Results for “tool-abuse”

Apply least-privilege tool allowlisting, identity binding, and human-in-the-loop controls for agent tool calls.

Design and validate model-facing tool definitions with clear names, action-oriented descriptions, bounded JSON Schema parameters, explicit side effects, safe defaults, idempotency, errors, and realistic tests. Use when creating function-calling tools, MCP tools, agent actions, structured tool inputs, or when a model selects the wrong tool, invents arguments, or causes unsafe side effects.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

Audit Kubernetes RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous bindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

Design tool descriptions, schemas, and response formats that agents can reliably route on, including MCP server design, tool-set consolidation, and naming conventions.

Assesses new tools, technologies, and integration options for adoption, comparing vendors and recommending implementations.

Master the AI tools that automate repetitive work and connect your tools. From simple Zapier integrations to complex AI-powered workflows, reclaim hours every week. Use when "automation, workflow, integrate tools, connect apps, zapier, no-code, automate process, rpa, automation, workflow, integration, no-code, zapier, make, rpa" mentioned.

Explains how to define and use tools with the Claude API, including tool schemas, tool choice, and server-side tools for code execution and web search.

Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.

Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.

Audits ECC Tools GitHub App for cost issues like runaway PR creation, quota bypass, premium-model leakage, and duplicate jobs, using an evidence-first workflow.

Expert technology assessment specialist focused on evaluating, testing, and recommending tools, software, and platforms for business use and productivity optimization

Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.

Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Claude ('No, that's wrong...', 'Actually...'), (3) User requests a capability that doesn't exist, (4) An external API or tool fails, (5) Claude realizes its knowledge is outdated or incorrect, (6) A better approach is discovered for a recurring task. Also review learnings before major tasks.

Audit your GTM tech stack for overlap, gaps, and wasted spend. What each tool actually does, where two tools do the same job, what nobody uses, and a consolidation plan with the renewal calendar attached. Built for B2B RevOps teams, customizable to your stack and your budget. Trigger on "audit my tech stack", "what tools overlap", "what are we not using", "cut our GTM spend", "what should we consolidate", or any tooling diagnostic.

Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust.

Operate and extend barretlee/agent-pulse, the evidence-backed AI industry intelligence system: inspect source catalog and lifecycle, collect and normalize signals, bind evidence, cluster Events, evaluate system health, generate Scout hypotheses, export the privacy-safe public site, and verify release gates. Use when the user asks to run, configure, debug, extend, or explain Agent Pulse, its collectors, Control Room, narratives, Scout, or GitHub Pages output. Triggers on: agent-pulse, Agent Pulse, evidence-backed intelligence, source catalog, signal collection, Event clustering, source audit, Scout opportunity, public export, weekly brief, or AI industry intelligence pipeline.

Agent skill for user-tools - invoke with $agent-user-tools

Creates or modifies agent tools for OpenAI Agents SDK, covering search, analysis, API integration, and database query patterns with caching and metrics.

Analyzes Claude Code session logs to report token usage, tool and skill rankings, and session search by prompt text.

Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.

Read-only audit of product-analytics instrumentation: event taxonomy, funnel completeness, consent-gated firing, dead/duplicate/phantom events. Use when "audit our analytics", "are we tracking the right events", "funnel instrumentation", or before iterate-post-launch. PostHog/Amplitude/Mixpanel/GA4.

Compacts the current conversation into a handoff document for another agent to pick up, referencing existing artifacts by path or URL instead of duplicating them.

Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.

Audit a codebase, UI, or copy for machine-generated tells across prose, visual/UI, code, and structure/IA, then produce a phased de-slop burndown. Use when the user says "feels AI-generated", "looks like AI slop", "reads like ChatGPT", "feels generic/soulless", or wants an authenticity/voice pass before launch.

Fetches and analyzes LangSmith execution traces to debug LangChain and LangGraph agents, investigating errors, tool calls, and performance.

Security Craft

Use with analysis-agent or task-agent for task-local transaction, isolation, and conflict decisions. Do not use without a transaction decision or as task owner.

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.

Use to design or audit a QA dispute and appeal workflow with timeboxes, adjudication standards, and second-level consistency so appeals improve trust instead of rewriting scores without rules. Trigger for "QA appeal process", "agents disputing scores", "who adjudicates QA disputes", "overturn rate too high", second-level review standards, or calibration erosion from ad-hoc score changes.

Compact the current conversation into a handoff document for another agent to pick up, including suggested skills and references to existing artifacts.

Sets up and audits the Claude Code harness for a project: CLAUDE.md, .claude/rules, skills, subagents, settings.json permissions, hooks, verification loop. Commands: kickoff (scaffold new setup), check-playbook (score an existing one), scouting-report (last scorecard), adjust (fix bloat/misplaced instructions), drill (turn advisory prose into real hooks/permissions/CI), decline (record an accepted risk), gameplan (work order with acceptance criteria before building), watch-film (check a diff against that order for scope creep/weakened tests/false claims). Use for setting up Claude Code, or on: "Claude ignores my CLAUDE.md", "it's huge and still misses things", "it said done but ran nothing", "it changed files I didn't ask about", "it weakened a test to pass", "rule, skill, or hook?", "is my setup any good". Not for code quality (code-audit), test coverage (test-assessment), one-off prompt wording (genie-proof-prompts), new skill authoring (skill-creator), or compacting a conversation (handoff).

Post-execution skill crystallization and learning engine updates for WinDAGs. Runs after successful execution to update Thompson sampling parameters, track method quality, detect monster-barring, log near-miss events, and signal Kuhnian crises. Activate on "curator", "learning update", "skill crystallization", "Thompson sampling", "monster-barring", "near-miss", "Kuhnian crisis", "post-execution learning". NOT for pre-execution risk scanning (use windags-premortem), retrospective analysis (use windags-looking-back), or DAG construction (use windags-architect).