Results for “secrets-stripping”

Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".

Scans agent skills for security issues including prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

Configure and manage GitHub secret scanning, push protection, custom patterns, and alert remediation.

Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms.

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Scan codebase and git history for leaked secrets — API keys, tokens, passwords, private keys. Uses whispers-style regex patterns + gitleaks. Run as /leak-check before any git push. Alerts on Claude API keys, GitHub tokens, AWS credentials, and generic high-entropy strings.

Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

Extract a bounded part of the invoking codebase into a new GitHub repository with private and public-OSS readiness gates

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Internal harness probe for the OI-3 readability-guidance spike. Use only when explicitly told to invoke spike-probe. Verifies that a freshly-created project skill renders into a subagent's context via the Skill tool.

明楼（谍战虚构）认知与表达框架（压缩蒸馏）：三面间谍、辞令层叠、亲情作人质 触发：伪装者 等。禁止间谍违法教程

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

Use to check whether a conversation export, dataset or AI pipeline is leaking personal data that should have been redacted, and to measure how well the redaction actually works. Trigger for "is this export safe to share", "check our redaction", "can we use support transcripts for training", sending transcripts to a vendor or model, "is there PII in this dataset", or before opening support data to a wider audience.

Provides a comprehensive security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data exposure.

Scan text or a file for accidentally committed secrets (API keys, tokens)

Use this skill for secret inventory, env vars, rotation plans, safe dev/prod separation, leak response. Trigger when the task involves security work related to Secrets Env Rotation, implementation, audits, debugging, strategy, or validation.

Create masked staggered word reveals on scroll with GSAP ScrollTrigger. Use when headings, hero copy, section titles, or editorial text should reveal word-by-word through an overflow mask as they enter the viewport.

安室透（少年推理漫）认知与表达框架（压缩蒸馏）：三重身份张力、波本梗、服务生伪装 触发：名侦探柯南 等。虚构；禁止犯罪教唆

Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Provides structured techniques for breaking through stuck points in problem-solving, including collision-zone thinking, inversion, pattern recognition, and simplification.

Move issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.

Provides a structured 5-phase workflow for bug bounty and SRC vulnerability hunting, including 19 attack-type playbooks, 305 structured payloads, 263 WAF bypass variants, and 2,887 real HackerOne case studies.

Shortcut for security review on current change set. Runs layered checks (secret-scan, dep-audit, semgrep, OWASP patterns, prompt-injection review).

Load this skill when the user says "asvs security review", "asvs-security-review", "/asvs-security-review", or when invoked by reference from the review-issue skill's standards-review step. Performs a rule-by-rule walk of docs/security-standards.md against a diff, scoped to the ASVS sections the diff actually touches, and reports findings using the project's existing severity mapping.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Throwaway experiments to validate an idea before build.

Rereads code, specs, plans, reviews, or skill edits with fresh eyes to catch blunders, oversights, and omissions before closure, reporting concrete evidence-backed findings.

Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.

Test LLM applications for system prompt leakage using manual payloads, garak, and Promptfoo to extract embedded secrets and routing logic.

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

崔健（摇滚）认知与表达框架（压缩蒸馏）：地下与现场感、隐喻与直白并置… 触发：一块红布 等。非煽动违法

韩寒（作家车手）认知与表达框架（压缩蒸馏）：反套路叙事、冷幽默、公共发言锋利… 触发：三重门赛车 等。不伪造赛事实；尊重他人