Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Design privacy-preserving analytics systems using differential privacy, k-anonymity, l-diversity, and t-closeness. Covers privacy budget allocation with epsilon tracking, references Google DP library, OpenDP, and Apple PPML. Includes Python differential privacy implementation for GDPR-compliant statistical analysis.
Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threat taxonomy and ISO 29134. Covers likelihood and severity assessment, risk matrix construction, inherent vs residual risk calculation, and risk appetite thresholds per EDPB WP248rev.01 guidance. Keywords: risk scoring, DPIA risk matrix, likelihood, severity, ENISA, ISO 29134, residual risk, risk appetite.
Guides data subject and stakeholder consultation requirements during Data Protection Impact Assessments under GDPR Article 35(9). Covers consultation planning, data subject engagement methods, DPO involvement per Art. 35(2), and documentation of views received. Keywords: DPIA consultation, stakeholder engagement, Art. 35(9), data subject views, DPO advice, public consultation, representative groups.
Governs employee health data processing for fitness-for-work assessments, occupational health surveillance, COVID testing legacy programmes, and absence management. Applies Art. 9(2)(b) employment obligations and Art. 9(2)(h) health professional exceptions. Covers data minimisation, occupational health provider relationships, and return-to-work procedures. Keywords: health data, Art. 9, occupational health, fitness-for-work, special category, employment, sickness absence.
Guidance for implementing differential cryptanalysis attacks on FEAL (Fast Data Encipherment Algorithm) and similar block ciphers. This skill should be used when tasks involve recovering round keys, implementing differential attacks, exploiting cipher weaknesses, or performing cryptanalysis on Feistel network ciphers. Applicable to CTF challenges and educational cryptanalysis exercises.
Guides implementation of GDPR Article 42-43 data protection certification mechanisms including accredited certification bodies, criteria development, and periodic review. Activate when pursuing privacy certifications, evaluating certification bodies, or developing certification criteria. Keywords: certification, Article 42, Article 43, accreditation, seal, privacy mark.
Guides the GDPR Article 56 one-stop-shop mechanism for determining lead supervisory authority in cross-border processing. Covers main establishment identification and cooperation. Activate when processing across EU borders. Keywords: one-stop-shop, Article 56, lead authority, cross-border.
Manages RoPA for complex multi-entity corporate groups including entity-level versus group-level records, intra-group transfer documentation, and shared processing coordination. Activate for group RoPA, multi-entity, corporate group, intra-group transfers, subsidiary records, holding company.
Implements HIPAA Privacy Rule requirements for research uses of protected health information under 45 CFR §164.512(i). Covers IRB and Privacy Board waivers of authorization, individual authorization for research, limited data set and data use agreements, preparatory to research provisions, and decedent research provisions. Keywords: HIPAA research, IRB waiver, Privacy Board, authorization, limited data set, preparatory research, de-identification, Common Rule.
Guides information security engineering—implementing and operating security controls, identity and access systems, encryption and secrets management, security tool integrations (SIEM, EDR, SOAR), cloud guardrails, hardening baselines, and remediation engineering for vulnerabilities. Use when building SSO/RBAC/PAM patterns, configuring KMS or certificate lifecycle, deploying WAF/DLP or EDR connectors, writing security-as-code policies (OPA, SCPs, CIS benchmarks), integrating logging to SIEM, automating security workflows, or validating control fixes—not for SOC triage (soc-analyst), pentesting (penetration-tester, network-pentester, web-pentester), red team (red-team-specialist), CI gates only (devsecops), platform provisioning without security ownership (infrastructure-engineer), CISO/exec program (chief-information-security-officer), security program strategy (cybersecurity), GRC program and audit prep (compliance-specialist), or product tenancy isolation (product-infrastructure-security-engineer).
Write an infrastructure-as-code review checklist and conduct a structured review of Terraform, CloudFormation, Pulumi, or Ansible code. Use when asked to review IaC code, audit infrastructure configurations, check cloud security posture, or produce a reusable IaC review checklist. Produces a structured review report with severity-categorized findings, remediation guidance, and a reusable checklist.
Build production-ready web authentication using Lucia Auth and The Copenhagen Book patterns. Use when users ask to "add auth", "implement authentication", "setup login", "add sessions", "password reset", "verify email", "implement OAuth", "add 2FA/MFA", "add passkeys", "password hashing", or reference "lucia auth" or "the copenhagen book". Default to a production baseline for browser-based web apps, not a demo-only login flow.
Generate a Personal Information Protection Impact Assessment (PIA) in an internal format for new features, products, or processing activities, using the structure learned from seed PIAs. Use when the user says "write a PIA," "personal information protection impact assessment," "do we need a PIA for this," "do a privacy review for this feature," or describes a new personal information processing activity.
Keep personal information processing rules aligned with practice. Two modes: a weekly scan of saved PIAs, DPA reviews, and triage results to find processing rule drift; or a direct query against proposed new practices. Use when the user asks "do our processing rules cover this," "we want to start doing X — do the processing rules need updating," "run the processing rule monitor," "processing rule scan," or wants to find where the processing rules no longer match what the team actually does.
Formal Quality Assurance Checklist before every Merge/Deploy. 6-phase validation with Build Verification, Test Suite, No-Touch Zones, Region Check, Security Review, and QA Report generation. Activate on "merge", "deploy", "release", "production", or /qa command.
Guides authorized enterprise adversary simulation and red team operations—campaign planning, threat-informed objectives, MITRE ATT&CK–framed TTP selection, OPSEC and scope, purple-team coordination, detection validation narratives, executive reporting, and blue-team lessons learned. Emphasizes rules of engagement, written authorization, and no unauthorized targeting. Use for red team, adversary simulation, purple team, assumed breach exercise, MITRE ATT&CK campaign, detection gap assessment, or threat-informed emulation—not LLM/agent adversarial testing (ai-redteam), single-vector pentest deliverables only (web-pentester, network-pentester, penetration-tester as execution specialists), SOC alert triage (soc-analyst), or incident command (incident-responder).
Processes GDPR Article 16 right to rectification requests, covering verification of corrected data accuracy, notification to recipients under Article 19, timeline management, and completion of incomplete data. Activate for rectification, correction request, inaccurate data, Art. 16, data correction queries.
Guide for sanitizing git repositories by identifying and replacing sensitive information such as API keys, tokens, and credentials. This skill should be used when tasks involve removing secrets from codebases, sanitizing repositories before sharing, or replacing sensitive values with placeholders. Applies to tasks involving secret detection, credential removal, or repository cleanup for security purposes.
Backend security auditor for authentication, authorization, token handling, payment abuse, file uploads, data leaks, injection, and broken access control. Inspects every layer of the stack and adapts to Express, NestJS, Django, Rails, Go, and other backends. Use when asked to security review, audit, harden, or check backend code for vulnerabilities.
Application security specialist focused on authentication and authorization, data protection, and compliance auditing. Use this Skill when the user needs to: (1) design a secure login and authentication system (2) conduct a security code review (3) check GDPR/privacy compliance (4) prevent common security vulnerabilities (OWASP Top 10).
Write a STRIDE-based threat model for a service or feature. Use when asked to produce a threat model, document security risks, identify attack vectors, assess a service's security posture, or prepare for a security design review. Produces a structured threat model covering assets, trust boundaries, STRIDE threat enumeration per component, risk scores, mitigation controls, and residual risk sign-off.
Install community skills from watched registries. Reads the allowlist first, fetches, shows the raw SKILL.md (not just a summary), runs structural trust checks, runs skills-qa, and writes files only after explicit user approval. Use when the user says "install [skill]," picks install while browsing, or provides a direct skill URL.
Evaluate a skill against the legal skill design framework — thirteen design parameters (including trust surface, freshness, schema validation, and conflict detection), three legal failure modes, and a three-tier verdict (ready / some concerns / major concerns). Use before deciding whether to trust a community skill for installation, before deploying a first-party skill to the team, or when the user asks "should I trust this?" or "is this skill well designed?" Runs automatically as part of /legal-builder-hub:skill-installer.
Senior Payment Solutions Architect for Stripe (2026). Specialized in secure checkout flows, complex billing models (usage-based/hybrid), global tax compliance via Stripe Tax, and high-performance Next.js 16 integration. Expert in building PCI-compliant, idempotent, and resilient payment systems using Checkout Sessions, Payment Elements, and Server Actions.
Critical guardrail for Supabase database operations ensuring multi-tenant isolation with publication_id filtering, proper use of supabaseAdmin, avoiding SELECT *, error handling patterns, and secure server-side database access. Use when writing database queries, working with supabase, accessing newsletter_campaigns, articles, rss_posts, or any tenant-scoped data.
Answer questions and produce mappings for Elastic Common Schema (ECS): Elastic/Elasticsearch fields, fieldsets, data types, allowed values, categorization (`event.kind`, `event.category`, `event.type`, `event.outcome`), custom fields, field reuse, normalization, and OpenTelemetry/OTel/OTLP/SemConv alignment. Use when mapping logs, security telemetry, SIEM detections, network flows, IAM/user activity, cloud/service context, threat intel, or observability metrics/traces into ECS, Elastic Security, Elastic Observability, or Elasticsearch mappings/templates.
Harden code with patient, layered defense. The turtle carries its shell — bone-deep protection grown from within, not strapped on. Use when building new features to ensure they're secure by design, or when auditing existing code for deep vulnerabilities that slip through standard reviews.
Quickly judge whether a processing activity requires a Personal Information Protection Impact Assessment, triggers the statutory assessment obligation under Article 55 of the Personal Information Protection Law, or can proceed directly — while also checking for personal information processing rule conflicts and routing to the correct next step. Use when the user asks "does this need a PIA," "triage this feature for privacy," "do a privacy check on X," "is this OK from a privacy standpoint," or describes a new personal information processing activity, product feature, or vendor relationship.
Best practices and integration guide for Visa developer APIs and payment protocols — covers platform setup, authentication, encryption, and product-specific workflows. Trigger keywords: VDP, Visa Developer Platform, VIC, Visa Intelligent Commerce, MPP, Machine Payments Protocol, X-Pay Token, Two-Way SSL, Mutual TLS, MLE, JWE, MCP integration, HTTP 402, network tokens, Visa Developer, Visa MLE.
Master orchestration workflow for reverse engineering complex Web/JS sites. Covers reversing sign/token/cookie/header/body/websocket fields, heavy obfuscation, junk instructions, control flow flattening, JSVMP, worker/wasm, browser vs. Node differentials, environment patching, local reproduction and regression, and case leads such as Akamai/Kasada/PX/reese84/Tongdun/a_bogus/Tencent captcha/Alibaba captcha/JSVMP/227/226/wasm/protobuf/rid/fuid/fs/bx-pp/run_js/storage.estimate/animationend. By default it coordinates the three MCPs jshook + js-reverse + chrome-devtools-mcp for debugging and analysis, switching to specialized skills at the locate, recover, runtime, env-patch and replay stages.
Perform code review by comparing the current branch with the base branch, generate a complete audit plan and execute it item by item, covering all changed files, integrating EliteForge standards checks, security detection, business logic correctness verification, and reliability and solution soundness assessment, with support for interrupt recovery; results are saved to the `{OUTPUT_DIR}` directory.
Design and audit admin audit logs covering privileged actions, configuration changes, user/role management, billing/admin settings, data export/delete, API tokens, integrations, security events, retention, tamper evidence, customer access, filters, exports, SIEM, alerting, privacy, and enterprise evidence. Use when customers or operators need trustworthy administrative traceability.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.