Security
Security scanning and vulnerability detection
security-logging
by CsHeng
Security controls and structured logging implementation. Use when security logging guidance is required.
security-headers
by CuriousLearner
Validate and implement HTTP security headers to protect web applications.
code-review-pro
by gked2121
Comprehensive code review covering security vulnerabilities, performance bottlenecks, best practices, and refactoring opportunities. Use when user requests code review, security audit, or performance analysis.
dependency-updater
by CuriousLearner
Smart dependency update checker with changelog summaries and breaking change detection.
code-reviewer
by CuriousLearner
Automated code review with best practices, security checks, and quality standards.
compliance-checker
by CuriousLearner
Check code against security compliance standards and best practices.
secret-scanner
by CuriousLearner
Detect accidentally committed secrets, credentials, and sensitive information in code.
brand-consistency-checker
by gked2121
Scan documents and slides for off-brand colors, fonts, and logos. Validate against brand guidelines and suggest corrections.
dependency-auditor
by CuriousLearner
Automated security auditing of project dependencies to identify known vulnerabilities.
meeting-notes
by CuriousLearner
Convert meeting discussions into clear, actionable notes with tasks, decisions, and follow-ups fo...
bug-bounty
by Mikacr1138
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports.
uv-deps
by WhatIfWeDigDeeper
Maintain Python packages through security audits or dependency updates on a dedicated branch using uv. Use for: security audits, CVE fixes, vulnerability checks, dependency updates, package upgrades, outdated packages, bump versions, fix Python vulnerabilities, check for Python CVEs, audit Python packages, update pyproject.toml dependencies, modernize Python deps, or when user types "/uv-deps" with or without specific package names or glob patterns. Use "help" or "--help" to show options.
research-synthesis
by tomwangowa
Use after running 2+ research skills (critical-research, tech-feasibility, narrative-auditor, codebase-audit) to synthesize findings into a unified decision document. Resolves conflicts between sources, weighs evidence, and produces an actionable recommendation.
security-hardening
by StealthyLabsHQ
Audit/harden app, infra, AI, privacy. Triggers: OWASP, XSS, SQLi, SSRF, auth/JWT, IDOR, secrets, deps, API, CI/CD, supply chain, cloud, K8s, IaC, AI IDE, browser builder, no-code, LLM/MCP, prompt injection, system prompt leakage, RAG poisoning, tool misuse, excessive agency, GDPR.
Available Skills in AgentOS (br3ezeclaw)
by br3eze-code
backend-development
by zircote
Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.
skill-auditor
by tomwangowa
Audit Claude Code skills for quality, security, and best practices. Use when reviewing SKILL.md files, ensuring skill quality standards, or before sharing skills with team.
codebase-audit
by tomwangowa
Claims-first codebase audit that extracts documentation claims and verifies them against code. Use when asked to "audit", "verify docs match code", "check if README claims are true", or "validate documentation accuracy". Falsification-first approach.
Available Skills in AgentOS (br3ezeclaw)
by br3eze-code
python-deprecation-fixer
by zircote
Automatically detect and fix Python deprecation warnings in codebases, including datetime.utcnow(), and other common deprecated patterns. Supports extensible pattern matching for future deprecations.
0-day
by gemstone-source
Systematic vulnerability research for CVE discovery, bug bounty methodology, patch-diff auditing, and offensive security work. Combines strategic architecture analysis with tactical exploitation testing. Covers source-to-sink tracing, trust boundary violations, authorization flaws, and variant hunting.
ruby-on-rails
by display-design-studio
Comprehensive Ruby on Rails 8.1 best-practices skill covering MVC, Active Record, routing, views, background jobs, storage, security, testing, and performance. Use when the user mentions Rails, Ruby on Rails, ActiveRecord, ActiveJob, ActionMailer, ActionCable, Active Storage, rails generate, rails routes, Hotwire, Turbo, Stimulus, or asks to build, review, debug, or migrate a Rails application or API.
saas-agent-toolkit
by hexbee
Design agent-usable SaaS tool systems using six reusable tool shapes (Search, Summarize, Draft, Update, Notify, Approve) plus connectors and policy guardrails. Use when turning SaaS features into reliable agent actions with clear contracts, permissions, audit trails, and approval gates.
security-review
by nicholasgriffintn
A specialist skill for security reviews, threat modeling, and remediation guidance. Use for auth/permissions changes, secrets or PII handling, public endpoints, or dependency upgrades.