Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Next Forge

  by @vercel

  Expert assistance for next-forge — a production-grade Turborepo template for Next.js SaaS apps. Triggers on questions about next-forge installation, setup, architecture, packages, customization, deployment, and development…

• Hai Audit Docs

  by @hylarucoder

  Audits documentation for internal contradictions and/or mismatches with code, config, schemas, and approved contracts. Use for 文档审计、前后冲突、术语漂移、README 是否过时、文档和代码一致吗, including check-and-fix requests. Select evidence sources from…

• Adr Documentation

  by @MadAppGang

  Architecture Decision Records (ADR) documentation practice. Use when documenting architectural decisions, recording technical trade-offs, creating decision logs, or establishing architectural patterns. Trigger keywords - "ADR",…

• Audit

  by @MadAppGang

  On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability scan", "code quality",…

• Code Search Selector

  by @MadAppGang

  Tool selector for code search tasks. Helps choose between semantic search (claudemem) and native tools (Grep/Glob) based on query type. Semantic search recommended for: 'how does X work', 'find all', 'audit', 'investigate',…

• Search Interceptor

  by @MadAppGang

  Bulk file read optimizer. Suggests semantic search alternatives when reading multiple files. Helps reduce token usage by using claudemem's ranked results instead of sequential file reads.

• Auth Patterns

  by @MadAppGang

  Use when implementing authentication (JWT, sessions, OAuth), authorization (RBAC, ABAC), password hashing, MFA, or security best practices for backend services.

• Codebase Audit

  by @majiayu000

  全面代码库审计 — 自适应并行深度分析（前后端契约、数据完整性、异常处理/安全、架构/技术债、配置/缓存），结构化 findings + 对抗验证 + 基线对比，输出按严重程度排序的统一报告和修复路线图。支持 quick 快速体检模式。Use when user asks to audit, analyze, or review an entire codebase for design issues, find hidden bugs, check…

• Auth Security

  by @majiayu000

  OAuth 2.1 + JWT authentication security best practices. Use when implementing auth, API authorization, token management. Follows RFC 9700 (2025).

• Agentsmd Scaffold

  by @majiayu000

  Generate or update repository-specific AGENTS.md instruction files from real repo evidence. Use when asked to create, design, scaffold, split, or improve root or scoped AGENTS.md files for Codex/Claude/agent workflows,…

• Dev Architecture Playbook

  by @majiayu000

  Route full software-development architecture work from product intent through design, implementation, testing, release, and operations. Use when the user asks for a complete development architecture, wants to know which…

• Config Secrets Environments

  by @majiayu000

  Design, audit, and verify configuration, environment separation, secrets, BYOK flows, key rotation, config schema validation, and drift checks across local, dev, staging, and production. Use when adding env vars, changing…

• Owasp Security

  by @hoodini

  Implement secure coding practices following OWASP Top 10. Use when preventing security vulnerabilities, implementing authentication, securing APIs, or conducting security reviews. Triggers on OWASP, security, XSS, SQL injection,…

• Google Consent Mode V2

  by @mukul975

  Configuring Google Consent Mode v2 for privacy-compliant measurement and advertising. Covers default and update commands, consent state mapping to GA4 and Google Ads, conversion modeling with cookieless pings, and EEA…

• Coppa Compliance

  by @mukul975

  Implements Children's Online Privacy Protection Act (COPPA) compliance under 16 CFR Part 312. Covers verifiable parental consent methods including signed forms, credit card verification, government ID, knowledge-based…

• Supplementary Measures

  by @mukul975

  Guides implementation of technical, contractual, and organisational supplementary measures for international data transfers per EDPB Recommendations 01/2020. Covers encryption, pseudonymisation, split processing, audit rights,…

• Ai Privacy Impact Template

  by @mukul975

  Provides combined DPIA and AI Act conformity assessment template with integrated risk scoring matrix. Covers GDPR Art. 35 DPIA elements, AI Act high-risk system requirements, mitigation measures, and human oversight assessment.…

• Scc Implementation

  by @mukul975

  Guides implementation of EU Standard Contractual Clauses under Commission Decision 2021/914 across all four modules (C2C, C2P, P2P, P2C). Covers clause-by-clause completion, Annex I-III drafting, and SCC module selection.…

• Cnil Compliant Cookies

  by @mukul975

  Implementation guide for CNIL cookie guidelines compliance. References the EUR 150M Google fine and EUR 60M Meta fine. Covers equal prominence accept/reject buttons, cookie wall prohibition, 6-month reconsent intervals,…

• Cnil Cookie Banner

  by @mukul975

  Designing and implementing CNIL-compliant cookie consent banners for French and EU audiences. References the EUR 100M Google LLC fine and EUR 150M Meta Platforms fine for non-compliant cookie practices. Covers equal prominence,…

• Eprivacy Essential Cookies

  by @mukul975

  Applying the ePrivacy Directive Article 5(3) strictly necessary exemption to classify cookies that do not require consent. Covers exemption criteria, functionality cookies, load balancing, session state, and non-exempt…

• Cookie Audit

  by @mukul975

  Comprehensive methodology for auditing website cookies and tracking technologies. Covers automated scanning, cookie categorization, lifecycle documentation, and compliance gap analysis referencing the Planet49 CJEU ruling…

• Unknown Vector Analysis

  by @blacklanternsecurity

  Analyze custom applications, scripts, and binaries that standard technique skills could not exploit. Performs source code review, attack surface mapping, CVE research, and PoC adaptation. Route here when ANY technique agent…

• Trust Attacks

  by @blacklanternsecurity

  Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation. Covers trust enumeration (nltest, PowerView, BloodHound), SID history injection (child domain to forest…

• Sccm Exploitation

  by @blacklanternsecurity

  Enumerates and exploits Microsoft SCCM/MECM (System Center Configuration Manager / Microsoft Endpoint Configuration Manager) infrastructure for credential harvesting, lateral movement, and domain escalation. Covers SCCM…

• Ad Persistence

  by @blacklanternsecurity

  Establishes persistent access in Active Directory environments after domain compromise. Covers DCShadow (rogue DC attribute modification), Skeleton Key (LSASS master password), custom SSP injection (credential logging via…

• Credential Recovery

  by @blacklanternsecurity

  Offline credential and file recovery with hashcat and john. Use when any skill captures hashes (NTLM, Kerberos TGS/AS-REP, shadow, MSCACHE2) or encrypted files (ZIP, Office, PDF, KeePass, SSH key, 7z, RAR). Trigger phrases:…

• Auth Coercion Relay

  by @blacklanternsecurity

  Forces remote systems to authenticate back to attacker-controlled listeners and relays captured authentication to escalate privileges or move laterally. Covers authentication coercion (PetitPotam, PrinterBug, DFSCoerce,…

• Gpo Abuse

  by @blacklanternsecurity

  Exploits Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. Covers GPO enumeration (GPOHound, BloodHound, PowerView), exploitation via immediate tasks, logon scripts, and…

• Xmpp Enumeration

  by @blacklanternsecurity

  XMPP/Jabber service enumeration for Openfire, ejabberd, Prosody, and other XMPP servers. Trigger when ports 5222 (client), 5223 (legacy TLS), or 5269 (server-to-server) are found open. Covers authentication testing, user…

• Adcs Persistence

  by @blacklanternsecurity

  Establishes persistence and exploits weak certificate mapping in AD CS. Covers ESC9 (no security extension), ESC10 (weak certificate mapping), ESC12-15 (YubiHSM, issuance policy, altSecIdentities, application policies), Golden…

• Smb Enumeration

  by @blacklanternsecurity

  SMB share enumeration, access testing, password policy extraction, and content searching. Enumerates shares via null session, guest, and authenticated access. Covers share listing, per-share access testing, MANSPIDER content…

• Credential Dumping

  by @blacklanternsecurity

  Extracts credentials from Active Directory: DCSync replication, NTDS.dit database extraction, SAM hive dump, Azure AD Connect (ADSync) credential extraction, LAPS passwords (legacy + Windows LAPS), gMSA passwords (KDS root key +…

• Kerberos Delegation

  by @blacklanternsecurity

  Exploits Kerberos delegation misconfigurations for privilege escalation and lateral movement in Active Directory. Covers Unconstrained Delegation (TGT harvesting via coercion), Constrained Delegation (S4U2Self + S4U2Proxy with…

• Infrastructure Enumeration

  by @blacklanternsecurity

  Enumeration of infrastructure services: DNS, SMTP, SNMP, IPMI, NFS, TFTP, RPC/MSRPC, and HTTP/HTTPS surface detection. Checks zone transfers, open relays, default community strings, cipher zero, NFS exports, and web technology…

• Kerberos Ticket Forging

  by @blacklanternsecurity

  Forges Kerberos tickets for domain persistence and privilege escalation. Covers Golden Ticket (krbtgt hash → forged TGT), Silver Ticket (service hash → forged TGS), Diamond Ticket (decrypt/modify/re-encrypt legitimate TGT for…

• Av Edr Evasion

  by @blacklanternsecurity

  Bypass antivirus and EDR detection for payload delivery during exploitation. Covers custom payload compilation (mingw C, Go), AMSI bypass, shellcode alternatives, and ETW patching. Route here when an agent reports a payload was…

• Password Spraying

  by @blacklanternsecurity

  Performs password spraying against authentication services with lockout-safe techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA, and any service with username/password auth. Service-agnostic — the…

• Linux File Path Abuse

  by @blacklanternsecurity

  Exploit writable critical files, NFS misconfigurations, shared library hijacking, and privileged group membership (docker, lxd, disk, adm, video, staff) for Linux privilege escalation. Use when a user belongs to a privileged…

• Acl Abuse

  by @blacklanternsecurity

  Exploits misconfigured Active Directory ACLs for privilege escalation. Covers GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, targeted Kerberoasting via SPN manipulation, shadow credentials…

• Adcs Access And Relay

  by @blacklanternsecurity

  Exploits ADCS through ACL abuse on templates/CA objects and NTLM relay to enrollment endpoints. Covers ESC4 (template ACL → modify to ESC1), ESC5 (PKI object ACLs), ESC7 (ManageCA/ManageCertificates abuse), ESC8 (NTLM relay to…

• Adcs Template Abuse

  by @blacklanternsecurity

  Exploits misconfigured AD CS certificate templates to impersonate any domain user via SAN manipulation or enrollment agent abuse. Covers ESC1 (enrollee supplies subject), ESC2 (any-purpose/no EKU), ESC3 (enrollment agent), ESC6…

• Database Enumeration

  by @blacklanternsecurity

  Database service enumeration and quick-win access checks for MSSQL, MySQL, PostgreSQL, Oracle, MongoDB, and Redis. Checks default/empty passwords, unauthenticated access, and command execution capabilities. Use after…

• Remote Access Enumeration

  by @blacklanternsecurity

  Enumeration of remote access services: FTP, SSH, RDP, VNC, and WinRM. Checks anonymous access, default credentials, version vulnerabilities, and authentication methods. Use after network-recon identifies remote access ports.

• Browser Exploitation

  by @blacklanternsecurity

  Exploit browser-based attack surfaces: malicious extension crafting for bot interaction scenarios, Chrome DevTools Protocol abuse on exposed debug ports, and browser profile/cache data extraction from compromised hosts.

• Retrospective

  by @blacklanternsecurity

  Post-engagement lessons-learned retrospective. Reads the engagement directory, analyzes skill routing decisions, identifies knowledge gaps and missing skills, and produces an actionable improvement report.

• Pass The Hash

  by @blacklanternsecurity

  Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket for lateral movement.

• Red Run Ctf

  by @blacklanternsecurity

  Multi-phase penetration test orchestrator. Handles recon, assessment surface mapping, vulnerability chaining, and routes to technique skills for execution. Invoke via /red-run-ctf slash command only.

• Ajp Ghostcat

  by @blacklanternsecurity

  Exploit Apache JServ Protocol (AJP) misconfigurations and Ghostcat (CVE-2020-1938) for file read and remote code execution on Apache Tomcat. Use when port 8009 is open or AJP connector is exposed.

• Network Recon

  by @blacklanternsecurity

  Network reconnaissance, host discovery, port scanning, and OS fingerprinting. Produces a port/service map that the orchestrator uses to route to service-specific enumeration skills.

• <Skill Name>

  by @blacklanternsecurity

  <What this skill does in 2-3 sentences. Focus on technique scope and when to use it. No trigger phrases, negative conditions, or OPSEC details here.>

• Red Run Legacy

  by @blacklanternsecurity

  Legacy subagent-based orchestrator. Superseded by /red-run-ctf (agent teams). Use /red-run-legacy to invoke manually. Does not auto-trigger.

• Windows Kernel Exploits

  by @blacklanternsecurity

  Exploit Windows kernel vulnerabilities, vulnerable drivers, and privileged file operations for local privilege escalation to SYSTEM.

• Idor

  by @blacklanternsecurity

  Exploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities during authorized penetration testing.

• Kerberos Roasting

  by @blacklanternsecurity

  Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.

• Lfi

  by @blacklanternsecurity

  Guide Local File Inclusion (LFI) and Remote File Inclusion (RFI) exploitation during authorized penetration testing.

• Linux Cron Service Abuse

  by @blacklanternsecurity

  Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.

• Pivoting Tunneling

  by @blacklanternsecurity

  Network pivoting, port forwarding, and tunneling through compromised hosts to reach internal networks.

• Cors Misconfiguration

  by @blacklanternsecurity

  Exploit CORS (Cross-Origin Resource Sharing) misconfigurations during authorized penetration testing.

• Linux Sudo Suid Capabilities

  by @blacklanternsecurity

  Exploit sudo misconfigurations, SUID/SGID binaries, and Linux capabilities for privilege escalation.

• Csrf

  by @blacklanternsecurity

  Exploit Cross-Site Request Forgery (CSRF) vulnerabilities during authorized penetration testing.

• Windows Credential Harvesting

  by @blacklanternsecurity

  Harvest stored credentials from a Windows system for privilege escalation or lateral movement.

• Linux Kernel Exploits

  by @blacklanternsecurity

  Exploit Linux kernel vulnerabilities and escape restricted shells for privilege escalation.

• Oauth Attacks

  by @blacklanternsecurity

  Exploit OAuth 2.0 and OpenID Connect vulnerabilities during authorized penetration testing.

• Windows Service Dll Abuse

  by @blacklanternsecurity

  Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.

• Smb Exploitation

  by @blacklanternsecurity

  Exploit remote SMB vulnerabilities for unauthenticated code execution on Windows hosts.

• Ad Discovery

  by @blacklanternsecurity

  Enumerates Active Directory domains and maps attack surface for penetration testing.

• Deserialization Dotnet

  by @blacklanternsecurity

  Exploit .NET deserialization vulnerabilities during authorized penetration testing.

• Deserialization Java

  by @blacklanternsecurity

  Exploit Java deserialization vulnerabilities during authorized penetration testing.

• Jwt Attacks

  by @blacklanternsecurity

  Exploit JWT (JSON Web Token) vulnerabilities during authorized penetration testing.

• Deserialization Php

  by @blacklanternsecurity

  Exploit PHP deserialization vulnerabilities during authorized penetration testing.

• 2fa Bypass

  by @blacklanternsecurity

  Bypass two-factor authentication (2FA/MFA) during authorized penetration testing.

• Command Injection

  by @blacklanternsecurity

  Guide OS command injection exploitation during authorized penetration testing.

• Windows Uac Bypass

  by @blacklanternsecurity

  Bypass Windows User Account Control to escalate from medium to high integrity.

• Ldap Injection

  by @blacklanternsecurity

  Exploit LDAP injection vulnerabilities during authorized penetration testing.

• Password Reset Poisoning

  by @blacklanternsecurity

  Exploit password reset vulnerabilities during authorized penetration testing.

• File Upload Bypass

  by @blacklanternsecurity

  Guide file upload restriction bypass during authorized penetration testing.

• Windows Discovery

  by @blacklanternsecurity

  Windows local privilege escalation enumeration and attack surface mapping.

• Windows Token Impersonation

  by @blacklanternsecurity

  Exploit Windows token privileges for local privilege escalation to SYSTEM.

• Nosql Injection

  by @blacklanternsecurity

  Guide NoSQL injection exploitation during authorized penetration testing.

• Linux Discovery

  by @blacklanternsecurity

  Linux local privilege escalation enumeration and attack surface mapping.

• Container Escapes

  by @blacklanternsecurity

  Container escape, Docker breakout, and Kubernetes exploitation.

• Sentry Fix Issues

  by @getsentry

  Find and fix issues from Sentry using MCP. Use when asked to fix Sentry errors, debug production issues, investigate exceptions, or resolve bugs reported in Sentry. Methodically analyzes stack traces, breadcrumbs, traces, and…

• Add Existing Mcp Servers

  by @speakeasy-api

  Use when adding existing remote MCP servers from a local client inventory to an explicit Speakeasy AI Control Plane project, including discovering which servers are missing.

• Add Mcp From Remote Url

  by @speakeasy-api

  Add a user-supplied remote MCP server URL to an explicit AICP project through the Speakeasy AI Control Plane Platform MCP.

• Sentry Instrument Logging

  by @getsentry

  Instruments structured Sentry logs in a new or existing application.

• 1kosmos Blockid

  by @membranedev

  1Kosmos BlockID integration. Manage data, records, and automate workflows. Use when the user wants to interact with 1Kosmos BlockID data.

• Abuselpdb

  by @membranedev

  AbuselPDB integration. Manage data, records, and automate workflows. Use when the user wants to interact with AbuselPDB data.

• 42crunch

  by @membranedev

  42Crunch integration. Manage data, records, and automate workflows. Use when the user wants to interact with 42Crunch data.

• Acunetix

  by @membranedev

  Acunetix integration. Manage data, records, and automate workflows. Use when the user wants to interact with Acunetix data.

• 15five

  by @membranedev

  15Five integration. Manage Persons, Organizations. Use when the user wants to interact with 15Five data.

• Council

  by @ryoppippi

  Spawns parallel task agents to explore a codebase area. Use when researching unfamiliar code, auditing a subsystem, or gathering diverse perspectives before a design decision.

• Api Development

  by @Mindrally

  Guidelines for building clean, scalable APIs with Go standard library and NestJS TypeScript, covering security, validation, and modular architecture.

• Aws Development

  by @Mindrally

  AWS development best practices for Lambda, SAM, CDK, DynamoDB, IAM, and serverless architecture using Infrastructure as Code.

• Clerk Authentication

  by @Mindrally

  Guidelines for implementing Clerk authentication in Next.js applications with middleware, hooks, and security best practices

• Auth0 Authentication

  by @Mindrally

  Guidelines for implementing Auth0 authentication with best practices for security, rules, actions, and SDK integration

• Devops

  by @Mindrally

  Comprehensive DevOps engineering practices for Kubernetes, CI/CD, Bash scripting, Ansible, and cloud infrastructure.

• Bash Scripting

  by @Mindrally

  Bash scripting guidelines covering security, portability, error handling, and automation best practices for DevOps.

• Aspnet Core

  by @Mindrally

  Guidelines for ASP.NET Core web development covering API design, authentication, caching, and best practices

• C Sharp

  by @Mindrally

  Guidelines for C# development including Blazor, Unity game development, and .NET backend best practices