All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,762
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 9,433–9,456 of 29,762 skills
- Pr Appsec ReviewSecurity review of a pull request in two independent halves — OWASP Top 10:2025 findings on the changed code, and STRIDE threats on the trust boundaries the change touches — each item marked as introduced by this change or pre-existing, written in the user's language (pt-BR by default). Use when the user runs /pr-appsec-review, or asks to review a PR, a diff, or a branch for security risk.Votes: 0GitHub stars: 2
- Appsec TestTurns one security finding into the test that proves it — a failing test in the project's own framework, written where the project keeps its tests, then optionally the minimal fix that turns it green. Written in the user's language (pt-BR by default). Use when the user runs /appsec-test, or asks to prove, reproduce, regression-test or fix a specific security finding or threat.Votes: 0GitHub stars: 2
- Appsec ProfileArchitecture profile of the project under review — the module map, the trust-boundary names, where the guard is, how tenancy is applied, what is public by declaration, and where validation, error handling, configuration and the test harness live — written to appsec/profile.md as claims every later run reads instead of re-deriving. Use when the user runs /appsec-profile, or asks to record or refresh the project's security architecture so the other commands stop reporting controls that already ...Votes: 0GitHub stars: 2
- App Stride ReportSTRIDE threat model of the project under review — system decomposition, a data-flow diagram with trust boundaries, and every threat per element with its attack path, current status and mitigation, written in the user's language (pt-BR by default). Use when the user runs /app-stride-report, or asks for a threat model, STRIDE analysis, attack surface review, or an assessment of the project's trust boundaries.Votes: 0GitHub stars: 2
- Web3 AuditSmart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.Votes: 0GitHub stars: 5,270
- Web2 ReconWeb2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.Votes: 0GitHub stars: 5,270
- Triage ValidationFinding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.Votes: 0GitHub stars: 5,270
- Security ArsenalSecurity payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.Votes: 0GitHub stars: 5,270
- Report WritingBug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.Votes: 0GitHub stars: 5,270
- Mobile PentestMobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent. Covers APK/IPA decompile for hardcoded secrets + hidden API endpoints + base URLs the web app never exposes, exported-activity and deeplink intent injection, WebView addJavascriptInt...Votes: 0GitHub stars: 5,270
- Meme Coin AuditMeme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, token_scanner.py automation, and real exploit examples from 2024-2025. Use for any token audit, rug pul...Votes: 0GitHub stars: 5,270
- Graphql AuditGraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.Votes: 0GitHub stars: 5,270
- Credential AttackPassword spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form / oauth / o365 / okta), rate-limit + lockout tactics, BBP legal guardrails, success detection, and the spray → authenticated /hunt chain pattern. Use when assessing whether credential attack is worth running on a target, picking the right mode, or recovering from common pitfalls.Votes: 0GitHub stars: 5,270
- Client ReverseClient-side request-signing and anti-bot token reversal for bug bounty — when a request carries a sign/sig/hmac/token/nonce/timestamp/X-Sensor header that Burp Repeater cannot replay, recover the signer just enough to reproduce the request outside the client. Packet-first staging (capture real request → prove replay works → only reverse if replay fails) across the locate→recover→runtime→validation→replay spine. Covers tracing backward from the signature field (writer→builder→entry→source), is...Votes: 0GitHub stars: 5,270
- Cicd SecurityCI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.Votes: 0GitHub stars: 5,270
- Bb MethodologyUse at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."Votes: 0GitHub stars: 5,270
- ArgusArgus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack), out-of-band confirmation of blind SSRF/XXE/SQLi/RCE/Log4Shell via interactsh, and an LLM red-team corpus (prompt-injection / jailbreak / system-prompt leak / exfil / indirect inje...Votes: 0GitHub stars: 5,270
- bug-bountyComplete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security t...Votes: 0GitHub stars: 5,270
- Agentic QaThis skill should be used whenever running or invoking a live QA walkthrough — e.g. "walk through ticket ABC-123", "verify this PR works end to end against staging" — via the interactive /agentic-qa:walkthrough command, an agent-invoked run through agentic-qa:qa-runner, or a direct Skill call. Carries the safety posture, evidence discipline, and escalation mechanism shared across every phase of the pipeline — the umbrella rules the phase-specific skills assume are already loaded.Votes: 0GitHub stars: 2
- zero-day-research-skillSystematic zero-day vulnerability research in source code and compiled binaries. Find bugs that scanners and AI training data have never seen. Based on Critical Thinking Bug Bounty Podcast Episode 166 and Eugene's methodology.Votes: 0GitHub stars: 11
- ParanoidWrite and review code as if it gets pentested tomorrow. Load this whenever code touches a trust boundary: authentication, authorization, user input, database access, secrets or environment variables, file uploads, outbound requests (fetch/webhooks), API or webhook endpoints, or anything that runs raw SQL/shell/HTML. Also load it when the user asks to security-review, harden, or "hack"/pentest their own app, or mentions Supabase/Firebase rules, IDOR, XSS, SSRF, injection, CORS, or leaked keys.Votes: 0GitHub stars: 19
- Vulnerability ScannerAdvanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.Votes: 0GitHub stars: 3
- Red Team TacticsRed team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.Votes: 0GitHub stars: 3
- Code Review ChecklistCode review guidelines covering code quality, security, and best practices.Votes: 0GitHub stars: 3