安全
安全扫描与漏洞检测
Top 100 Web Vulnerabilities Reference
zebbern
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
Pentest Commands
zebbern
The assistant provides essential penetration testing commands for Nmap, Metasploit, SQLMap, Hydra, John the Ripper, Nikto, and other tools. Activate when users ask about "pentest commands," "nmap scanning," "metasploit exploits," "password cracking," "web vulnerability scanning," or "network enumeration."
Security Scanning Tools
zebbern
This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.
PowerShell Scripting for Security
zebbern
This skill should be used when the user asks to "write PowerShell scripts", "automate security tasks with PowerShell", "create PowerShell functions", "work with PowerShell modules", "parse data with PowerShell", or "build security automation scripts". It provides comprehensive PowerShell scripting fundamentals for security professionals.
Quick Pentest Reference
zebbern
This skill should be used when the user asks to "perform quick enumeration", "run directory busting", "enumerate DNS", "discover live hosts", "brute force passwords", or "needs a pentest cheat sheet". It provides rapid reference commands for penetration testing.
Pentesting from Beginner to Advanced
zebbern
The assistant provides a structured web application penetration testing learning path from fundamentals to advanced techniques. Activate when users ask about "learning pentesting," "web security training," "OWASP vulnerabilities," "BurpSuite tutorial," "penetration testing roadmap," or "web app security course."
OSCP Notes
zebbern
The assistant provides detailed OSCP preparation notes covering service enumeration, exploitation techniques, and protocol-specific attacks. Activate when users ask about "OSCP enumeration," "service pentesting," "SMB attacks," "FTP exploitation," "SSH pentesting," or "protocol-specific exploits."
Phishing Attacks
zebbern
The assistant guides users through phishing attack simulation tools and techniques for penetration testing and security awareness. Activate when users ask about "phishing simulation," "social engineering testing," "Shellphish," "WiFi phishing," "credential harvesting," or "security awareness training."
Wi-Fi Penetration Testing
zebbern
This skill should be used when the user asks to "perform wireless network penetration testing", "crack WEP or WPA passwords", "capture Wi-Fi handshakes", "conduct deauthentication attacks", "test wireless security", "perform MITM attacks on Wi-Fi", or "assess wireless network vulnerabilities". It provides comprehensive techniques for auditing wireless network security.
bug-bounty
Mikacr1138
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports.
📦 Dependency Management
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
🏷️ Issue Analysis with Label Inference
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
auditing-security
Git-Fg
"Scans for secrets and performs comprehensive security audits. MUST Use when verifying security of code changes or auditing file safety."
code-sync
niracler
Use when syncing all git repos under ~/code across machines, typically at end-of-day (push) or start-of-day (pull). Triggers on「同步代码」「code-sync」「下班同步」「上班更新」.
django-reviewer
physics91
WHEN: Django project review, ORM queries, views/templates, admin customization WHAT: ORM optimization + View patterns + Template security + Admin config + Migration safety WHEN NOT: FastAPI → fastapi-reviewer, Flask → flask-reviewer, DRF API only → consider api-expert
📦 Dependency Management
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
coder-system-design-external-api
OzeroHAX
Reliable and secure external API integration patterns for production-grade services.
🔐 Security Audit and Vulnerability Scanning
ShunsukeHayashi
Miyabi Plugins for Claude Code - 25+ Agents, 22 Skills, 50+ Commands
testing-security
OzeroHAX
Basic security testing (OWASP, auth, data exposure)
planning-risk-assessment
OzeroHAX
Risk assessment: likelihood/impact, mitigations, residual risk
security
scottymcandrew
Security audit specialist. Use before releases, after authentication/authorization changes, when handling sensitive data, or for periodic security reviews of code.
secure-node-typescript
joacod
'Write secure-by-default Node.js and TypeScript applications following security best practices. Use when: (1) Writing new Node.js/TypeScript code, (2) Creating API endpoints or middleware, (3) Handling user input or form data, (4) Implementing authentication or authorization, (5) Working with secrets or environment variables, (6) Setting up project configurations (tsconfig, eslint), (7) User mentions security concerns, (8) Reviewing code for vulnerabilities, (9) Working with file paths or child processes, (10) Setting up HTTP headers or CORS.'
disciplined-validation
terraphim
Phase 5 of disciplined development. Validates system against original requirements through system testing and user acceptance testing (UAT). Uses structured stakeholder interviews to gather sign-off and traces defects back to research or design phases.
wcag-audit-perceivable-media
Jkense
Route audio, video, and multimedia accessibility requirements