Security

ihabkhaled Bundle

Use when mandatory behavior, integration, security, migration, or data requirements lack the appropriate kind of proof.

ihabkhaled Bundle

Use when rules appear satisfied while their intent is bypassed, counters reset, classifications change conveniently, or an AI-Psychiatry audit is requested.

ihabkhaled Skill

Use when beginning any plan, audit, investigation, modification, review, test, or expensive tool action before the primary objective and completion conditions are explicit.

ihabkhaled Bundle

Use when an important implementation, architecture, security, data, or delivery decision rests on unresolved critical unknowns.

ihabkhaled Bundle

Use when an AI-Psychiatry budget expires while new evidence shows a narrow extension is required for correctness, security, or completion.

ihabkhaled Skill

Use when reviewers or judges repeat rounds, invent requirements, block on style, expand scope, or continue after correctness, security, regression, and explicit requirements are satisfied.

promovaweb Bundle

Projetar, implementar e revisar soluções Supabase — Postgres, Auth, Row Level Security, Storage, Realtime, Edge Functions e ambiente local. Use quando houver `supabase/config.toml`, migrations Supabase ou clientes `@supabase/*`; não use como substituto de análise Postgres profunda de schema/índice/plano — combine com `specsfy-specialist-postgres` para isso.

thegoat395 Bundle

Diagnose measured runtime and Core Web Vitals.

x-cmd Skill

Security audit for code changes. Triggered by "/security-review" when reviewing auth, crypto, input handling, or when user explicitly requests a security audit.

shuwanito Bundle

Blue team defense and threat detection specialist. Use when you need SIEM analysis, anomaly detection, incident response planning, or zero-day defense strategies. Focuses on reducing detection time and minimizing false positives in security monitoring.

shuwanito Bundle

Threat intelligence and predictive cybersecurity specialist. Use when you need threat modeling, adversarial ML analysis, predictive security assessments, or dark web monitoring insights. Proactively identifies unmodeled threats and emerging attack vectors before they materialize.

shuwanito Bundle

Headless browser fleet orchestration and management. Use when you need to coordinate multiple headless browser instances for automated web auditing, scraping, or testing at scale using tools like Pinchtab. Detects and corrects unstable fleets that fail audit coverage.

shuwanito Bundle

Assessment & Evaluation Architect specializing in educational assessment design, rubrics, formative and summative evaluation, and portfolios. Use when you need to design evaluations that measure competencies, create rubrics, or audit existing assessments for alignment and clarity.

jordangaston Bundle

Apply the Imagineering Pyramid — Lou Prosperi's framework derived from Walt Disney Imagineering's theme-park design principles — to develop, refine, audit, or "plus" any creative idea, product, feature, experience, or piece of communication. Use this skill whenever the user wants to design an experience, shape a user journey or onboarding flow, make something more engaging, memorable, or intuitive, pressure-test a creative concept, sharpen a pitch or landing page, or turn a rough idea into a coherent designed experience. Also trigger on explicit mentions of Imagineering, the Imagineering Pyramid, "the Art of the Show," theming, wienies, forced perspective, plussing, or "designing it like Disney would." Especially useful for founders and builders treating a product as an experience rather than a feature list.

jordangaston Skill

Reference guide for Wave Terminal's wsh CLI commands. Use when the user asks about wsh commands, Wave Terminal CLI usage, or needs help with wsh syntax, flags, and examples. Covers: view, edit, editor, getmeta, setmeta, ai, editconfig, setbg, badge, run, deleteblock, ssh, wsl, web, notify, conn, setconfig, file, launch, getvar/setvar, termscrollback, wavepath, blocks, and secret.

x-cmd Skill

Look up CVE records via x cve — cached, zero-API-key, daily xz TSV. Load for cve, vulnerability id, kev, epss, nvd, cvelist, or security advisory.

andresnator Skill

Trigger: tooling audit, test tooling gaps. Detect build/test/coverage/mutation tooling for refactor safety plans.

andresnator Bundle

Trigger: dependency audit, CVE scan, vulnerable libraries, runtime support. Audit dependency and runtime risk with read-only evidence.

blacklanternsecurity Skill

Exploit Cross-Site Request Forgery (CSRF) vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Exploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Guide DOM-based XSS exploitation during authorized penetration testing.

blacklanternsecurity Skill

Guide stored (persistent) and blind XSS exploitation during authorized penetration testing.

blacklanternsecurity Skill

Exploit JWT (JSON Web Token) vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Exploit Apache JServ Protocol (AJP) misconfigurations and Ghostcat (CVE-2020-1938) for file read and remote code execution on Apache Tomcat. Use when port 8009 is open or AJP connector is exposed.

blacklanternsecurity Skill

Exploit OAuth 2.0 and OpenID Connect vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Guide reflected XSS exploitation during authorized penetration testing.

blacklanternsecurity Skill

Exploit LDAP injection vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Exploit race conditions and TOCTOU vulnerabilities in web applications during authorized penetration testing.

blacklanternsecurity Skill

Establishes persistence and exploits weak certificate mapping in AD CS. Covers ESC9 (no security extension), ESC10 (weak certificate mapping), ESC12-15 (YubiHSM, issuance policy, altSecIdentities, application policies), Golden Certificate (forge with stolen CA key), certificate theft (DPAPI/CAPI/CNG), and account persistence via certificate mapping.

blacklanternsecurity Skill

Exploit PHP code evaluation injection via eval(), assert(), preg_replace /e, create_function(), call_user_func(), usort() callbacks, and runtime function creation (runkit, uopz). Distinct from OS command injection (shell operators) and SSTI (template engines) — this targets direct PHP code evaluation of user input.

blacklanternsecurity Skill

Security-focused source code review. Identifies hardcoded credentials, injection sinks, authentication weaknesses, and framework-specific vulnerabilities. Use when application source code is available for review.

blacklanternsecurity Skill

Exploit PHP deserialization vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Exploit remote SMB vulnerabilities for unauthenticated code execution on Windows hosts.

blacklanternsecurity Skill

Exploit browser-based attack surfaces: malicious extension crafting for bot interaction scenarios, Chrome DevTools Protocol abuse on exposed debug ports, and browser profile/cache data extraction from compromised hosts.

blacklanternsecurity Skill

Exploit Java deserialization vulnerabilities during authorized penetration testing.

blacklanternsecurity Skill

Exploit CORS (Cross-Origin Resource Sharing) misconfigurations during authorized penetration testing.