security-review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-19 00:11
Security & auditing
7,227 results
brakeman
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits,…
10duke
10Duke integration. Manage data, records, and automate workflows. Use when the user wants to interact with 10Duke data.
detectify
Detectify integration. Manage Organizations. Use when the user wants to interact with Detectify data.
jupiterone
JupiterOne integration. Manage data, records, and automate workflows. Use when the user wants to interact with JupiterOne data.
detecting-ransomware-encryption-behavior
Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to…
hunting-for-process-injection-techniques
Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event…
implementing-aqua-security-for-container-scanning
Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and…
implementing-cloud-security-posture-management
Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS…
implementing-rbac-hardening-for-kubernetes
Hardens Kubernetes RBAC by designing least-privilege Roles and ClusterRoles, auditing RoleBindings, eliminating cluster-admin sprawl, separating service…
api-credentials
Securely manages API credentials for multiple providers (Anthropic Claude, Google Gemini, GitHub). Use when skills need to access stored API keys for external…
code-security
Guides secure coding and security-focused code review across languages and infrastructure—OWASP-oriented vulnerability patterns (injection, XSS, auth, crypto,…
java-vuln-scanner
Java component version vulnerability detection tool. Scans third-party dependencies in pom.xml, build.gradle, or jar files, matches known vulnerability rules (CVE), and generates a vulnerability detection report. Suitable for: (1) Java project dependency security auditing, (2) identifying high-risk component vulnerabilities such as Log4j, Fastjson, Shiro, Spring, etc., (3) jar…
azure-security-keyvault-keys-java
Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify…
skill-sentinel
Audit and evolution of the skills ecosystem. Code quality, security, costs, gaps, duplications, dependencies, and health reports.
crypto-secrets
Audit application source code and configuration for cryptography and secrets hygiene issues: hardcoded API keys, committed .env files, private keys, weak…
infra-security
Audit Infrastructure-as-Code for security misconfigurations before it ships — Terraform (.tf/.tfvars/.hcl), CloudFormation/SAM (YAML/JSON), Kubernetes & Helm…
ad-domain-attack
Full attack chain for Active Directory domain environments. Use when the target host is in a domain environment (systeminfo shows Domain not WORKGROUP), ports 88/389/636 are discovered, or domain user credentials are obtained. Covers domain information gathering, user enumeration, Kerberoasting, AS-REP Roasting, delegation attacks, ACL...
ctf-reverse
CTF reverse engineering techniques. Use when challenges provide unknown binaries that require analyzing algorithm logic, game clients need cracking and verification bypass, obfuscated code needs restoring, or custom VMs need interpreted execution. Covers Ghidra/IDA static analysis, GDB/Frida dynamic debugging, anti-debugging bypass, and multi-platform reverse engineering for WASM/.NET/APK/Python bytecode/Go/Rust
red-team
Probe docs and skills. Use when: adversarially probing a doc, skill, plan, or claim for weaknesses, gaps, or unstated assumptions before it ships.
secret-scanning
Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.
zero-day
Deprecated name. Use vulnerability-research; load this notice only when zero-day is explicitly requested.
pentest-cloud-infrastructure
Cloud security posture management and container security assessment for AWS, Azure, GCP, and Kubernetes.
pentest-ctf-crypto
Cryptography tools for solving CTF challenges involving ciphers, hashing, and weak encryption.