factory-review
Reviews pull requests to the factory Worker for correctness, Workers-platform pitfalls, and credential hygiene.
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-27 00:15
Security & auditing
7,499 results
workos-migrate-auth0
Migrate to WorkOS from Auth0.
workos-migrate-aws-cognito
Migrate to WorkOS from AWS Cognito.
workos-migrate-clerk
Migrate to WorkOS from Clerk.
workos-migrate-descope
Migrate to WorkOS from Descope.
workos-migrate-firebase
Migrate to WorkOS from Firebase.
workos-migrate-supabase-auth
Migrate to WorkOS from Supabase Auth.
asgardeo
Asgardeo (WSO2 Identity Platform) work through the `asg` CLI. Use for any task that runs `asg` or touches an Asgardeo org, including a single user, app or role…
bugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity…
hunt-ato
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host header injection redirects token to attacker,…
hunt-cache-poison
Hunting skill for cache poison vulnerabilities. Built from 4 public bug bounty reports. Use when hunting cache poison on any target.
hunt-cloud-misconfig
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed…
hunt-dispatch
Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when…
hunt-idor
Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
hunt-mfa-bypass
Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2)…
hunt-ssrf
Hunting skill for ssrf vulnerabilities. Built from 9 public bug bounty reports. Use when hunting ssrf on any target.
meme-coin-audit
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority,…
mid-engagement-ir-detection
Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those…
report-writing
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula,…
triage-validation
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain…
web2-recon
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau),…
web3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan,…
security-audit
Defensive web and web-application security auditing for local projects, localhost, staging, and authorized public/private websites. Use when the user asks to…
build-cloudflare-access-sso
Use if protecting a subdomain with Cloudflare Access + Google SSO, or locking an origin against Access bypass.