Plugins

12 plugins

Security from nivkazdan/skills-agents-catalog.

16 skills · plugin

Security audits, vulnerability scanning and secure coding.

30 skills · plugin

Code Security Review Pipeline

Audit code changes for bugs, security flaws, and quality issues before merging.

15 skills · plugin

@alirezarezvani

Engineering Team

32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security,

16 skills · plugin

Static Analysis

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

3 skills · plugin

Testing Handbook Skills

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills · plugin

MCP Security Audit Pipeline

Audit MCP servers for secrets exposure, shell injection, and supply chain risks.

12 skills · plugin

Secure Laravel Deployment

Installs a pipeline to harden, audit, verify, and enforce security for Laravel apps.

4 skills · plugin

Secure Firebase Backend

Installs a pipeline to validate, plan, execute, and enforce Firebase security best practices.

7 skills · plugin

PR Review Pipeline

Install this pack to review a PR with structured analysis, security scanning, and quality enforcement.

11 skills · plugin

Bug Finding Pipeline

Install this pack to detect bugs, security issues, and logical errors in your branch changes.

9 skills · plugin

Secure Spring Boot Service

Installs a pipeline to harden, audit, verify, and enforce security for Spring Boot services.

4 skills · plugin

Results for “security”

1,231 skills

Audit Solidity smart contracts for reentrancy, oracle manipulation, token decimals, SafeERC20, ERC-4626 inflation, infinite approvals, and MEV vulnerabilities with a pre-deployment checklist.

Detecting Shadow API Endpoints

Discover and inventory undocumented API endpoints by comparing live traffic against OpenAPI specs, scanning code repositories, and analyzing cloud configurations.

24.6k · bundle

Scanning Docker Images With Trivy

Scan Docker images for vulnerabilities, misconfigurations, secrets, and license violations using Trivy, with CI/CD integration and policy enforcement.

24.6k · bundle

Exploiting Websocket Vulnerabilities

Test WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.

24.6k · bundle

Implementing AWS Nitro Enclave Security

Builds AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration, and secure vsock communication for processing sensitive data.

24.6k · bundle

Implementing Semgrep For Custom Sast Rules

Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.

24.6k · bundle

Performing Web Application Scanning With Nikto

Scan web servers and applications for vulnerabilities, misconfigurations, and outdated software using the Nikto open-source scanner.

24.6k · bundle

Conducting Internal Reconnaissance With Bloodhound Ce

Map Active Directory attack paths and identify privilege escalation chains using BloodHound Community Edition for authorized security assessments.

24.6k · bundle

Configure and test common network services (HTTP, HTTPS, SNMP, SMB) for penetration testing lab environments, enabling hands-on practice with service enumeration, log analysis, and security testing.

AI Engineering Standards

Enforces production-grade Python and AI engineering standards for FastAPI, LangChain/LangGraph, RAG pipelines, and LLM integrations, covering type safety, error handling, testing, and security.

Conducts authorized security assessments to identify vulnerabilities, map them to OWASP and MITRE frameworks, and provide remediation guidance with responsible disclosure planning.

sakamoto-family-smile

Laravel Security

Hardens Laravel applications against common vulnerabilities with guidance on authentication, authorization, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

Provides chat-based Azure infrastructure assistance using the Azure CLI, supporting read-only queries, auditing, and monitoring of resources, with safe change proposals requiring explicit confirmation.

Network Policies Security

Implements Kubernetes network policies for micro-segmentation, covering ingress/egress rules, Calico and Cilium, with a Python CLI for managing and validating policies.

construct-ai-primary

Threat Modeling

Use when designing new systems, features, or integrations to identify potential security threats and vulnerabilities before they are exploited. This skill provides a structured approach to threat identification, risk assessment, and mitigation planning.

Testing strategies for MCP servers including unit tests, integration tests, schema validation, and security testingUse when "mcp testing, test mcp server, mcp inspector, mcp validation, mcp, testing, unit-testing, integration-testing, schema-validation" mentioned.

Threat Modeling

Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.

Quarkus Verification

Runs a comprehensive verification pipeline for Quarkus projects including build, static analysis, tests with coverage, security scans, native compilation, and diff review before PRs or releases.

Salesforce Apex Quality

Enforces bulk-safety rules, sharing model requirements, CRUD/FLS security, SOQL injection prevention, PNB test coverage, and modern Apex idioms for Salesforce development.

Github Actions Hardening

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

36.2k · bundle

Correlating Threat Campaigns

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns and attribute them to common threat actors.

24.6k · bundle

Performing Ssl Stripping Attack

Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms.

24.6k · bundle

Detecting API Enumeration Attacks

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

24.6k · bundle

Detecting AWS Iam Privilege Escalation

Identify AWS IAM privilege escalation paths by analyzing policies for dangerous permission combinations and least-privilege violations using boto3 and Cloudsplaining-style analysis.

24.6k · bundle

Detecting Lateral Movement With Splunk

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

24.6k · bundle

Exploiting Constrained Delegation Abuse

Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.

24.6k · bundle

Implementing Code Signing For Artifacts

Sign build artifacts (binaries, packages, containers) with GPG, Sigstore, and platform-specific tools to ensure integrity and authenticity throughout the software supply chain.

24.6k · bundle

Implementing Mitre Attack Coverage Mapping

Map MITRE ATT&CK coverage to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.

24.6k · bundle

Detecting AI Model Prompt Injection Attacks

Detects prompt injection attacks targeting LLM-based applications using regex pattern matching, heuristic scoring, and DeBERTa transformer classification.

24.6k · bundle

Exploiting Ms17 010 Eternalblue Vulnerability

Exploits the MS17-010 (EternalBlue) vulnerability in Microsoft's SMBv1 implementation for authorized security testing, red team exercises, and penetration testing engagements.

24.6k · bundle

Performing Network Traffic Analysis With Zeek

Deploy Zeek network security monitor to capture, parse, and analyze network traffic metadata for threat detection, anomaly identification, and forensic investigation.

24.6k · bundle

Performing Power Grid Cybersecurity Assessment

Conduct cybersecurity assessments of electric power grid infrastructure, including NERC CIP compliance verification, substation automation security, and IEC 61850 protocol analysis.

24.6k · bundle

Develops custom WordPress themes and plugins, creates Gutenberg blocks, configures WooCommerce stores, implements REST API endpoints, and applies security hardening with nonces, sanitization, escaping, and capability checks.

10.4k · bundle

Audit paid-ad landing pages for message match, mobile experience, performance, accessibility, trust, forms, consent, tracking, security, and conversion friction.

Index of Odoo 19 development guides covering actions, controllers, data files, decorators, fields, manifests, migrations, mixins, models, OWL components, performance, reports, security, testing, translation, transactions, and views.

sakamoto-family-smile

Secure Perl applications against injection, taint, and web vulnerabilities with validated patterns for input handling, file operations, process execution, and DBI queries.