secure-ship
Security for vibe coders. Full PDPA 2024 + OWASP Top 10 compliance for any codebase. Covers enterprise-grade access control, SSRF prevention, SQL injection,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-23 00:13
Security & auditing
7,326 results
ssrf-prevention
Enterprise-grade Server-Side Request Forgery (SSRF) prevention for APIs, webhooks, URL previewers, importers, and fetch-by-URL features. Covers strict…
security-deep-scan
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path security scan. Run repeated independent…
security-fix-finding
Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch,…
security-scan
Use when the user asks for a security scan or review of a repository, a scoped path (package, folder, or submodule), or a Git-backed change set (pull request,…
security-triage-finding
Use when the user supplies existing security findings or vulnerability reports — SARIF results, CVE/GHSA or advisory text, scanner tickets, bug bounty reports,…
cloud-attack-methods
Cloud attacks: metadata API, S3/K8s, AWS/Azure/GCP identity privilege escalation, MinIO matrix, Alibaba Cloud FC, ChengZi SDK decryption. Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.
zero-day-discovery
0day autonomous discovery engine: variant analysis / patch gap / diffing / fuzzing / taint inference / N-day weaponization / hunter mindset. Use when public vulns not found and need to discover 0day or weaponize N-day.
security-best-practices
Implement security best practices for web applications and infrastructure. Use when securing APIs, preventing common vulnerabilities, or implementing security…
review-security-structure
Review owned or authorized code for security using structure-first evidence: AST/structure maps, call graphs, complexity, Source/Sink flow, and defensive…
agent-id-auth
DPoP-signed (RFC 9449) authenticated calls to Alien-aware services. Discover any Alien-aware service's manifest at /.well-known/alien-agent-id.json, render its…
alipay-payment-feedback
Alipay skill issue feedback. Use only when users encounter problems that cannot be solved while using the alipay-authenticate-wallet, alipay-pay-for-service, or alipay-pay-for-402-service skills. Trigger conditions: 1) The payment process repeatedly fails and cannot be fixed on its own; 2) The payment feature activation/authorization process is abnormal and retries are ineffective; 3…
appsec
Application-level security review: dependency manifests for known-vulnerable packages, missing HTTP security headers, permissive CORS configuration. Use when…
stripe-security-audit
Audits Stripe security posture -- API key hygiene, restricted keys, secret leakage, PCI scope, and webhook signature verification. Use when the user mentions…
aegis-configuration-hardening
Audit repositories for insecure defaults and hardening gaps across debug modes, exposed admin and actuator surfaces, CORS, security headers, cookie flags, TLS,…
aegis-supply-chain
Audits dependency manifests, lockfiles, vendored code, and CI/CD definitions for supply-chain weaknesses such as vulnerable or unmaintained components,…
nuke-deps
Use when dependencies need a planned audit or upgrade — "nuke deps", "update dependencies", "are our deps safe/outdated", "upgrade to v5" — vulnerable,…
b20-console
Inspect B20 token contract addresses on Base through B20 Console. Use this skill when a user asks whether a B20 contract is live, initialized, recognized by…
box-cli
Use the official Box CLI for Box command-line operations, reproducible shell automation, CLI authentication or troubleshooting, and bulk Box work. Do not use…
harness-update
Safely update Harness. With backups for peace of mind and safety. Use when user mentions '/harness-update', update harness, update version, or template updates. Do NOT load for: app updates,…
test-attack-technique
Tests and validates Stratus Red Team attack techniques by executing warmup, detonation, and cleanup phases with comprehensive validation. Validates cloud…
google-cloud-auth
Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default…
codex-sandbox
Run code in Codex fully isolated sandbox - network disabled, CWD only, Seatbelt/Docker isolation
cc-payment-callback-safety
Payment callback/webhook security checks to prevent callback forgery, replay attacks, and amount tampering.