Security

cowork-os Bundle

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

cowork-os Bundle

Use when the user asks for a repository-wide or scoped-path security scan.

cowork-os Bundle

Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.

vishuwa2004 Bundle

Audit a command surface end to end so registration, discoverability, permissions, and execution all line up before shipping.

openlabor Skill

Run security vulnerability scans

openlabor Skill

Audit application performance

malekokour Bundle

Reviews an already-written first-in-human starting-dose rationale — the most-sensitive-species argument, the NOAEL to HED to MRSD conversion chain, the MABEL consideration where the mechanism indicates one, and the escalation and stopping-rule skeleton — and recomputes every arithmetic step with a printed audit trail. Use this skill when someone asks to check, QC, verify or review an existing FIH dose rationale, IB dose-justification section or protocol starting-dose narrative — for example "does the HED in this IB recompute from the rat NOAEL" or "review the dose rationale before it goes to tox and the medical monitor". Do not use it to derive, select, propose, justify or approve a starting dose, to set or adjust an escalation increment, to judge whether a safety factor or staggering interval is adequate, or to prepare a registration-dose justification.

aiunlocked1412 Bundle

ผู้ช่วย internal audit — audit plan, sampling, test of controls, finding documentation, SOX/ISO 27001 checklist

haomingz Bundle

深度分析 Git 仓库历史，识别高频变更的热点文件、分析代码的实际贡献归属关系、并扫描历史提交中的密钥泄露等安全隐患。当用户提及分析仓库、查看代码归属、寻找热点文件或安全风险扫描，或询问团队协作、代码审查分配、技术债务与安全审计等关键词时触发。

haomingz Bundle

以消费者视角审计服务条款（服务条款、用户协议、隐私政策），识别霸王条款、隐蔽数据授权、自动续费陷阱、单方面修改权、责任免除滥用等风险，输出包含总体评级、逐项风险分析和消费者行动建议的结构化审计报告。当用户要求审计服务条款、审查用户协议、分析隐私政策，或提及霸王条款、数据授权、自动续费、terms of service audit、ToS review、privacy policy review、用户协议风险分析、条款合规检查、消费者权益审计时触发。

haomingz Bundle

建立全面的软件QA测试流程，包括制定测试策略、按照Google AAA标准编写测试用例、执行测试计划、使用P0-P4分级追踪缺陷、计算质量指标（如通过率与覆盖率）以及生成每日/每周进度报告。提供完整的文档模板，可直接用于外包团队交接，并实施OWASP安全测试，以90%的覆盖率为目标。当用户提到搭建QA流程、编写测试用例、制定测试计划、追踪缺陷（P0-P4）、计算质量指标、生成QA报告、进行安全测试或准备外包交接时触发。

build-with-dhiraj Bundle

Audit Obsidian vault, score second brain, and grade PKM graph health on an 8-dimension Grade-A rubric. Pure Python CLI, read-only, no GPT or API keys. Measures link density, orphan rate, near-orphan rate, connected-2plus share, top-hub edge-share, top-hub:next ratio, Louvain modularity, and frontmatter-wikilink adoption against expert-cited thresholds (kepano, Matuschak, Ahrens, Konik, Paranyushkin, Milo). Use when the user asks any of: audit my obsidian vault, score my obsidian, is my obsidian healthy, is my second brain healthy, score my pkm graph, obsidian vault review, obsidian graph analysis, measure my obsidian, find orphans in my obsidian vault, obsidian orphans, cross-linking review, obsidian graph health check, grade my pkm, obsidian vault quality, obsidian scorecard, zettelkasten audit, second brain audit, why is my vault rotting, pkm metrics, atomic notes review. Works on any markdown vault using wikilinks (Obsidian, Logseq, Foam, Quartz).

uphiago Skill

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (alg:none, RS256→HS256 key confusion, weak HMAC secret, kid injection), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

uphiago Skill

Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.

uphiago Skill

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

uphiago Skill

DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis

uphiago Skill

Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.

uphiago Skill

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.

uphiago Skill

Exploit XMLRPC multicall, pingback for brute force and SSRF.

uphiago Skill

Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT: alg=none, weak HMAC bruteforce, kid path traversal, JWK injection, token confusion. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, JWT flaws, mass-assignment, prototype pollution.

uphiago Skill

Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.

uphiago Skill

Find leaked API keys, tokens, and credentials in public GitHub repositories.

uphiago Skill

Hunt WP plugins via REST, exploit CVEs when version known.

uphiago Skill

Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.

uphiago Skill

Exploit unauthenticated multi-step API flows without credentials.

uphiago Skill

Exploit Firebase/Supabase for data via JS config leak probe.

uphiago Skill

Exploit WP CORS credential reflection for data theft.

uphiago Skill

Exploit public bucket Content-Type override for stored XSS on target origin.

build-with-dhiraj Bundle

Audit token waste across Claude Code, Codex, OpenClaw, Hermes, OpenCode. Detect idle burns and config bloat.

build-with-dhiraj Bundle

Find the ghost tokens. Audit Claude Code or Codex setup, see where context goes, fix it. Use when context feels tight.

gianlucanaarden Skill

Analyseert de ankerteksten van een lijst backlinks, deelt elke linktekst in bij een van vier typen (merknaam, omschrijvend, kale URL, exact zoekwoord) en wijst eenzijdigheid aan, zonder een verzonnen normverdeling te hanteren. Werkt op een export uit Google Search Console of een handmatig aangeleverde lijst, benoemt per twijfelgeval waarom een tekst bij een type hoort, zoekt bij een dominante stapel naar de gezamenlijke bron en adviseert hoe je vanaf nu varieert zonder overcorrectie. Gebruik deze skill wanneer iemand vraagt om "analyseer mijn ankerteksten", "anchor text audit", "is mijn linkprofiel natuurlijk", "te veel exact match ankers", "ankertekst verdeling checken", "linkteksten uit Search Console beoordelen", "welke ankertekst moet ik gebruiken", of een lijst backlinks met linkteksten aanlevert. Ook triggeren bij het kiezen van een ankertekst voor een nieuw gastartikel of een linkruil. Niet gebruiken om een ideale percentageverdeling voor te schrijven, want Google publiceert geen ankertekst-ratio's en

gianlucanaarden Skill

Vindbaarheids Audit

gianlucanaarden Skill

Beoordeelt een lijst backlinks op de zeven kwaliteitsvragen uit het artikel Wat is linkbuilding van TheSEO en legt per link uit wat hij waard is en waarom. Levert een eerlijk oordeel over het hele linkprofiel plus een actielijst, zonder verzonnen scores of normpercentages. Gebruik deze skill ALTIJD wanneer iemand vraagt om "beoordeel mijn backlinks", "linkprofiel analyseren", "zijn deze links goed", "backlink audit", "welke links zijn giftig", "linkprofiel check", "wat is deze link waard", "backlinks beoordelen", "is dit een goede backlink", of wanneer iemand een lijst met verwijzende sites of een export uit Search Console, Ahrefs of een andere linktool plakt en wil weten wat die links betekenen. Ook triggeren bij "moet ik deze links laten verwijderen", "is mijn linkprofiel natuurlijk" en "waarom doet mijn concurrent het beter met minder links". Niet gebruiken voor het vinden van nieuwe linkkansen, voor interne links binnen een site en niet voor technische crawlvragen.

xspoonai Bundle

Description

xspoonai Bundle

Query Solodit audit knowledge to review smart contracts with evidence-backed findings, severity summaries, and remediation guidance. Use for contract audit prep, vulnerability triage, and secure coding reviews.

xspoonai Bundle

Secret Guard