Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Use tlsx to analyze TLS certificates and configuration. Use it to extract SSL/TLS certificate information (SAN/CN), detect TLS versions and cipher suites, identify JARM/JA3 fingerprints, or find certificate misconfigurations. tlsx is a TLS probe tool from ProjectDiscovery. Use this skill for any SSL/TLS analysis, certificate information collection, or JARM fingerprinting task.
Design and audit public trust centers, security pages, privacy/compliance portals, subprocessors, uptime/status links, data protection summaries, policy libraries, evidence request flows, customer assurance, sales enablement, and review cadence. Use when a SaaS, developer tool, marketplace, AI product, or enterprise product needs credible trust proof before procurement or launch.
Use when the user asks how Twingate works, wants to design or evaluate a Twingate deployment, needs to understand components (Controller, Client, Connector, Relay), or is planning a ZTNA rollout. Activate for: zero trust, ZTNA, remote access architecture, network design with Twingate, VPN replacement, microsegmentation, split DNS, NAT traversal, P2P vs Relay, Remote Network topology, Resource definition strategy, or deployment sequencing. Also activate for community/reference deployment patterns: exposing a self-hosted AI chat assistant (OpenClaw, WhatsApp/Telegram bots) with no public inbound ports, private Railway/PaaS app deployment with zero-ingress, or "what does the twingate-assistant plugin itself do" meta-questions.
Use when the user needs to deploy, configure, upgrade, or troubleshoot Twingate Connectors on any platform. Activate for: Docker connector, Linux connector, systemd connector, ECS connector, Azure Container Instances, GCE, Helm chart connector, connector tokens, connector HA, connector health, connector metrics, connector logging, connector upgrades, DEAD_NO_RELAYS, DEAD_NO_HEARTBEAT, or connector placement questions. Also activate for connector deployment tooling and unofficial platform support: Raspberry Pi, Ubiquiti/UniFi (UDM Pro, UDM SE, UXG) gateways, Unraid, Home Assistant, Steam Deck / Decky Loader, Hyper-V, Chocolatey packaging, custom or hardened connector containers, GitHub Codespaces, Coder workspaces, render.com, Spacelift CI runners, connector log shipping to S3, connector fleet autoscaling, Grafana connector dashboards, PagerDuty connector alerting, or Docker container auto-updating for connector hosts.
Use when the user deploys Twingate in Kubernetes, uses the Twingate Helm chart or operator, manages TwingateResource or TwingateRemoteNetwork CRDs, routes traffic from cluster pods outward through Twingate, gates kubectl access via Twingate, or integrates Twingate into a GitOps workflow. Also trigger when an existing K8s stack needs connector deployment, token secret management, or declarative Twingate resource definitions. Also trigger for Helm chart `values.yaml` fields, operator CRD kinds (`TwingateConnector`, `TwingateResource`, `TwingateResourceAccess`, `TwingateGroup`, `TwingateGateway`, `TwingateCertificateAuthority`), kubeconfig sync automation, or running the Twingate headless client as a Kubernetes sidecar container.
Use when the user writes, debugs, or reviews Twingate Pulumi code in any language (TypeScript, Python, Go, C#/.NET). Activate on mentions of Pulumi, pulumi-twingate, @pulumi/twingate, or pulumi_twingate, or when an existing Pulumi stack needs to add Twingate resources. Also trigger when the user is migrating from Terraform to Pulumi for Twingate, or building a multi-language Pulumi stack that needs Twingate provisioning. Also trigger for local-plugin build/install errors (`pulumi plugin install`, 404 on `pulumi up`/`pulumi preview`, `+dirty`/alpha version strings), or requests for SE reference quick-start Pulumi scripts per cloud.
Use when the user writes, debugs, or reviews Twingate Terraform configuration. Activate for any .tf file that touches Twingate resources, the Twingate Terraform provider, IaC provisioning of Remote Networks, Connectors, Resources, Groups, or Service Accounts, provider version questions, and terraform apply errors involving Twingate. Also trigger when existing AWS, Azure, GCP, or Kubernetes Terraform stacks need to add Twingate. Also trigger for provider source/schema questions (`internal/provider/`), `group_ids` / `access` block migration errors, provider release version and changelog questions, or requests for SE reference quick-start Terraform modules per cloud.
Scripts and workflows to batch-test popular WordPress plugin CVEs across hundreds of domains. Covers automated plugin detection, version extraction from readme.txt, CVE matching against a curated matrix of high-impact plugin vulnerabilities (ElementsKit, Revslider, WPDM, Gravity Forms, Contact Form 7, Jetpack, WP File Manager, GSpeech), and exploitation PoC generation. Use after initial WordPress detection recon — when you have a target list of WP domains and need to find which specific plugin CVEs are exploitable at scale
Systematic approach to finding and testing CVEs for identified WordPress plugins. Covers plugin discovery, version extraction from multiple sources (readme.txt, assets, inline JS), CVE database cross-referencing with WPScan/Patchstack/NVD/NVD API, version-based vulnerability matching, exploitation PoC generation, and false-positive elimination. Built from field experience finding exploitable plugin CVEs across 58-company mass recon including ElementsKit (CVE-2023-6851/CVE-2023-6853), Revslider (CVE-2024-2534), WPDM (CVE-2023-49753), Gravity Forms (CVE-2024-6115), and Jetpack (CVE-2024-1782).
Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification, and data leakage
Use when you need to actually run security tests against a running application you own or are authorized to test — the shared execution harness for lab/proxy/scanner setup, safe non-destructive execution, and standardized proof-of-concept capture that the find/exploit specialist skills rely on.
Alibaba Cloud WAF Bot Management automated configuration assistant. Automatically completes bot protection policy evaluation, configuration, verification, and tuning via OpenAPI/CLI. Supports scenarios such as LLM API protection, retail promotion anti-scalper, general anti-crawling, and academic research platforms. Triggers when the user mentions Bot management, crawler protection, anti-crawling, WAF Bot, BOT2.0, LLM API abuse prevention, retail anti-scalper, promotion protection, SMS bombing, script attacks, or automated traffic protection.
Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring. Provides a breach classification taxonomy across confidentiality, integrity, and availability dimensions. Covers detection tool selection, alert tuning, and integration with privacy incident response workflows. Keywords: breach detection, SIEM, DLP, anomaly detection, insider threat, classification.
Maintains the GDPR Article 33(5) breach register documenting all personal data breaches regardless of whether supervisory authority notification was required. Covers mandatory register fields including facts, effects, and remedial actions, retention periods, audit readiness, and integration with the accountability framework. Keywords: breach register, Article 33(5), breach documentation, accountability, audit readiness, remedial actions.
Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and root cause analysis. References industry-standard tools including Splunk, ELK Stack, and Wireshark. Provides forensic workflow from initial evidence collection through final investigation report. Keywords: digital forensics, breach investigation, evidence preservation, chain of custody, root cause analysis, Splunk, ELK, Wireshark.
Implements BYOD privacy compliance frameworks for personal device use in the workplace. Covers personal vs corporate data separation, MDM capabilities and limitations, employee consent requirements, data wiping boundaries, and monitoring restrictions on personal devices. Keywords: BYOD, mobile device management, MDM, personal device, data separation, containerisation, remote wipe, employee privacy.
Designs and implements privacy notices for children that comply with GDPR Articles 12-14, UK AADC Standard 4, and COPPA Section 312.4. Covers plain language, visual explanations, layered information, age-appropriate vocabulary, and interactive notice elements. Keywords: children privacy notice, transparency, plain language, visual, age-appropriate, layered notice.
Configures cloud storage retention policies across AWS S3, Azure Blob Storage, and Google Cloud Storage. Covers lifecycle rules, object lock, legal hold, immutability policies, cross-region replication retention alignment, and compliance mode configuration. Activate for cloud retention, S3 lifecycle, Azure retention, GCP retention policy queries.
Implementation guide for CNIL cookie guidelines compliance. References the EUR 150M Google fine and EUR 60M Meta fine. Covers equal prominence accept/reject buttons, cookie wall prohibition, 6-month reconsent intervals, essential cookies exemption, and detailed CNIL Deliberation No. 2020-091 requirements.
Design and audit compliance evidence rooms, gated security document portals, SOC/ISO reports, pen test summaries, policies, DPAs, subprocessors, audit evidence, access approval, expiry, watermarking, renewal, and buyer proof workflows. Use when enterprise customers or auditors need sensitive evidence without uncontrolled document sharing.
Track compliance requirements and audit readiness. Trigger on “compliance,” “audit prep,” “SOC 2,” “ISO 27001,” “GDPR,” “regulatory requirement,” or when the user needs help tracking, preparing for, or documenting compliance activities.
Technical architecture guide for building a multi-purpose consent preference center. Covers per-purpose granularity, easy withdrawal under Article 7(3), version history, audit trails, and IAB Transparency and Consent Framework v2.2 integration. Includes database schema, API design, and UI component specifications.
Design and audit data governance, data classification, access controls, least privilege, approval workflows, owner review, retention, deletion, audit logs, data catalog, sensitive fields, analytics access, support/admin access, AI dataset access, and break-glass paths. Use when teams need product data access without privacy, security, or compliance drift.
Audits project dependencies for security vulnerabilities, license compliance issues, outdated packages, and transitive dependency risk. Use when asked to audit dependencies, review package security, check license compliance, assess dependency health, or produce a vulnerability report. Produces a vulnerability findings table, license compliance matrix, update priority matrix, dependency health score, and 30-day remediation plan.
Author, edit, or apply a Descope FGA schema using the ReBAC/ABAC DSL. Use this skill whenever the user asks to create a new FGA schema, modify an existing one, add types/relations/permissions/conditions, review an authorization model, or apply schema changes to a Descope project. Trigger even if the user says things like "set up authorization", "define roles and permissions", "add team-based access", "make this endpoint check FGA", or "update my authz model"—these almost always mean an FGA schema change.
Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic.
Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.
Provides GDPR Article 13 information at the point of direct data collection, covering all required elements under Art. 13(1)(a)-(f) and Art. 13(2)(a)-(g), layered notice design, and timing requirements. Activate for Art. 13, direct collection notice, privacy notice at collection, data collection information queries.
Conducts Data Protection Impact Assessments for biometric identification and authentication systems under GDPR Article 35 and Article 9 special category rules. Covers facial recognition, fingerprint, iris scanning, voice recognition, and behavioural biometrics. Applies EDPB Guidelines 3/2019, CNIL Reglement Type Biometrie, and ISO/IEC 24745 biometric template protection. Keywords: DPIA biometric, facial recognition, fingerprint, Art. 35, Art. 9, biometric template, special category.
Builds a multi-channel DSAR intake system supporting web form, email, phone, and in-person requests with identity verification tiers, automated routing logic, SLA tracking, and response generation. Activate for DSAR intake, rights request portal, multi-channel intake, SLA tracking, request management queries.
Conducts Data Protection Impact Assessments for employee monitoring systems per EDPB Guidelines 3/2019 on workplace data processing. Covers video surveillance, email monitoring, GPS tracking, keystroke logging, and productivity tools. Applies proportionality testing under Art. 35 GDPR. Keywords: DPIA, employee monitoring, surveillance, proportionality, EDPB, workplace privacy, keystroke logging, GPS tracking.
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.