verifying-build-provenance-with-slsa-sigstore
Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-19 00:11
Security & auditing
7,224 results
laravel-dependencies-trim-packages
Remove unneeded Composer packages and assets to improve boot time, memory, and security surface
authenticate-openant
Sign in to OpenAnt via key-based login (recommended) or email OTP. Use login --key then agents register for new agents. Use when the agent needs to log in,…
composer-upgrade
Guides PHP project upgrades using Composer commands. Use when helping users upgrade PHP packages, check for security vulnerabilities with `composer audit`,…
php-archive-extract-audit
PHP Web archive extraction (Zip Slip/path traversal) audit tool. Identify how extraction entry names are joined with the target directory and whether a base dir constraint is missing, and output exploitability grading, observable PoC, and remediation recommendations (omission prohibited).
php-exploit-chain-audit
PHP exploit chain/POP (rebound) chain aggregator. String together the various vulnerability reports already produced into a exploitability chain narrative according to "preconditions satisfied" (without adding a new evidence-point dictionary).
php-vuln-scanner
PHP component version vulnerability detection tool. Scans composer.json / composer.lock or jar/package metadata, matches known vulnerability rules and outputs a report (including a possible trigger point analysis framework).
web-app-security-audit
Use when testing a web application for security vulnerabilities, before deployment or during security review — guides through a structured 10-phase penetration…
spider-weave
Weave authentication webs with patient precision. Spin the threads, connect the strands, secure the knots, and bind the system. Use when integrating auth,…
ai-security
This skill should be used when the user asks to "scan AI systems for security threats", "check for prompt injection vulnerabilities", "assess model security…
secure-oauth-oidc
Design, implement, audit, test, troubleshoot, or migrate secure OAuth 2.0 and OpenID Connect (OIDC) systems using RFC 9700 / BCP 240. Use for authorization servers and OpenID Providers, OAuth clients and OIDC relying parties, resource servers, native apps, browser-based apps, multi-issuer login, redirect URIs, authorization code and PKCE flows, state and nonce handling, ID Token validation, token storage and replay, refresh-token rotation, sender-constrained tokens (DPoP or mTLS), mix-up and injection attacks, discovery and metadata, reverse proxies, or migration away from implicit and resource-owner-password grants.
input-sanitization
Input sanitization expert. Use for XSS prevention, encoding, validation, and security headers.
mqttx-cli
Use MQTTX CLI for MQTT connections, publishing and subscriptions, MQTT 5 features, TLS and SCRAM authentication, payload codecs and schemas, benchmarks,…
mitm-report
Generate a security vulnerability report. Use when user asks for a report, summary of findings, or formatted vulnerability documentation.
argocd-login
ArgoCD CLI auth with SSO and gRPC-Web. Use when the user mentions ArgoCD login, argocd authentication, SSO auth, or accessing ArgoCD applications and clusters.
solidity-security-audit
Comprehensive Solidity smart contract security auditing and vulnerability analysis skill. Based on methodologies from Trail of Bits, OpenZeppelin, Consensys…
anonyflow
AnonyFlow integration. Manage data, records, and automate workflows. Use when the user wants to interact with AnonyFlow data.
checkmarx
Checkmarx integration. Manage data, records, and automate workflows. Use when the user wants to interact with Checkmarx data.
correlating-threat-campaigns
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to…
executing-phishing-simulation-campaign
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs…
review-sui-contracts
Review Sui Move code that integrates OpenZeppelin Contracts for Sui against the library's own patterns and conventions. Use this when a developer wants their…
nerv-break-5.6-jailbreak
GPT-5.6 jailbreak framework with context reconstruction, real-time tamper engine, and cloud audit bypass for security research
nerv-break-jailbreak-framework
GPT-5.6 jailbreak framework using context reconstruction, real-time tamper engine, and MCP security tools for penetration testing and reverse engineering
arcgis-authentication
Implement authentication with ArcGIS using OAuth 2.0, API keys, and identity management. Use for accessing secured services, portal items, and user-specific…