All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,231
- 1,218
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,121–3,144 of 29,231 skills
- Browser GotoDrive PWN::Ai::Agent::Tools::BrowserGoto from pwn_eval.Votes: 0GitHub stars: 86
- Task DagDrive PWN::AI::Agent::TaskDAG from pwn_eval.Votes: 0GitHub stars: 86
- Skill ReviewDrive PWN::AI::Agent::SkillReview from pwn_eval.Votes: 0GitHub stars: 86
- MissionDrive PWN::AI::Agent::Mission from pwn_eval.Votes: 0GitHub stars: 86
- ConfirmationDrive PWN::AI::Agent::Confirmation from pwn_eval.Votes: 0GitHub stars: 86
- Kernel Pwn TriageUse when triaging kernel bugs. Debugger and REDB first.Votes: 0GitHub stars: 86
- HumanizerHumanize text: strip AI-isms and add real voice.Votes: 0GitHub stars: 86
- Heap ExploitationUse when exploiting glibc heap. Debugger and REDB steps for tcache.Votes: 0GitHub stars: 86
- Firmware Unpack EmulateUse when unpacking firmware. REDB on extracted bins.Votes: 0GitHub stars: 86
- Browser ExploitationUse when attacking browsers. Proxy plus Debugger.Votes: 0GitHub stars: 86
- Soc2 ComplianceUse when preparing a SaaS company for a SOC 2 Type I or Type II audit: Trust Service Criteria mapping, control matrices, gap analysis and evidence collection. Also covers readiness checklists, vendor management and continuous compliance. Framework playbook; for the auditor org role across SOC 2, ISO 27001 and HIPAA see compliance-auditor.Votes: 0GitHub stars: 21
- Security ReviewerUse when conducting a security audit or pentest: SAST, dependency and secrets scans, manual auth and crypto review, and a severity-rated report. Tools include Semgrep, Bandit, Gitleaks, npm audit and Trivy, plus infrastructure and cloud checks; requires scoped authorization. For an in-flight coding checklist use security-review.Votes: 0GitHub stars: 21
- Security ReviewUse when adding auth, user input, file uploads, secrets, API endpoints or payment features: a pass/fail security checklist with TypeScript patterns. Covers secrets in env vars, Zod validation, SQL injection, XSS, CSRF, rate limiting and data exposure. A developer checklist; for full audits and pentest reports use security-reviewer.Votes: 0GitHub stars: 21
- Security AuditorUse when an org role acts as security auditor and must assess existing code and systems for exploitable vulnerabilities, rate severity, and re-test fixes. Covers OWASP and CWE checklists, auth and IDOR testing, SAST/SCA/secrets scanning and scoped audits. For smart contracts, use blockchain-auditor.Votes: 0GitHub stars: 21
- Security ArchitectUse when an org role acts as security architect and must design security in before build: threat models, trust boundaries, zero-trust and authn/authz patterns. Covers STRIDE, least privilege, defense in depth, secrets architecture, OIDC and mTLS, and ADRs for security controls.Votes: 0GitHub stars: 21
- Secure Code GuardianUse when implementing security controls in code: auth and authorization, password hashing, parameterized SQL, input validation, CORS and CSP headers, JWTs. Workflow of threat model, implement, validate against OWASP Top 10 with checkpoints, plus TypeScript examples (bcrypt, Zod, Helmet). Implementation-focused, not an audit.Votes: 0GitHub stars: 21
- Production AuditUse when asking whether an app is production-ready or what breaks in prod, as a pre-launch or post-merge audit built only from local evidence. Checks release surface, recent changes, auth, data, payments, CI, migrations and rollback, then gives a ship/block call. Not a formal compliance audit.Votes: 0GitHub stars: 21
- Intent Driven DevelopmentUse when a feature or high-risk change (auth, data, migration, external API) needs scoped, verifiable acceptance criteria before or alongside implementation. Produces Quick Capture or Full Acceptance Briefs with AC-NNN criteria and handles revisions; lighter-weight and risk-scaled compared with spec-driven-workflow.Votes: 0GitHub stars: 21
- Adversarial ReviewerUse when you want a deliberately hostile code review in which three personas must each find issues. Saboteur, New Hire and Security Auditor findings end in a BLOCK, CONCERNS or CLEAN verdict; built to break agreeable self-review.Votes: 0GitHub stars: 21
- X ApiX/Twitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.Votes: 0GitHub stars: 17
- Security Bounty HunterHunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.Votes: 0GitHub stars: 17
- Quarkus SecurityQuarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.Votes: 0GitHub stars: 17
- Prediction Market Risk ReviewReview prediction-market, basket, oracle, and trading-agent workflows for compliance, safety, data-quality, privacy, and execution risk. Use before any workflow handles venue auth, user portfolio data, API keys, or trade planning.Votes: 0GitHub stars: 17
- Opensource PipelineOpen-source pipeline: fork, sanitize, and package private projects for safe public release. Chains 3 agents (forker, sanitizer, packager). Triggers: '/opensource', 'open source this', 'make this public', 'prepare for open source'.Votes: 0GitHub stars: 17