Plugins

12 plugins

Security from nivkazdan/skills-agents-catalog.

16 skills · plugin

Security audits, vulnerability scanning and secure coding.

30 skills · plugin

Code Security Review Pipeline

Audit code changes for bugs, security flaws, and quality issues before merging.

15 skills · plugin

@alirezarezvani

Engineering Team

32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security,

16 skills · plugin

Static Analysis

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

3 skills · plugin

Testing Handbook Skills

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills · plugin

MCP Security Audit Pipeline

Audit MCP servers for secrets exposure, shell injection, and supply chain risks.

12 skills · plugin

Secure Laravel Deployment

Installs a pipeline to harden, audit, verify, and enforce security for Laravel apps.

4 skills · plugin

Secure Firebase Backend

Installs a pipeline to validate, plan, execute, and enforce Firebase security best practices.

7 skills · plugin

PR Review Pipeline

Install this pack to review a PR with structured analysis, security scanning, and quality enforcement.

11 skills · plugin

Bug Finding Pipeline

Install this pack to detect bugs, security issues, and logical errors in your branch changes.

9 skills · plugin

Secure Spring Boot Service

Installs a pipeline to harden, audit, verify, and enforce security for Spring Boot services.

4 skills · plugin

Results for “security”

877 skills

sakamoto-family-smile

Laravel Security

Hardens Laravel applications against common vulnerabilities with guidance on authentication, authorization, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

Network Policies Security

Implements Kubernetes network policies for micro-segmentation, covering ingress/egress rules, Calico and Cilium, with a Python CLI for managing and validating policies.

construct-ai-primary

Threat Modeling

Use when designing new systems, features, or integrations to identify potential security threats and vulnerabilities before they are exploited. This skill provides a structured approach to threat identification, risk assessment, and mitigation planning.

Threat Modeling

Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.

Quarkus Verification

Runs a comprehensive verification pipeline for Quarkus projects including build, static analysis, tests with coverage, security scans, native compilation, and diff review before PRs or releases.

Github Actions Hardening

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

36.2k · bundle

Correlating Threat Campaigns

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns and attribute them to common threat actors.

24.6k · bundle

Performing Ssl Stripping Attack

Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms.

24.6k · bundle

Detecting API Enumeration Attacks

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

24.6k · bundle

Detecting AWS Iam Privilege Escalation

Identify AWS IAM privilege escalation paths by analyzing policies for dangerous permission combinations and least-privilege violations using boto3 and Cloudsplaining-style analysis.

24.6k · bundle

Detecting Lateral Movement With Splunk

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

24.6k · bundle

Exploiting Constrained Delegation Abuse

Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.

24.6k · bundle

Implementing Code Signing For Artifacts

Sign build artifacts (binaries, packages, containers) with GPG, Sigstore, and platform-specific tools to ensure integrity and authenticity throughout the software supply chain.

24.6k · bundle

Implementing Mitre Attack Coverage Mapping

Map MITRE ATT&CK coverage to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.

24.6k · bundle

Detecting AI Model Prompt Injection Attacks

Detects prompt injection attacks targeting LLM-based applications using regex pattern matching, heuristic scoring, and DeBERTa transformer classification.

24.6k · bundle

Exploiting Ms17 010 Eternalblue Vulnerability

Exploits the MS17-010 (EternalBlue) vulnerability in Microsoft's SMBv1 implementation for authorized security testing, red team exercises, and penetration testing engagements.

24.6k · bundle

Performing Network Traffic Analysis With Zeek

Deploy Zeek network security monitor to capture, parse, and analyze network traffic metadata for threat detection, anomaly identification, and forensic investigation.

24.6k · bundle

Performing Power Grid Cybersecurity Assessment

Conduct cybersecurity assessments of electric power grid infrastructure, including NERC CIP compliance verification, substation automation security, and IEC 61850 protocol analysis.

24.6k · bundle

Develops custom WordPress themes and plugins, creates Gutenberg blocks, configures WooCommerce stores, implements REST API endpoints, and applies security hardening with nonces, sanitization, escaping, and capability checks.

10.4k · bundle

sakamoto-family-smile

Secure Perl applications against injection, taint, and web vulnerabilities with validated patterns for input handling, file operations, process execution, and DBI queries.

srednoff888-art

Secrets Env Rotation

Use this skill for secret inventory, env vars, rotation plans, safe dev/prod separation, leak response. Trigger when the task involves security work related to Secrets Env Rotation, implementation, audits, debugging, strategy, or validation.

srednoff888-art

Supply Chain Sbom Sca

Use this skill for SBOM, SCA, lockfile review, provenance, package integrity, supply-chain risk. Trigger when the task involves security work related to Supply Chain SBOM SCA, implementation, audits, debugging, strategy, or validation.

Clawhub Security Auditor

Audit public skill or plugin bundles for ClawHub, Claude, Hermes, and GitHub release risks. Use when: checking Suspicious/upload flags, dangerous local behaviors, metadata mismatches, legacy auth surface, or non-runtime files before publishing.

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes in API designs, configuration schemas, and cryptographic library ergonomics.

Conducting Phishing Incident Response

Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages, and remediating affected accounts.

24.6k · bundle

Exploiting Bgp Hijacking Vulnerabilities

Simulates BGP hijacking attacks in isolated lab environments to test RPKI deployment, route origin validation, and BGP monitoring defenses against prefix hijacking and route leak attacks.

24.6k · bundle

Securing Remote Access To Ot Environment

Implements secure remote access architecture for OT/ICS environments with jump servers, MFA, session recording, and privileged access management.

24.6k · bundle

Performing Cloud Log Forensics With Athena

Query AWS CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs with Athena for forensic investigation of security incidents.

24.6k · bundle

Hardening Linux Endpoint With Cis Benchmark

Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements.

24.6k · bundle

Detecting Typosquatting Packages In NPM Pypi

Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity, publish date heuristics, and download count anomalies.

24.6k · bundle

Conducting Social Engineering Penetration Test

Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.

24.6k · bundle

Performing Log Analysis For Forensic Investigation

Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.

24.6k · bundle

Generates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and security reports after reverse engineering, penetration testing, or CTF tasks.

12.8k · bundle

Get best practices for developing applications with Helidon 4 (SE and MP). Use when working with Helidon SE or Helidon MP, HttpService routing, Helidon DB Client, MicroProfile Config, Helidon Security, or Helidon testing in Java 21+ projects.

You're a developer who has shipped dozens of Firebase projects. You've seen the "easy" path lead to security breaches, runaway costs, and impossible migrations. You know Firebase is powerful, but you also know its sharp edges.

hoangnguyen0403

Python Language

Core Python 3.11+ language standards for typing, dataclasses, imports, pathlib, and stdlib-first code. Use for idiomatic language constructs in Python modules or stubs; defer pytest fixtures, database/client configuration, subprocess security, and other specialized concerns.