Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Hunt Ldap

  by @elementalsouls

  Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \ NUL /),…

• Hunt Clickjacking

  by @elementalsouls

  Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money…

• Hunt Cicd

  by @elementalsouls

  Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897…

• Hunt Springboot

  by @elementalsouls

  Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965),…

• Hunt Deserialization

  by @elementalsouls

  Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use…

• Hunt Oauth

  by @elementalsouls

  Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

• Himalaya

  by @spinabot

  CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).

• Healthcheck

  by @spinabot

  Host security hardening and risk-tolerance configuration for Brigade deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, Brigade cron scheduling for periodic…

• Oauth Setup

  by @spinabot

  Connect an OAuth 2.0 service (Gmail, Google APIs, etc.) using the built-in oauth_authorize tool — get a click-to-authorize link, auto-capture the code, and seal the tokens. Use whenever the operator asks to connect Gmail / a…

• Apple Notes

  by @spinabot

  Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks Brigade to add a note, list notes, search notes, or manage note folders.

• Bear Notes

  by @spinabot

  Create, search, and manage Bear notes via grizzly CLI.

• Agent Watchdog

  by @BuilderIO

  Use when asked to watch, babysit, audit, review, compare, or fix another agent's work from a Codex session ID, Claude Code session/transcript, chat/thread link, PR, branch, log, or pasted run summary. Monitor until the other…

• Read The Damn Docs

  by @BuilderIO

  Use when implementing, integrating, upgrading, debugging, or answering anything involving third-party APIs, libraries, frameworks, CLIs, cloud services, model/provider SDKs, fast-moving product behavior, user requests for…

• Plow Ahead

  by @BuilderIO

  Use when the user explicitly wants autonomous progress without routine clarification stops: "plow ahead", "do not stop", "use your best judgment", "keep going until done", "finish while I am away", "do not ask questions unless…

• Codebase Wiki

  by @inkeep

  How to work in a Codebase Wiki project (the `codebase-wiki` starter pack): an agent-authored, source-grounded wiki of the surrounding codebase. Read when the project has a `wiki/` knowledge base with `architecture/`, `modules/`,…

• Nodejs Cli Best Practices

  by @lirantal

  Guide and audit Node.js CLI application development against 41 established best practices covering UX, distribution, interoperability, accessibility, testing, error handling, development setup, analytics, versioning, and…

• Boat

  by @davidondrej

  Manage Boat (boat.dev, formerly Box by Ascii) cloud sandboxes via API, CLI, and SSH. Use for provisioning, environments, secrets, templates, snapshots, stop/resume/fork, or running BB and coding agents on Boat.

• Box Ascii

  by @davidondrej

  Operate Box by Ascii cloud VMs through its REST API, CLI, and SSH. Use for Box provisioning, environments, secrets, templates, snapshots, stop/resume/fork, or running BB and coding agents on box.ascii.dev. This is for Ascii's…

• Create Readonly Db Role

  by @davidondrej

  Set up read-only PostgreSQL access for agents. Use only when the user explicitly invokes /create-readonly-db-role.

• Code Understanding

  by @gadievron

  Provides adversarial code comprehension for security research, mapping architecture, tracing data flows, and hunting vulnerability variants to build ground-truth understanding before or alongside static analysis.

• Audit

  by @gadievron

  Hypothesis-driven, tool-grounded security review of coverage gaps

• Frida

  by @gadievron

  Dynamic instrumentation via Frida - attach to or spawn a process, load a JS hook script, capture send() events into a lifecycle-managed run directory. Supports local, USB-attached, and remote frida-server targets.

• Pinme R2

  by @glitternetwork

  Use when a PinMe Cloudflare Worker needs R2 object storage, including secure file or image upload, streaming download, metadata lookup, deletion, listing, Range requests, or R2+D1 coordination. Guides AI to use PinMe's…

• Kiro Steering Custom

  by @gotalab

  Create custom steering documents for specialized project contexts. Use when creating domain-specific steering files.

• Kiro Steering Custom

  by @gotalab

  Create custom steering documents for specialized project contexts

• Kiro Steering

  by @gotalab

  Manage {{KIRO_DIR}}/steering/ as persistent project knowledge

• Leveling Up Content Engine

  by @ericosiu

  Diagnose and transform any authorized video URL, upload, recording, transcript, podcast, interview, presentation, screen recording, webinar, ad, or published video into the strongest justified content portfolio. Use for video…

• Game Security Research Rigor

  by @gmh5225

  Verify consequential or disputed game-security claims with primary sources, reproducible evidence, explicit trust boundaries, and calibrated uncertainty. Use alongside a domain skill when evidence quality affects the conclusion.

• Dma Attack Techniques

  by @gmh5225

  Analyze PCIe DMA threats, host-mediated memory acquisition, FPGA behavior, and IOMMU defenses. Use when the memory initiator or device boundary matters; use kernel security for host-only mechanisms.

• Game Hacking Techniques

  by @gmh5225

  Classify game-cheat capabilities and their defensive implications across memory, injection, rendering, input, engines, kernels, DMA, and remote transports. Use for authorized threat modeling, not operational deployment.

• Anti Cheat Systems

  by @gmh5225

  Analyze layered anti-cheat architecture, detection evidence, telemetry, and enforcement tradeoffs. Use for system-level defense questions; use narrower skills for DMA, kernel, graphics, mobile, or server details.

• Awesome Game Security Overview

  by @gmh5225

  Find, select, classify, or maintain resources in awesome-game-security. Use for repository navigation, category placement, duplicate review, generated descriptions, wiki coverage, or choosing a domain skill.

• Windows Kernel Security

  by @gmh5225

  Analyze Windows driver trust, callbacks, IRQL, kernel memory, DSE, PatchGuard, VBS/HVCI, ETW, crash evidence, and build-specific internals for authorized game-security research.

• Mobile Security

  by @gmh5225

  Analyze Android or iOS game-security trust boundaries, packages, native code, platform integrity, instrumentation, attestation, and signing. Use when mobile OS or device behavior is central.

• Reverse Engineering Tools

  by @gmh5225

  Analyze supplied game binaries, protection components, drivers, dumps, or traces through reproducible disassembly, decompilation, debugging, diffing, and interface reconstruction.

• Game Engine Resources

  by @gmh5225

  Analyze game-engine internals and select version-matched resources for Unreal, Unity, Source, Godot, or custom engines. Use for engine structure, object models, assets, SDK extraction, or editor/runtime boundaries.

• Graphics Api Hooking

  by @gmh5225

  Analyze Direct3D, DXGI, OpenGL, or Vulkan rendering, overlays, presentation, capture, and measurement evidence. Use when the graphics pipeline or frame-observation boundary is central.

• Game Server Security

  by @gmh5225

  Review multiplayer authority, RPCs, sessions, authorization, replication, inventory, economy, purchases, retries, and replay. Use when server or backend state is the security boundary.

• Linux Platform Security

  by @gmh5225

  Analyze Linux, SteamOS, Steam Deck, Wine, or Proton game-security boundaries. Use for ELF/process evidence, privileges, namespaces, seccomp, LSMs, compatibility, or Linux memory forensics.

• Game Supply Chain Security

  by @gmh5225

  Assess game build, launcher, update, distribution, mod, plugin, dependency, signing, provenance, and recovery trust. Use when release or content ingestion is the security boundary.

• Video Content Engine

  by @ericosiu

  Diagnose and transform any authorized video URL, upload, recording, transcript, podcast, interview, presentation, screen recording, webinar, ad, or published video into the strongest justified content portfolio. Use for video…

• Secure Code Review

  by @aiming-lab

  Use this skill when reviewing or writing code that handles user input, authentication, file I/O, network requests, or database queries. Always check for common security vulnerabilities before considering the code complete.

• Doca Dms

  by @NVIDIA

  Operate NVIDIA DOCA Management Service (`dmsd` + `dmspe`) on a BlueField, Arm/x86 host, or Kubernetes pod: choose deployment and authentication, configure `-allowed_users` and `dmsgroup`, use gNMI Get/Set/Subscribe, run…

• Ai Search Visibility Audit

  by @davepoon

  Audit whether a website can be found, crawled, and cited by AI answer engines such as ChatGPT Search, Perplexity, Google AI Overviews, and Microsoft Copilot. Use when someone asks why their brand is missing from AI answers,…

• Security Audit

  by @davepoon

  Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.

• Cal Com Automation

  by @davepoon

  Automate Cal.com tasks via Rube MCP (Composio): manage bookings, check availability, configure webhooks, and handle teams. Always search tools first for current schemas.

• Bamboohr Automation

  by @davepoon

  Automate BambooHR tasks via Rube MCP (Composio): employees, time-off, benefits, dependents, employee updates. Always search tools first for current schemas.

• Release Check

  by @davepoon

  Pre-release verification checklist. Validates features, tests, docs, security, and quality gates before shipping. Delegates to the Centinela (QA) agent.

• Unlazy

  by @Leonxlnx

  Enforces completion discipline for substantial autonomous work by writing acceptance gates before execution, decomposing work with the Depth Tree, running approved checks, and re-verifying evidence before reporting. Use when an…

• Self Configuration

  by @letta-ai

  Inspect or modify Letta Code's own memory, model, context window, system prompt, compaction, permissions, toolsets, mods, skills, channels, schedules, agent secrets, and local runtime settings. Use when the user asks how this…

• Context Doctor

  by @letta-ai

  Investigate agent behavior and audit memory structure, organization, and skills; make evidence-backed repairs.

• Secknowledge Skill

  by @Netw0rkNoob

  Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 150 风险 + OWASP Top 10 (LLM/ASI/WSTG)。 TRIGGER when 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt 注入/越狱/MCP/Agent/沙箱逃逸)。用户明确给出测试目标 (URL/代码/模型/Agent…

• Web Security Advanced

  by @Netw0rkNoob

  Web高级安全测试 — 注入攻击族、协议安全、认证与逻辑漏洞、文件与部署安全、现代Web攻击面，含完整Playbook

• Ctf Web

  by @Netw0rkNoob

  CTF Web攻击知识库 — PHP弱比较绕过、命令注入空格绕过、eval回显技巧、SSTI注入链、反序列化利用链、PHP代码审计checklist、常见flag位置

• Redteam Postex Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized post-exploitation testing after initial access, including privilege escalation, persistence, lateral movement, data collection, and cleanup considerations. Use when a task…

• Redteam Container Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized container and orchestration security testing, including Docker escape, Kubernetes privilege escalation, image vulnerabilities, and service mesh bypasses. Use when a task…

• Redteam Logic Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized business logic vulnerability testing, including race conditions, flow bypass, price tampering, permission logic errors, and bulk operation abuse. Use when a task belongs to the…

• Redteam Mobile Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use when a task belongs to the…

• Redteam Cmdi Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized operating system command injection testing, including direct injection, blind injection, out-of-band callbacks, and argument injection. Use when a task belongs to the command…

• Redteam Network Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized network-layer security testing, including exposed services, protocol downgrade, man-in-the-middle risks, and segmentation bypasses. Use when a task belongs to the network…

• Redteam Ad Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing…

• Redteam Recon Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized reconnaissance and information gathering, including subdomain enumeration, port scanning, directory discovery, fingerprinting, and OSINT. Use when a task belongs to the recon…

• Redteam Code Audit Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized source code security review, including dangerous function tracing, data-flow analysis, logic flaw detection, and dependency review. Use when a task belongs to the code audit…

• Redteam Auth Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized authentication, authorization, and session security testing, including password policy, JWT/token, OAuth, and MFA bypass issues. Use when a task belongs to the auth testing…

• Redteam Api Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain…

• Redteam Cache Poison Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to the cache poisoning domain…

• Redteam Cloud Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and…

• Redteam Evasion Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized defense evasion and bypass testing, including WAF bypass, AV/EDR evasion, logging considerations, and traffic obfuscation. Use when a task belongs to the evasion domain and…

• Redteam File Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized file operation vulnerability testing, including path traversal, arbitrary file read/write/upload, and LFI/RFI. Use when a task belongs to the file vulnerability domain and…

• Redteam Csrf Detail Pack

  by @Netw0rkNoob

  Domain routing and boundary guidance for authorized CSRF testing, including token bypasses, SameSite bypasses, and JSON CSRF. Use when a task belongs to the CSRF testing domain and needs scope, evidence, pivot, or exit criteria.

• Redteam Cve Lookup

  by @Netw0rkNoob

  CVE lookup and applicability assessment domain card. Use after reconnaissance has identified products, versions, services, or fingerprints and red-team mode needs evidence-based CVE matching before deeper testing.

• Redteam Web Detail Pack

  by @Netw0rkNoob

  Routing and boundary guidance for authorized general web application security testing. Use as a web testing router when the attack surface should be dispatched to more specific web vulnerability skills.

• Redteam Recon Intake

  by @Netw0rkNoob

  Recon intake skill for first contact with a bare domain, URL, or IP address. Use to build an initial recon_profile and provide factual inputs for CVE lookup and attack-path routing.

• Redteam Cve Validation

  by @Netw0rkNoob

  CVE validation domain card. Use after CVE lookup has produced applicable or candidate CVEs and red-team mode needs scoped evidence to decide whether to continue, pivot, or report.

• Cve Triage

  by @Netw0rkNoob

  CVE lookup and triage — map discovered services/versions to known CVEs via the cve_lookup tool, score by CVSS/exploitability, and prioritize what to verify first.

• Security

  by @markdown-viewer

  Create security architecture diagrams using PlantUML syntax with identity, encryption, firewall, and compliance stencil icons. Best for IAM flows, zero-trust models, encryption pipelines, and threat detection architectures.

• Doca Aes Gcm

  by @NVIDIA

  Use this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only…

• Amc Run Rtsp Calibration

  by @NVIDIA

  Calibrate a new dataset from live RTSP camera streams via the AutoMagicCalib REST API. Use when the user provides RTSP URLs or asks to calibrate live cameras; VIOS records clips, AMC ingests them, then runs calibration.

• Ctf Pwn

  by @ljagiello

  Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation,…

• Ctf Web

  by @ljagiello

  Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi,…

• Ctf Reverse

  by @ljagiello

  Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM,…

• Ctf Crypto

  by @ljagiello

  Provides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith,…

• Ctf Forensics

  by @ljagiello

  Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows…

• Ctf Misc

  by @ljagiello

  Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio…

• Ctf Malware

  by @ljagiello

  Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications,…

• Ctf Ai Ml

  by @ljagiello

  Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning,…

• Ctf Osint

  by @ljagiello

  Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback…

• Solve Challenge

  by @ljagiello

  Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious…

• Ctf Writeup

  by @ljagiello

  Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to document the solution steps, tools used, and lessons learned in a structured format.

• Yichen Codex Chatgpt

  by @mcncarl

  Use the signed-in ChatGPT website in Chat UI Pro mode, never Work mode, to research, architect, and review one local project through a configured Secure Tunnel and read-only MCP, while Codex alone edits and tests locally.…

• Yichen Grok Consult

  by @mcncarl

  Consult or search with xAI Grok from a GPT-led Codex conversation without switching the main model. Use when the user asks Grok to answer, review, challenge, compare, provide a second opinion, search the web, search X/Twitter,…

• Golang Continuous Integration

  by @samber

  GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release pipelines, Docker build/push,…

• Golang Security

  by @samber

  Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD…

• Golang Dependency Management

  by @samber

  Dependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated…

• Golang Design Patterns

  by @samber

  Idiomatic Golang design patterns — functional options, constructor APIs, `init()` and global-state avoidance, enums, panic vs error decisions, resource management and lifecycle, graceful shutdown, timeouts and retries, streaming…

• Golang Gopls

  by @samber

  Golang semantic code intelligence via `gopls`, the official Go language server — go-to-definition, find references, call/implementation hierarchy, workspace symbol search, package API discovery, diagnostics, safe rename,…

• Golang Database

  by @samber

  Comprehensive guide for Go database access — parameterized queries, struct scanning, NULLable columns, transactions, isolation levels, SELECT FOR UPDATE, connection pool, batch processing, context propagation, and migration…

• Golang How To

  by @samber

  Golang skills orchestrator — always active on any Golang coding, review, debug, or setup task. Reads the task context and loads the most relevant skills from samber/cc-skills-golang, often multiple at once: writing a gRPC…

• Golang Popular Libraries

  by @samber

  Golang library and framework selection — vetted production-ready options by category (web, database, testing, logging, messaging), new and experimental stdlib packages, standard-library-first tradeoffs, and maturity signals…

• Golang Safety

  by @samber

  Defensive Golang coding against accidental bugs — nil panics, typed-nil interfaces, `append` backing-array aliasing, silent int64-to-int32 truncation, float `==` comparison, `defer` inside loops, defensive copies of slices and…