All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,807
- 1,326
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,441–19,464 of 31,807 skills
- Compliance ReviewBuild or review code for compliance with the EU AI Act, GDPR, the NIS2 Directive (EU 2022/2555), and secure-development (SSDLC) best practice. Three modes. REVIEW: audit a repo and produce an evidence-based gap analysis — triggers on "compliance review", "gap analysis", "NIS2 check", "is this repo GDPR compliant", "security audit of the code". DESIGN/BUILD: apply the same requirements as compliance-by-design guardrails while writing new code, then self-check — triggers on "build X with GDPR/A...Votes: 0GitHub stars: 3
- Preflight Security AuditThis skill should be used when the user wants a comprehensive pre-ship audit of an app, product, or codebase — phrases like "audit my app", "security check before launch", "is this ready to ship", "preflight audit", "review my product for vulnerabilities", "check my code for security issues", or after building a feature/product and wanting a thorough security, reliability, performance, privacy, and launch-readiness review. Covers OWASP Top 10 (2025), LLM Top 10, GDPR/KVKK, accessibility, SEO,...Votes: 0GitHub stars: 4
- VantageAutonomous, artifact-driven SAST (Static Application Security Testing) for web AND mobile app repositories, plus optional code-level remediation. Use whenever the user asks to security-review, pentest, audit, or scan a codebase for vulnerabilities — web (SQLi, XSS, IDOR/BOLA, auth bypass, SSRF, XXE, hardcoded secrets, vulnerable dependencies, business logic flaws) or mobile/Android/iOS (OWASP Mobile Top 10 2024: improper credential usage, insecure data storage, insecure communication, insuffi...Votes: 0GitHub stars: 4
- Xss DetectionDetect and prevent Cross-Site Scripting (XSS) vulnerabilities in web applications. Use when tasks involve testing for reflected, stored, or DOM-based XSS on systems you are authorized to test, scanning with dalfox, reviewing code for dangerous DOM sinks, implementing Content Security Policy, encoding output, sanitizing user input, or auditing web applications for injection vulnerabilities. Covers detection and remediation.Votes: 0GitHub stars: 155
- Ssrf DetectionFinds server-side request forgery (SSRF) risk in code that fetches a user-supplied URL, and fixes it with a tested URL-validation guard (scheme allowlist, DNS resolution against private/link-local ranges, connect-to-resolved-IP to close the DNS-rebinding gap). Use when reviewing a webhook, link-preview, image-import, PDF-generator or any feature that fetches an external URL server-side, or when hardening cloud metadata access (IMDSv2).Votes: 0GitHub stars: 155
- SshOpenSSH gives encrypted remote login, file transfer and port forwarding between machines. Use when a user asks to connect to a remote server, generate or install SSH keys, write ~/.ssh/config, reach hosts through a bastion with ProxyJump, create local, remote or SOCKS tunnels, harden sshd, or fix permission denied and host key errors.Votes: 0GitHub stars: 155
- SqlmapDetect and exploit SQL injection with sqlmap. Use when a user asks to test for SQL injection, extract database contents, bypass authentication via SQLi, automate injection testing, or dump database schemas.Votes: 0GitHub stars: 155
- SpiderfootSpiderFoot is an open-source OSINT automation tool whose 200+ modules profile a domain, IP address, e-mail address, username or name from public sources. Use when: running automated OSINT investigations on a target, correlating data across dozens of sources, building threat intelligence profiles, or mapping connections between entities.Votes: 0GitHub stars: 155
- SkipfishCrawl and probe a web application with SkipFish, a fast active security scanner that brute-forces paths from a dictionary, tests injection points and writes an HTML report. Use when a user asks to scan a web app they own for hidden directories, backup files, XSS, SQL injection or misconfigurations, or wants a quick dictionary-driven first pass before manual testing in Burp or ZAP. Unmaintained since 2012, so treat results as leads.Votes: 0GitHub stars: 155
- Security AuditScan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers the OWASP Top 10 (2025), dependency auditing, secrets detection, and generates fix recommendations with severity ratings.Votes: 0GitHub stars: 155
- SchemathesisSchemathesis automatically tests APIs by generating test cases from their OpenAPI or GraphQL schemas. Use when tasks involve API fuzzing, finding edge cases in REST or GraphQL APIs, testing schema compliance, generating property-based tests from API specs, finding crashes and 500 errors, or validating API contracts. Schemathesis generates thousands of test cases from the schema and finds bugs that manual testing misses.Votes: 0GitHub stars: 155
- PentagiPentAGI is a self-hosted, autonomous AI penetration-testing system: LLM agents plan and run security tools such as nmap and sqlmap inside sandboxed Docker containers and write a vulnerability report. Use when a user asks to automate security testing, set up autonomous pentesting, deploy an AI-driven vulnerability scanner, build a self-hosted security testing platform, or drive pentests through the PentAGI API. Only for systems the user is authorized to test.Votes: 0GitHub stars: 155
- Pci Dss ComplianceAchieve PCI DSS compliance for handling payment card data — scoping, controls, and SAQ selection. Use when storing, processing, or transmitting payment card data, building e-commerce security, or achieving payment processing compliance.Votes: 0GitHub stars: 155
- Owasp ZapOWASP ZAP (Zed Attack Proxy) is an open-source web application security scanner that crawls a site, passively inspects traffic and optionally attacks it to find XSS, SQL injection, missing security headers and other OWASP Top 10 issues. Use when configuring automated scans, running zap-baseline, zap-full-scan or zap-api-scan, adding security scanning to CI/CD or GitHub Actions, or triaging scan results. Trigger words: owasp zap, security scan, vulnerability scanner, penetration testing, zap-b...Votes: 0GitHub stars: 155
- Nuclei ScannerScans web applications and infrastructure for vulnerabilities with Nuclei, a template-based security scanner. Use when someone asks to "scan for vulnerabilities", "security scan my website", "Nuclei scanner", "find CVEs", "automated security testing", "vulnerability assessment", or "check for misconfigurations" on systems they own or are authorized to test. Covers template scanning, custom templates, CI integration, and severity-based reporting.Votes: 0GitHub stars: 155
- Nmap ReconNmap is the standard open-source network scanner for finding live hosts, open ports, service versions and operating systems. Use this skill when a user asks to scan a network or host they are authorized to test, discover hosts, find open ports, enumerate service versions, run NSE scripts, save results as XML, or do initial reconnaissance for a penetration test.Votes: 0GitHub stars: 155
- NiktoScan web servers for vulnerabilities with Nikto, an open-source Perl scanner that checks for dangerous files, outdated server software, risky HTTP settings, missing security headers and default content. Use when a user asks to audit web server configuration, find outdated software, detect exposed files, check for misconfigurations, or run a web server security scan on a host they are authorized to test.Votes: 0GitHub stars: 155
- MetasploitExploit vulnerabilities with Metasploit Framework. Use when a user asks to exploit known CVEs, generate payloads, perform post-exploitation, pivot through networks, or build exploit chains in penetration tests.Votes: 0GitHub stars: 155
- Audit Package SurfaceAudit what a Joomla extension's build actually distributes and installs — unintended shipped files, directly reachable executable entry points, unsafe installer and update behaviour, and vulnerable production dependencies. Use when reviewing release packaging or install/update surface for a Joomla extension, or when explicitly invoked for a package surface audit. Missing _JEXEC guards in intended files belong to audit-jexec.Votes: 0GitHub stars: 6
- WindowsWindows-specific patterns, security practices, and operational traps that cause silent failures.Votes: 0GitHub stars: 17
- WifiTroubleshoot and secure wireless networks with channel optimization and diagnostics.Votes: 0GitHub stars: 17
- Whatsapp Business ApiComplete WhatsApp Business Cloud API for messages, templates, media, webhooks, flows, and business profiles.Votes: 0GitHub stars: 17
- VpnConfigure and troubleshoot VPN connections for privacy and remote access.Votes: 0GitHub stars: 17
- Uber EatsNavigate Uber Eats in a live browser or app handoff to compare merchants, manage carts, and reach checkout safely.Votes: 0GitHub stars: 17