Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.
Alibaba Cloud Firewall Status Overview Skill. One-click query of overall cloud firewall status including asset management, border firewall switch status, and traffic overview. Triggers: "cloud firewall status", "firewall overview", "firewall status overview", "asset management", "protection coverage", "what is the overall cloud firewall status", "how many assets are not managed", "what is the protection coverage for each boundary", "CFW status", "cloud firewall overview"
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route selection, CE marking, SBOM requirements, vulnerability and incident reporting to ENISA/CSIRTs, support period obligations, and manufacturer/importer/distributor duties. Trigger for EU CRA, Cyber Resilience Act, PDE compliance, Annex I requirements, SBOM EU, CE marking cybersecurity, or connected product security EU.
Hunt LDAP injection and XPath injection—authentication bypass, blind character-by-character attribute exfiltration, AD user/group enumeration, and XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \\ NUL /), search-filter context vs. DN injection, parenthesis balancing, AND/OR filter logic, and {SSHA}/{CRYPT} userPassword exfiltration on non-AD directories. Use when the target uses LDAP/AD authentication, corporate SSO with a directory backend, an address-book/people-search API, or XML-based data stores queried with XPath.
Perform language- and framework-specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best-practice guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Use this skill when the user asks to “analyze network traffic with Wireshark,” “capture packets for troubleshooting,” “filter PCAP files,” “follow TCP/UDP streams,” “detect network anomalies,” “investigate suspicious traffic,” or “perform protocol analysis.” It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
Use this skill when the user asks to “add turnstile,” “implement bot protection,” “validate turnstile token,” “fix turnstile error,” or “set up captcha alternative,” or encounters error codes 100*/300*/600*, CSP errors, or token validation failures. Provides CAPTCHA-alternative protection for Cloudflare Workers, React, Next.js, and Hono
Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable fields on ORM-backed endpoints (Rails, Django, Laravel, Spring). Use when testing REST APIs for privilege escalation or authorization bypass via unintended parameter binding
Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously
Applies n8n's RBAC scope decorators to REST endpoints. Use when creating a new @RestController, adding any @Get/@Post/@Put/@Patch/@Delete route to an existing controller, or reviewing endpoint authorization. Every authenticated endpoint must be gated by @ProjectScope or @GlobalScope.
Use this skill when the user asks to “follow red team methodology,” “perform bug bounty hunting,” “automate reconnaissance,” “hunt for XSS vulnerabilities,” “enumerate subdomains,” or needs security researcher techniques and tool configurations from top bug bounty hunters
Configures Sinch API credentials and authentication. Use when setting up OAuth2, Basic auth, application signing, or API keys for any Sinch product, including Conversation API, Voice, Verification, Numbers, Fax, and Mailgun. Also use when troubleshooting 401 Unauthorized, 403 Forbidden, invalid signature, or credential errors against any Sinch API. For SDK usage, see sinch-sdks.
Audits a codebase or business process for regulatory compliance across GDPR, HIPAA, SOC2, CCPA, and PCI-DSS. Scans for PII handling, data retention, encryption, access controls, audit logging, consent management, and data transfer issues. Generates a structured compliance report with findings, gap analysis, remediation steps, and evidence requirements
Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.
Use when the user asks to “set up authentication,” “add login,” “add logout,” “add sign in,” “enable auth,” “add role-based access,” “add authorization,” “protect routes,” “configure identity provider,” “configure Entra ID,” “configure Entra External ID,” “configure OpenID Connect,” “add OIDC,” “set up SAML,” “set up WS-Federation,” “set up local login,” “add Facebook login,” “add Google sign in,” “add Microsoft Account,” or otherwise wants to set up authentication (login/logout) and role-based authorization for their Power Pages SPA site using any supported identity provider. Also sets up the IdP app registration for OIDC providers (Okta, Auth0, Entra External ID, and other OIDC): reads the provider’s docs first, then either guides the user through the provider’s console or, when the provider supports it, configures it for the user, and wires the client ID, authority, and claims mapping into Power Pages
Use this skill when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
Alibaba Cloud Governance Center evaluation report skill. Use for querying governance maturity check results, generating structured risk reports, and account compliance analysis. Triggers: “云治理,” “成熟度检测,” “合规检查,” “安全风险,” “治理检测,” “governance evaluation,” “maturity check,” “compliance report,” “risk report,” “governance center.”
Pre-production review of a Factorial Code app — clone the workspace read-only, run the static check catalog, classify findings as Blocker/Warning/Suggestion, and write APP_VALIDATION_REPORT.md with a ✅/❌ promotion verdict. Use when validating, reviewing, or auditing a Factorial Code (fcode) app or workspace before a release, or when asked whether an app is ready to ship.
Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments.
Deploy a docker-compose app via a Jenkins INBOUND AGENT running on the target server (no SSH from controller), with Docker-secrets "L3" hardening — runtime secrets live on tmpfs and never appear in `docker inspect` nor in `.env`. Use when the user wants: "deploy via jenkins agent", "no-ssh deploy", "agent thay vì ssh", "docker secrets L3", "ẩn secret khỏi docker inspect", "secret không nằm trên đĩa", or is wiring a Jenkins pipeline that deploys docker-compose to a Linux host. Encodes the gotchas learned from a real 1:1 run (Java 21, 0444 secret perms, 0400 file-credential, agent user needs docker+sudo).
Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin.
Audits existing table permissions on a Power Pages site by analyzing them against site code and Dataverse metadata, then GRADES the configuration with deterministic 1–5 scores across 3 security/usability/correctness categories (9 dimensions). Detection is anchored by a recurring-issue catalog so findings and severities stay consistent run-to-run. Generates an HTML report with an at-a-glance verdict and per-category scores in the Overview plus a single list of major/minor issues (each major issue labelled permissions-only or upstream-caused with a short justification), and suggested fixes. Use when the user wants to review, verify, check, score, or grade table permissions for security issues. Supports SPA and PAC-downloaded non-SPA sites
Expert skill for integrating local Large Language Models using llama.cpp and Ollama. Covers secure model loading, inference optimization, prompt handling, and protection against LLM-specific vulnerabilities including prompt injection, model theft, and denial of service attacks.
MUST be used whenever fixing dependency issues in a Dune app. This skill finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues — it does not just report them. Triggers: dependencies, packages, fix dependencies, update packages, fix vulnerabilities, npm audit fix, pnpm audit fix, CVE fix, outdated, deprecated, supply chain, license.
Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.
A software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
Creates and configures web roles for a Power Pages SPA site. Web roles control access and permissions for site users, including authenticated and anonymous roles. Use when the user wants to create, add, set up, or manage web roles for their site. Also supports PAC-downloaded non-SPA sites with nested or directly opened metadata roots
This skill should be used when the user asks to “search for exposed devices on the internet,” “perform Shodan reconnaissance,” “find vulnerable services using Shodan,” “scan IP ranges with Shodan,” or “discover IoT devices and open ports.” It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.
This skill should be used when the user asks to “perform cloud penetration testing,” “assess Azure or AWS or GCP security,” “enumerate cloud resources,” “exploit cloud misconfigurations,” “test O365 security,” “extract secrets from cloud environments,” or “audit cloud infrastructure.” It provides comprehensive techniques for security assessment across major cloud platforms.
Manages the whole Didit identity verification platform over the API: programmatic account and application setup, API keys, workflows, verification sessions (create, retrieve, list, approve, decline, resubmit, correct data, AML hit review, PDF, share, delete), bulk imports, questionnaires, block/allow lists, users (KYC) and businesses (KYB) with AML monitoring and biometric templates, KYB registry lookups, billing and top-ups, branding, and webhook destinations with signature verification. Use when someone needs to create a Didit account or API key, build a verification workflow, create or poll verification sessions, review or resubmit a session, manage users, businesses or lists, check or top up credits, configure webhooks, or verify Didit webhook signatures.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.