All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,842
- 1,327
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 18,433–18,456 of 31,842 skills
- Security WebshellsWeb shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells. Use for security research and detection system testing.Votes: 0GitHub stars: 373
- Security UsernamesTop username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing.Votes: 0GitHub stars: 373
- Security PayloadsEssential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.Votes: 0GitHub stars: 373
- Security PatternsSensitive data patterns for security testing: API keys, credit cards, emails, SSNs, phone numbers, IPs, and more. Use for data discovery and validation.Votes: 0GitHub stars: 373
- Security PasswordsTop password lists for authorized security testing: common passwords, darkweb leaks, worst passwords. Curated essentials (<10MB).Votes: 0GitHub stars: 373
- Security FuzzingEssential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.Votes: 0GitHub stars: 373
- Llm TestingComprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.Votes: 0GitHub stars: 373
- Security DevsecopsDevSecOps, secure software development lifecycle (SSDLC), and application security (AppSec) practices covering secret handling, input validation, dependency hygiene, authentication/authorization, and CI/CD security tooling (SAST, SCA, DAST, secret scanning, IaC scanning). Use when writing code that handles credentials, user input, database queries, or authentication, when setting up a CI/CD pipeline, or when reviewing code or infrastructure for security issues.Votes: 0GitHub stars: 300
- Network TroubleshootingSystematic, safety-first diagnosis of developer network failures such as connection refused, DNS resolution errors, TLS certificate problems, proxy failures, and package registry timeouts. Use when a command fails with a network-shaped error (curl, npm, pip, git, docker), when a service is unreachable, or when the user asks to debug connectivity, DNS, TLS, or proxy issues.Votes: 0GitHub stars: 300
- Security Scanning Security HardeningCoordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.Votes: 0GitHub stars: 508
- Cmd SastSource code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast <repo_path> [--lang c|cpp|rust|java|python|go|php] [--min-score 4] [--max-files 30] [--skip-static] [--best-of N]Votes: 0GitHub stars: 815
- Cmd AnalyzeAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>Votes: 0GitHub stars: 815
- Agent Sast File RankerSource file attack surface ranker. Reads a repository, scores every source file 1-5 by exploitability. Outputs ranked JSON for per-file hunting. Use via /sast command.Votes: 0GitHub stars: 815
- Agent Sast Exploit BuilderBuilds working exploits from confirmed SAST findings. Takes a confirmed crash, develops it into a full exploit. Tier 1 (DoS) → Tier 5 (code execution). Use via /sast command after PoC confirmation.Votes: 0GitHub stars: 815
- Agent Sast Devils AdvocateAdversarial validator for SAST findings. Your ONLY job is to DISPROVE the candidate. Find every reason it's not exploitable. If you can't disprove it, it survives. Use via /sast command.Votes: 0GitHub stars: 815
- Agent Sast Danger MapperMaps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command.Votes: 0GitHub stars: 815
- Agent Report WriterSecurity report generation agent. Use for compiling findings into formal penetration test reports, executive summaries, technical write-ups, and bug bounty submissions. Provide the findings directory or list of vulnerabilities to document.Votes: 0GitHub stars: 815
- Agent Oauth HunterOAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT specialist. Dispatcher passes subtype — 'oauth', 'oidc', 'saml', or 'jwt' — in the task; falls back to inference. Use for redirect_uri / returnTo flaws, state/nonce/PKCE bypass, alg confusion (none/HS-with-RS-key/kid/jku), SAML XSW + comment injection + assertion replay, OIDC ID token validation gaps, code/token leak channels, cross-tenant impersonation, PKCE downgrade, and any flow involving a code, access_token, id_token, assertion, ...Votes: 0GitHub stars: 815
- Agent Js AnalyzerJavaScript static analysis agent for client-side security review. Use for analyzing JS bundles, finding hardcoded secrets, tracing DOM XSS source-sink flows, identifying postMessage handlers, extracting API endpoints, and reviewing client-side access controls. Provide URLs or local JS file paths.Votes: 0GitHub stars: 815
- Agent Info DisclosureInformation Disclosure specialist (H1 #18, CWE-200/209/215/538/668/798). Use for finding exposed sensitive data: stack traces, debug endpoints, config files, environment variables, API keys, .git/.env exposure, Spring Actuator surfaces, source code leaks. Standalone is feeder-class — must chain to be reportable.Votes: 0GitHub stars: 815
- Agent CorrelatorFinding correlation engine. Use AFTER multiple agents have reported findings to discover attack chains. Combines individual findings into higher-impact chains (e.g., open redirect + CORS + SSRF = token theft). Run periodically or before final reporting.Votes: 0GitHub stars: 815
- Agent Config AuditorSecurity header and server configuration auditor. Use for HTTP security header analysis, CSP evaluation, CORS policy review, TLS configuration assessment, cookie security, and server hardening checks. Provide target URL or list of URLs.Votes: 0GitHub stars: 815
- Agent Auth TesterAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.Votes: 0GitHub stars: 815
- Sicurezza GithubAggiunge alle repository GitHub workflow di sicurezza automatici - scansione dipendenze vulnerabili, ricerca di segreti nel codice, analisi statica CodeQL e Dependabot. Trigger - "sicurezza repo", "scansione repository", "dependabot", "secret scanning". EN - Adds automated security workflows to GitHub repositories - vulnerable dependency scanning, secret/key detection in code, CodeQL static analysis and Dependabot. Triggers - "repo security", "security GitHub Actions", "repository scanning", ...Votes: 0GitHub stars: 4