application-inspector
Run Microsoft Application Inspector for technology profiling and security feature detection. Use when analyzing technology stack, finding crypto/auth patterns,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-23 00:13
Security & auditing
7,323 results
codeql
Run CodeQL static analysis for security vulnerability detection, taint tracking, and data flow analysis. Use when asked to scan code with CodeQL, write QL…
content-security-policy
Analyze Content-Security-Policy headers for misconfigurations and bypass risks. Use when reviewing CSP from raw strings, URLs, or domains.
data-validation-pattern
Security pattern for input validation and sanitization. Use when implementing input handling, preventing injection attacks (SQL, XSS, command), ensuring data…
dom-clobbering-anti-pattern
Security anti-pattern for DOM Clobbering vulnerabilities (CWE-79 variant). Use when generating or reviewing code that accesses DOM elements by ID, uses global…
insecure-defaults-anti-pattern
Security anti-pattern for fail-open defaults (CWE-1188). Use when reviewing code that uses fallback values for secrets, credentials, or security settings.…
integer-overflow-anti-pattern
Security anti-pattern for integer overflow vulnerabilities (CWE-190). Use when generating or reviewing code that performs arithmetic on user-controlled values,…
limit-request-rate-pattern
Security pattern for implementing rate limiting and throttling. Use when protecting against brute-force attacks, DoS/DDoS mitigation, preventing resource…
message-authentication-code-pattern
Security pattern for implementing Message Authentication Codes (MACs) to ensure data integrity and origin authentication. Use when implementing HMAC, CMAC, or…
oauth-security-anti-pattern
Security anti-pattern for OAuth implementation vulnerabilities (CWE-352, CWE-287). Use when generating or reviewing OAuth/OIDC authentication flows, state…
opaque-token-based-authentication-pattern
Security pattern for server-side token authentication (e.g., session IDs). Use when implementing session management, designing stateful authentication where…
opengrep
Run Opengrep static analysis for fast security scanning with open-source rules. Use when scanning with truly open-source SAST, avoiding proprietary rule…
osv-scanner
Run Google OSV-Scanner for Software Composition Analysis (SCA) and vulnerability detection in dependencies. Use when scanning package manifests, lock files,…
redos-anti-pattern
Security anti-pattern for Regular Expression Denial of Service (CWE-1333). Use when generating or reviewing code that uses regex for input validation, parsing,…
sarif-tools
Process, analyze, and transform SARIF files using Microsoft's sarif-tools CLI. Use when consolidating SARIF outputs from multiple scanners, generating…
transparent-encrypted-storage-pattern
Security pattern for full-disk or database-level encryption at rest. Use when implementing Transparent Data Encryption (TDE), full-disk encryption, or when…
type-confusion-anti-pattern
Security anti-pattern for type confusion vulnerabilities (CWE-843). Use when generating or reviewing code in dynamic languages that compares values, processes…
unicode-security-anti-pattern
Security anti-pattern for Unicode-related vulnerabilities (CWE-176). Use when generating or reviewing code that handles usernames, displays text, validates…
unrestricted-file-upload-anti-pattern
Security anti-pattern for unrestricted file upload vulnerabilities (CWE-434). Use when generating or reviewing code that handles file uploads, processes…
qiaomu-ai-access
Use this qiaomu skill workflow when the user wants to check whether their local or browser environment looks like a China user before accessing AI models,…
blockchain-engineer
Use when architecturalizing protocols, developing smart contracts, or auditing security for blockchain systems.
skill-security-checklist
Trigger: security audit, codebase review, technical debt assessment, architecture analysis. Comprehensive audit of any codebase detecting frameworks,…
vulnerability-assessor
Assess identified vulnerabilities for exploitability, impact, and risk. Provide CVSS scoring and remediation strategies. Use when analyzing security findings.
axiom-file-protection-ref
Use when asking about 'FileProtectionType', 'file encryption iOS', 'NSFileProtection', 'data protection', 'secure file storage', 'encrypt files at rest',…