implementing-log-integrity-with-blockchain
Builds an append-only log integrity chain using SHA-256 hash chaining, where each entry incorporates the previous entry's hash so tampering invalidates all…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-22 00:14
Security & auditing
7,294 results
implementing-security-information-sharing-with-stix2
Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and…
secure-endpoint
Put authentication, rate limiting, IP restrictions, header rules, or a custom response in front of an ngrok endpoint using a Traffic Policy, without changing…
blockchain-privacy
Expert in on-chain privacy technologies - ZK-SNARKs, ZK-STARKs, mixers, stealth addresses, ring signatures, and confidential transactions for building…
check-stripe
Audit Stripe integration: configuration, webhooks, subscription logic, security. Outputs structured findings. Use log-stripe-issues to create issues. Invoke…
stripe-audit
Comprehensive audit of existing Stripe integration. Checks configuration, code patterns, security, and business model alignment.
frontend-security-basics
Secure Solana frontends against phishing, bad prompts, and unsafe signing requests. Use for audits of wallet UX and dApp sites.
cred-omega
CISO operacional enterprise para gestao total de credenciais e segredos.
jwt
Implements JWT Bearer authentication for service-to-service and user authorization. Use when: Configuring authentication, creating authorization policies,…
telnyx-oauth-curl
Implement OAuth 2.0 authentication flows for Telnyx API access. This skill provides REST API (curl) examples.
telnyx-verify-go
Look up phone number information (carrier, type, caller name) and verify users via SMS/voice OTP. Use for phone verification and data enrichment. This skill…
telnyx-verify-java
Look up phone number information (carrier, type, caller name) and verify users via SMS/voice OTP. Use for phone verification and data enrichment. This skill…
telnyx-verify-ruby
Look up phone number information (carrier, type, caller name) and verify users via SMS/voice OTP. Use for phone verification and data enrichment. This skill…
security-audit
Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP…
accessible-authentication
Use when reviewing sign-in, sign-up, MFA, CAPTCHA, recovery, and re-auth flows. Evaluate the full authentication path, including error handling and backup…
blazor-auth-security
Authentication and authorization in Blazor with ASP.NET Core Identity, Entra ID, JWT, and policy-based auth
rendering-untrusted-content
Renders stored, authored, or imported content into HTML without shipping XSS — auditing every autoescape bypass (|safe, Markup, innerHTML), sanitizing Markdown…
concourse-tactics
Concourse CI penetration testing and exploitation. Use when a target is found running a Concourse CI instance, Fly CLI credentials or API Token are obtained, or there is a need to steal credentials from Concourse Pipelines or inject malicious tasks. Covers unauthorized access, Pipeline variable and private key theft, Job tampering, Resource...
database-tactics
Database service attack methodology. Use when database ports such as Redis (6379), MSSQL (1433), PostgreSQL (5432), MySQL (3306), MongoDB (27017), etc. are discovered. Covers unauthorized access, weak password brute forcing, command execution, file read/write, and privilege escalation. This skill should be used in any scenario involving database attacks, database privilege escalation, or database exploitation
dns-pentesting
DNS service (port 53) penetration testing methodology. Covers DNS service discovery and version identification, zone transfer testing (AXFR), subdomain enumeration, DNS cache reconnaissance, reverse queries, DNS tunnel detection, and known vulnerability exploitation. This Skill is triggered when an Agent scan finds port 53 open, needs to enumerate DNS records and subdomains, test zone transfers, or perform data transfer over DNS.
pop-pentesting
POP3 mail service (ports 110/995) penetration testing methodology. Covers POP3 service discovery, banner information extraction, credential brute forcing, email content extraction, and known vulnerability exploitation. This Skill is triggered when an Agent scan finds port 110 or 995 open, when the authentication strength of a mail service needs to be tested, when email content needs to be enumerated, or when a POP3 service vulnerability needs to be exploited.
portainer-tactics
Portainer post-exploitation methodology: authentication bypass via default credentials, user enumeration timing attack, Docker API privileged container escape RCE, host filesystem mount. When users mention Portainer vulnerabilities, Portainer RCE, Portainer...
postgresql-attack
PostgreSQL penetration testing and exploitation. Use when a target is found with port 5432 open, PostgreSQL allows remote connections, and data needs to be extracted from the database or command execution achieved. Covers unauthorized access, database enumeration and export, user credential extraction (pg_authid hashes), SQL injection variants, file reading (pg_read_file/COPY), command execution (COPY TO...
postgresql-pentesting
PostgreSQL database service (port 5432) penetration testing methodology. Covers PostgreSQL service discovery, default credential testing, database enumeration, file read/write (COPY/lo_import), command execution (RCE via UDF/extension), privilege escalation, known vulnerability exploitation. When an Agent scan discovers port 5432 open and needs to test PostgreSQL…