Security

dtsong Skill

Use when designing integration strategies for device hardware APIs including camera, sensors, biometrics, and Bluetooth. Covers permission flows, cross-platform abstraction evaluation, fallback behavior, and power impact analysis. Do not use for platform guideline compliance (use platform-audit) or navigation architecture (use navigation-design).

dtsong Skill

Use when reviewing physical implementation security for power domain coupling, timing-related leakage, clock domain crossing issues, and layout-level information exposure. Covers DPA/SPA resistance, EM emanation, fault injection countermeasures, and probing defenses. Do not use for RTL logic review (use rtl-security-review) or microarchitectural attack analysis (use microarch-analysis).

sugatoray Skill

Virtual CISO role bundle for organizations without a full-time CISO. Orchestrates security program assessment, compliance readiness, risk management, and board-level reporting. Auto-invoked when the user asks for security program guidance, compliance assessment, risk posture evaluation, or board reporting preparation. Sequences the appropriate security skills based on engagement type.

sugatoray Skill

SOC Analyst role bundle covering Tier 1 through Tier 3 operations. Orchestrates alert triage, threat hunting, incident investigation, and detection engineering workflows. Auto-invoked when the user needs help with security monitoring, alert analysis, threat hunting hypotheses, incident timelines, or detection rule development. Sequences the appropriate security skills based on the operational engagement type.

sugatoray Bundle

Reviews REST and GraphQL APIs against the OWASP API Security Top 10:2023. Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication, rate limiting, and SSRF. Produces findings mapped to API1-API10 with remediation guidance.

sugatoray Skill

Reviews identity and access management configurations against NIST SP 800-63B, NIST SP 800-207 zero trust principles, and CIS Controls v8. Auto-invoked when reviewing IAM policies, role definitions, user provisioning workflows, or when asked to assess identity security posture. Produces findings on least privilege violations, MFA gaps, stale accounts, and service account hygiene with prioritized remediation.

sugatoray Skill

Guides structured triage of security alerts using a four-phase methodology (collect, correlate, classify, escalate) mapped to MITRE ATT&CK v16 and aligned with NIST SP 800-61 Rev 2 incident handling guidelines. Auto-invoked when the user discusses alert investigation, asks "is this a true positive?", or shares alert data requiring disposition. Produces a triage decision with priority assignment, disposition category, and escalation recommendation.

sugatoray Skill

Performs a structured DNS security review against NIST SP 800-81 Rev 2 (Secure Domain Name System Deployment Guide) and CIS Controls v8 (Control 9.2 -- Use DNS Filtering Services). Auto-invoked when reviewing DNS configurations, DNSSEC deployment, or investigating DNS-based exfiltration and tunneling indicators. Produces a DNS security assessment covering DNSSEC validation, protective DNS, and exfiltration detection patterns.

sugatoray Skill

Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI integration patterns.

sugatoray Bundle

Reviews web applications against the OWASP Top 10:2021 vulnerability categories. Auto-invoked when reviewing web application code, server configurations, or when a user asks for a general security review of a web application. Produces structured findings mapped to A01-A10 with CWE references, severity ratings, and specific remediation guidance.

sugatoray Skill

Performs a structured firewall rule base audit against CIS Controls v8 (Controls 4.4 and 4.5) and NIST SP 800-41 Rev 1 (Guidelines on Firewalls and Firewall Policy). Auto-invoked when reviewing firewall configurations, ACLs, or network security policies. Produces a prioritized findings report covering overly permissive rules, shadowed rules, logging gaps, and egress filtering deficiencies.

sugatoray Bundle

Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity ratings and specific remediation guidance.

sugatoray Skill

Performs a PCI DSS v4.0 compliance review across all 12 requirements and their sub-requirements. Auto-invoked when discussing payment card security, cardholder data protection, PCI compliance validation, or merchant/service provider assessment. Covers scope reduction strategies, SAQ vs ROC determination, compensating controls, customized approach, and the new targeted risk analysis requirements introduced in v4.0.

sugatoray Bundle

Analyzes project dependencies for known vulnerabilities, license risks, and supply chain integrity. Auto-invoked when package manifests (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml) are shared or when discussing dependency security. Produces an SBOM assessment with CVE findings triaged by EPSS and CISA KEV, license compliance check, and supply chain risk rating.

chanw-research Bundle

Use when a manuscript is close to submission or resubmission and you need a preflight audit for claim support, figure-panel coverage, legend sync, methods references, terminology stability, and venue-facing risks.

shawnpang Skill

When the user needs to design, improve, or audit a post-signup activation flow to get new users to their first value moment. Activate when activation is lagging, time-to-value feels excessive, or first sessions lack impact.

bsene Skill

REST API design best practices — URI naming, HTTP verbs/status codes, pagination, filtering, error envelopes, versioning, security. Based on Octo's API design guide with modern updates. TRIGGER when: designing REST API, designing endpoint, API design review, URL design, resource naming, HTTP verb choice, status code choice, pagination strategy, cursor vs page pagination, error format, response envelope, API versioning, REST conventions, RESTful, "/users vs /user", PATCH vs PUT, 201 vs 200, 400 vs 422, idempotency key, rate limiting headers, expand/include parameter, HATEOAS, OAuth2, reviewing routes/controllers/handlers. DO NOT USE when: GraphQL, gRPC, WebSocket, or RPC-style APIs; pure backend logic unrelated to HTTP surface; OpenAPI/Swagger tooling questions only (use generic tools).

bsene Bundle

Write, audit, or improve AGENTS.md — the tool-agnostic context file for coding agents — plus harness adapters (CLAUDE.md, .cursorrules, GEMINI.md, Copilot instructions). Use when creating one from scratch, auditing for bloat or anti-patterns, consolidating multiple tool files into one source of truth, or applying progressive disclosure.

calle-ai Bundle

Audit what your own branches tell callers by phone, judge each answer against written policy, and return a branch-level gap register that is deliberately unusable as a staff performance record.

viktorsbaikers Bundle

Frame an ad-hoc ask before coding, then audit the diff. Use for underspecified imperative asks, raw-diff self-audits, or `/rite-quick` setup. Not a lifecycle gate.

viktorsbaikers Bundle

Review polished feature diff for correctness, readability, architecture, security, tests proving acceptance, Critical/Important findings, and quality dimensions before seal.

viktorsbaikers Bundle

Audit a completed spec for missing decisions before strategy or architecture. Use after /rite-spec when coverage is incomplete or stale; not for spec writing.

zyrexnn Skill

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

zyrexnn Skill

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

zyrexnn Skill

Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.

zyrexnn Skill

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.

zyrexnn Skill

Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).

zyrexnn Skill

Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.

arasz Skill

Use when reviewing a diff, PR, or a batch of changed files and you need to know where the risk concentrates — which changed units have the largest blast radius, whether the highest-risk ones are actually covered by tests, and whether the result is safe to merge. Trigger phrases: "review these changes", "how risky is this diff", "what's the blast radius", "did anything untested change", "rank these changes by risk". Not for a pass/fail preflight of style, security, and layering checks — that is `code-review-checklist`; run the checklist for the mechanical gates and reach for this skill to decide where its attention should concentrate. The two compose: checklist for gates, this skill for prioritization.

arasz Bundle

Use when ai-badger's own machinery needs to be observed — "did that hook even run?", "enable debug logging", "why is the drift notice silent?", "turn on the audit log", "what did the hooks do?" — or to check, tail, or switch off that logging. Records which hook ran, in which project, under which version, to an append-only log.

eugenelim Bundle

Route into the compiled OKF bundle `security-checklists` using generated indexes.

jeremylongshore Bundle

Validate Nixtla skills and plugins with deterministic evidence bundles and strict schema gates. Use when auditing changes or enforcing compliance. Trigger with 'run validation' or 'audit validators'.

jeremylongshore Bundle

Audits Nixtla library usage and recommends cost-effective routing strategies. Scans TimeGPT, StatsForecast, and MLForecast patterns, identifies cost optimization opportunities, generates comprehensive usage reports, and suggests smart routing between models. Activates when user needs cost optimization, API usage audit, routing strategy design, or Nixtla cost reduction.

jeremylongshore Bundle

Validate skills and plugins with deterministic evidence bundles and strict schema gates. Use when auditing changes or enforcing compliance. Trigger with 'run validation' or 'audit validators'.

viktorsbaikers Skill

Audit and reconcile an older released DevRites workspace. Proves a current-contract defect, then routes its phase owner while preserving completed work and history.

viktorsbaikers Skill

Audit one feature read-only for security, performance, or simplification risks. Use for one bounded audit axis; not for code changes.