purview-insider-risk-management
Guidance for Microsoft Purview Insider Risk Management (IRM) — detect, investigate, and act on risky user activity (data theft by departing employees,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-20 00:13
Security & auditing
7,250 results
firmware-analysis
Firmware security analysis methodology. Covers firmware acquisition (from device/download/UART/JTAG), firmware unpacking and filesystem extraction (binwalk/firmware-mod-kit), static analysis (hardcoded credentials/encryption keys/backdoors), dynamic analysis (QEMU emulation), vulnerability discovery, firmware modification and repackaging. When an Agent needs to analyze embedded device firmware, extract sensitive information from firmware, or perform IoT…
gau-urlfetch
Use gau to collect known URLs of the target domain from historical data sources. Use when you need to discover the target's historical URLs, hidden endpoints, parameters, and API paths. gau aggregates four major data sources: Wayback Machine, Common Crawl, OTX, and URLScan. This skill should be used in any scenario involving URL collection, attack surface discovery, parameter discovery, or historical page collection.
k8s-ingress-nightmare
IngressNightmare (CVE-2025-1974) — Kubernetes Ingress-NGINX Admission Controller Unauthorized RCE. When the target K8s cluster uses ingress-nginx, an admission webhook on port 443/8443 is discovered, or via Pod…
masscan-scan
Use masscan for ultra-large-scale high-speed port scanning. Use when scanning large CIDR ranges or internet-wide scans. masscan is an asynchronous stateless scanner with speeds reaching millions of packets per second, suitable for large-scale asset discovery. Requires root privileges. This skill should be used in any scenario involving large-scale network segment scanning, high-speed port discovery, or internet mapping
nxc-cme
Use NetExec (nxc) / CrackMapExec (cme) for batch operations on Windows/AD networks. Use when you need to batch-validate credentials, password spray, execute remote commands, enumerate shares, or dump credentials. nxc is the successor to CrackMapExec, supporting SMB/WinRM/LDAP/MSSQL/SSH/RDP/FTP/WMI…
padbuster-padding-oracle
Use PadBuster for Padding Oracle attacks. Use when a web application is found to use CBC mode encryption and a Padding Oracle vulnerability exists. PadBuster can automatically decrypt ciphertext and forge valid ciphertext corresponding to arbitrary plaintext, and is suitable for encrypted Cookie/Token/URL parameters. Any involving Padding Oracle…
responder-poison
Use Responder for LLMNR/NBT-NS/MDNS poisoning and NTLMv2 hash capture. Use it when in a Windows domain network, when you need to passively capture credentials or perform a man-in-the-middle attack. Responder listens for name resolution broadcast requests (LLMNR/NBT-NS/MDNS) on the network, forges responses to trick the target into sending NTLMv2...
white-hat
Build defensive security capabilities, implement security by design, and practice ethical hacking to protect systems proactively
gpc-security
Use when dealing with GPC credential security, secret management, audit logging, or access control. Make sure to use this skill whenever the user mentions…
top-web-vulnerabilities
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability…
1password-environments
Manage 1Password Developer Environments and local .env mounts through the local 1Password MCP server, without exposing secret values. Use when the user asks to…
cloud-security-audit
Professional skills and methodology for cloud security auditing
owasp
Security review requiring judgment about exploitability: injection and input handling, authentication and session management, authorization, secret storage and…
blink-auth
Authentication with managed and headless modes. Social providers, email/password, magic links, RBAC.
code-security-audit
Performs OWASP-based code security audits on any codebase. Analyzes source code against ASVS 5.0.0 verification requirements, API Security Top 10 2023 risk…
bash-automation
Bash scripting for security automation. One-liners, enumeration, post-exploitation. Use for quick scripts and automation tasks.
globalize-now-account-setup
Install the Globalize CLI, authenticate, and verify your organization. Use this skill when the user asks to set up Globalize, install the Globalize CLI, sign…
env-secret-detector
Detect env secret detector operations. Auto-activating skill for Security Fundamentals. Triggers on: env secret detector, env secret detector Part of the…
oauth2-flow-helper
Configure with oauth2 flow helper operations. Auto-activating skill for Security Fundamentals. Triggers on: oauth2 flow helper, oauth2 flow helper Part of the…
password-strength-analyzer
Analyze password strength analyzer operations. Auto-activating skill for Security Fundamentals. Triggers on: password strength analyzer, password strength…
penetration-test-planner
Plan penetration test planner operations. Auto-activating skill for Security Advanced. Triggers on: penetration test planner, penetration test planner Part of…
vulnerability-report-generator
Generate vulnerability report generator operations. Auto-activating skill for Security Advanced. Triggers on: vulnerability report generator, vulnerability…
audit-security
Audit and fix app code against OWASP (injection, headers, dependencies). Use when "review security" or "check vulnerabilities". Auth gates → audit-auth-flows.…