iac-security-scan-skills
AI-powered Infrastructure-as-Code security scanner with attack chain analysis and multi-domain vulnerability detection
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-16 00:02
Security & auditing
5,619 results
privilege-escalation-methods
Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems.…
zk-proofs
Zero-knowledge proofs and privacy patterns on Stellar. Covers Groth16 verification in smart contracts via BLS12-381 host functions (CAP-59), the BN254 +…
pci-dss-compliance
Implement PCI DSS requirements for payment card data. Configure cardholder data environment and security controls. Use when processing payment cards.
analyzing-pdf-malware-with-pdfid
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening…
auth0-aspnetcore-authentication
Use when adding cookie-based login, logout, or user profile to an ASP.NET Core MVC, Razor Pages, or Blazor Server web app. Integrates…
fedramp-compliance
Implement FedRAMP requirements for federal cloud services. Configure NIST 800-53 controls and continuous monitoring. Use when providing cloud services to US…
sbom-supply-chain
Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies,…
ai-security-hardening
Harden AI/LLM deployments against prompt injection, data exfiltration, model theft, and supply chain attacks. Covers input validation, output filtering, access…
SQL Injection Testing
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection",…
analyzing-threat-actor-ttps-with-mitre-attack
Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify…
x-ray
Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis,…
testing-for-open-redirect-vulnerabilities
Identifies and exploits open redirect vulnerabilities by analyzing URL redirection parameters (next, url, redirect, return, goto), applying bypass techniques,…
flowdriver-covert-transport
Tunnel SOCKS5 traffic through Google Drive API requests to bypass restrictive networks and DPI inspection.
privacy-parser-pii-extraction
Extract structured PII spans from text using the OpenAI Privacy Filter 1.5B model reversed — returns what, where, and which type instead of masking.
flutter-security
Use when securing local storage with flutter_secure_storage, enforcing AES-256-GCM encryption, or adding biometric authentication gates.
supabase-best-practices
Supabase security and performance guidelines with Clerk authentication integration. Contains 40+ rules across 10 categories covering RLS policies, Clerk setup,…
red-team-engagement
Plan, scope, and execute an authorized red-team engagement — distinct from a penetration test. Covers engagement methodology, assumed-breach scenarios, ATT&CK…
llamaguard
Meta's 7-8B specialized moderation model for LLM input/output filtering. 6 safety categories - violence/hate, sexual content, weapons, substances, self-harm,…
analyzing-outlook-pst-for-email-forensics
Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata,…
1password
Set up and use 1Password CLI (op, one-password). Use when installing the CLI, enabling desktop app integration, signing in, selecting Peter's multi-account…
hardening-docker-containers-for-production
Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root…
top-web-vulnerabilities
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic…
testing-for-xxe-injection-vulnerabilities
Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration…