Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
Quick Pentest Reference
zebbern
This skill should be used when the user asks to "perform quick enumeration", "run directory busting", "enumerate DNS", "discover live hosts", "brute force passwords", or "needs a pentest cheat sheet". It provides rapid reference commands for penetration testing.
Pentesting from Beginner to Advanced
zebbern
The assistant provides a structured web application penetration testing learning path from fundamentals to advanced techniques. Activate when users ask about "learning pentesting," "web security training," "OWASP vulnerabilities," "BurpSuite tutorial," "penetration testing roadmap," or "web app security course."
OSCP Notes
zebbern
The assistant provides detailed OSCP preparation notes covering service enumeration, exploitation techniques, and protocol-specific attacks. Activate when users ask about "OSCP enumeration," "service pentesting," "SMB attacks," "FTP exploitation," "SSH pentesting," or "protocol-specific exploits."
Phishing Attacks
zebbern
The assistant guides users through phishing attack simulation tools and techniques for penetration testing and security awareness. Activate when users ask about "phishing simulation," "social engineering testing," "Shellphish," "WiFi phishing," "credential harvesting," or "security awareness training."
Wi-Fi Penetration Testing
zebbern
This skill should be used when the user asks to "perform wireless network penetration testing", "crack WEP or WPA passwords", "capture Wi-Fi handshakes", "conduct deauthentication attacks", "test wireless security", "perform MITM attacks on Wi-Fi", or "assess wireless network vulnerabilities". It provides comprehensive techniques for auditing wireless network security.
bug-bounty
Mikacr1138
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports.
📦 Dependency Management
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
🏷️ Issue Analysis with Label Inference
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
auditing-security
Git-Fg
"Scans for secrets and performs comprehensive security audits. MUST Use when verifying security of code changes or auditing file safety."
code-sync
niracler
Use when syncing all git repos under ~/code across machines, typically at end-of-day (push) or start-of-day (pull). Triggers on「同步代码」「code-sync」「下班同步」「上班更新」.
django-reviewer
physics91
WHEN: Django project review, ORM queries, views/templates, admin customization WHAT: ORM optimization + View patterns + Template security + Admin config + Migration safety WHEN NOT: FastAPI → fastapi-reviewer, Flask → flask-reviewer, DRF API only → consider api-expert
📦 Dependency Management
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
coder-system-design-external-api
OzeroHAX
Reliable and secure external API integration patterns for production-grade services.
🔐 Security Audit and Vulnerability Scanning
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
testing-security
OzeroHAX
Basic security testing (OWASP, auth, data exposure)
planning-risk-assessment
OzeroHAX
Risk assessment: likelihood/impact, mitigations, residual risk
security
scottymcandrew
Security audit specialist. Use before releases, after authentication/authorization changes, when handling sensitive data, or for periodic security reviews of code.
secure-node-typescript
joacod
'Write secure-by-default Node.js and TypeScript applications following security best practices. Use when: (1) Writing new Node.js/TypeScript code, (2) Creating API endpoints or middleware, (3) Handling user input or form data, (4) Implementing authentication or authorization, (5) Working with secrets or environment variables, (6) Setting up project configurations (tsconfig, eslint), (7) User mentions security concerns, (8) Reviewing code for vulnerabilities, (9) Working with file paths or child processes, (10) Setting up HTTP headers or CORS.'
wcag-audit-perceivable-media
Jkense
Route audio, video, and multimedia accessibility requirements
wcag-audit-perceivable-layout
Jkense
Route page structure and spatial organization accessibility requirements
fullstack-security
pluginagentmarketplace
Security and performance - hardening, optimization, auditing
backend-dev
dy9759
Comprehensive backend development workflow that orchestrates expert analysis, architecture design, implementation, and deployment using the integrated toolset. Handles everything from API design and database architecture to security implementation and DevOps automation.
iterative-converging-audit
rolandcanyon-cmd
Run any "find all instances of X" sweep — security audit, safety audit, code review, research, compliance check — as an iterative loop that does NOT stop at one pass. Audit, fix, RE-audit, repeat until a clean pass returns zero new discoveries. Trigger words: audit, sweep, find all, review everything, comprehensive, thorough, exhaustive, security review, did we get everything, convergence.
magento-security-analyst
maxnorm
Conducts comprehensive Magento 2 security assessments and implements security measures. Use when auditing security, identifying vulnerabilities, implementing security controls, or ensuring compliance. Masters security auditing, vulnerability management, and compliance frameworks.