Security

patsnap Bundle

Identify potentially protectable technical contributions in R&D updates, meeting notes, design documents, architecture descriptions, experiment records, and technical-improvement narratives. Use when a user asks what may be innovative, patent-review worthy, suitable for trade-secret review, or in need of invention-disclosure follow-up.

patsnap Bundle

Audit catalyst preparation and evaluation methods for executability, reproducibility, controlled comparison, attribution, measurement reliability, safety-review readiness, and claim-to-evidence linkage. Use for experimental procedures, screenshots, paper methods, patent examples, draft plans, and machine-generated catalyst routes.

freakyady Bundle

Audit reinforcement learning (RL) environment verifiers, reward functions, and grading rubrics for reward-hacking vulnerabilities before training or publishing. Use when inspecting, designing, testing, or hardening RL environments in OpenEnv, Prime Intellect verifiers-spec, or Gymnasium formats.

carolz1 Bundle

审查一个 Skill 并自动打分。当用户想「审查/评审一个 skill」「给 skill 打分」「这个 skill 能参赛吗」「帮我看看这个 skill 有什么问题」，或提供一个 Skill 包目录、SKILL.md 文件、或粘贴 SKILL.md 内容让你评估时使用。即使对方没有说「审查」二字，只要在让评估一个 skill 的质量，也主动使用本技能。Review a skill and score it automatically; use when the user wants to audit, score, or diagnose a skill's quality.

yuji-tt Bundle

Audit whether optimizing a stated objective or proxy advances the real goal. Use for suspicious metric gains, incentive failures, population mismatch, or before further optimization when goal alignment is uncertain; do not reframe routine tasks without evidence.

senshanshan Bundle

在已获授权的测试或预发布环境中，使用 OWASP ZAP 对有限范围的 HTTP API 做 OpenAPI 驱动的 DAST 检查：整理接口、建立鉴权上下文、执行 api/baseline/full 扫描、复打告警并输出带证据的判定报告。适用于 ZAP、API 安全扫描、DAST、 被动或主动 Web/API 风险检查；不适用于字段契约、业务联调、源码/依赖审计、 性能测试或生产扫描。

voltsommer2026 Bundle

Coordinate a product website from user-supplied references through workspace setup, guided design, Shopify implementation and evidence-based review. Use for the integrated product-site workflow or a request to start or audit a product site; route workspace creation to product-project-bootstrap and implementation to shopify-product-site-factory.

navinramharak-rgb Bundle

Audit a real website end to end and hand back a prioritized fix list plus a fix-or-rebuild verdict. Use when the user gives a URL and wants it reviewed, or says "audit my site", "review my website", "why isn't my website getting me leads", "people find me and don't call", "is my site any good", "what's wrong with my website", "my site looks dated", "check my site on mobile", "my website isn't converting", or asks what to fix first. Also use before rebuilding a site, to produce the brief. Works for any business, goes deeper for local and service businesses.

ruosong320 Bundle

Clarify requirements before starting from-zero project builds or new feature work. Use when asked to create a complete new project, scaffold an app, design a system, add a new feature, introduce a new workflow, or make any change whose product, technical, UX, data, integration, security, deployment, or acceptance boundaries are unclear; generate a checklist from the user request, identify unclear boundaries, ask targeted multi-round questions, and begin implementation only after the checklist is sufficiently resolved.

commonset Skill

Assesses whether a software change is ready to ship across data, configuration, security, observability, rollout, rollback, and smoke coverage. Use before deployment, release approval, or production rollouts.

commonset Skill

Reviews a pull request or code diff for correctness, security, regressions, missing tests, maintainability, and material performance issues. Use before merge or when asked to assess a proposed code change.

gabson0x Skill

Master index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT.

gabson0x Skill

Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting up a fork test, using Foundry cheatcodes, or reproducing a known DeFi hack for learning.

gabson0x Bundle

Security audit of Solidity code while you develop. Trigger on "audit", "check this contract", "review for security". Modes - default (full repo) or a specific filename.

gabson0x Skill

ZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, which patterns block all 10 bug classes, and when to abandon a target. Contains architecture breakdown, 25 tested attack vectors, and pre-dive scoring refinements for large L1 bridge protocols.

gabson0x Bundle

HackenProof bug bounty triage workflow for Claude Code plugin marketplace operations. Use when analyzing security reports, validating scope and exploitability, assigning severity, detecting duplicates, setting report state, adding labels/comments, and preparing consistent triage decisions for HackenProof programs.

barnabys-drew Skill

Use this skill when the user wants to review, clean up, audit, or "spring clean" their GitHub repositories — e.g. "go through my repos", "which repos do I still need", "triage my repos", "audit my github", "help me clean up old projects", "are these repos still needed". Enumerates the user's repos, gathers signals to judge whether each is still useful, asks the user repo-by-repo what to do, acts on the decision (keep / archive / delete), and for repos worth keeping kicks off a conversation about concrete next steps.

rifteo Bundle

A final accuracy check for offensive security work — it re-tests each conclusion against the evidence and labels every part confirmed, inferred, or assumed, so an unverified result never goes out as if it were proven. Trigger when the user says "deadangle" or "/deadangle", before delivering a finding/vulnerability conclusion/attack path, after completing recon and summarizing coverage, before presenting a multi-step attack chain, before assigning severity/impact/confidence to anything, or before using language like "this is vulnerable" or "I confirmed".

rifteo Bundle

Full static analysis methodology for Android APK files on Linux — decompiles with apktool and jadx, hunts for hardcoded secrets and API keys, maps endpoints and network surface, fingerprints the tech stack, detects vulnerability patterns, and produces a structured Markdown report aligned to OWASP MASVS. Trigger when the user provides an APK file and asks for a security review, secret scan, endpoint extraction, or mobile pentest.

tahr-security Bundle

Review and safely test web authentication and session boundaries across login, registration, password reset, magic links, MFA or OTP, OAuth/OIDC, SAML, passkeys, tokens, cookies, logout, and recovery. Use for authentication code review, pre-release auth testing, account-takeover analysis, session-management review, SSO integration review, or validating an existing security assessment.

tahr-security Bundle

Retest a security fix in the exact vulnerable context, decide whether the exploit path is closed, and validate secure remediation and regression coverage without breaking legitimate behavior. Use after a vulnerability patch, remediation commit, PR fix, dependency or configuration change, failed security retest, or when developers need proof that a fix is complete rather than a superficial code change.

rifteo Bundle

Full JWT attack methodology alg:none, RS256 to HS256 confusion, weak secret brute-force, kid injection, jku/jwk injection, and claim tampering. Trigger when the user asks to test JWT tokens, authentication bypass, or token forgery, wants to try alg:none/algorithm confusion/weak secret brute-force, needs to test kid/jku/x5u/jwk injection, asks to check if exp/iss/aud claims are validated, is trying to bypass authentication on an API or web app, or provides a string that looks like a JWT.

rifteo Bundle

Interviews the user about a pentest or audit engagement before any testing begins, capturing target, scope, rules of engagement, auth, and deliverables into a structured brief. Trigger when the user says "start a pentest", "begin an engagement", or "test this target", describes a target without mentioning scope/authorization/deliverables, or wants to structure an engagement before diving in.

rifteo Bundle

Search known exploit databases and sources for a given service, version, or CVE, from searchsploit to Vulners, MSF, and beyond. Trigger when the user has identified a service/version and wants to know if public exploits exist, provides a CVE ID and wants PoC or weaponized exploit references, ran nmap/banner grabbing and wants to cross-reference exploit databases, wants to know if a vulnerability is actively exploited in the wild, or is preparing a pentest report needing exploit evidence references.

gabson0x Bundle

Bug bounty and security audit engine — trust-first iterative hunting. The "3rd eye" for pentesting.

gabson0x Skill

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

rifteo Bundle

Builds deterministic, reproducible proof-of-concepts to validate suspected or partially-confirmed vulnerabilities (e.g., XSS, IDOR) and eliminate false positives. Triggered when tool outputs flag potential issues, or when manual confirmation of exploitability is required before documenting a finding.

rifteo Bundle

Looks up any control ID across ISO 27001, NIST CSF, PCI-DSS v4, and OWASP returns the full control card, cross-framework mappings with confidence level, related controls, and testing hints. Trigger when the user provides a control ID and asks what it means, asks how controls map across frameworks, searches for a control by keyword or description, needs testing hints or evidence criteria before writing a finding, or wants to understand related or prerequisite controls within a framework.

rifteo Bundle

Converts raw pentest notes, logs, or observations into a structured audit finding ready for a security report. Trigger when the user pastes raw notes, tool output, or a quick observation from a pentest, describes a vulnerability needing structure for a client report, has a log snippet or HTTP request/response revealing a security issue, or wants to turn a single-line note into a deliverable write-up.

gabson0x Skill

Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, token_scanner.py automation, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.

gabson0x Skill

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, conditionally-valid-with-chain table, temp email creation scripts, XXE/deserialization/host header injection payloads. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, temp email setup for multi-account testing, or to check if a finding is submittable. Also use when asked about what NOT to submit.

gabson0x Bundle

Comprehensive smart contract security audit framework with multi-expert analysis. Use for full audits of Ethereum / EVM Solidity and Vyper, Solana / SVM Anchor Rust, TON / FunC / Tact, or Sui / Move projects.

rifteo Bundle

Weighs each attack path's effort against its likely impact, pursuing the highest-value surfaces first to find the most important weakness with the least wasted effort it shapes the order you test in, not what you test. Trigger when doing any offensive security engagement and deciding where to focus effort, when the attack surface is large and not everything can be tested with equal depth, or when the goal is maximum impact from available time and effort. Works standalone or alongside a mindset skill like redmind.

rifteo Bundle

Tests for vulnerabilities less aggressively — read-only where possible, confirming a flaw without exercising its full impact or causing damage, under a strict set of safety rules. Not the default; activate only when the user explicitly signals safety as a constraint, e.g. "don't break anything", "read-only", "non-destructive testing", "careful with production", "keep it clean", or "just prove the finding, don't exploit it fully".

rifteo Bundle

Aggregates audit findings mapped to framework controls, classifies each control, identifies blind spots, prioritizes gaps by severity, and produces a complete gap report supports ISO 27001, NIST CSF, PCI-DSS, and OWASP. Trigger when the user provides audit findings tagged to framework controls and asks for a gap report, asks what controls are failing or what their biggest compliance gaps are, needs to identify blind spots or untested controls, wants to compare current compliance posture against a previous audit, or shares pentest/audit results wanting them mapped to a compliance framework.

ankit1598 Bundle

Requires append-only audit events for data writes, auth/session/RBAC changes, and operator actions — with sanitized payloads and no secrets. Use when adding mutations, Server Actions, write APIs, auth changes, role changes, or operator/admin actions; independent of multi-tenancy.