Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Blue Recon

  by @tonone-ai

  Audit existing security controls and detection coverage — find gaps against MITRE ATT&CK. Use when asked to "audit our detection coverage", "where are our security control gaps", or "check our MITRE coverage".

• Capgo Native Builds

  by @Cap-go

  Use for Capgo Cloud Build native iOS and Android workflows, including CLI login, API-key handling, iOS build onboarding, signing credential storage, build requests, store upload settings, output download links, and…

• Capacitor Security

  by @Cap-go

  Comprehensive security guide for Capacitor apps using Capsec scanner. Covers 63+ security rules across secrets, storage, network, authentication, cryptography, and platform-specific vulnerabilities. Use this skill when users…

• Capacitor Ci Cd

  by @Cap-go

  Complete CI/CD guide for Capacitor apps covering GitHub Actions, GitLab CI, build automation, app signing, and deployment pipelines. Use this skill when users need to automate their build and release process.

• Docs Skill Review

  by @elastic

  Review an Elastic agent skill against official documentation for accuracy, completeness, and coverage gaps. Use when a writer wants to review, audit, or validate a skill from a repository of agent skills.

• Security Review

  by @JasonxzWen

  Load when a task needs security-sensitive code, auth, user input, secrets, API endpoints, payments, injection risk, or unsafe IO reviewed; use code-review for broader review.

• Blockchain Web3

  by @brucesongs

  Blockchain & Web3 security — Solidity/Vyper smart contract auditing, DeFi attack vectors (flash loans, MEV, oracle manipulation), bridge attacks, wallet security, with tooling from Slither/Mythril/Foundry.

• Autonomous Loops

  by @brucesongs

  Performing repetitive enumeration across many targets - Running batch vulnerability scans on multiple hosts - Monitoring for changes in target environment - Executing attack chains that require iterative steps - User says…

• Cloud Security

  by @brucesongs

  Cloud security covers security assessment for major cloud platforms including AWS, Azure, and GCP, with core focus on IAM misconfiguration detection, storage bucket exposure scanning, metadata service attacks, container escape,…

• Automotive Vehicle Security

  by @brucesongs

  CAN/CAN-FD bus analysis, UDS diagnostics, IVI pentest, OBD-II exploitation, key fob replay/relay attacks, GNSS spoofing, EV charging station (ISO 15118), and connected vehicle red team operations.

• Ai Security

  by @brucesongs

  Semantic-layer attack testing against AI systems and LLM-integrated applications.

• Api Security

  by @brucesongs

  API Security Testing covers security assessment across three major API architectures: REST, GraphQL, and gRPC, focusing on the OWASP API Security Top 10 core risks: Broken Authentication, Broken Object Level Authorization…

• Ai Fuzzing

  by @brucesongs

  AI-assisted fuzzing for automated vulnerability discovery. Coverage-guided fuzzing engines, AI-driven seed generation, intelligent mutation strategies, and systematic crash triage.

• Av Edr Evasion

  by @brucesongs

  AV/EDR evasion covers techniques for bypassing antivirus (AV) and Endpoint Detection/Response (EDR) solutions during payload delivery, execution, and post-exploitation.

• Dns Attacks

  by @brucesongs

  DNS Attacks exploit the Domain Name System protocol for reconnaissance, spoofing, tunneling, and data exfiltration. DNS is a foundational infrastructure service that is frequently misconfigured, poorly monitored, and trusted by…

• Chronicle

  by @brucesongs

  A system for recording, indexing, and distilling knowledge from agent lifecycle events. Through a three-layer document system (overview -> detailed records -> knowledge distillation), raw conversation events are transformed into…

• Article Writing

  by @brucesongs

  Transform technical findings into clear, structured written content: penetration test reports, vulnerability disclosures, security blog posts, and technical documentation.

• Container Security

  by @brucesongs

  Container security covers the complete lifecycle from image building, registry management, runtime protection, to orchestration platform (Kubernetes) security.

• Cloud Identity Attack

  by @brucesongs

  Cloud identity provider attacks covering Azure AD/Entra ID, Okta, Auth0, Ping, AWS IAM Identity Center, and Google Workspace — including OAuth 2.0 token theft, OIDC redirect abuse, SAML response forgery, conditional access…

• Codebase Onboarding

  by @brucesongs

  Rapidly acquire a mental model of any unfamiliar codebase — from a 500-line script to a 100M+ line monorepo. This skill transforms raw code into structured intelligence: architecture maps, entry points, data flows, security…

• Continuous Learning

  by @brucesongs

  After completing a penetration test engagement - When encountering a novel attack technique or defense - After a tool produces unexpected results - When identifying recurring patterns across targets - User says "learn",…

• Darkweb Intel

  by @brucesongs

  Dark web intelligence gathering — Tor/onion service reconnaissance, marketplace monitoring, breach data markets, threat actor profiling, with strict OPSEC for investigators.

• Binary Reverse

  by @brucesongs

  Binary reverse engineering covers the complete chain from static analysis, dynamic debugging, to vulnerability discovery, exploit development, and malware analysis.

• Council

  by @brucesongs

  Council provides a structured framework for analyzing security questions from multiple adversarial and defensive perspectives simultaneously.

• Crypto Attacks

  by @brucesongs

  Cryptographic Attacks target implementation flaws and algorithm weaknesses in encryption systems, covering OWASP A04: Cryptographic Failures.

• Dependency Auditor

  by @seaworld008

  Audit dependency versions, vulnerabilities, licenses and upgrade risks across package manifests and lockfiles.

• Command Injection Advanced

  by @brucesongs

  Advanced injection attacks beyond SQL - covering OS command injection, LDAP injection, NoSQL injection, template injection (SSTI), XPath injection, and comprehensive filter bypass techniques.

• Deep Research

  by @brucesongs

  Multi-source intelligence gathering through systematic web research — producing thorough, cited reports from diverse sources.

• Ci Cd Supply Chain Attack

  by @brucesongs

  CI/CD pipeline and software supply chain compromise covering Jenkins (script console, Jenkinsfile injection, shared library abuse, CVE-2024-23897 args4j), GitLab CI/CD (runner abuse, .gitlab-ci.yml injection, self-hosted runner…

• Agentic Pentest

  by @brucesongs

  LLM-driven autonomous penetration testing framework operations covering PentestGPT, HexStrike AI, Viper, PentestAgent, AI-Infra-Guard, AutoPWN, and custom agent harness patterns — including reasoning chain orchestration, tool…

• Docker Patterns

  by @brucesongs

  Setting up a practice lab for penetration testing techniques - Creating isolated environments for exploit development and testing - Building vulnerable application targets for training - Testing tools against known-vulnerable…

• Bluetooth Rfid Nfc

  by @brucesongs

  Near-field wireless penetration testing skills covering Bluetooth Classic device enumeration and exploitation, BLE GATT service attacks against IoT devices, RFID card cloning (MIFARE Classic/DESFire), NFC tag manipulation, and…

• Database Attack

  by @brucesongs

  Direct attacks against database servers at the protocol level — distinct from web-based SQL injection (covered by web-sqli). This skill targets database listeners, authentication mechanisms, stored procedures, and protocol-level…

• Exploit Development

  by @brucesongs

  Exploit development covers the full chain from vulnerability discovery through crash analysis to working exploit code, spanning buffer overflows, ROP chains, format string bugs, and shellcode injection across x86 and ARM…

• File Inclusion

  by @brucesongs

  Local File Inclusion (LFI) and Remote File Inclusion (RFI) attack techniques covering path traversal, PHP wrapper abuse, log poisoning, session file inclusion, and remote payload hosting for code execution.

• Data Scraper Agent

  by @brucesongs

  Automated data collection from structured sources: CVE databases, threat intelligence feeds, exploit databases, and security advisories. Transform unstructured web data into structured knowledge units.

• Engagement Manager

  by @brucesongs

  End-to-end penetration test project management skill. Orchestrates the full engagement lifecycle from scoping through reporting, managing skill composition, evidence chains, and phase transitions.

• Exa Search

  by @brucesongs

  Semantic search using Exa API for security research queries. Unlike keyword-based search, Exa understands context and retrieves high-quality, relevant results for technical research.

• Embedded Rtos Security

  by @brucesongs

  RTOS penetration testing — VxWorks WDB debug agent (Urgent/11), QNX microkernel, FreeRTOS+TCP CVEs, ThreadX/Azure RTOS, Zephyr, Mbed OS, TI-RTOS, MicroC/OS, NuttX, RIOT, Contiki

• Ad Ldap Attack

  by @brucesongs

  Active Directory is the backbone of enterprise identity and access management, making it a primary target during internal network penetration tests.

• Anti Forensics

  by @brucesongs

  Anti-forensics is the offensive counterpart to digital forensics.

• Edge Computing Attack

  by @brucesongs

  Attacks against edge computing platforms — Cloudflare Workers (V8 isolate), Fastly Compute@Edge (WASM/Wasmtime), AWS Lambda@Edge and CloudFront Functions, Akamai EdgeWorkers, Vercel Edge Functions, and Deno Deploy. Covers V8…

• Arena

  by @seaworld008

  Specialist orchestrating codex exec / Antigravity CLI through dual paradigms — COMPETE (multi-variant comparison, select best) and COLLABORATE (decompose tasks across engines, integrate). Supports Solo/Team/Quick execution modes.

• Concurrency Exploitation

  by @brucesongs

  Concurrency exploitation covers race condition vulnerabilities including TOCTOU, signal handler races, thread synchronization bypasses, and timing attacks.

• Ai Safety Redteam Advanced

  by @brucesongs

  Advanced AI safety red team operations covering OWASP LLM Top 10 (2025), prompt injection (direct/indirect/multi-turn), jailbreak techniques (DAN, cognitive hacking, persona-based), data poisoning detection, model inversion…

• Eu Ai Act Compliance Redteam

  by @brucesongs

  EU AI Act (Regulation (EU) 2024/1689) compliance-focused red team testing for high-risk AI systems — Article 9 adversarial testing, Annex III classification, Annex IV technical documentation, conformity assessment, and Notified…

• Cms Framework Attack

  by @brucesongs

  Targeted security assessment of Content Management Systems (WordPress, Joomla, Drupal) using specialized scanners and exploit techniques.

• Cps Attack

  by @brucesongs

  Cyber-Physical Systems (CPS) attacks — PLCs (Siemens S7, Rockwell ControlLogix, Schneider Modicon, Mitsubishi MELSEC), ICS protocols (Modbus, DNP3, Profinet, EtherNet/IP, IEC 61850, OPC UA), HMIs, SCADA historians, OT-to-IT…

• Confidential Computing Attack

  by @brucesongs

  Attacks against Trusted Execution Environments (TEEs) and confidential computing platforms — Intel SGX (Foreshadow/SGAxe/LVI/ÆPIC Leak), Intel TDX, AMD SEV/SEV-ES/SEV-SNP (CrossLine/BadRAM), Azure CCF, Marblerun, and…

• Ai Agent Security

  by @brucesongs

  Offensive security testing of AI agent systems covering MCP server attacks, tool poisoning, indirect prompt injection against agents, RAG knowledge base poisoning, agent sandbox escape, multi-agent compromise chains, and…

• Ad Cs Abuse

  by @brucesongs

  Active Directory Certificate Services (AD CS) abuse — ESC1-ESC15 attack patterns, PKINIT, PetitPotam to AD CS to Domain Admin chains, CVE-2022-26923 (Certifried), Shadow Credentials, Golden Certificate, certificate template ACL…

• 5g 6g Telecom Attack Advanced

  by @brucesongs

  Advanced 5G/6G telecom attacks covering 5G Core (SBA) exploitation, IMSI catcher evolution (5G Stingray), SIP/Diameter protocol attacks, Open RAN vulnerabilities, network slicing abuse, and early 6G research vectors (THz comms,…

• Comply

  by @seaworld008

  Regulatory compliance and audit agent. Maps business regulatory requirements (SOC2/PCI-DSS/HIPAA/ISO 27001), checks control implementations, designs audit trails, and implements Policy as Code. Use when compliance auditing is…

• Data Loss Prevention Bypass

  by @brucesongs

  DLP bypass techniques covering steganography (LSB, audio, video), DNS tunneling, ICMP tunneling, cloud sync abuse (Dropbox, OneDrive), WebSocket/HTTP3 exfil, AI-augmented exfil (semantic chunking), and modern DLP evasion patterns.

• Edge Computing Security

  by @brucesongs

  Edge computing security testing covering CDN bypass, Cloudflare Workers abuse, AWS Lambda@Edge attacks, cache poisoning, origin IP discovery, WAF bypass, and edge function injection.

• Blockchain L2 Attack

  by @brucesongs

  Layer-2 blockchain attack — Lightning Network (BOLT, HTLC), Optimistic Rollups (Optimism/Arbitrum/Boba/Base), ZK Rollups (zkSync/StarkNet/Polygon zkEVM/Scroll/Linea), Polygon PoS, Gnosis sidechain, cross-chain bridges…

• Cloud Native Vuln Research

  by @brucesongs

  CVE research methodology, PoC reproduction, patch gap analysis, and exploit chain composition across container/k8s/cloud-native surfaces; SBOM-driven vuln management and nuclei template authoring.

• Code Review And Quality

  by @seaworld008

  Review code changes for correctness, maintainability, security, and validation evidence before integration or when a review is requested.

• Api Design Reviewer

  by @seaworld008

  Use when reviewing API designs for consistency, usability, versioning, error semantics, security, backward compatibility, and developer experience before implementation or release.

• Cloudflare Troubleshooting

  by @seaworld008

  Diagnose Cloudflare DNS, TLS, redirects, and configuration issues using live API settings and request evidence.

• Wp Plugin Review

  by @wpacademy

  Comprehensive WordPress plugin review covering security vulnerabilities, WordPress Coding Standards (WPCS) compliance, plugin repository guidelines, unit test coverage, and accessibility. Runs automated tools (PHPCS with WPCS,…

• Database Schema Designer

  by @seaworld008

  Design relational database schemas from requirements and generate migrations, TypeScript/Python types, seed data, RLS policies, and indexes. Handles multi-tenancy, soft deletes, audit trails, versioning, and polymorphic…

• Api Test Suite Builder

  by @seaworld008

  Generate API tests from routes and contracts for authentication, validation, pagination, errors, uploads, and limits in Node.js or Python projects.

• Cloud Identity And Auth

  by @Tibsfox

  Identity, authentication, authorization, and token management for cloud platforms. Covers Keystone-style scoped tokens, OAuth 2.0 flows, OpenID Connect, JWT structure and pitfalls, federation with SAML/OIDC, service-to-service…

• Docker Expert

  by @seaworld008

  Use when containerizing an application with Docker, optimizing multi-stage builds and image size, designing Docker Compose services, troubleshooting container networking or volumes, or adding secure image build and CI/CD…

• Code Review

  by @Tibsfox

  Reviews code for bugs, style, and best practices. Use when reviewing PRs or checking code quality.

• Codeql Security Scanner

  by @seaworld008

  用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scanning 集成。

• AWS Penetration Testing

  by @SamarthaKV29

  This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or…

• Antigravity Workflows

  by @SamarthaKV29

  Orchestrate multiple Antigravity skills through guided workflows for SaaS MVP delivery, security audits, AI agent builds, and browser QA.

• Security Review

  by @LangConfig

  Comprehensive security code review covering OWASP Top 10, authentication, authorization, and secure coding practices. Use when reviewing code for vulnerabilities or implementing security features.

• Git Workflow

  by @LangConfig

  Expert guidance for Git workflows, branching strategies, and version control best practices. Use when managing repositories, resolving conflicts, or establishing team workflows.

• Code Review

  by @LangConfig

  Systematic code review guidance covering best practices, security, performance, and maintainability. Use when reviewing code, checking PRs, or analyzing code quality.

• Inertia Rails Architecture

  by @inertia-rails

  Server-driven architecture patterns for Inertia Rails + React. Load this FIRST when building any Inertia page or feature — it routes to the right skill. Decision matrix for data loading, forms, navigation, state management.…

• Rw Generate Video

  by @runwayml

  Generate videos directly using the Runway API via runnable scripts. Supports text-to-video, image-to-video, and video-to-video with seedance2, gen4.5, veo3, and more.

• Rw Generate Image

  by @runwayml

  Generate images directly using the Runway API via runnable scripts. Supports text-to-image with optional reference images.

• Perseus:Start

  by @kaivyy

  Use when you want to run a full, automated penetration test from start to finish (Scan -> Audit -> Exploit -> Report)

• Perseus:Scan

  by @kaivyy

  Use when starting a security assessment to map architecture, entry points, and attack surface (Phase 1 & 2)

• Perseus Injection

  by @kaivyy

  Deep-dive injection vulnerability analysis (NoSQL, LDAP, XPath, Template, OS Command, Expression Language)

• Perseus Crypto

  by @kaivyy

  Deep-dive cryptography and secrets analysis (JWT, hashing, encryption, key management)

• Perseus Client

  by @kaivyy

  Client-side security analysis (DOM XSS, React/Vue/Angular, SSR, prototype pollution)

• Perseus:Audit

  by @kaivyy

  Use when analyzing components for vulnerabilities (Phase 2 - Parallel Analysis)

• Using Perseus

  by @kaivyy

  Use when starting a security conversation to understand the Perseus methodology

• Perseus Api

  by @kaivyy

  Deep-dive API security analysis (REST, GraphQL, WebSocket, gRPC, OAuth, Cache)

• Perseus:Exploit

  by @kaivyy

  Use when verifying vulnerabilities with Dynamic Exploit Generation (Phase 3)

• Perseus Supply Chain

  by @kaivyy

  Supply chain security analysis (CVEs, dependencies, typosquatting, licenses)

• Perseus Config

  by @kaivyy

  Security configuration analysis (Headers, CORS, Docker, CI/CD, Cloud, K8s)

• Perseus Specialist

  by @kaivyy

  Run all specialist deep-dive skills in parallel for comprehensive analysis

• Perseus File

  by @kaivyy

  File security analysis (path traversal, upload bypass, XXE, zip slip)

• Perseus:Report

  by @kaivyy

  Use when generating the final executive security report (Phase 4)

• Perseus Logic

  by @kaivyy

  Business logic, race conditions, and AI security analysis

• Lov Env Management

  by @lovstudio

  统一管理平台、账号与多组 API Key，维护有效期和启用状态，安全同步到 zsh 或用户会话环境，并提供脱敏 Dashboard；用户说“管理环境变量”“rotate API keys”时使用。

• Code Comments

  by @zenobi-us

  Write clear, plain-spoken code comments and documentation that lives alongside the code. Use when writing or reviewing code that needs inline documentation—file headers, function docs, architectural decisions, or explanatory…

• Tribunal

  by @GadaaLabs

  Use when completing tasks, implementing major features, or before merging to verify work meets requirements

• Better Auth Security Best Practices

  by @zenobi-us

  Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users…

• Two Factor

  by @zenobi-us

  Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor…

• Email And Password

  by @zenobi-us

  Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up,…

• Best Practices

  by @zenobi-us

  Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript…

• Sop Rfc2119

  by @zenobi-us

  Use when writing SOPs that require precise requirement levels using RFC 2119 constraint keywords (MUST, SHOULD, MAY). Covers proper usage of requirement keywords for deterministic agent behavior.

• Agents Md Generator

  by @thienanblog

  Create, audit, or compact repository instructions in AGENTS.md, scoped overrides, and requested tool compatibility files. Use to preserve non-obvious project rules while removing stale, duplicated, or generic guidance.

• Dynamic

  by @ww-w-ai

  Fullstack development skill using bkend.ai BaaS platform. Covers authentication, data storage, API integration for dynamic web apps. Project initialization with "init dynamic" or "dynamic init". Use proactively when user needs…