twingate-dns-security
Twingate Internet Security — DNS filtering, exit networks, browser security, and DNS-over-HTTPS. Load when the user mentions DNS filtering, content filtering,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-20 00:13
Security & auditing
7,243 results
twingate-identity
Use when the user asks about IdP integration, SCIM provisioning, security policies, device trust, groups, users, or access control in Twingate. Activate for:…
entra-verified-id
Guidance for Microsoft Entra Verified ID — verifiable credentials issuance and verification platform based on open standards (W3C Verifiable Credentials, DIDs,…
using-backstage-permissions
Use when a Backstage plugin needs to gate UI behind permissions (frontend) or authorize actions in route handlers (backend). Covers createPermission, the…
agentic-actions-auditor
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not…
adinfo-enum
Use Adinfo for Active Directory information gathering. Use when you have obtained domain user credentials and need to quickly gather domain environment information. Adinfo is a fast AD information gathering tool; a single command outputs key information such as the domain controller list, domain admin users, trust relationships, GPOs, SPNs, delegation configurations, and more—far faster than manual LDAP queries. Use this skill for the first step of information gathering after discovering a domain environment.
ai-identity-security
AI system identity and permission security testing methodology. Triggered when the target system involves Agent identity authentication, multi-Agent permission management, role-setting security, session management, or MCP/API credential control. Coverage: role escape (assumed scenario/assumed role/forgetting method/goal hijacking), permission loss of control (Action privilege escalation/unauthorized MCP resource acquisition), multi-Agent...
apt-emulation
APT simulation and intelligence-driven red team methodology. Design red team action plans based on the TTPs (MITRE ATT&CK) of known APT groups. Use when it is necessary to simulate a specific threat group, design a high-fidelity attack exercise, or formulate an attack strategy based on threat intelligence
ccupp-password-profiler
Use ccupp to generate a weak password dictionary based on social engineering information. ccupp is the most complete password profiling tool for Chinese scenarios—input the target's name, birthday, phone number, ID card, and other information, and it automatically generates a password dictionary combining pinyin variants, date variants, and cultural numbers (520/1314/888). Use this skill when you need to perform targeted weak password brute-forcing against a target person, social engineering password guessing, or when a general weak password dictionary is insufficient and a customized dictionary is needed.
cdk-escape
Use CDK for container environment penetration and escape. Use when you have entered a container environment (Docker/K8s Pod) and need to assess escape possibilities, exploit container vulnerabilities, or perform in-container information gathering. CDK integrates container environment assessment, multiple escape techniques (privileged/mount/cgroup/lxcfs/runc/kernel vulnerabilities), and in-container lateral movement. Once you get a container shell...
disk-forensics-evasion
Disk forensics and anti-disk forensics methodology. Understand how the blue team recovers deleted files from disk, extracts timelines, and analyzes file system artifacts, and how the red team performs anti-forensics (secure deletion, timestamp tampering, trace removal). Use when needing to evade disk forensics or conduct disk analysis
exchange-attack
Microsoft Exchange mail server attack methodology. Use when an OWA (Outlook Web App) login page, Exchange admin panel, Exchange running on port 443, or an Exchange server on the internal network is discovered. When a port scan finds 25/443/587/993/995 with Exchange fingerprints...
iox-proxy
Use iox for port forwarding and intranet penetration. Use it when you need to forward an intranet port to the external network, establish a SOCKS5 tunnel, or do traffic relay. iox is a single-binary, zero-dependency port forwarding/proxy tool that supports forward proxy, reverse proxy, port mapping, and SOCKS5 proxy, and is especially suitable for building traffic tunnels in intranet penetration. Lighter than frp/nps, and compared to socat…
malware-analysis-methodology
Malware analysis methodology. Use when analyzing suspicious binaries (PE/ELF/Mach-O), malicious code in memory dumps, or samples of known malware families. Covers the full workflow of static analysis, dynamic analysis, code reverse engineering, and IOC extraction. Red team perspective: understand the detection surface to improve evasion
mapcidr-cidr
Use mapcidr for CIDR network segment processing. Use it when you need to expand CIDR into an IP list, aggregate IPs into CIDR, slice network segments, count IPs, or shuffle IP order. mapcidr is a CIDR processing tool produced by ProjectDiscovery, supporting IPv4/IPv6. Anything involving CIDR calculation, IP...
zombie-brute
Use zombie for multi-protocol brute force. zombie is a high-performance brute force tool produced by chainreactors, supporting 20+ protocols including SSH/FTP/MySQL/MSSQL/PostgreSQL/Redis/SMB/RDP/SNMP/LDAP/VNC, with built-in smart dictionary generation and distributed mode. With hydra…
incident-response
Professional skills and methodologies for security incident response
nft-blockchain
NFT display and blockchain interaction in Decentraland. NftShape (framed NFT artwork), wallet checks (getPlayer, isGuest), signedFetch (authenticated…
re-ai-attack
AI Model Security Assessment and Forensics (Behavioral Layer): extraction assessment (API black-box extraction assessment), fingerprint verification (behavioral fingerprinting and attribution verification), privacy leakage evaluation (membership inference/privacy leakage evaluation), robustness...
re-ebpf
eBPF program reverse engineering and adversarial analysis: BPF-64 instruction set, progs/maps association, bpftool disassembly, three uses: trace forensics / malicious samples / EDR countermeasures. Trigger words: eBPF, BPF, bpftool, bcc, libbpf, xlated, BPF instructions, bpf hook, EDR countermeasures, tracepoint, kprobe.
re-fp-runtime
Functional language runtime reverse engineering (Haskell/OCaml): closure/heap object model, calling conventions, data-flow-first strategy. Trigger words: Haskell reverse engineering, OCaml reverse engineering, GHC RTS, thunk, STG, OCaml runtime, closure, functional artifacts.
re-mips
MIPS architecture reverse engineering and router firmware analysis methodology: delay slots, $gp calling convention, endianness determination, httpd location. Trigger words: MIPS, mipsel, router firmware, embedded, delay slot, big-endian, big endian, little endian, httpd, busybox
re-nim
Nim compiled artifact reverse engineering: runtime identification, NimString structure, exception and GC paths. Trigger words: Nim reverse engineering, nim, NimString, NimMain, nim artifacts.
re-stego
Steganography detection and extraction: end-of-file appending, image LSB, audio and other carriers, extraction verification. Trigger words: steganography, stego, LSB, end-of-file appending, steganography extraction, image steganography.