  Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.

• Client Side

  by @transilienceai

  Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

• Api Security

  by @transilienceai

  API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.

• Dfir

  by @transilienceai

  Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks,…

• Phx Deps Audit

  by @oliver-kriska

  Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

• Pci Secure Software

  by @transilienceai

  Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers…

• Ai Threat Testing

  by @transilienceai

  Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates…

• Reverse Engineering

  by @transilienceai

  Static and dynamic reverse engineering — ELF/PE analysis, custom-VM bytecode, packed binaries, anti-debug bypass, Frida hooking.

• Cryptography

  by @transilienceai

  Cryptanalysis techniques — lattice attacks, padding oracles, weak-RNG exploitation, signature forgery, secret-sharing recovery.

• Coordination

  by @transilienceai

  Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.

• Cloud Containers

  by @transilienceai

  Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.

• Social Engineering

  by @transilienceai

  Social engineering testing - phishing, pretexting, vishing, and physical security assessment techniques.

• Transilience Report Style

  by @transilienceai

  Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.

• Mobile Security

  by @transilienceai

  Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC, storage, crypto, signing),…

• Reconnaissance

  by @transilienceai

  Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.

• Essential Tools

  by @transilienceai

  Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards.

• Source Code Scanning

  by @transilienceai

  Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code,…

• Techstack Identification

  by @transilienceai

  OSINT-based technology stack identification. Routes to 6 domain sub-skills (frontend, backend, infra, security, osint, correlation) to discover a target's stack from publicly available signals.

• Hackerone

  by @transilienceai

  HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.

• Hackthebox

  by @transilienceai

  HackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions

• Phx Deps Update

  by @oliver-kriska

  Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures…

• Phx Document

  by @oliver-kriska

  Use when asked to document Elixir code: add or fill in @moduledoc and @doc for modules and functions. Documents tested code only; may add a README section or ADR. Not for docs lookup or audits.

• Skill Update

  by @transilienceai

  Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits. Use when creating, updating, or improving skills.

• Cloud Defense

  by @transilienceai

  Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection…

• Blockchain Security

  by @transilienceai

  Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use…

• Phx Deps Vet

  by @oliver-kriska

  Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after phx-deps-audit findings or to initialize hex_vet.exs.

• Github Workflow

  by @transilienceai

  GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review. Use when asked to commit, push, create PRs/branches/issues, or manage git workflow.

• Phx Audit

  by @oliver-kriska

  Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.

• Phx Brainstorm

  by @oliver-kriska

  Brainstorm Elixir/Phoenix features — explore ideas, compare approaches, gather requirements. Use when vague idea, not sure how to approach, or want to discuss before plan.

• Pentest Engagement

  by @transilienceai

  Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation,…

• Authenticated Session Acquisition

  by @transilienceai

  Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value…

• Attack Path Stitcher

  by @transilienceai

  Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.

• Regression Sweep

  by @transilienceai

  Re-validates every previously-confirmed finding against its current target — detects drift (patched, mitigated, re-introduced). Cron-driven weekly sweep across the org's validated finding tree.

• Risk Prioritiser

  by @transilienceai

  Risk-based prioritisation of confirmed attack paths. Combines exploit feasibility, technical CVSS severity, and asset business impact into a single ranked list driving remediation roadmaps.

• Cve Poc Generator

  by @transilienceai

  CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.

• Techstack Frontend

  by @transilienceai

  Frontend tech-stack identification — JavaScript frameworks, meta-frameworks, CSS frameworks, UI libraries, build tools, and CMS via DOM, JS globals, HTML, and bundle patterns.

• Techstack Backend

  by @transilienceai

  Backend tech-stack identification — web servers, runtimes, languages, frameworks, databases, APIs, and CMS via HTTP headers, cookies, error pages, and API discovery.

• Techstack Security

  by @transilienceai

  Security-posture and third-party SaaS identification — security headers, CSP, HSTS, email auth, security.txt, plus payments/analytics/auth/CRM/support integrations.

• Techstack Correlation

  by @transilienceai

  Correlation, confidence scoring, and conflict resolution across all tech-stack signals. Cross-validates and assigns High/Medium/Low confidence per technology.

• Osint

  by @transilienceai

  Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.

• Techstack Infra

  by @transilienceai

  Infrastructure tech-stack identification — cloud providers, CDN/WAF, DNS services, TLS/CT, DevOps tooling, plus asset discovery (domains, subdomains, IPs).

• Phx Compound

  by @oliver-kriska

  Capture solved problems as searchable solution docs. Use after fixing bugs, when "that worked", or after successful phx-review or phx-investigate.

• Ti Ingest

  by @transilienceai

  Threat-intel signal ingest — converts a CVE + affected-asset + claim payload into a queued engagement-scope row for the validation pipeline.

• Techstack Osint

  by @transilienceai

  OSINT-side tech-stack identification — public repositories (GitHub/GitLab), job postings & ATS, and Wayback Machine historical snapshots.

• Cve Risk Score

  by @transilienceai

  Retrieve CVE risk scores from NVD. Auto-invoked whenever a CVE ID is mentioned to display CVSS score, severity, CWE, and description.

• Network Appliance Offensive

  by @transilienceai

  Offensive testing of perimeter network appliances and VPN crypto — IKE/IPsec (aggressive-mode, transform/DH enum, NAT-T), Check Point SIC/OPSEC, safe firmware/patch-level inference for FortiGate/PAN-OS/Cisco ASA/Citrix feeding…

• Phx Examples

  by @oliver-kriska

  Provide Phoenix, LiveView, Ecto, OTP, or Oban examples. Use when asked for sample code, a walkthrough, a proper implementation, or expected workflow output. Pair with domain skills. NOT for debugging, direct changes,…

• Skill Prune

  by @transilienceai

  Identify and remove negative-ROI skill content — orphan files, never-read entries, duplicates, content reintroducing challenge-specific lore. Inverse of /skill-update. Use during quarterly maintenance or after the linter flags…

• Protect With Password

  by @transilienceai

  Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type). Use when asked to password-protect / encrypt / lock one or more deliverable files with a single password before…

• Patt Fetcher

  by @transilienceai

  Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment.

• Ln 54 Codebase Auditor

  by @levnikolaevich

  Audits cross-cutting codebase health, security and maintainability; not a single-change review or specialist audit.

• Script Generator

  by @transilienceai

  Generates optimized, syntax-validated scripts on demand. Never executes — only generates, optimizes, and validates.

• Ln 21 System Design Baseline Builder

  by @levnikolaevich

  Defines measurable architecture drivers and constraints before system design; edits architecture docs only.

• Ln 42 Dependency Upgrader

  by @levnikolaevich

  Upgrades dependencies in reversible batches with version-specific compatibility and regression checks.

• Security Assessment

  by @rsmdt

  Vulnerability review, threat modeling, OWASP patterns, and secure coding assessment. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations.

• Docker Build Strategies

  by @docker

  Use this skill when writing, reviewing, or optimizing Dockerfiles, even if the user just says their image is too large, their build is slow, or they need to harden a container for production. Covers multi-stage builds, layer…

• Docker Sandboxes Network Credentials

  by @docker

  Use this skill when configuring what a Docker Sandboxes (`sbx`) sandbox can reach on the network or which credentials it authenticates with, even if the user just says they want to "let the agent call an internal API", "block…

• Adversarial Spec

  by @zscole

  Iteratively refine a product spec by debating with multiple LLMs (GPT, Gemini, Grok, etc.) until all models agree. Use when user wants to write or refine a specification document using adversarial development.

• Deps Audit

  by @oliver-kriska

  Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

• Security

  by @oliver-kriska

  Enforce Elixir/Phoenix security — auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys.

• Deps Update

  by @oliver-kriska

  Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures…

• Document

  by @oliver-kriska

  Generate @moduledoc/@doc for tested Elixir features; may update their README section or ADR. Not for docs lookup, documentation audits/reviews, or capturing standalone decisions.

• Deps Vet

  by @oliver-kriska

  Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs.

• Audit

  by @oliver-kriska

  Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.

• Brainstorm

  by @oliver-kriska

  Brainstorm Elixir/Phoenix features — explore ideas, compare approaches, gather requirements. Use when vague idea, not sure how to approach, or want to discuss before plan.

• Compound

  by @oliver-kriska

  Capture solved problems as searchable solution docs. Use after fixing bugs, when "that worked", or after successful /phx:review or /phx:investigate.

• Examples

  by @oliver-kriska

  Provide Phoenix, LiveView, Ecto, OTP, or Oban examples. Use when asked for sample code, a walkthrough, a proper implementation, or expected workflow output. Pair with domain skills. NOT for debugging, direct changes,…

• Quick

  by @oliver-kriska

  Implement small Phoenix changes without planning — add validations, update routes, fix components, create migrations. Use for single-file edits under 50 lines.

• Assigns

  by @oliver-kriska

  Compatibility alias for the Elixir/Phoenix plugin's LiveView assigns audit. Invoke explicitly with /lv:assigns.

• Security Audit

  by @TheDecipherist

  Audit code and dependencies for security vulnerabilities. Use when reviewing PRs, checking dependencies, preparing for deployment, or when user mentions security, vulnerabilities, or audit.

• Pmstudio Arb

  by @coco-research

  Generate an Architecture Review Board (ARB) presentation in Coco Inc's standard 11-slide format. Use when someone asks to "create an ARB deck", "architecture review presentation", "prepare for architecture review board", "ARB…

• Pmstudio Changelog

  by @coco-research

  Create or update a structured change log for a product or platform. Use when someone asks to "create a change log", "log this change", "what changed", "update the change log", "release notes", or "changelog". Reads project…

• Expo Api Routes

  by @coco-research

  Use when adding server-side API routes to an Expo Router app (+api.ts files) for secrets, database access, third-party proxies, webhooks, CORS, or EAS Hosting deploys. Covers file routing, env vars, and Cloudflare Workers limits.