sast-fileupload
Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-19 00:11
Security & auditing
7,224 results
sast-graphql
Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly…
sast-sqli
Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input…
mobile-app-security-testing
Professional skills and methodology for mobile application security testing
xss-vulnerability-scanner
Scan xss vulnerability scanner operations. Auto-activating skill for Security Fundamentals. Triggers on: xss vulnerability scanner, xss vulnerability…
china-kyc-doc-parse
Parse and extract data from Chinese identity documents for KYC (Know Your Customer) compliance. Adapts the original kyc-doc-parse skill for Chinese ID cards,…
cloudflare-api-shield
Cloudflare API Shield integration. Manage data, records, and automate workflows. Use when the user wants to interact with Cloudflare API Shield data.
fireeye
FireEye integration. Manage data, records, and automate workflows. Use when the user wants to interact with FireEye data.
detecting-cloud-threats-with-guardduty
Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, and…
detecting-qr-code-phishing-with-email-security
Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based…
hunting-for-data-exfiltration-indicators
Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to…
convex-helpers-patterns
Guide for convex-helpers library patterns including Triggers, Row-Level Security (RLS), Relationship helpers, Custom Functions, Rate Limiting, and Workpool.…
validation
Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings…
secknowledge-skill
Web+AI security testing knowledge base. Integrates WooYun 88,636 cases + Xianzhi L1-L4 methodology + GAARM 173 risks + OWASP Top 10 (LLM/ASI/WSTG). TRIGGER when the task is hands-on security testing: penetration testing, vulnerability discovery/exploitation, red team offense and defense, security auditing…
picoclaw-security-guardian
Picoclaw security posture skill with advisory awareness, configuration drift detection, and supply-chain verification guidance.
azure-identity-ts
Authenticate to Azure services with various credential types.
sast-idor
Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check…
sast-missingauth
Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the…
m365-oversharing
Guidance for remediating oversharing across Microsoft 365 (SharePoint, OneDrive, Teams, Exchange) using the Secure & Governed Data Foundation blueprint - a…
competition-zip-archive
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for ZIP and PKZIP archive challenges, legacy ZipCrypto identification,…
line-login
Comprehensive reference for LINE Login (OAuth 2.1) — authorization code flow, PKCE, token management, ID token JWT verification, user profiles, bot linking,…
form-security
Security patterns for web forms including autocomplete attributes for password managers, CSRF protection, XSS prevention, and input sanitization. Use when…
google-workspace-cli
This skill should be used when the user asks to "audit Google Workspace", "check GWS security settings", "set up Google Workspace authentication", "diagnose…
red
Residual re-identification RISK CHECK on text you have ALREADY redacted (defensive, dual-use). Use when the user asks to "check residual re-id risk", "red-team…