implementing-zero-knowledge-proof-for-authentication
Implements the Schnorr identification protocol and a simplified Zero-Knowledge Password Proof (ZKPP) over the discrete logarithm problem, letting a prover…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-20 00:13
Security & auditing
7,234 results
gemini-cli-security
AI-powered code vulnerability analysis and dependency scanning using Gemini CLI security extension patterns. Detects hardcoded secrets, injection attacks, weak…
medusa-security
AI-first security scanning with Medusa. 3,000+ detection patterns covering AI/ML, agents, MCP, RAG, prompt injection, and traditional SAST vulnerabilities.…
computer
Computer connector for exposing local services to remote sandboxes via authenticated ngrok tunnels. Use when user mentions "computer use", "tunnel", "ngrok",…
smart-contract-auditor
Elite security researcher who hunts vulnerabilities in smart contracts. Has found critical bugs worth millions in TVL. Specializes in reentrancy, access…
iso-27001-evidence-collection
Collect, organize, and validate evidence for ISO 27001 and SOC 2 audits. API-first approach with CLI commands for major cloud platforms. Produces timestamped,…
nemo-guardrails
NVIDIA's runtime safety framework for LLM applications. Features jailbreak detection, input/output validation, fact-checking, hallucination detection, PII…
qms-audit-expert
Senior QMS Audit Expert for internal and external quality management system auditing. Provides ISO 13485 audit expertise, audit program management,…
review-hog-perspective-contracts-security
The Contracts & Security review perspective for PostHog Review. Verifies that changed code is safe and maintains compatibility: API contracts and breaking…
review-hog-validation-criteria
The validation criteria for PostHog Review, the bar for deciding whether a flagged PR issue is worth keeping. Keeps real, user-affecting correctness / security…
broken-access-control
Security testing skill for A01:2025 Broken Access Control — the #1 OWASP risk for two consecutive cycles. Use this skill whenever the user asks about: access…
email-forensics
Analyze email messages and mailbox data for forensic investigation. Use when investigating phishing attacks, business email compromise, insider threats, or any…
skill-audit
Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust.
auth-module-architecture
Use when handling the BK-CI Auth module, for example RBAC permission checks, user groups and resource management, IAM integration, authorization migration, and OAuth2 authentication. Prefer this when the user wants to change the permission platform implementation rather than a one-off permission model change.
hipaa-compliance
Technical safeguards and architectural patterns for building HIPAA-compliant software on AWS. Use when building healthcare SaaS, handling PHI (Protected Health…
analyzing-dotnet-assemblies
Reverse engineer .NET assemblies and executables with dnSpyEx, ILSpy, and de4dot — identifying and unwrapping obfuscators and packers, deobfuscating control…
security-threat-model
Create a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit…
bloodhound-enum
Use BloodHound.py for Active Directory information gathering. Use when you need to enumerate domain users, groups, computers, sessions, ACLs, trust relationships, and analyze attack paths within the domain. BloodHound.py is the Python collector for BloodHound, which gathers AD data via the LDAP/DNS/Kerberos protocols and outputs…
ctf-misc
CTF miscellaneous challenge techniques. Use when encountering CTF challenges that do not belong to pwn/crypto/web/reverse/forensics/osint, such as encoding puzzles, Python/Bash sandbox escapes, RF/SDR signals, game/VM reverse engineering, K8s RBAC, floating-point tricks, Z3 constraint solving, game theory, etc. First rule out other categories before using this skill
ctf-osint
CTF open-source intelligence (OSINT) techniques. Use when a challenge requires finding clues from public information—such as tracking an identity given a username/email, geolocating given a photo, or recovering data from historical web snapshots. Covers social media investigation, Google Dorking, reverse image search, Wayback Machine, DNS reconnaissance, Tor relay queries, metadata extraction
ctf-solve
CTF comprehensive challenge-solving orchestrator. Use when facing a CTF challenge of unknown type and needing to automatically analyze the challenge type and choose the correct solving path. Automatically dispatches the corresponding specialized skill (pwn/crypto/web/reverse/forensics/osint/malware/misc), suitable for scenarios where a challenge file or service endpoint is given but it is unclear which category it belongs to.
ctf-source-audit
Source code audit methods in CTF challenges. Use when discovering a .git directory, .bak/.zip backups, or source code leakage via /proc/self/environ. Different from real code auditing—vulnerabilities in CTF source code are intentionally placed, usually with only 1-2 key points. First find dangerous functions (sinks), then trace the path from the input (source) to that function. Covers…
code-vuln-audit
Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL…
shodan-reconnaissance
This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using…