Security

aki2022 Bundle

Audit and safely settle elevated access granted during the current or resumed session. Use when a task granted IAM roles, API scopes, bucket bindings, or other temporary access and the session is closing, or when the caller explicitly asks to audit or revoke session-granted permissions. Classify grants as temporary or standing, revoke temporary grants, verify the removal, and report the result; do not audit pre-existing access by guesswork.

charlesjones-dev Skill

Initialize Claude Code security settings with intelligent file denial patterns based on your project's technology stack.

charlesjones-dev Bundle

Evidence-based repository security audit with attack-surface coverage, candidate verification, baseline reconciliation, and archived Markdown/JSON artifacts.

charlesjones-dev Skill

Interactive codebase modernization assessment to identify technical debt, anti-patterns, and quality issues from older AI-generated or legacy code.

charlesjones-dev Skill

Comprehensive performance analysis to identify bottlenecks, optimization opportunities, and scalability issues.

charlesjones-dev Skill

Harden your project against npm supply chain attacks by configuring pnpm's minimum-release-age quarantine and frozen lockfile enforcement.

charlesjones-dev Skill

Interactive open-source license compliance audit to identify all dependency licenses, flag risks, and detect license incompatibilities.

firef1ie Skill

Use AgentPMT external API to run the Global Agriculture & Food Security Data tool with wallet signatures, credits purchase, or credits earned from jobs.

charlesjones-dev Skill

Scan a deployed website for outdated dependencies, known CVEs, and security misconfigurations.

zircote Bundle

This skill should be used when the user asks to "release a project", "create a release", "bump version", "publish to GitHub", "prepare a release", "run release validation", or needs to perform SDLC-compliant releases for Claude Code plugins, Python, Node.js, Go, or Rust projects. Provides comprehensive pre-release validation including tests, lint, coverage, and security checks.

iamhenry Bundle

Fresh-subagent code quality review gate after implementation and before verification. Use when code changes are complete and the orchestrator needs APPROVE_CODE, REVISE_CODE, or ASK_USER based on plan fidelity, simplicity, tests, repo style, security, and maintainability. Does not implement or write files.

iamhenry Skill

When the user wants a full ASO health audit, review their App Store listing quality, or diagnose why their app isn't ranking. Also use when the user mentions "ASO audit", "ASO score", "why am I not ranking", "listing review", or "optimize my app store page". For keyword-specific research, see keyword-research. For metadata writing, see metadata-optimization.

ryryo Bundle

Webサービスを攻撃者目線でレビューし、実在する攻撃ベクターに基づいて脆弱性を発見・整理するスキル。 静的レビューと実証検証は別サブエージェントに委任し、メインセッションは両者の結果を 査読・比較して次アクションを判断する。Medium以上の実証済み所見、または実証未了でも 優先度が高い所見がある場合はメインセッションで対策プランの作成を促す。 Trigger: 脆弱性レビュー, セキュリティ診断, 攻撃者目線レビュー, ペネトレーション観点, /dev:attack-surface-review, attack surface review, pentest perspective, exploit path

iamhenry Skill

When the user wants to discover, evaluate, or prioritize App Store keywords. Also use when the user mentions "keyword research", "find keywords", "search volume", "keyword difficulty", "keyword ideas", or "what keywords should I target". For implementing keywords into metadata, see metadata-optimization. For auditing current keyword performance, see aso-audit.

mae616 Skill

Security Expert

rooseveltadvisors-claude-agent-stack Bundle

Code review and anti-pattern detection. USE WHEN user says review code, audit code, check for anti-patterns, code quality check, OR find bugs. Scans for security issues, anti-patterns, and project-specific violations.

trilwu Bundle

Test REST and GraphQL APIs for authentication bypasses, authorization flaws, IDOR, mass assignment, injection attacks, and rate limiting issues. Use when pentesting APIs or testing microservices security.

trilwu Skill

Write a new SecSkills skill end to end — choosing the plugin bucket and skill tier, writing a description that triggers correctly without stealing traffic from siblings, the required sections, registering the skill in ttp-index.json, adding routing eval cases including negative traps, and running the three validators. Use when adding a skill to this repo, splitting or merging existing skills, fixing a skill that triggers on the wrong requests, or when a new skill fails validate.py, sync_attack.py, or run_evals.py.

trilwu Skill

Locate the vulnerability a security patch fixes by diffing the pre- and post-patch binaries — using BinDiff, Diaphora, or ghidriff to find the changed functions, reading the added checks to recover the bug class, and reasoning back to a reachable pre-patch trigger for 1-day analysis. Use when comparing two versions of a DLL/ELF, extracting a Microsoft patch from an MSU/MSP for delta comparison, or turning a vague advisory into the exact code that changed.

trilwu Skill

Perform a security review of a diff, branch, or pull request — assessing what the change introduces, weakens, or exposes, with a triage-first workflow and false-positive discipline. Use when asked to security review a PR or branch, check a diff before merge or commit, or assess whether a change is safe to ship.

trilwu Skill

Analyze raw shellcode and position-independent code — extracting the bytes, guessing architecture, disassembling at the right base, decoding self-decoder stubs, resolving hashed Windows APIs, emulating to the decoded stage, and pulling C2 and stage IOCs. Use when handed a raw blob of position-independent code, an extracted payload with no PE/ELF header, shellcode lifted from an exploit or a macro/loader, a `\x`-escaped or base64 buffer, a suspected Cobalt Strike or Metasploit stager, or an egg-hunter.

ryryo Bundle

コードベースまたは指定範囲を、main Codex 主導でアーキテクチャ上の満足条件まで段階的にリファクタリングする。独立エージェント向けのread-only audit modeでは、実装や進捗fileを作らずarchitecture mapとfindingを返す。大規模リファクタ、責務分離、依存方向、状態・副作用境界、テスト容易性の監査と改善で使う。起動語: architecture-refactor-loop, アーキテクチャリファクタリングループ, architecture audit, read-only architecture audit

trilwu Skill

Reverse engineer and security-review macOS applications and Mach-O binaries — thinning universal binaries, recovering Objective-C/Swift structure, reading code-signing entitlements and the hardened runtime, and auditing XPC services, dylib load paths, and TCC privacy exposure. Use when analyzing a .app bundle or Mach-O on macOS, checking entitlements and notarization, hunting a dylib-hijack or XPC privilege bug, or reasoning about Gatekeeper and quarantine.

trilwu Skill

Security-test desktop thick-client applications (.NET/WPF, Java, Electron, native Win32) against their local and network attack surface — proxying non-HTTP traffic, extracting secrets and DB connection strings from config/registry/memory, bypassing client-side trust controls, and reviewing update channels and DLL search order. Use when assessing an installed desktop app that talks to a backend, when Burp sees no traffic from a fat client, or when a two-tier app connects straight to a database.

trilwu Skill

Navigate security work by MITRE ATT&CK tactic and technique — resolve a technique ID or name to the right skill, map a threat intel report or adversary emulation plan to procedures, and run the purple-team loop from technique to detection to validation. Use when a request names an ATT&CK ID like T1003.001, a tactic like lateral movement, an APT group or intel report, or when planning coverage against the matrix.

everyone-needs-a-copilot Skill

Security Engineer for authentication, authorization, secrets, trust boundaries, unsafe inputs, data exposure, and practical security review.

trilwu Skill

Attack Bluetooth Classic, BLE, and NFC targets -- device enumeration, GATT characteristic exploitation, BLE MITM and replay, Ubertooth and nRF sniffing, MIFARE Classic cracking, Proxmark3 card cloning, NFC relay attacks, and access control bypass. Use when pentesting BLE peripherals or IoT devices, assessing NFC-based access controls or contactless payment security, testing Bluetooth pairing and authentication, or evaluating physical access card cloneability.

trilwu Skill

Write security findings and assessment reports — severity scoring with CVSS and business impact, reproducible proof of concept, remediation guidance, executive summaries, and coordinated disclosure. Use when writing up a vulnerability, producing a pentest or audit report, triaging a bug bounty submission, or preparing a disclosure timeline.

trilwu Skill

Diagnose and defeat TLS interception failures in mobile apps — certificate pinning, Android Network Security Config, user-CA distrust, native BoringSSL pinning, and mutual TLS — using objection, Frida, SSL Kill Switch, and APK patching. Use when Burp, mitmproxy, or Charles shows a TLS handshake error, an empty proxy, or "network error" from a mobile app, or when a target is known to pin certificates.

trilwu Skill

Test Industrial Control Systems and Operational Technology protocols — Modbus, DNP3, OPC UA, BACnet, EtherNet/IP, S7comm, MQTT — with safety-first methodology for SCADA and ICS environments. Use when assessing OT network security, testing ICS protocol authentication, reviewing IT-OT segmentation, or performing authorized ICS penetration testing.

trilwu Skill

Test web applications for security vulnerabilities including SQLi, XSS, command injection, JWT attacks, SSRF, file uploads, XXE, and API flaws. Use when pentesting web apps, analyzing authentication, or exploiting OWASP Top 10 vulnerabilities.

everyone-needs-a-copilot Bundle

Stride Dread

everyone-needs-a-copilot Bundle

Web application security covering OWASP Top 10 (2021) — injection, broken auth, XSS, insecure design, security misconfiguration, vulnerable components, IDOR, SSRF, and more — with prose guidance and deterministic OWASP coverage scoring via executable script. Use proactively when reviewing web application or API security, running a pre-launch security checklist, performing post-incident gap analysis against OWASP Top 10, or any review touching authentication, authorization, injection, or session management. Run the OWASP scorer for deterministic coverage assessment.

trilwu Skill

Identify and exploit insecure deserialization across Java, .NET, PHP, Python, and Ruby — recognizing serialized formats by magic bytes, finding gadget chains with ysoserial and ysoserial.net, and detecting blind cases via DNS or timing. Use when a request contains base64 starting with rO0AB or AAEAAAD, when a cookie or parameter holds a serialized object, or when reviewing readObject, unserialize, pickle.loads, or Marshal.load.

trilwu Skill

Attack WiFi networks using WPA/WPA2 cracking, WPS exploitation, Evil Twin attacks, deauthentication, and wireless reconnaissance. Use when pentesting wireless networks or performing WiFi security assessments.

trilwu Skill

Pentest Android and iOS mobile applications including APK analysis, dynamic analysis, SSL pinning bypass, root/jailbreak detection bypass, and mobile-specific vulnerabilities. Use when testing mobile app security or performing mobile pentesting.