Security
Security scanning and vulnerability detection
analyzing-macro-malware-in-office-documents
by mukul975
'Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download
analyzing-linux-system-artifacts
by mukul975
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover
analyzing-docker-container-forensics
by mukul975
Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to
analyzing-cyber-kill-chain
by mukul975
'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases
analyzing-disk-image-with-autopsy
by mukul975
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and
analyzing-email-headers-for-phishing-investigation
by mukul975
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify
analyzing-cobalt-strike-beacon-configuration
by mukul975
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure,
acquiring-disk-image-with-dd-and-dcfldd
by mukul975
Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through
analyzing-memory-dumps-with-volatility
by mukul975
'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,
analyzing-network-covert-channels-in-malware
by mukul975
Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration,
secure-code-review
by zebbern
"Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users ask for a security review, vulnerability scan, or penetration testing assistance, or mention keywords like OWASP, SQL injection, XSS, code audit, or security checklist."
repo-audit
by zebbern
"Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets. Triggered when users ask about Git analysis, code hotspots, who owns what code, secret scanning, security audits of commit history, or optimizing code review assignments."
code-vuln-audit
by zebbern
"Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks."
1k-code-review-pr
by OneKeyHQ
Review OneKey PRs and diffs for security, correctness, concurrency, React/RN pitfalls, and repository-specific regressions. Use for code review or 审查 PR.
1k-auditing-pre-release-security
by OneKeyHQ
Audits security and supply-chain risk between two git refs with Codex cross-validation. 预发布安全审计（含 Codex 交叉验证）。Use when performing pre-release security audits, supply-chain reviews, or comparing two git refs for security regressions. Triggers on “预发布审计”, “security audit”, “release audit”, “安全预审”.
react-doctor
by PostHog
Diagnose and fix React codebase health issues. Use when reviewing React code, fixing performance problems, auditing security, or improving code quality.
aws-penetration-testing
by zebbern
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
shodan-reconnaissance
by zebbern
This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.
sqlmap-database-pentesting
by zebbern
This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.
windows-privilege-escalation
by zebbern
This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege escalation," "exploit Windows misconfigurations," or "perform post-exploitation privilege escalation." It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.
top-web-vulnerabilities
by zebbern
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
pentest-commands
by zebbern
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
broken-authentication
by zebbern
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
wordpress-penetration-testing
by zebbern
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.