Plugins

12 plugins

Security from nivkazdan/skills-agents-catalog.

16 skills · plugin

Security audits, vulnerability scanning and secure coding.

30 skills · plugin

Code Security Review Pipeline

Audit code changes for bugs, security flaws, and quality issues before merging.

15 skills · plugin

@alirezarezvani

Engineering Team

32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security,

16 skills · plugin

Static Analysis

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

3 skills · plugin

Testing Handbook Skills

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills · plugin

MCP Security Audit Pipeline

Audit MCP servers for secrets exposure, shell injection, and supply chain risks.

12 skills · plugin

Secure Laravel Deployment

Installs a pipeline to harden, audit, verify, and enforce security for Laravel apps.

4 skills · plugin

Secure Firebase Backend

Installs a pipeline to validate, plan, execute, and enforce Firebase security best practices.

7 skills · plugin

PR Review Pipeline

Install this pack to review a PR with structured analysis, security scanning, and quality enforcement.

11 skills · plugin

Bug Finding Pipeline

Install this pack to detect bugs, security issues, and logical errors in your branch changes.

9 skills · plugin

Secure Spring Boot Service

Installs a pipeline to harden, audit, verify, and enforce security for Spring Boot services.

4 skills · plugin

Results for “security”

1,231 skills

Detecting Exfiltration Over Dns With Zeek

Analyze Zeek dns.log files to detect DNS-based data exfiltration by computing Shannon entropy, flagging long subdomain labels, and identifying anomalous query patterns.

24.6k · bundle

Detecting Dcsync Attack In Active Directory

Detect DCSync attacks by monitoring Active Directory replication requests from non-domain-controller accounts via Event ID 4662 and associated GUIDs.

24.6k · bundle

Performing Threat Hunting With Elastic Siem

Proactively search for threats in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection.

24.6k · bundle

Performing Cloud Incident Containment Procedures

Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement.

24.6k · bundle

agentskillexchange

Semgrep Rule Runner

Runs Semgrep static analysis via the semgrep CLI with custom YAML rule packs, supports community rules, parses JSON output, and integrates with the Semgrep App API for findings management.

cloudthinker-ai

Audit Okta identity and access management configurations with read-only API calls, covering user lifecycle, application assignments, MFA status, group and policy review, and system log analysis.

AWS Metadata Ssrf

Exploit SSRF vulnerabilities in AWS EC2-hosted applications to extract IAM credentials and User Data from the Instance Metadata Service, including techniques for bypassing basic filters against IMDSv1.

Validate Azure deployments against functional, security, performance, and operational criteria before production release. Use this skill when users ask for readiness checks, health verification, or production sign-off gates. Covers Well-Architected Framework validation, SLA verification, and release readiness.

当一段改动已经写完、要在收尾或合并前对它做一次独立审查时使用——如"审一遍这条分支、review 这次改动、这批代码有没有问题、帮我把关再合"。先把 BASE..HEAD 生成一份审查包一次读完，再按 correctness / readability / architecture / security / performance 五轴加测试质量逐项判定，输出带 file:line 的 Critical / Important / Minor 分级 findings。composable 层能力单元，通常由 execute-task 在整体验收时调用。不要用于：改动还没写完、只想跑测试、要的是动手修复而不是审查、评审需求或技术方案本身。

Built-in MCP (Model Context Protocol) client that connects to external MCP servers, discovers their tools, and registers them as native Hermes Agent tools. Supports stdio and HTTP transports with automatic reconnection, security filtering, and zero-config tool injection.

Expert guidance for OPA (Open Policy Agent), the CNCF policy engine for unified authorization across the stack. Helps developers write Rego policies for Kubernetes admission control, API authorization, infrastructure-as-code validation, and data filtering — enforcing security policies as code.

construct-ai-primary

Incident Response

Use when detecting, responding to, or recovering from system failures, outages, security breaches, or critical errors. This skill provides a structured incident response process for any type of failure, ensuring consistent handling, communication, and post-incident learning.

Product Intake Processor

Use this when the user gives a broad app, system, service, tool, or feature request and it must be converted into structured implementation requirements, runtime assumptions, security concerns, likely components, and handoff tasks for developer or designer skills.

Built-in MCP (Model Context Protocol) client that connects to external MCP servers, discovers their tools, and registers them as native Hermes Agent tools. Supports stdio and HTTP transports with automatic reconnection, security filtering, and zero-config tool injection.

Built-in MCP (Model Context Protocol) client that connects to external MCP servers, discovers their tools, and registers them as native Hermes Agent tools. Supports stdio and HTTP transports with automatic reconnection, security filtering, and zero-config tool injection.

Entry Point Analyzer

Identifies state-changing entry points in smart contract codebases for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.

Cairo Vulnerability Scanner

Scans Cairo/StarkNet smart contracts for 6 critical vulnerability patterns including arithmetic overflow, L1-L2 messaging issues, and signature replay. Use when auditing StarkNet projects.

Detecting Pass The Hash Attacks

Hunt for Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons where Kerberos is expected, and correlating with credential dumping indicators.

24.6k · bundle

Testing For Broken Access Control

Systematically test web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.

24.6k · bundle

Detecting Attacks On Scada Systems

Detects cyber attacks targeting SCADA systems, including man-in-the-middle, command injection, HMI compromise, historian manipulation, and DoS, using OT-specific intrusion detection and protocol anomaly analysis.

24.6k · bundle

Performing Container Escape Detection

Audits Kubernetes pods for container escape vectors by analyzing privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts using the Kubernetes Python client.

24.6k · bundle

Generating Threat Intelligence Reports

Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts.

24.6k · bundle

Performing Dmarc Policy Enforcement Rollout

Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.

24.6k · bundle

Analyzing Network Covert Channels In Malware

Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, and protocol abuse for C2 and data exfiltration.

24.6k · bundle

Implementing Google Workspace Admin Security

Hardens Google Workspace environments by configuring super admin accounts, phishing-resistant MFA, email authentication (SPF/DKIM/DMARC), DLP policies, OAuth app controls, and external sharing restrictions.

24.6k · bundle

Implementing Security Information Sharing With Stix2

Create, validate, and share STIX 2.1 threat intelligence objects using the stix2 Python library, covering indicators, malware, campaigns, relationships, bundles, and TAXII 2.1 publishing.

24.6k · bundle

Implementing Network Segmentation With Firewall Zones

Design and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.

24.6k · bundle

Implementing Network Intrusion Prevention With Suricata

Deploy and configure Suricata as a network intrusion prevention system with custom rules, Emerging Threats rulesets, and inline traffic inspection for real-time threat blocking.

24.6k · bundle

Competition Prompt Injection

Analyzes prompt injection, retrieval poisoning, memory contamination, planner drift, and tool-boundary abuse in agentic systems, mapping trust boundaries and proving exploit chains.

12.8k · bundle

Assesses a project against all five SOC 2 Trust Service Criteria, producing a control-by-control PASS/PARTIAL/FAIL matrix with evidence references, remediation roadmap, and evidence collection checklist for audit readiness.

Clawhub Skill Optimizer

Optimize publish-ready SKILL.md packages across ClawHub, Claude, Hermes, and GitHub. Use when: refining naming, frontmatter, body structure, bilingual copy, and release-mode variants without changing runtime behavior. Not for plugin manifest generation or deep security auditing.

Launch Readiness Reviewer

Review whether a product, MVP, or feature is actually ready to launch. Use when the team needs a production-minded check across product quality, UX edge cases, auth and security, observability, support readiness, pricing readiness, and post-launch measurement.

Azure Enterprise Infra Planner

Architect and provision enterprise Azure infrastructure from workload descriptions, generating Bicep or Terraform for networking, identity, security, and multi-resource topologies aligned with the Well-Architected Framework.

Wake Token Spotter Analysis

Evaluates Base ERC-20 tokens by contract address, returning a 0-100 score across five criteria, launch protocol classification, security flags, and a narrative interpretation.

Escaping Containers To Host

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

24.6k · bundle

Configuring Hsm For Key Storage

Configure Hardware Security Modules (HSMs) using the PKCS#11 standard interface for key generation, signing, encryption, and key management with both physical HSMs and SoftHSM2 for development.

24.6k · bundle