Security

withcrux Bundle

Identify and exploit Linux cron job misconfigurations to escalate privileges from a low-privilege user to root. Covers writable cron scripts, world-writable PATH entries, wildcard injection, and cron-based reverse shells in isolated lab environments.

withcrux Bundle

Analyze HTTP response headers for security misconfigurations including missing Content Security Policy, HSTS, X-Frame-Options, and information disclosure via Server/X-Powered-By headers. Covers manual inspection and automated scanning to identify header-based vulnerabilities and recommend remediations.

withcrux Bundle

Identify and crack weak password hashes (MD5, SHA1, NTLM, bcrypt) using dictionary attacks, rainbow tables, and rule-based mutations with Hashcat and John the Ripper inside an isolated lab environment. Covers hash identification, wordlist selection, and password policy auditing for security assessments.

withcrux Bundle

Enumerate and exploit sudo misconfigurations on Linux systems to escalate privileges. Covers NOPASSWD entries, wildcard abuse, sudo -l enumeration, LD_PRELOAD injection, and GTFOBins lookup for allowed commands in isolated lab environments. Core skill for Linux privilege escalation phases.

withcrux Bundle

Detect reflected, stored, and DOM-based Cross-Site Scripting (XSS) vulnerabilities in web applications using manual payloads and browser-based analysis inside isolated lab environments. Covers OWASP A03 injection and sanitization bypass.

bhaumikmaan Bundle

Security analysis for code changes and requests. Classifies activities as permitted, forbidden, or requiring authorization context. Covers OWASP risks, boundary validation, and dual-use tool guidance. Use when reviewing code for security, handling security-related requests, performing threat modeling, or when asked to assess security posture.

withcrux Bundle

Identify and exploit OS command injection vulnerabilities in web applications where user-supplied input is passed unsanitized to a shell command. Covers in-band, blind, and out-of-band command injection techniques against deliberately vulnerable targets in isolated lab environments.

withcrux Bundle

Detect insecure deserialization vulnerabilities in Java, Python (pickle), and PHP applications that allow remote code execution through crafted serialized objects. Covers gadget chain identification, ysoserial tool usage, and detection techniques in isolated lab environments. OWASP A08:2021.

douglasrao Bundle

Active Directory exploitation skill — credential attacks, lateral movement, privilege escalation, and domain domination. Activate when the user wants to exploit an AD environment after enumeration, or mentions: Kerberoasting, AS-REP Roasting, pass-the-hash, pass-the-ticket, lateral movement, DCSync, Golden Ticket, BloodHound attack paths, evil-winrm, PSExec, or any variation of "attack the domain", "escalate in AD", "get domain admin". Picks up from ad-recon output when available.

douglasrao Bundle

Web application exploitation skill — offensive kill chain for confirming and exploiting vulnerabilities discovered during web recon. Activate when the user mentions exploiting, testing, or confirming vulnerabilities such as SQLi, XSS, LFI, RFI, SSRF, SSTI, XXE, broken access control, IDOR, JWT attacks, OAuth abuse, file upload bypass, deserialization, RCE, CSRF, or any variation of "exploit this endpoint", "test this param", or "web exploitation" after a recon phase. Picks up where web-recon leaves off — reuses recon output when available.

emaduneme Bundle

Systematic academic manuscript review for inconsistencies, citation errors, statistical reporting problems, and style mismatches. Use this skill whenever the user asks to review, proofread, check, or audit an academic paper, manuscript, journal submission, or dissertation chapter. Also trigger when the user mentions finding errors in a draft, verifying citations, checking APA formatting, or preparing a manuscript for resubmission. Covers experimental research, quantitative analysis, and social science writing conventions. Works alongside the academic-research skill but focuses specifically on error detection and correction rather than content generation.

sourav15mukherjee Skill

Scan project dependencies for known CVEs, outdated packages, and supply chain risks. Use when the user asks to audit dependencies, check for vulnerabilities, scan packages, run a security check on node_modules, or wants to know if their dependencies are safe. Supports npm, pip, cargo, go mod, maven, gem, and nuget.

soknoy12 Bundle

High-level software architecture design, system decomposition, tradeoff analysis, and technical decision framing. Use when Codex needs to act as an architecture designer for a new system or a major change: define components and service boundaries, choose architectural patterns, evaluate scalability/reliability/security concerns, compare options, produce ADR-style recommendations, or outline migration plans and architecture reviews.

lurui1997 Bundle

Maintain, update, and audit project dependencies. Use when upgrading packages, resolving security vulnerabilities, managing lockfiles, pruning unused dependencies, or planning major version migrations.

yog-sotho Bundle

REST API design patterns including resource naming, HTTP methods, status codes, pagination, filtering, error responses, versioning, rate limiting, idempotency, and security. Always activate when the user is designing or reviewing API endpoints, adding pagination or filtering, implementing error handling, planning versioning, building public or partner-facing APIs, or asks how to structure a route, response, or status code — even if they don't use the word "API design".

weizhengzhou Bundle

Skill: privacy-audit

weizhengzhou Skill

Skill: youtube-kids-audit

yog-sotho Skill

Run a structured pre-PR verification sweep across build, types, lint, tests, security, and diff review. Always activate this skill when the user says things like "verify my changes", "run checks", "is this ready for PR?", "check my code", "run the verification loop", or after completing a feature, refactor, or significant change. Also activate proactively before any PR creation — even if not explicitly asked. Works for TypeScript, JavaScript, and Python projects.

weizhengzhou Skill

Sub-skill: analyze-kids-content

yog-sotho Skill

Act as an expert code reviewer — producing structured feedback with severity tiers, not writing or fixing code. Use this skill when the user wants passive review, analysis, or a quality assessment of existing code without asking for an immediate rewrite. Trigger on: "review this", "look at this code", "check my code", "audit this", "is this safe?", "is this good practice?", "find bugs", "review my PR", "what's wrong here?", "give me feedback on", or any time the user pastes code and wants analysis rather than a fix. Do NOT trigger when the user asks you to fix, implement, refactor, or build something — use elite-coder for that instead.

sourav15mukherjee Bundle

Review code for bugs, security issues, performance problems, and best practice violations. Use when the user asks to review code, check code quality, find bugs, or audit a file. Provides actionable feedback with severity ratings and suggested fixes.

sourav15mukherjee Bundle

Manage .env files, validate required variables, generate .env.example templates, and detect missing config between environments. Use when the user asks to check environment variables, create an env example file, compare configs, validate env setup, or audit secrets in their repository.

efficience-it Skill

Audit et amélioration de templates Twig. Vérifie l'accessibilité, la performance, les bonnes pratiques, et la sécurité. Utiliser pour auditer un template existant ou quand on veut un retour sur la qualité d'un template.

clawpod-app Skill

Generate contextual briefings for legal work — daily summary, topic research, or incident response. Use when starting your day and need a scan of legal-relevant items across email, calendar, and contracts, when researching a specific legal question across internal sources, or when a developing situation (data breach, litigation threat, regulatory inquiry) needs rapid context.

efficience-it Skill

Audit de performance pour projet PHP/Symfony. Détecte les requêtes N+1, les problèmes d'hydratation Doctrine, les caches manquants, les requêtes lentes.

clawpod-app Skill

Generate threat intelligence briefings with relevance assessment and recommended actions. Trigger with "threat briefing", "what threats this week", "security update", or "any new vulnerabilities".

rationaleyes Bundle

Runtime security monitor for Claude Skills. Activates automatically when skills are loaded to scan all installed skill files for suspicious patterns including external URL references, credential access, persistence mechanisms, and hidden content. Run this skill before executing any untrusted skill to get a security report. Invoke with: "run security monitor", "scan installed skills", "check skills for threats", or "audit skill security".

clawpod-app Skill

Prepare journal entries with proper debits, credits, and supporting detail. Use when booking month-end accruals (AP, payroll, prepaid), recording depreciation or amortization, posting revenue recognition or deferred revenue adjustments, or documenting an entry for audit review.

clawpod-app Skill

Document a business process — flowcharts, RACI, and SOPs. Use when formalizing a process that lives in someone's head, building a RACI to clarify who owns what, writing an SOP for a handoff or audit, or capturing the exceptions and edge cases of how work actually gets done.

clawpod-app Skill

Review code for correctness, maintainability, performance, and security. Trigger with "review this code", "check this PR", "code review", or "look at this diff".

clawpod-app Skill

Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.

clawpod-app Skill

Assess a specific CVE or vulnerability against the organization's technology stack. Determine exposure, severity, and remediation steps. Trigger with "assess CVE-XXXX", "are we affected by [vulnerability]", "check [CVE]", or "vulnerability impact".

chenxiaoyi0807 Bundle

Comprehensive OAuth2 & OIDC authentication skill covering authorization flows, Spring Security 6.x integration, Spring Authorization Server, and enterprise Result<T> wrappers.

bruk-io Skill

This skill should be used when the user asks to "run a security review", "review the spec", "check the specification security", "analyze SkillSign", or mentions reviewing the SkillSign specification. Launches 6 specialized agents in parallel (crypto-reviewer, input-surface-reviewer, identity-reviewer, policy-reviewer, attack-researcher, consistency-checker) to perform a comprehensive security review and synthesize findings into tiered recommendations.

bruk-io Skill

This skill provides threat modeling frameworks for signing specifications using STRIDE and attack trees. Use when analyzing supply chain compromise, substitution attacks, sidecar rollback, verification bypass, policy weakening, downgrade attacks, TOCTOU exploitation, temporal attack vectors, or signer impersonation paths. Do NOT use for general application threat modeling unrelated to signing systems.

bruk-io Skill

This skill provides domain knowledge about Sigstore keyless signing infrastructure including Fulcio certificate authority, Rekor transparency log, and TUF root distribution. Use when reviewing cryptographic protocols, certificate chain validation, SCT vs SET distinctions, verification modes (default, strict, offline), or common Sigstore integration vulnerabilities. Do NOT use for general cryptography unrelated to Sigstore.