Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Langsmith Custom Apps

  by @langchain-ai

  INVOKE THIS SKILL when building, iterating on, copying, or sharing a LangSmith Custom App — a React/TypeScript UI that runs inside LangSmith and reads the LangSmith API. Covers the langsmith apps CLI, pulling an existing app's…

• Dt Sec Insights

  by @Dynatrace

  Query and analyze Dynatrace security data in security.events with DQL: vulnerabilities, threat detections, compliance posture, and scan coverage. Covers Dynatrace-native Runtime Vulnerability Analytics (RVA — CVEs, reachability,…

• Dt Obs Azure

  by @Dynatrace

  Azure cloud resources including VMs, VMSS, SQL Database, Storage, AKS, App Service, Functions, VNet networking, load balancers, Event Hubs, Container Apps, and Key Vault. Monitor Azure infrastructure, analyze resource usage,…

• Payload

  by @payloadcms

  Use when working with Payload projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.

• Dt Obs Log Semantic Mapping

  by @Dynatrace

  Suggest and validate semantic dictionary (SD) mappings for audit log integrations using raw vendor log payloads or live ingested events. Use when: mapping a vendor audit log feed, authentication logs, user activity logs to the…

• Dt Sec Ioc Hunting

  by @Dynatrace

  Hunt threat-intelligence indicators of compromise (IoCs) across Dynatrace logs and spans and produce a 0-100 threat-exposure score. Extracts and normalizes IoCs — IPs, Domains (hostnames included), URLs, Emails, CVEs, File…

• Dt Sec Contextualization

  by @Dynatrace

  Resolve security signals, IoC matches, or Smartscape nodes to runtime Dynatrace entities and connect findings on different entity levels through a shared runtime entity. Covers identity-to-Smartscape mapping (incl.…

• Dt Obs Problems

  by @Dynatrace

  DAVIS problem analysis including root cause identification, impact assessment, and correlation with other telemetry. Use when querying or investigating detected problems. Trigger: "active problems", "root cause analysis",…

• Dt Obs Ext Monitors

  by @Dynatrace

  3rd-party test and monitor result ingestion into Dynatrace Grail via the platform events ingest API (platform/ingest/custom/events/). Use when sending external synthetic test outcomes, CI monitor data, or third-party check…

• Dt Obs Compliance Assistant

  by @Dynatrace

  Monitor and investigate EU DORA compliance posture using Dynatrace Compliance Assistant. Covers compliance score, CIF health, incident lifecycle, and ICT risk inputs (vulnerabilities, security detection findings,…

• 3proxy

  by @TerminalSkills

  Deploy and configure 3proxy — a lightweight universal proxy server. Use when a user asks to set up HTTP, HTTPS, SOCKS4, SOCKS5, or transparent proxies, build proxy chains, configure authentication, set bandwidth limits, manage…

• Ai Pentesting

  by @TerminalSkills

  Run autonomous AI-driven penetration tests on web applications using tools like Shannon, PentAGI, and similar frameworks. Use when tasks involve setting up automated penetration testing pipelines, combining AI agents with…

• Ag2

  by @TerminalSkills

  You are an expert in AG2 (formerly AutoGen), the open-source multi-agent conversation framework. You help developers build systems where multiple AI agents collaborate through structured conversations — with tool use,…

• Apollo Client

  by @TerminalSkills

  You are an expert in Apollo Client, the comprehensive GraphQL client for React applications. You help developers fetch data with GraphQL queries and mutations, manage local and remote state with Apollo's normalized cache,…

• Alert Optimizer

  by @TerminalSkills

  Restructure and optimize alert rules for monitoring platforms (Sentry, PagerDuty, Datadog, OpsGenie). Use when someone asks to "reduce alert noise", "fix alert fatigue", "create alert rules", "set up escalation policies", "tune…

• Airtable

  by @TerminalSkills

  Build integrations with the Airtable Web API — bases, tables, records, fields, views, webhooks, and OAuth. Use when tasks involve reading or writing Airtable data, syncing external sources with Airtable bases, building…

• Amass

  by @TerminalSkills

  OWASP Amass for in-depth DNS enumeration, subdomain discovery, and network mapping with active and passive modes. Use when: comprehensive subdomain enumeration, ASN and IP range mapping, attack surface discovery, building full…

• Aircrack Ng

  by @TerminalSkills

  Audit Wi-Fi networks with the aircrack-ng suite. Use when a user asks to test their own wireless network, capture WPA2 handshakes, crack captured handshakes offline, put an adapter into monitor mode, or perform a wireless…

• Api Design Patterns

  by @bobmatnyc

  Comprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices

• Env Manager

  by @bobmatnyc

  Environment variable validation, security scanning, and management for Next.js, Vite, React, and Node.js applications

• Security Scanning

  by @bobmatnyc

  CI security scanning: secrets, deps, SAST, triage, expiring exceptions

• Mpm Ticket Wizard

  by @bobmatnyc

  Interactive ticket creation wizard with Q&A flow for bugs, features, tasks, and epics

• Authentication Oauth

  by @omer-metin

  Expert guidance on authentication implementation including OAuth 2.0/OIDC, JWT tokens, session management, and secure password handling. Covers both implementing auth from scratch and integrating auth providers. Use when…

• Blockchain Privacy

  by @omer-metin

  Expert in on-chain privacy technologies - ZK-SNARKs, ZK-STARKs, mixers, stealth addresses, ring signatures, and confidential transactions for building privacy-preserving blockchain applicationsUse when "privacy, zero knowledge,…

• Backend

  by @omer-metin

  World-class backend engineering - distributed systems, database architecture, API design, and the battle scars from scaling systems that handle millions of requestsUse when "backend, api, database, postgres, mysql, mongodb,…

• Auth Specialist

  by @omer-metin

  Authentication and authorization expert for OAuth, sessions, JWT, MFA, and identity securityUse when "authentication flow, login system, oauth integration, jwt tokens, session management, password hashing, mfa setup, refresh…

• Ai Code Security

  by @omer-metin

  Security vulnerabilities in AI-generated code and LLM applications, covering OWASP Top 10 for LLMs, secure coding patterns, and AI-specific threat modelsUse when "ai code security, llm vulnerabilities, ai generated code review,…

• Api Designer

  by @omer-metin

  API design specialist for REST, GraphQL, gRPC, versioning strategies, and developer experienceUse when "api design, rest, graphql, grpc, openapi, swagger, versioning, pagination, rate limiting, endpoint, api, rest, graphql,…

• Dependency Audit

  by @bobmatnyc

  Dependency audit and cleanup workflow for maintaining healthy project dependencies. Use for regular maintenance, security updates, and removing unused packages.

• Mpm Orchestrator

  by @bobmatnyc

  Multi-Agent Project Manager orchestration - delegation patterns, agent types, and verification protocol

• Website Finishing Director

  by @guia-matthieu

  Run a structured 5-pass finishing audit on any website before launch — scoring visual polish, technical foundation, UX completeness, content quality, and cross-device readiness on 100 points. Use when: **Pre-launch** - Final…

• Ms365 Tenant Manager

  by @yezannnnn

  Microsoft 365 tenant administration for Global Administrators. Automate M365 tenant setup, Office 365 admin tasks, Azure AD user management, Exchange Online configuration, Teams administration, and security policies. Generate…

• Performing Multi Agent Code Review

  by @bitwarden

  Perform a rigorous, multi-agent code review with architecture-compliance, parallel quality/security analysis, finding validation, and severity audit. Use when the user asks for a structured, deep, thorough, multi-pass, or…

• Threat Modeling

  by @bitwarden

  This skill should be used when the user asks to "create a threat model", "define security goals", "generate a data flow diagram", "write security definitions", "perform an initial security assessment", or needs to produce threat…

• Reviewing Claude Config

  by @bitwarden

  Reviews Claude configuration files for security, structure, and prompt engineering quality. Use when reviewing changes to CLAUDE.md, agents, prompts, commands, hooks, or settings. Routes each file type to a targeted review skill…

• Senior Architect

  by @yezannnnn

  This skill should be used when the user asks to "design system architecture", "evaluate microservices vs monolith", "create architecture diagrams", "analyze dependencies", "choose a database", "plan for scalability", "make…

• Senior Secops

  by @yezannnnn

  Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking, and security automation. Use…

• Senior Backend

  by @yezannnnn

  This skill should be used when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load…

• Senior Fullstack

  by @yezannnnn

  Fullstack development toolkit with project scaffolding for Next.js/FastAPI/MERN/Django stacks and code quality analysis. Use when scaffolding new projects, analyzing codebase quality, or implementing fullstack architecture…

• Senior Security

  by @yezannnnn

  Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools.

• Auditing External Claude Plugins

  by @bitwarden

  Audits an external (third-party) Claude Code plugin pinned in this marketplace for security risk before it is vendored, and writes the report to a file for downstream posting. Use when asked to "audit an external plugin", "audit…

• Perform Security Review

  by @bitwarden

  Performs a security-focused code review by launching multiple specialized agents and a verification agent to ensure comprehensive coverage and accurate findings. Use this skill when the user asks for a "perform-security-review",…

• Architecting Solutions

  by @bitwarden

  Architecting solutions at the team level while staying coherent with Bitwarden's holistic architecture. Covers security mindset, architectural judgment, Bitwarden-specific constraints, and working with the architecture group.…

• Reviewing Security Architecture

  by @bitwarden

  This skill should be used when the user asks to "review the security architecture", "check authentication patterns", "evaluate trust boundaries", "review encryption implementation", "assess authorization design", or needs to…

• Analyzing Code Security

  by @bitwarden

  This skill should be used when the user asks to "analyze code for security issues", "check for OWASP vulnerabilities", "review code against CWE Top 25", "find injection vulnerabilities", "do a security code review", or needs…

• Action Remediate

  by @bitwarden

  Remediate GitHub Actions action findings identified by the action-audit skill. Applies the appropriate fix per action type — `@main` ref for internal `bitwarden/` actions, full SHA with inline version comment for external…

• Reviewing Agent Definitions

  by @bitwarden

  Reviews Claude Code agent definition files for tool-access security, triggering quality, and system prompt clarity. Use when reviewing changes to agents/<name>.md or agents/<name>/AGENT.md, whether under .claude/agents/ or…

• Action Audit

  by @bitwarden

  Audit GitHub Actions action usage across an org. Searches for a specific action (incident mode) or sweeps all workflow files for non-compliant action references (audit mode). Produces a read-only report of findings with…

• Reviewing Dependency Changes

  by @bitwarden

  Use this skill when a PR diff contains changes to dependency manifest files (package.json, .csproj, Cargo.toml, go.mod, requirements.txt, etc.) or when reviewing Renovate/Dependabot bot PRs. Evaluates new dependencies for AppSec…

• Bitwarden Security Context

  by @bitwarden

  Bitwarden's security principles (P01-P06), security vocabulary, and data classification standards. Use when you need foundational security context for any Bitwarden development, review, or security task — such as understanding…

• Detecting Secrets

  by @bitwarden

  This skill should be used when the user asks to "find hardcoded secrets", "audit for credential leaks", "check for API keys in code", "review secret scanning alerts", "rotate a leaked secret", or needs to detect hardcoded…

• Triaging Security Findings

  by @bitwarden

  This skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work with Aikido feed issues, GitHub…

• Reviewing Dependencies

  by @bitwarden

  This skill should be used when the user asks to "review Dependabot alerts", "check for vulnerable dependencies", "audit third-party packages", "assess supply chain risk", "run an Aikido scan", or needs to evaluate dependency…

• Classifying Review Findings

  by @bitwarden

  Use this skill when categorizing code review findings into severity levels. Apply when determining which emoji and label to use for PR comments, deciding if an issue should be flagged at all, or classifying findings as CRITICAL,…

• Web Security

  by @academind

  Enforce web security and avoid security vulnerabilities

• Integration

  by @GGPrompts

  Integrate projects with TabzChrome terminals via Markdown links, HTML attributes, WebSocket, JS API, or Spawn API

• Config Hardening

  by @proflead

  Harden configuration and defaults for safer deployment. Use when a mid-level developer needs to reduce misconfig risks.

• Dependency Risk Audit

  by @proflead

  Audit dependencies for licensing, security, and maintenance risk. Use when a senior developer needs risk assessment.

• Security Quick Scan

  by @proflead

  Scan code or configuration for common security issues. Use when a mid-level developer needs a quick security pass.

• Threat Modeling

  by @proflead

  Perform threat modeling for a system or feature. Use when a senior developer needs security risk assessment.

• Activecampaign Automation

  by @diegosouzapw

  ActiveCampaign Automation via Rube MCP workflow skill. Use this skill when the user needs Automate ActiveCampaign tasks via Rube MCP (Composio): manage contacts, tags, list subscriptions, automation enrollment, and tasks. Always…

• Activecampaign Automation V2

  by @diegosouzapw

  ActiveCampaign Automation via Rube MCP workflow skill. Use this skill when the user needs Automate ActiveCampaign tasks via Rube MCP (Composio): manage contacts, tags, list subscriptions, automation enrollment, and tasks. Always…

• Securing Ai Systems

  by @trilwu

  Assess and harden LLM applications and agentic systems against prompt injection, tool misuse, excessive agency, memory poisoning, RAG data leakage, and model supply-chain risk, mapped to the OWASP Top 10 for LLM and Agentic…

• Auditing Code For Vulnerabilities

  by @trilwu

  Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis. Use when reviewing a codebase or diff for security bugs, performing a security audit,…

• Orchestrating Vulnerability Research

  by @trilwu

  Run a sustained, multi-agent vulnerability-discovery campaign against a target — split its attack surface into slices, hunt each slice with a builder agent, and have a separate critic with fresh context adversarially refute…

• Producing Threat Intelligence

  by @trilwu

  Produce cyber threat intelligence by pivoting on indicators to find related infrastructure, tracking actors and campaigns, enriching and contextualizing IOCs, applying attribution discipline and analytic confidence, and…

• Investigating Azure Incidents

  by @trilwu

  Investigate security incidents in Microsoft Azure (resource and subscription control plane) -- reconstruct attacker activity from the Azure Activity Log and resource/data-plane diagnostic logs, anchor the investigation on the…

• Investigating Windows Endpoints

  by @trilwu

  Investigate a compromised or suspicious Windows host from on-disk artifacts -- triage collection, evidence of execution (Prefetch, Amcache, Shimcache, SRUM, UserAssist, BAM), the event-log workhorses by ID (Security…

• Analyzing Network Traffic

  by @trilwu

  Analyze packet captures and network telemetry for intrusion evidence — capture and handling, the Wireshark/tshark triage funnel, Zeek log mining, Suricata rule runs, beacon and DNS-tunnel detection, TLS/JA3 fingerprinting, HTTP…

• Investigating Aws Incidents

  by @trilwu

  Investigate security incidents in Amazon Web Services -- reconstruct attacker activity from CloudTrail, VPC Flow Logs, and GuardDuty, anchor the investigation on the compromised principal (access key or role), trace privilege…

• Auditing Php Applications

  by @trilwu

  Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash auth bypass, LFI/RFI through…

• Hardening Cloud Posture

  by @trilwu

  Proactively harden a cloud account or organization before an incident — prioritizing IAM and identity risk over checkbox findings, closing the exposures that become attack paths (public storage, over-broad roles, missing audit…

• Reversing Obfuscated Javascript

  by @trilwu

  Reverse engineer minified, bundled, and obfuscated browser/Node JavaScript — unpacking webpack chunks, recovering source from sourcemaps, undoing obfuscator.io string-array and control-flow obfuscation with…

• Hunting Web Backdoors

  by @trilwu

  Hunt planted webshells and backdoors across a web source tree — PHP first (also JSP, ASP, Node) — triaging a directory at scale, statically decoding obfuscation layers without ever executing the payload, finding…

• Devirtualizing Vm Protected Code

  by @trilwu

  Recover the original logic from code protected by a virtualization obfuscator — VMProtect, Themida/WinLicense, Code Virtualizer, or a custom opcode VM — by locating the VM dispatcher, reverse-engineering the handlers into…

• Investigating Gcp Incidents

  by @trilwu

  Investigate a security incident in Google Cloud — establishing what audit logging exists before trusting a gap, reconstructing activity from Cloud Audit Logs, triaging service-account and OAuth abuse, following Security Command…

• Analyzing Shellcode

  by @trilwu

  Analyze raw shellcode and position-independent code — extracting the bytes, guessing architecture, disassembling at the right base, decoding self-decoder stubs, resolving hashed Windows APIs, emulating to the decoded stage, and…

• Defending Kubernetes

  by @trilwu

  Harden and monitor a Kubernetes cluster against the attacks that actually happen — RBAC least privilege and escalation paths, Pod Security Admission enforcement, network policy default-deny, secrets and service-account token…

• Writing Yara Rules

  by @trilwu

  Author durable YARA detection rules — meta/strings/condition anatomy, string types and modifiers, structural conditions with file magic and offsets, the PE/ELF/math/hash modules, specificity-vs-durability tuning, atom-aware…

• Analyzing Disk Images

  by @trilwu

  Perform dead-disk forensics on an acquired disk image using The Sleuth Kit, Plaso, and bulk_extractor — verify integrity and mount read-only, map partitions, recover deleted files, build a file-system and super-timeline, carve…

• Analyzing Linux Persistence

  by @trilwu

  Systematically identify and analyze persistence mechanisms on Linux systems during DFIR investigations -- sweep systemd units, cron jobs, shell initialization, SSH config, kernel modules, LD_PRELOAD, package manager hooks, udev…

• Analyzing Phishing Emails

  by @trilwu

  Triage and forensically analyze reported phishing safely — extract the raw message, read the Received chain, verify SPF/DKIM/DMARC, detect display-name and lookalike spoofing, unwrap redirects and SafeLinks/URLDefense, decode…

• Triaging Security Alerts

  by @trilwu

  Work a security alert queue to a defensible disposition — separating true positives from false positives and benign true positives, reasoning about base rates before escalating, ordering enrichment by cheapest discriminator,…

• Maintaining Engagement State

  by @trilwu

  Keep the durable record that outlives a session — credential provenance, access inventory, artifacts left on target for cleanup, findings with evidence, and a dead-end log — so work spanning days or analysts does not restart or…

• Managing Vulnerabilities

  by @trilwu

  Prioritize and drive remediation of a vulnerability backlog by real risk, not raw CVSS — combining severity with exploitation signals (EPSS, CISA KEV), asset exposure and business context, using SSVC-style decisions,…

• Analyzing Firmware Images

  by @trilwu

  Extract, analyze, and assess firmware images from embedded devices, IoT hardware, routers, and similar targets — filesystem extraction, hardcoded credential discovery, binary analysis across architectures, web interface review,…

• Auditing Mcp Servers

  by @trilwu

  Audit Model Context Protocol servers for injection surfaces, excessive tool scope, authorization gaps, resource over-exposure, and transport weaknesses across stdio, SSE, and Streamable HTTP deployments. Use when reviewing an…

• Abusing Adcs

  by @trilwu

  Enumerate and abuse Active Directory Certificate Services with Certipy and Certify — the ESC1 through ESC16 escalation paths, vulnerable template and CA configurations, NTLM relay to web enrollment, certificate-based…

• Attacking Bluetooth Nfc

  by @trilwu

  Attack Bluetooth Classic, BLE, and NFC targets -- device enumeration, GATT characteristic exploitation, BLE MITM and replay, Ubertooth and nRF sniffing, MIFARE Classic cracking, Proxmark3 card cloning, NFC relay attacks, and…

• Vetting Agent Extensions

  by @trilwu

  Decide whether an agent skill, plugin, or MCP server is safe to install into an AI coding agent, where its content is loaded into a model's context and its config can run on startup. Use when reviewing a skill pack, Claude Code…

• Analyzing Macos Binaries

  by @trilwu

  Reverse engineer and security-review macOS applications and Mach-O binaries — thinning universal binaries, recovering Objective-C/Swift structure, reading code-signing entitlements and the hardened runtime, and auditing XPC…

• Diffing Binary Patches

  by @trilwu

  Locate the vulnerability a security patch fixes by diffing the pre- and post-patch binaries — using BinDiff, Diaphora, or ghidriff to find the changed functions, reading the added checks to recover the bug class, and reasoning…

• Attacking Eks Gke Aks

  by @trilwu

  Assess managed Kubernetes clusters on EKS, GKE, and AKS by exploiting the seams between cloud IAM and Kubernetes RBAC -- IRSA/OIDC trust abuse, Workload Identity Federation, pod-to-IMDS escalation, aws-auth ConfigMap takeover,…

• Attacking Entra Id

  by @trilwu

  Attack and enumerate Azure AD / Entra ID tenants — initial recon with AADInternals and ROADtools, password spraying, token theft (PRT, CAE, refresh tokens), application and service principal abuse, Conditional Access bypass,…

• Abusing Ci Cd Oidc

  by @trilwu

  Exploit CI/CD pipeline misconfigurations and OIDC federation weaknesses across GitHub Actions, GitLab CI, and Jenkins -- poisoned workflows, secret exfiltration, runner compromise, overly broad OIDC trust policies, build…

• Reversing Browser Extensions

  by @trilwu

  Reverse engineer and security-review Chrome/Firefox browser extensions — unpacking the CRX/XPI, reading the manifest for over-broad permissions, and tracing the trust boundary between page, content script, background service…

• Investigating M365 Entra

  by @trilwu

  Investigate security incidents in Microsoft 365 and Entra ID (Azure AD) -- search the Unified Audit Log, correlate sign-in and audit events, trace illicit OAuth consent grants, analyze mailbox rule manipulation, and contain…

• Attacking Graphql

  by @trilwu

  Test GraphQL APIs — introspection and schema recovery when introspection is disabled, field suggestion abuse, batching and alias-based rate limit bypass, query depth and complexity denial of service, authorization gaps per field…

• Analyzing Go Binaries

  by @trilwu

  Reverse engineer Go binaries by recovering function names and types from pclntab and moduledata using GoReSym, redress, and IDA/Ghidra Go plugins, and by reading Go's non-standard calling convention, interface dispatch, and…

• Analyzing Rust Binaries

  by @trilwu

  Reverse engineer Rust binaries — demangling legacy and v0 symbol schemes, recognizing monomorphized generics, Result and Option control flow, trait object vtable dispatch, and panic-site strings that leak source paths and crate…