All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,769
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 9,553–9,576 of 29,769 skills
- Protocol ReverseUse for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.Votes: 0GitHub stars: 8
- Netlify IdentityUse when the task involves authentication, user signups, logins, password recovery, OAuth providers, role-based access control, or protecting routes and functions. Use `@netlify/identity`. Never use `netlify-identity-widget` or `gotrue-js` — they are deprecated.Votes: 0GitHub stars: 8
- Neo4j Security SkillProgrammatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER),Votes: 0GitHub stars: 8
- Neo4j Graphql SkillBuild and configure a GraphQL API backed by Neo4j using @neo4j/graphql v7 (current) or v5 (LTS).Votes: 0GitHub stars: 8
- Neo4j Aura Provisioning SkillProvisions and manages Neo4j Aura instances via CLI (aura-cli v1.7+) or REST API.Votes: 0GitHub stars: 8
- Mixpanel AuthManage Mixpanel Headless authentication: check session state, list/add/use accounts, run OAuth login, switch projects/workspaces, manage targets, and check bridge credentials.Votes: 0GitHub stars: 8
- Llm Agent Security RedteamLLM and agent security red teaming with agentic-actions-auditor, supply-chain-risk-auditor, semgrep, codeql, and sarif-parsing. Use for prompt injection, tool misuse, data exfiltration, excessive agency, insecure output handling, supply-chain risk, retrieval poisoning, and OWASP LLM Top 10 style threat modeling.Votes: 0GitHub stars: 8
- Firmware Pentest固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。Votes: 0GitHub stars: 8
- Finding DiscoveryUse when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.Votes: 0GitHub stars: 8
- Docs GeneratorCreates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.Votes: 0GitHub stars: 8
- Digital ForensicsUse for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.Votes: 0GitHub stars: 8
- Deep Security ScanUse when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent discovery passes over one resolved scope with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run validation, attack-path analysis, canonical JSON completion, and generated reporting once. Do not use for PRs, commits, branch diffs, or working-tree diffs.Votes: 0GitHub stars: 8
- Cryptography EngineerExpert-thinking profile for Cryptography Engineer (applied crypto / protocol design & review / key management (HSM/KMS) / standards (NIST, IETF, FIPS 140-3) / PQC migration): Reasons from explicit threat models, vetted primitives, key hierarchy, and constant-time secret handling through STRIDE threat modeling, standards (RFC 8446 TLS 1.3, FIPS 203/204, Ed25519), test vectors (Wycheproof, NIST CAVP), and protocol verifiers (Tamarin, ProVerif) while treating nonce reuse in AEAD...Votes: 0GitHub stars: 8
- CryptographerExpert-thinking profile for Cryptographer (theoretical / applied / implementation & standards cryptography): Reasons from IND-CCA/EUF-CMA games and tight reductions through AES-GCM/RSA-OAEP/ECDSA, ML-KEM/ML-DSA (FIPS 203/204), ProVerif/Tamarin/EasyCrypt, dudect constant-time, CAVP/ACVP and FIPS 140-3 CMVP—not pure number theory or vuln fuzzing.Votes: 0GitHub stars: 8
- Computer Security ResearcherExpert-thinking profile for Computer Security Researcher (dry-computational / vulnerability, protocol, and empirical security research): Reasons from explicit threat models and CIA/STRIDE through AFL++/libFuzzer triage, ASan/KASAN oracles, ProVerif/Tamarin proofs, CVE/CWE/CAPEC taxonomies, CyberGym dual-execution benchmarks, Menlo/CVD ethics, and USENIX open-science artifact norms.Votes: 0GitHub stars: 8
- Code Review And QualityConducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.Votes: 0GitHub stars: 8
- ElectronZoom Meeting SDK for Electron desktop applications. Use when embedding Zoom meetings in an Electron app with the Node addon wrapper, JWT auth, join/start flows, settings controllers, and raw data integration.Votes: 0GitHub stars: 8
- Attack Path AnalysisUse when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.Votes: 0GitHub stars: 8
- Attack ChainUse for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.Votes: 0GitHub stars: 8
- Apollo RouterVersion-aware guide for configuring and running Apollo Router for federated GraphQL supergraphs. Generates correct YAML for both Router v1.x and v2.x. Use this skill when: (1) setting up Apollo Router to run a supergraph, (2) configuring routing, headers, or CORS, (3) implementing custom plugins (Rhai scripts or coprocessors), (4) configuring telemetry (tracing, metrics, logging), (5) troubleshooting Router performance or connectivity issues, (6) securing the graph with JWT, declarative field...Votes: 0GitHub stars: 8
- Api SecurityUse for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.Votes: 0GitHub stars: 8
- Agentic Actions AuditorAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline securit...Votes: 0GitHub stars: 8
- Trace Data FlowsUse when tracking how data enters, transforms, persists, and exits a system, or when investigating trust boundaries, validation gaps, and potential data exfiltration pathsVotes: 0GitHub stars: 2
- Simulate BehaviorUse when predicting how a system behaves under different conditions, testing "what if" scenarios for gate combinations, or comparing behavioral fingerprints across configurationsVotes: 0GitHub stars: 2