Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually renders, looking for leaked PII, internal identifiers, debug data, or business-sensitive fields the frontend filters but the API still transmits. Use when auditing REST or mobile-app APIs for over-fetching, response filtering bypass, or unintended data leakage in endpoint responses.
This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.
Skill security auditing tool. Verifies the security of Claude Code skills by checking for malicious code, sensitive information leaks, dangerous operations, and more. Conducts a security assessment and generates a security report before installing or using new skills.
Comprehensive security and correctness audit of a branch's changes. Use for thermo nuclear, thermonuclear, or deep review requests, or branch/PR diff audits focused on bugs, breaking changes, security issues, devex regressions, and feature-gate leaks.
Use when building or debugging Google sign-in on a website: the GIS button or One Tap, server-side ID token checks, account linking, and login CSRF. Not for a server authenticating to Google (google-auth). Opt out: no wiring, без обвязки. Triggers: “sign in with google,” “one tap,” “вход через Google.”
Use when turning local, private, or personal Agent Skills into publishable skills for GitHub, marketplaces, teams, or public sharing, especially when private paths, personal habits, credentials, internal hosts, or user-specific context must be removed
Expert knowledge for Azure Policy development, including troubleshooting, best practices, decision making, architecture and design patterns, security, configuration, integrations, coding patterns, and deployment. Use when authoring JSON policies, deploying via ARM/Bicep/Terraform, enforcing security baselines, automating with Gatekeeper, or running policy-as-code in CI/CD, and other Azure Policy development tasks. Not for Azure Blueprints (use azure-blueprints), Azure Role-based access control (use azure-rbac), Azure Resource Manager (use azure-resource-manager), or Azure Security (use azure-security)
Vetted, compilable Rust templates for common Omni Gateway Policy Development Kit (PDK) features — JWT validation/generation, OAuth2 introspection, header/body manipulation, body streaming, rate limiting, spike control, CORS, IP filtering, JSON/XML validators, HTTP outbound calls, gRPC, DataWeave evaluation, caching, distributed locks, worker variables, request data, control flow, contracts, data storage, timers, logging, metadata, policy violations, stop_iteration, outbound policies, and PDK unit testing. Use whenever the user asks "how do I X in PDK?", "show me a PDK template for Y", "PDK Rust snippet for Z", "JWT template", "rate limit template", "header manipulation example", "PDK gRPC", "PDK DataWeave", or any prompt mapping to one of the 30 template files under templates/. Read the matching file and adapt it into the user's `src/lib.rs` (and companion files for multi-file features). For project scaffolding, build, and publish lifecycle, defer to `develop-pdk-policy`.
Install Claude skills from GitHub repositories with automated security scanning. Triggers when users want to install skills from a GitHub URL, need to browse available skills in a repository, or want to safely add new skills to their Claude environment.
Remediate security findings by producing minimal, surgical code patches. Triggers on 'patch security findings', 'fix vulnerabilities', 'remediate findings', 'threat patch', or when the user provides a findings.json (from threat-model), a Codex security findings CSV, a THREAT-MODEL.md, or individual vulnerability descriptions and wants them fixed. Also trigger when reviewing code flagged by a security scanner and the user wants actionable fixes rather than just reports.
Deep-dive security posture assessment by analyzing IAM policies, encryption configs, network rules, and security controls in code to produce evidence-backed findings aligned with the Well-Architected Security pillar
Alibaba Cloud Security Center (SAS) Overview Data Query Skill. Retrieves security score, asset status, risk governance, asset risk trends, and billing info. Supports flexible scope: query a single data item, a specific module, or the full overview based on user intent. 阿里云云安全中心（SAS）总览数据查询技能。可获取安全评分、资产状态、风险治理、资产风险趋势及账单信息。支持灵活查询范围：根据用户意图查询单个数据项、特定模块或完整总览。Triggers: “SAS overview”, “security center overview”, “SAS 总览”, “云安全中心总览”, “security score”, “安全评分”, “安全分”, “fixed vulnerability statistics”, “baseline risk”, “handled alerts”, “已修复漏洞统计”, “基线风险统计”, “已处理告警”, “host assets”, “uninstalled clients”, “主机资产”, “CPU 核数”, “未安装客户端”, “risk governance”, “WAF blocks”, “asset risk trend”, “风险治理”, “WAF 拦截统计”, “资产风险趋势”, “SAS billing”, “订阅状态”, “云安全中心账单”, “按量模块开关”. Out of scope: This Skill only covers SAS overview data queries. It does not perform remediation, modify configurations, or manage non-SAS services
Use this skill when the user asks to “pentest AWS,” “test AWS security,” “enumerate IAM,” “exploit cloud infrastructure,” “AWS privilege escalation,” “S3 bucket testing,” “metadata SSRF,” or “Lambda exploitation,” or needs guidance on Amazon Web Services security assessment.
Use this skill when the user asks to “test for insecure direct object references,” “find IDOR vulnerabilities,” “exploit broken access control,” “enumerate user IDs or object references,” or “bypass authorization to access other users’ data.” It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
Creates, edits, and manages Power Pages Server Logic files—server-side JavaScript that runs securely on the Power Pages runtime. Orchestrates the full lifecycle: gathering requirements, fetching documentation, implementing code, configuring site settings, and deploying. Use when the user wants to add server-side code, create API endpoints, or move logic from the browser to the server in their Power Pages site.
Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.
Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines.
SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks.
Ghi và kiểm provenance (nguồn + sha256 checksum) cho skill — dùng khi 'cài skill từ ngoài', 'skill này từ đâu', 'audit nguồn skill', 'checksum skill', 'supply-chain skill', phát hiện skill bị sửa lén; bổ trợ orca-sec-scans. Chạy fdk/tools/skill-provenance.py. /skill-provenance
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. “0”, “null”, empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N failures (first N requests bypass it). Detection: intercept a successful form submission, remove the CAPTCHA field entirely, replay — if it still succeeds, server-side validation is absent. Medium severity standalone; High when it removes the only rate-limit gate protecting a login, registration, or payment endpoint
Build communication features with Twilio: SMS messaging, voice calls, WhatsApp Business API, and user verification (2FA). Covers the full spectrum from simple notifications to complex IVR systems and multi-channel authentication. Critical focus on compliance, rate limits, and error handling. Use when: twilio, send SMS, text message, voice call, phone verification.
Integrate the Didit Database Validation API (POST /v3/database-validation/) to check identity data against government and authoritative registries. Use when the user wants to validate a national ID, CPF, CURP, DNI, RUT or cedula number against official records, confirm a person's name and date of birth with a civil registry, run a registry face match (Argentina RENAPER, Panama SIB), choose database validation services per country, or implement government database lookups using Didit. Covers 100+ services in 45 countries (strongest in Latin America, plus Spain, South Africa, Kenya and other markets) with per-service pricing and per-field match results.
Use this skill when the user asks to “escalate privileges on Linux,” “find privesc vectors on Linux systems,” “exploit sudo misconfigurations,” “abuse SUID binaries,” “exploit cron jobs for root access,” “enumerate Linux systems for privilege escalation,” or “gain root access from a low-privilege shell.” It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.
JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.
This skill should be used when the user asks to “pentest SSH services,” “enumerate SSH configurations,” “brute force SSH credentials,” “exploit SSH vulnerabilities,” “perform SSH tunneling,” or “audit SSH security.” It provides comprehensive SSH penetration testing methodologies and techniques.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.