Results for “the-sleuth-kit”

Configure and manage GitHub secret scanning, push protection, custom patterns, and alert remediation.

明楼（谍战虚构）认知与表达框架（压缩蒸馏）：三面间谍、辞令层叠、亲情作人质 触发：伪装者 等。禁止间谍违法教程

Manages Kit (formerly ConvertKit) email marketing lists via a managed OAuth gateway, covering subscribers, tags, forms, sequences, broadcasts, and custom fields.

Manage Kit (formerly ConvertKit) email marketing data through a managed OAuth gateway, covering subscribers, tags, forms, sequences, broadcasts, segments, and custom fields.

Manage Kit (formerly ConvertKit) email marketing lists, subscribers, tags, forms, sequences, broadcasts, and custom fields through a managed OAuth gateway.

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.

Detects leaked secrets in Git repositories by scanning full commit history with Gitleaks rules and the GitHub Secret Scanning API, identifying exposed API keys, tokens, and credentials.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Collects publicly available information about a target organization to identify attack surfaces, social engineering targets, technology stacks, and credential exposures for authorized security testing.

Investigate tokens, wallets, and on-chain entities with natural-language answers backed by on-chain data. Detect insiders, whales, pump-and-dump, wash trading, and wallet networks on Base.

【河图】SKILL.md — 全术数技能系统 v2.0

Scans a project for stack signals and pain points, searches the skills-hub registry and local skills, scores candidates, and presents a ranked shortlist with install commands.

Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".

安室透（少年推理漫）认知与表达框架（压缩蒸馏）：三重身份张力、波本梗、服务生伪装 触发：名侦探柯南 等。虚构；禁止犯罪教唆

Scans agent skills for security issues including prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

Chief Security Officer mode. (gstack)

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

GitHub Spec-Kit integration for constitution-based spec-driven development. 7-phase workflow (constitution, specify, clarify, plan, tasks, analyze, implement). Use when working with spec-kit CLI, .specify/ directories, or creating specifications with constitution-driven development. Triggered by "spec-kit", "speckit", "constitution", "specify", references to .specify/ directory, or spec-kit commands.

Configure Gemini and Codex CLI tools with Cloudflare AI Gateway endpoints and MCP servers.

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".

Shortcut for security review on current change set. Runs layered checks (secret-scan, dep-audit, semgrep, OWASP patterns, prompt-injection review).

Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks.

Composite skill — diagnose, repair, and validate a test suite end-to-end. Chains test-health (diagnose) → config-drift-detect (gate compatibility) → test-cleanup (prune + add integration tests) → mutation-test (validate survivors) → adr-write (capture decisions) → docs-sync. Use when "the test suite is bad" or you've hit the test-cleanup-bails-at-the-gate failure mode.

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment.

吕秀才（情景喜剧虚构）认知与表达框架（压缩蒸馏）：子曰嘴炮、读书人迂阔与意外高光 触发：武林外传 等。虚构

Conduct passive OSINT reconnaissance on target organizations using a MITRE ATT&CK framework. Discovers employees, email patterns, subdomains, infrastructure, leaked credentials, and cloud assets with confidence-scored findings.

利威尔（少年漫）认知与表达框架（压缩蒸馏）：兵长洁癖战力、矮个子反差、残酷抉择 触发：进击的巨人 等。虚构；非仇恨教唆

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.

御坂美琴（少年漫）认知与表达框架（压缩蒸馏）：炮姐傲娇、正义感、学园都市梗 触发：某科学的超电磁炮 等。虚构

Stack the Tech: the right tech and the right signals

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

Publishes agent skills to GitHub with automatic validation of SKILL.md, README quality checks, repository creation or updates, and real installation verification via npx skills.

SkillHub 每日推荐 v6.2

Crypto Wallet Helper