django-access-review
django-access-review
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-21 00:11
Security & auditing
7,270 results
data-subject-request-ops-review
Design and audit data subject request operations for access, export, correction, deletion, restriction, objection, consent withdrawal, identity verification,…
security-changelog-disclosure-review
Design and audit security changelog and disclosure operations covering vulnerability severity, exploitability, affected versions, remediation status, customer…
create-ocsf-mapping
Create OCSF mapping operators for a Tenzir parser package. Use when the user wants to map parsed events to OCSF, normalize security data to OCSF, or says "map…
security-review
MANDATORY for security-sensitive code changes - OWASP-based security review with dedicated checklist, required before PR for auth, input handling, API,…
hunt-firebase
Hunt Firebase / Firestore / GCP exploitation — Firebase API key discovery in JS bundles, anonymous auth via signUp endpoint, Firestore collection enumeration…
hunt-supabase
Hunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing…
hunt-tls-network
Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC…
recon-sector-expansion
Multi-sector batch domain expansion — identify untested/under-tested sectors, generate candidate company domains (national chains, franchises, regionals),…
redteam-mindset
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where…
scada-hikvision-isapi
Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.
sector-recon-methodology
Pick sectors, compile targets, batch recon for campaigns.
web3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan,…
wordpress-full-compromise
Use when verified WordPress findings may combine into an authorized path to administrative or server control.
xmlrpc-exploitation
Exploit XMLRPC multicall, pingback for brute force and SSRF.
xss-methodology
Detection, exploitation, and bypass of reflected/stored/DOM XSS. Use when a web application echoes user input (search/comments/forms/URL parameters), or when a stored content output point is discovered. Includes context analysis decision tree, WAF bypass techniques, CSP bypass methods, DOM Clobbering, mXSS, SVG XSS. Prioritize over other vulnerability tests—XSS…
defi-risk-assessment
Framework for evaluating DeFi protocol risk — smart contract audits, TVL analysis, governance structure, oracle dependencies, and token economics. Use when…
desktop-security-electron
Electron fuses, ASAR integrity, sandbox hardening, CSP, permission handling, navigation restrictions
analysis-tshark
Network protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line…
forensics-osquery
SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases. Enables rapid evidence…
webapp-nikto
Web server vulnerability scanner for identifying security issues, misconfigurations, and outdated software versions. Use when: (1) Conducting authorized web…
deserialization-testing
Professional skills and methodology for deserialization vulnerability testing
tech-prompt-engineering
Debug and harden production LLM prompts — handle prompt injection, output format drift, instruction forgetting in long contexts, and cross-model portability…
backdoor_test
Test skill for security scanning