sca-osv-scanner
Run Google's OSV-Scanner for Software Composition Analysis. Scans lockfiles and SBOMs across all major ecosystems (npm, PyPI, Maven, Go, Cargo, NuGet,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-27 00:15
Security & auditing
7,536 results
secure-coding-generate
Generate secure code following OWASP Secure Coding rules. Automatically detects the security domain and produces code with inline Rule ID citations (e.g.,…
kilo-security-review
Full-stack security review skill for Kilo CLI and OpenCode that produces pentest-grade reports with CVSS scores, HackerOne bug-bounty references, working…
vulnerability-scanner
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
bff-proxy-security-contracts
Use for pre-release security review or remediation when a frontend repository owns server-side BFF/API proxy code: Next.js API Routes or Route Handlers, Remix…
download-export-safety
Use when reviewing or implementing client-side export/copy flows: CSV/Excel downloads, JSON/text/blob file downloads, URL.createObjectURL lifecycle,…
payment-page-client-security
Use when reviewing checkout/payment pages for frontend-owned payment security: Stripe/Adyen/Braintree/Razorpay/PayPal hosted fields, iframes, redirects,…
github-dependabot-report
Generates a Dependabot security alerts report for walletconnect, reown-com, and walletconnectfoundation GitHub orgs. Groups alerts by team ownership (GitHub…
hubspot-security-queue
Summarizes the HubSpot security ticket pipeline queue. Shows all tickets, unassigned items, tickets by stage, and AI triage status. Use for security queue…
kong-exploit
Kong API Gateway and Konga management platform vulnerability exploitation and detection skills. Covers exploitation techniques for all known high-risk vulnerabilities in Kong, including: - CVE-2020-11710: Kong Admin API unauthorized access (<=2.0.3) - Kong Admin API SSRF proxy attack -…
ssti-detect
Rapid detection and engine identification of SSTI (Server-Side Template Injection) vulnerabilities. Use when user input is found reflected to the page, or when parameter names contain template/name/message/greeting. Only performs detection and engine determination; for specific exploitation, refer to ssti-methodology
astro-release-security
Review an Astro Changesets release PR for vulnerabilities that should block publication. Use for release-blocking security review of withastro/astro release…
factory-review
Reviews pull requests to the factory Worker for correctness, Workers-platform pitfalls, and credential hygiene.
workos-migrate-auth0
Migrate to WorkOS from Auth0.
workos-migrate-aws-cognito
Migrate to WorkOS from AWS Cognito.
workos-migrate-clerk
Migrate to WorkOS from Clerk.
workos-migrate-descope
Migrate to WorkOS from Descope.
workos-migrate-firebase
Migrate to WorkOS from Firebase.
workos-migrate-supabase-auth
Migrate to WorkOS from Supabase Auth.
asgardeo
Asgardeo (WSO2 Identity Platform) work through the `asg` CLI. Use for any task that runs `asg` or touches an Asgardeo org, including a single user, app or role…
bugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity…
hunt-ato
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host header injection redirects token to attacker,…
hunt-cache-poison
Hunting skill for cache poison vulnerabilities. Built from 4 public bug bounty reports. Use when hunting cache poison on any target.
hunt-cloud-misconfig
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed…