Security

nosignalmxh Bundle

audit a paper like a strong reviewer with claim-evidence-falsify tables, stepwise red-teaming, and comparison against field consensus or active controversy. use when the user wants 强批判审稿报告, 分步红队, 共识与争议对比, rigorous criticism, reviewer-style questions, or evidence-disciplined paper auditing.

rj-gauntlet Bundle

Run scaled testing against an implemented project — smoke tests, integration, end-to-end, visual UI verification, performance, and security — based on the stakes level. Use when the user wants to test a project, run QA, verify the build works, check the UI, check performance, run security tests, or validate after a review.

hajikopo Bundle

Production-readiness reviewer and quality gate. Validates code quality, security, architecture, testing, and delivery readiness. Routes to specialist skills when needed.

hansjm10 Skill

Audit a PR review for false positives, scope drift, overstated claims, and unsubstantiated assertions. Use when: (1) User runs `/pr-audit`, (2) User asks to "audit" or "check" a review, (3) User wants to find false positives or verify claims in a review, (4) User provides a review and asks if claims are justified. Does NOT re-review the PR; evaluates whether the review's claims are supported by evidence.

hajikopo Bundle

Mobile app development for Android and iOS. Covers lifecycle management, permissions, offline sync, security, testing, app store release, performance, and battery optimization.

hajikopo Bundle

Expert in application security, penetration testing workflows, threat modeling, and compliance (SOC2, GDPR).

dev-dennis-040 Skill

You are **ComplianceAuditor**, an expert technical compliance auditor who guides organizations through security and privacy certification processes. You focus on the operational and technical side ...

dev-dennis-040 Skill

You are **Blockchain Security Auditor**, a relentless smart contract security researcher who assumes every contract is exploitable until proven otherwise. You have dissected hundreds of protocols, ...

dev-dennis-040 Skill

You are **Security Engineer**, an expert application security engineer who specializes in threat modeling, vulnerability assessment, secure code review, and security architecture design. You protec...

dev-dennis-040 Skill

You are **Threat Detection Engineer**, the specialist who builds the detection layer that catches attackers after they bypass preventive controls. You write SIEM detection rules, map coverage to MI...

klaudecode Skill

Thorough code review and QA audit for production readiness. Use when the user asks for a code review, QA check, audit, bug hunt, or asks to review a codebase. Enforces single-pass completeness to minimize token waste.

vythanhtra Skill

Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.

chriscox Bundle

Keep project documentation in sync with code changes. Identifies which docs need updating after a PR merges or code changes, drafts the updates, and manages doc site structure (mkdocs, docusaurus, vitepress). Use when: (1) a PR just merged and docs may need updating, (2) the user says "update the docs" or "sync docs", (3) a new doc was created and needs to be added to site navigation, (4) the user wants to audit which docs are stale. NOT for: writing docs from scratch for a new project (just write them), generating API reference docs from code comments (use typedoc/jazzy/etc.), or content that isn't developer documentation.

njones17 Skill

Simulates VLAN hopping attacks using switch spoofing and double tagging techniques in authorized environments to test VLAN segmentation effectiveness and validate switch port security configurations against Layer 2 bypass attacks.

njones17 Skill

Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.

njones17 Skill

Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.

nikopj01 Bundle

Extract, normalize, and validate metadata from files, logs, and artifacts for downstream analysis. Use when enriching threat intel, processing evidence, or building searchable security datasets.

nikopj01 Bundle

Perform implementation-focused code reviews that prioritize correctness, security, and maintainability. Use when reviewing pull requests, validating feature completeness, or preparing release-critical changes.

njones17 Bundle

Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.

njones17 Skill

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.

nikopj01 Bundle

Build and refine Sigma-based detections to identify malicious behavior across logs and telemetry. Use when creating detections, mapping ATT&CK techniques, and improving SOC hunting coverage.

njones17 Bundle

Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments.

njones17 Bundle

Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w

njones17 Skill

Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkeyed headers and parameters during authorized security tests.

njones17 Skill

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

njones17 Skill

Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.

njones17 Bundle

Hardware Security Modules (HSMs) are tamper-resistant physical devices that safeguard cryptographic keys and perform cryptographic operations in a hardened environment. Keys stored in an HSM never lea

njones17 Bundle

Web exploitation techniques for CTF challenges. Use when solving web security challenges involving XSS, SQLi, SSTI, SSRF, CSRF, XXE, file upload bypasses, JWT attacks, prototype pollution, path traversal, command injection, request smuggling, DOM clobbering, Web3/blockchain, or authentication bypass.

njones17 Skill

Generates a professional security report from findings. Supports pentest, vulnerability assessment, bug bounty, code review, and IR post-mortem formats. Pass the report type and any notes or findings as arguments.

njones17 Skill

Rates the severity of a security finding by walking through CVSS v3.1 scoring, EPSS context, and real-world risk factors. Produces a justified severity rating with full CVSS vector. Use when you need to assign or challenge a severity for a finding.

njones17 Bundle

Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.

njones17 Skill

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

njones17 Skill

Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.

njones17 Bundle

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

njones17 Skill

Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.

njones17 Skill

Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate response teams. Activates for requests involving incident triage, security alert classification, severity assessment, incident prioritization, or initial incident analysis.