the-consigliere
Use when needing impartial architectural advice, security audit, spec integrity review, or a second opinion — operates outside the chain of command with…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-20 00:13
Security & auditing
7,243 results
fix-code-vulnerability
Guidance for identifying and fixing security vulnerabilities in code. This skill should be used when asked to fix security issues, address CVEs or CWEs,…
Supply Chain Security
Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline…
opswat
OPSWAT integration. Manage data, records, and automate workflows. Use when the user wants to interact with OPSWAT data.
business-logic-testing
Use when testing application-specific workflow and business-rule flaws that scanners cannot find — price/quantity/parameter tampering, workflow and…
file-upload-and-ssrf
Use when testing file-upload handling, server-side request forgery (SSRF), and insecure deserialization — upload bypasses (type/extension/content, polyglots,…
security-testing
Use when you want to security-test, pentest, audit, or find vulnerabilities in an application you own or are authorized to test — entry point that confirms…
detecting-t1003-credential-dumping-with-edr
Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon…
evaluating-threat-intelligence-platforms
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII…
hunting-for-persistence-via-wmi-subscriptions
Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003) by monitoring the creation of WMI event filters, consumers, and…
implementing-siem-use-cases-for-detection
Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk,…
performing-oil-gas-cybersecurity-assessment
Conduct cybersecurity assessments of upstream, midstream, and downstream oil and gas operations, covering pipeline SCADA, refinery DCS, safety instrumented…
ai-privacy-impact-template
Provides combined DPIA and AI Act conformity assessment template with integrated risk scoring matrix. Covers GDPR Art. 35 DPIA elements, AI Act high-risk…
apec-cbpr-cert
Guides APEC Cross-Border Privacy Rules system certification process including self-assessment against the APEC Privacy Framework principles, accountability…
background-check-privacy
Manages privacy compliance for employee background checks including criminal record processing under Art. 10 GDPR, DBS checks (UK), national law variations,…
eprivacy-essential-cookies
Applying the ePrivacy Directive Article 5(3) strictly necessary exemption to classify cookies that do not require consent. Covers exemption criteria,…
skill-security-framing
URL validation and content sanitization for untrusted sources — use when handling external input safely
gravit-designer-unlocker-analysis
Analyze and understand potentially malicious software distribution repositories masquerading as legitimate design tools
cryptographic-failures
Detect, audit, and remediate A04:2025 Cryptographic Failures in Python web applications (FastAPI and Flask). Use this skill whenever the user asks about crypto…
Keycloak FastAPI Integration
This skill should be used when the user asks to "add Keycloak authentication", "implement OIDC", "configure SSO", "validate JWT token", "add role-based…
managing-vulnerabilities
Prioritize and drive remediation of a vulnerability backlog by real risk, not raw CVSS — combining severity with exploitation signals (EPSS, CISA KEV), asset…
mapping-attack-techniques
Navigate security work by MITRE ATT&CK tactic and technique — resolve a technique ID or name to the right skill, map a threat intel report or adversary…
securing-ai-systems
Assess and harden LLM applications and agentic systems against prompt injection, tool misuse, excessive agency, memory poisoning, RAG data leakage, and model…
triaging-security-alerts
Work a security alert queue to a defensible disposition — separating true positives from false positives and benign true positives, reasoning about base rates…