Plugins

12 plugins

Security from nivkazdan/skills-agents-catalog.

16 skills · plugin

Security audits, vulnerability scanning and secure coding.

30 skills · plugin

Code Security Review Pipeline

Audit code changes for bugs, security flaws, and quality issues before merging.

15 skills · plugin

@alirezarezvani

Engineering Team

32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security,

16 skills · plugin

Static Analysis

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

3 skills · plugin

Testing Handbook Skills

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills · plugin

MCP Security Audit Pipeline

Audit MCP servers for secrets exposure, shell injection, and supply chain risks.

12 skills · plugin

Secure Laravel Deployment

Installs a pipeline to harden, audit, verify, and enforce security for Laravel apps.

4 skills · plugin

Secure Firebase Backend

Installs a pipeline to validate, plan, execute, and enforce Firebase security best practices.

7 skills · plugin

PR Review Pipeline

Install this pack to review a PR with structured analysis, security scanning, and quality enforcement.

11 skills · plugin

Bug Finding Pipeline

Install this pack to detect bugs, security issues, and logical errors in your branch changes.

9 skills · plugin

Secure Spring Boot Service

Installs a pipeline to harden, audit, verify, and enforce security for Spring Boot services.

4 skills · plugin

Results for “security”

877 skills

Perform thorough code reviews on files or pull requests, checking for bugs, security vulnerabilities, performance issues, and style violations. Use when the user requests code review or provides relevant inputs for this workflow.

Intended Vs Implemented

Finds gaps between documented intent and actual implementation in codebases, catching bugs that generic scanners miss because they lack a model of intent.

Cloud Design Patterns

Provides 42 technology-agnostic cloud design patterns for distributed systems, covering reliability, performance, messaging, security, and deployment to help architects design robust workloads.

36.2k · bundle

Supply Chain Risk Auditor

Audits project dependencies for supply chain risks including single maintainers, unmaintained packages, low popularity, high-risk features, past CVEs, and missing security contacts.

Exploiting Idor Vulnerabilities

Identify and exploit Insecure Direct Object Reference vulnerabilities during authorized penetration tests by manipulating object identifiers in API requests and URLs.

24.6k · bundle

Collecting Indicators Of Compromise

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing.

24.6k · bundle

Detecting Modbus Protocol Anomalies

Detects anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems using Zeek, Suricata, and custom Python analysis.

24.6k · bundle

Implementing GCP Vpc Firewall Rules

Audit, create, and monitor GCP VPC firewall rules to enforce network segmentation and least-privilege access.

24.6k · bundle

Analyzing Docker Container Forensics

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

24.6k · bundle

Detecting Process Hollowing Technique

Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.

24.6k · bundle

Hardening Docker Daemon Configuration

Hardens the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.

24.6k · bundle

Reverse Engineering IOS App With Frida

Dynamically instrument iOS apps with Frida to trace methods, extract secrets, and bypass security controls during authorized penetration testing.

24.6k · bundle

Performing Log Source Onboarding In Siem

Integrate new data sources into SIEM platforms by configuring collectors, parsers, normalization, and validation for security monitoring.

24.6k · bundle

Performing AWS Privilege Escalation Assessment

Identify and test IAM misconfigurations that allow privilege escalation in AWS environments using Pacu, CloudFox, Principal Mapper, and manual analysis.

24.6k · bundle

Building Threat Intelligence Enrichment In Splunk

Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

24.6k · bundle

Implementing Image Provenance Verification With Cosign

Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.

24.6k · bundle

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

12.8k · bundle

Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.

12.8k · bundle

Guides authorized macOS and Mach-O reverse engineering covering codesign analysis, Objective-C/Swift symbol recovery, endpoint security surfaces, and Apple platform malware analysis.

12.8k · bundle

Competition Android Hooking

Hooks Android APKs to inspect signer logic, trace Java and native boundaries, bypass SSL pinning or root checks, and replay accepted mobile requests.

12.8k · bundle

agentskillexchange

Semgrep Rule Author

Generates custom Semgrep rules from natural language descriptions of vulnerability patterns, verifying syntax with semgrep --validate and testing against sample fixtures with semgrep --test.

Pump Rust Vanity

Production-grade multi-threaded Rust vanity address generator for Solana — 100K+ keys/sec using Rayon parallel iterators with solana-sdk, Base58 pattern matching, prefix/suffix support, security-hardened file output, and Criterion benchmarks.

richardnguyen0715

Security And Hardening

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

Doubt Driven Development

Subjects every non-trivial decision to a fresh-context adversarial review before it stands, prioritizing correctness over speed for high-stakes or unfamiliar code.

Security Threat Model

Performs repository-grounded threat modeling by enumerating trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, then writes a concise Markdown threat model.

23.3k · bundle

Code Maturity Assessor

Assesses codebase maturity using Trail of Bits' 9-category framework, producing a professional scorecard with evidence-based ratings and actionable recommendations.

Audit Solidity smart contracts for reentrancy, oracle manipulation, token decimals, SafeERC20, ERC-4626 inflation, infinite approvals, and MEV vulnerabilities with a pre-deployment checklist.

Detecting Shadow API Endpoints

Discover and inventory undocumented API endpoints by comparing live traffic against OpenAPI specs, scanning code repositories, and analyzing cloud configurations.

24.6k · bundle

Scanning Docker Images With Trivy

Scan Docker images for vulnerabilities, misconfigurations, secrets, and license violations using Trivy, with CI/CD integration and policy enforcement.

24.6k · bundle

Exploiting Websocket Vulnerabilities

Test WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.

24.6k · bundle

Implementing AWS Nitro Enclave Security

Builds AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration, and secure vsock communication for processing sensitive data.

24.6k · bundle

Implementing Semgrep For Custom Sast Rules

Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.

24.6k · bundle

Performing Web Application Scanning With Nikto

Scan web servers and applications for vulnerabilities, misconfigurations, and outdated software using the Nikto open-source scanner.

24.6k · bundle

Conducting Internal Reconnaissance With Bloodhound Ce

Map Active Directory attack paths and identify privilege escalation chains using BloodHound Community Edition for authorized security assessments.

24.6k · bundle

Configure and test common network services (HTTP, HTTPS, SNMP, SMB) for penetration testing lab environments, enabling hands-on practice with service enumeration, log analysis, and security testing.

Conducts authorized security assessments to identify vulnerabilities, map them to OWASP and MITRE frameworks, and provide remediation guidance with responsible disclosure planning.