skill-08-security-audit
Performs Web3 security analysis including vulnerability detection, rug pull checks, and exploit monitoring. Use before interacting with unknown contracts or…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-27 00:15
Security & auditing
7,498 results
skill-10-identity-did
Manages decentralized identity including DIDs, verifiable credentials, ENS names, ZK-KYC, and on-chain attestations. Use for identity verification, name…
skill-15-mev-protection
Protects transactions from MEV via Flashbots, intent-based trading, sandwich attack mitigation, and TWAP orders. Use for high-value swaps, liquidations, or any…
cloud-security-prowler
Run Prowler for comprehensive cloud security posture assessment. Audits AWS, Azure, and GCP against CIS Benchmarks, PCI-DSS, HIPAA, GDPR, and other compliance…
cloud-security-scoutsuite
Run ScoutSuite for multi-cloud security auditing. Collects configuration data from AWS, Azure, GCP, Oracle, and Alibaba Cloud and generates an interactive…
dependency-confusion-detect
Run Confused and GuardDog to detect dependency confusion and typosquatting risks. Checks if internal package names exist on public registries and identifies…
iac-scan-tfsec
Run tfsec (now part of Trivy) to scan Terraform code for security misconfigurations. Deep HCL analysis with support for Terraform modules, variables, and…
license-scan-scancode
Run ScanCode Toolkit for comprehensive license and copyright detection. Identifies license types, copyright holders, and compliance obligations across…
sast-bandit
Run Bandit SAST scans on Python code. Detects common security issues like SQL injection, hardcoded passwords, exec usage, and insecure crypto.
sast-detekt
Run detekt static analysis on Kotlin code with security-focused rules. Detects hardcoded secrets, insecure crypto, and code quality issues affecting security.
sast-semgrep
Run Semgrep SAST scans on code. Supports 30+ languages with OWASP, security, and custom rulesets. Parses results and provides remediation guidance.
sca-npm-audit
Run npm audit for Node.js dependency vulnerability scanning. Built-in SCA for npm projects with automatic fix suggestions.
sca-osv-scanner
Run Google's OSV-Scanner for Software Composition Analysis. Scans lockfiles and SBOMs across all major ecosystems (npm, PyPI, Maven, Go, Cargo, NuGet,…
secure-coding-generate
Generate secure code following OWASP Secure Coding rules. Automatically detects the security domain and produces code with inline Rule ID citations (e.g.,…
kilo-security-review
Full-stack security review skill for Kilo CLI and OpenCode that produces pentest-grade reports with CVSS scores, HackerOne bug-bounty references, working…
vulnerability-scanner
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
bff-proxy-security-contracts
Use for pre-release security review or remediation when a frontend repository owns server-side BFF/API proxy code: Next.js API Routes or Route Handlers, Remix…
download-export-safety
Use when reviewing or implementing client-side export/copy flows: CSV/Excel downloads, JSON/text/blob file downloads, URL.createObjectURL lifecycle,…
payment-page-client-security
Use when reviewing checkout/payment pages for frontend-owned payment security: Stripe/Adyen/Braintree/Razorpay/PayPal hosted fields, iframes, redirects,…
github-dependabot-report
Generates a Dependabot security alerts report for walletconnect, reown-com, and walletconnectfoundation GitHub orgs. Groups alerts by team ownership (GitHub…
hubspot-security-queue
Summarizes the HubSpot security ticket pipeline queue. Shows all tickets, unassigned items, tickets by stage, and AI triage status. Use for security queue…
kong-exploit
Kong API Gateway and Konga management platform vulnerability exploitation and detection skills. Covers exploitation techniques for all known high-risk vulnerabilities in Kong, including: - CVE-2020-11710: Kong Admin API unauthorized access (<=2.0.3) - Kong Admin API SSRF proxy attack -…
ssti-detect
Rapid detection and engine identification of SSTI (Server-Side Template Injection) vulnerabilities. Use when user input is found reflected to the page, or when parameter names contain template/name/message/greeting. Only performs detection and engine determination; for specific exploitation, refer to ssti-methodology
astro-release-security
Review an Astro Changesets release PR for vulnerabilities that should block publication. Use for release-blocking security review of withastro/astro release…