test-red-team
Red-team a running web, React Native, or Capacitor app. Use when "red team this app", "attack my app", "break it", "pentest the app", or "pre-launch…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-21 00:11
Security & auditing
7,271 results
security-scanner
Performs comprehensive OWASP Top 10:2025 security vulnerability analysis on any codebase. Use this skill whenever the user asks to: review code for security,…
implementing-syslog-centralization-with-rsyslog
Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation, generating server and client configuration files with…
implementing-zero-trust-with-hashicorp-boundary
Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller/worker setup, Vault-backed…
performing-initial-access-with-evilginx3
Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication…
performing-s7comm-protocol-security-analysis
Perform security analysis of Siemens S7comm and S7CommPlus protocols used by SIMATIC S7 PLCs to identify vulnerabilities including replay attacks, integrity…
kentucky-kppa
Kentucky Consumer Privacy Protection Act (KPPA) compliance. Effective January 1, 2026. Covers consumer rights, controller thresholds at 100,000 consumers,…
managing-consent-for-children
Guide for managing consent for children's personal data under GDPR Article 8 and COPPA. Covers parental consent mechanisms, age verification methods,…
multi-jurisdiction-matrix
Guides building a multi-jurisdiction privacy compliance matrix for organisations operating across multiple countries. Covers common requirements…
multi-state-compliance
Multi-state harmonized privacy compliance program. Common requirements matrix across all US state privacy laws, state-specific deltas, unified privacy program…
privacy-maturity-model
Guides privacy program maturity assessment using the AICPA/CIPT Privacy Maturity Model with five levels: Ad Hoc, Repeating, Defined, Managed, and Optimized.…
privacy-program-metrics
Guides privacy program effectiveness measurement including leading and lagging indicators, KPI definition, benchmarking methodology, executive reporting…
privacy-threshold-analysis
Guides the Privacy Threshold Analysis screening process to determine whether a full DPIA is required. Provides a quick-screen questionnaire, threshold criteria…
ping-foundation
Use when setting up, configuring, or administering any Ping Identity platform — PingOne, PingOne Advanced Identity Cloud (AIC), or Ping Advanced Identity…
diff-risk-review
Review the current git diff for correctness, security, and performance risks before you commit. Produces severity-ranked findings with the exact file:line and…
experimentersoftroll422-windows-filesystem-security
Windows filesystem security monitoring, access control, and encryption workflows using EaseFilter SDK with Rust bindings
spec-to-code-compliance
Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs…
enterprise-admin-permission-review
Design and audit enterprise admin permissions across RBAC, ABAC, custom roles, admin scopes, delegated administration, SSO/SCIM mappings, role requests,…
marketplace-fraud-review-queue-review
Design and audit marketplace fraud review queues across risk signals, seller/buyer behavior, payout holds, refund abuse, fake reviews, account takeover,…
deserialization-methodology
Insecure deserialization vulnerability exploitation. Use when Base64-encoded Cookie/parameters, Python pickle data, PHP serialized strings (O:4:...), or Java serialized data (rO0AB...) are found. Can directly achieve RCE
idor-methodology
IDOR Insecure Direct Object Reference and unauthorized access detection and exploitation. Use when predictable identifiers such as user_id, account, order number, filename, etc. appear in API/URL, or when testing horizontal privilege escalation (accessing others' data), vertical privilege escalation (a regular user obtaining admin administrator privileges), or endpoint privilege escalation. Covers ID enumeration, bypass techniques (parameter pollution/encoding/method switching), multi-step IDOR...
oauth-sso-attack
OAuth 2.0 / SSO / OpenID Connect authentication flow attacks. Use when the target has a "Sign in with Google/GitHub/WeChat" button, a redirect_uri parameter, an authorization_code flow, or a /.well-known/openid-configuration endpoint. Covers…
secrets-handling
Use when working with API keys, passwords, or credentials. Use when asked to hardcode secrets. Use when secrets might leak.
openclaw-admin
Fix, configure, tune, or troubleshoot OpenClaw. Use for config changes, security fixes, performance tuning, doctor --fix, or when openclaw-doctor flags issues…