security-audit-owasp-top-10
Performs comprehensive security audit of any codebase against OWASP Top 10 2025. Use when user asks for OWASP audit, OWASP Top 10 review, OWASP security check,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-21 00:11
Security & auditing
7,272 results
file-upload-methodology
Detection, bypass, and exploitation of arbitrary file upload. Use when the target has upload functionality (avatar, attachments, import), multipart forms, file management interfaces. Includes three-layer bypass of extension/Content-Type/Magic Bytes, .htaccess override, .user.ini+auto_prepend_file, image webshell secondary rendering bypass, ZIP decompression exploitation, upload path guessing methods
graphql-methodology
GraphQL API security testing. Use when a /graphql endpoint, POST JSON queries, GraphQL Playground/Explorer pages, or data/errors JSON structures in responses are discovered. Includes Introspection leakage, injection attacks, authorization bypass, nested query DoS
mobile-backend
Mobile App backend API security testing. Use when the target is a mobile application's backend interface, mobile API paths such as /api/v1/ are discovered, or the communication security between the App and the server needs to be tested. Covers API endpoint discovery, authentication mechanism testing, business logic vulnerabilities, and mobile-specific security issues
sql-injection-methodology
Complete methodology for SQL injection detection, exploitation, and bypass. Use when the target has form submission, login pages, search functionality, or data query interfaces. Includes POST parameter completeness checks, EXTRACTVALUE truncation pitfalls, and the full UNION/error-based/blind/sqlmap workflow
ssti-methodology
Detection, engine identification, and exploitation of Server-Side Template Injection (SSTI). Use when the target is a Flask/Jinja2/Django/Twig/Mako/Pug application, when user input is reflected, or when parameter names contain template/name/message/greeting. Phase…
auth-patterns
Use when implementing authentication. Use when storing passwords. Use when asked to store credentials insecurely.
binary-re
Analyzes ELF binaries, executables, and firmware images to understand behavior without source code; coordinates sub-skills binary-re:triage,…
alibabacloud-ecs-vpc-publicnetwork-troubleshoot
Use when an ECS instance cannot reach the internet, its public IP is unreachable, ping to the public network times out, a security group blocks public access,…
alibabacloud-security-health-check
Configuration baseline health check and remediation list generation for security products of Alibaba Cloud signed customers. Scans a total of 60 configuration items across four product categories: WAF 3.0 / SAS / CFW / DDoS, scores them on a 100-point scale across five dimensions: coverage rate / protection strength / response timeliness / compliance alignment / best practices, and outputs an HTML report + Excel remediation list + Markdown...
osprey-appraise
Precision project estimator that turns security audits and code assessments into professional proposals with scope, timeline, pricing, and deliverables. The…
dependency-audit
Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. Use when the user mentions…
authentication-authorization
Secure authentication and authorization with sessions, RBAC/ownership, server-side protection, cookies, and prevention of common failures. Use when implementing login, guards,…
exif_metadata_analyzer
The English introduction is being prepared.
code-quality-scan
Scan mobile app code quality and security against MASVS-CODE controls and MASTG tests. Use when checking for vulnerable dependencies, input validation issues,…
prompt-guard
Meta's 86M prompt injection and jailbreak detector. Filters malicious prompts and third-party data for LLM apps. 99%+ TPR, <1% FPR. Fast (<2ms GPU).…
cardano-cli-wallets-operator
Execute wallet operations: key generation, address building. Manual invoke only for safety.
tm7-threat-model
Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create,…
OWASP LLM Security
LLM-specific security controls, prompt injection prevention, OWASP LLM Top 10
security-check
Security audit for web applications based on OWASP Top 10 and common vulnerabilities. Use when auditing code for security issues, reviewing auth/authz, or…
firecrawl-security-basics
Secure Firecrawl identities, targets, request options, webhooks, untrusted content, retention, logs, and self-hosted exposure. Use when threat-modeling or…
mistral-security-basics
Threat-model Mistral credentials, untrusted content, model output, tools, files, and tenant access. Use when securing or reviewing an integration. Trigger with…
sentry-data-handling
Configure GDPR-compliant data handling, PII scrubbing, and data retention policies in Sentry. Use when implementing beforeSend filters, server-side data…
security-headers-audit
Use when reviewing HTTP security headers, checking a Content-Security-Policy, auditing CORS or HSTS configuration, evaluating X-Frame-Options or…