All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,807
- 1,326
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,513–19,536 of 31,807 skills
- Windows AdUse for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.Votes: 0GitHub stars: 4
- Wifi WirelessUse for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.Votes: 0GitHub stars: 4
- Supply Chain SecurityUse for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.Votes: 0GitHub stars: 4
- Reverse EngineeringProvides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone cryp...Votes: 0GitHub stars: 4
- Protocol ReverseUse for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.Votes: 0GitHub stars: 4
- Src Hunter实战 SRC / 众测 / Bug bounty vulnerability挖掘工作流 skill。包含：5 phasemethodology（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR bypass变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src vulnerability挖掘 / bug bounty / 众测 / hackerone / vulnerability赏金 / SRC / 任意 X vulnerability...Votes: 0GitHub stars: 4
- Pentest ToolsActive penetration testing toolchain. Covers reconnaissance, port scanning, vulnerability scanning, web exploitation, SQL injection, directory brute-forcing, password cracking, and more. Exposes 20+ security tools to the AI agent via MCP servers (pentestMCP / mcp-security-hub). Trigger keywords: penetration testing, port scan, Nmap, vulnerability scan, Nuclei, SQL injection, SQLMap, directory brute-force, FFUF, password cracking, Hashcat, reconnaissance, subdomain, web exploitation, ZAP, Burp.Votes: 0GitHub stars: 4
- Patch Diff ExploitN-day patch diffing to exploitation. Reverse-engineer the vulnerability from vendor-released patches, write a PoC, and turn it into a usable attack module. Use cases: a known CVE with a patch but no PoC, SRC/red team targeting assets that have not been updated in time, N-day weaponization, Patch Tuesday follow-up. Core method: obtain the before/after binaries -> align symbols -> binary diff -> infer the bug class from newly added security checks -> write a PoC that triggers the vulnerability....Votes: 0GitHub stars: 4
- Ot IcsUse for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.Votes: 0GitHub stars: 4
- Firmware PentestFirmware / IoT pentest chain. Start from a .bin / .img blob and close the full loop: reverse → extract → emulate → exploit. Methodology follows the OWASP FSTM nine stages; the toolchain centers on binwalk v3, unblob, EMBA, Firmadyne, and AFL++. Use cases: router/camera/smart-home firmware audits, firmware update package reversing, IoT CVE reproduction, embedded 0day discovery. Trigger keywords: firmware, IoT, binwalk, unblob, UART, JTAG, squashfs, UBI, JFFS2, Firmadyne, QEMU full-system emula...Votes: 0GitHub stars: 4
- Email SecurityUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.Votes: 0GitHub stars: 4
- Docs GeneratorCreates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: "write a report", "write documentation", "produce a report", writeup, technical documentation, report, documentation.Votes: 0GitHub stars: 4
- Database SecurityUse for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.Votes: 0GitHub stars: 4
- Code AuditUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.Votes: 0GitHub stars: 4
- Cloud K8sUse for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.Votes: 0GitHub stars: 4
- Attack ChainUse for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.Votes: 0GitHub stars: 4
- Api SecurityUse for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.Votes: 0GitHub stars: 4
- ReverseOps-routerRoutes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct ReverseOps entrypoint is unclear.Votes: 0GitHub stars: 4
- Security AuditUse when the user asks for a security review, security audit, vulnerability scan, secret scan, dependency or CVE check, OWASP review, pentest review, compliance evidence, or asks "is this safe to ship". Runs real scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner) over code, full git history, dependencies, IaC, and Supabase/Firebase row-level security, verifies each finding against source, and writes one severity-ranked report.Votes: 0GitHub stars: 4
- 20 Supply Chain SecuritySoftware supply chain security — SBOM generation and analysis, dependencyVotes: 0GitHub stars: 552
- Apple DeveloperConfigure and verify Apple Developer signing, bundle identifiers, capabilities, provisioning, entitlements, App Store Connect, TestFlight, Developer ID, notarization, and release readiness for any iOS, iPadOS, macOS, watchOS, tvOS, visionOS, or app-extension target. Use when creating a new Apple app or extension, repairing Xcode signing, selecting an Apple team, registering App IDs, adding widgets or App Groups, preparing archives/uploads, or auditing signed artifacts and Apple release eviden...Votes: 0GitHub stars: 9
- saas-preflightAudit a vibe-coded or AI-generated SaaS for security and payment failures before it ships, focused on the Next.js + Supabase + Stripe stack. Use this whenever the user is about to deploy, launch, or "ship" a web app that handles authentication, user data, or payments. Trigger on phrases like "is my app secure", "can someone read other users' data", "is my Stripe integration safe", "will someone get a free subscription", "review my SaaS before launch", "I'm going to production", or any review ...Votes: 0GitHub stars: 2
- Requirements ElicitationGuide structured discovery of business requirements through stakeholder interviews, workshops, and document analysis. Use when starting a new project, feature, or initiative that needs clear requirements.Votes: 0GitHub stars: 8
- Cross Cutting ReviewMulti-domain review across performance, security, operations, reliability, and data axes for changes that span concerns.Votes: 0GitHub stars: 8