Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Prevent and fix Google Safe Browsing "Dangerous site" flags. Use when launching a public web app, buying/picking a domain, building a login or signup page, or when any site shows a red "Dangerous site" / "Deceptive site" warning in Chrome, Brave, Safari, Firefox, or Edge. Triggers on "dangerous site", "deceptive site", "site blocked", "safe browsing", "phishing flag", "red warning screen".
Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification LOW/MEDIUM/HIGH/EXTREME. Produces structured vetting reports. Never install untrusted skills without running this first.
Diagnose why a request was blocked by Alibaba Cloud WAF. Retrieves block logs, identifies the triggering rule, and provides remediation guidance. Supports disabling problematic rules and managing WAF log collection settings. Use when users report being blocked by WAF, encounter 405/block error pages, see "Your request has been blocked" messages, or need to investigate and fix WAF interception issues. Trigger words: "WAF block query", "blocked by WAF", "405 troubleshooting", "request blocked", "checkresponse", "intercept query", "WAF拦截", "被WAF拦截", "disable WAF rule", "enable WAF log"
Expert knowledge for Azure Attestation development, including troubleshooting, best practices, security, configuration, and deployment. Use when validating attestation tokens, authoring policies, enforcing SGX/TPM baselines, configuring private endpoints, and for other Azure Attestation development tasks. Not for Azure Confidential Computing (use azure-confidential-computing), Azure Virtual Enclaves (use azure-virtual-enclaves), Azure Dedicated HSM (use azure-dedicated-hsm), or Azure Key Vault (use azure-key-vault).
Expert knowledge for Azure Cloud Hsm development, including troubleshooting, best practices, limits and quotas, security, and integrations and coding patterns. Use when configuring Cloud HSM authentication/networking, routing logs, managing PKCS#11 keys/certs, handling capacity/algorithm limits, or performing other Azure Cloud Hsm-related development tasks. Not for Azure Dedicated HSM (use azure-dedicated-hsm), Azure Key Vault (use azure-key-vault), or Azure Payment Hsm (use azure-payment-hsm).
Expert knowledge for Azure Network Function Manager development, including security and configuration. Use when setting up NF Manager prerequisites, resource groups, managed identities, role assignments, or secure NF access, and for other Azure Network Function Manager development tasks. Not for Azure Firewall Manager (use azure-firewall-manager), Azure Virtual Network Manager (use azure-virtual-network-manager), Azure Virtual Network (use azure-virtual-network), or Azure Virtual WAN (use azure-virtual-wan).
Gate a branch before it becomes a PR — catch the structural defects tests miss, not style: read the full diff against the default base, run a two-pass checklist (blocking pass first — unsafe queries, race conditions, trust-boundary and auth mistakes, conditional side effects — then the non-blocking remainder), and verify each candidate against surrounding code before reporting. Stays read-only and reports blocking-first; only becomes mutating after you explicitly approve a specific fix per issue — never batches decisions or auto-fixes. Use as the branch gate right before shipping or opening a PR.
Comprehensive threat modeling for multi-agent systems using CSA MAESTRO 7-layer framework and OWASP Multi-Agentic System Threat Modeling Guide v1.0. Systematically analyzes threats across all architectural layers from foundation models to agent ecosystems.
Operate and validate Obscura for JavaScript page loading, stealth browsing, anti-fingerprinting, tracker blocking, screenshots and visual comparison, CDP automation with Puppeteer or Playwright, screencasting, PDF export, MCP browser interaction, and web extraction. Use when running Obscura against deterministic fixtures or real sites, diagnosing rendering, geometry, resource, identity, or transport failures, or choosing the correct CLI, CDP, MCP, rendering, or stealth workflow.
Generate, scaffold, or refactor code so it embodies FIASSE v1.0.4 SSEM qualities by default — 10 attributes, Transparency and Least-Astonishment principles, ASVS-aligned controls, defensive boundary handling. Trigger on "secure/securable/FIASSE-compliant code", "harden", "secure-by-default", "audit-ready", or security-sensitive components (auth, file upload, password reset, input validation, API endpoints, queries) — even when those words are not explicit. For requirements use prd-securability-enhancement; for review use securability-engineering-review. The full PRD→generate→review→enhance loop is opt-in via "--full-loop" or "end-to-end securable".
Ascend C code review skill. Reviews code for safety and compliance based on a hypothesis-testing methodology. When invoking, you must explicitly provide: the code snippet and a description of the review rules. TRIGGER when: the user requests code inspection or code review, asks about code security, wants to check coding standards, or needs to investigate a specific code issue (such as a memory leak, integer overflow, or null pointer). Keywords: Ascend C, code inspection, code review, safety and compliance, memory, pointers, overflow, leaks, coding standards.
C/C++/CAPL best practices for automotive embedded systems. This skill should be used when writing, reviewing, or refactoring embedded C/C++ code or CAPL scripts targeting automotive ECUs, following MISRA, AUTOSAR, ISO 26262, and ISO 21434 guidelines. Triggers on tasks involving embedded firmware, CAN/CAN FD/LIN/Ethernet communication, TCP/UDP/DoIP/SOME-IP protocols, RTOS programming, safety-critical code, cybersecurity, diagnostics (UDS), CAPL test automation, or calibration toolchain integration.
Token and address risk assessment. Use this skill ONLY when the user's query is exclusively about token/contract/address security with no other analysis dimensions. Trigger phrases: is this token safe, check contract risk, is this address safe, honeypot, rug. If the query ALSO mentions fundamentals, technicals, news, sentiment, or any other analysis dimension, use gate-info-research instead — it handles multi-dimension queries in a single unified report. Address risk mode (is this address safe) is exclusive to this skill and must NOT be routed to gate-info-research.
Guide for creating and managing Infisical App Connections — the reusable authenticated links between Infisical and third-party services that Secret Syncs, Secret Rotations, PKI certificate authorities, PKI Syncs, and Secret Scanning data sources all depend on. Covers all 83 connection types and their exact auth methods (AWS assume-role vs access-key, GitHub OAuth vs GitHub App vs PAT, Azure OAuth vs client-secret vs certificate, GCP service account impersonation, and more), platform-managed credentials, Gateway-routed connections for private networks, and connection-level credential rotation. Use this skill when someone asks about: App Connections, connecting Infisical to AWS/GCP/Azure/GitHub, 'connection not found' when creating a sync, which auth method a connection needs, reusing a connection across syncs, or 'how do I authenticate Infisical to a third-party service'. This is Infisical authenticating OUTWARD to a third party. Not for machine identities, which are workloads authenticating INTO Infisical (infisical-setup).
Guide for Infisical Secret Scanning — detecting leaked credentials in source code and developer systems. Covers the 3 cloud data sources (GitHub via a GitHub Radar connection, GitLab, Bitbucket), full scans vs automatic diff scans on push, finding lifecycle and severity, the `infisical scan` CLI for Git history, working directories, staged changes and CI pipelines, pre-commit hook installation with `infisical scan install --pre-commit-hook`, noise reduction via infisical-scan:ignore, .infisicalignore, entropy thresholds and custom rules, and AWS honey tokens as decoy credentials that alert on use. Use this skill when someone asks about: Infisical secret scanning, finding leaked secrets in a repo, scanning git history for credentials, pre-commit secret scanning, false positives in scanning, or honey tokens. Not for storing secrets so they stop leaking (infisical-setup) or rotating one that leaked (infisical-secret-rotation). GitHub scanning needs a github-radar App Connection, not a github one.
Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation). Use when reviewing IaC files for misconfigurations, overpermissioning, exposed resources, missing encryption, secrets in code, and supply chain risks. Covers CIS benchmarks and cloud security best practices.
Expert knowledge for Azure Confidential Ledger development, including troubleshooting, decision-making, architecture and design patterns, limits and quotas, security, integrations and coding patterns, and deployment. Use for configuring Entra-secured ACL access, MST payloads, Blob/Cosmos integrations, node attestation, or ARM/Terraform deployments, and other Azure Confidential Ledger development tasks. Not for Azure Confidential Computing (use azure-confidential-computing), Azure Enclave (use azure-enclave), or Azure Key Vault (use azure-key-vault).
Expert knowledge for Azure US Government development, including decision-making, architecture and design patterns, security, configuration, integration and coding patterns, and deployment. Use when choosing Azure Gov vs global, meeting FedRAMP/DoD IL5 requirements, using SACA patterns, Gov Marketplace, or sovereign APIs, and for other Azure US Government development tasks. Not for Azure Local (use azure-local), Azure Extended Zones (use azure-extended-zones), Azure Networking (use azure-networking), or Azure Virtual Network (use azure-virtual-network).
ISO 27001:2022 ISMS implementation and cybersecurity governance for HealthTech and MedTech. Use for ISMS design, risk assessment per Clause 6.1.2, Annex A controls, ISO 27001 certification, security audits, and incident response.
Operational security guidance for deployment, monitoring, and maintenance. Use this skill when you need to understand which middlewares to apply, configure environment variables, monitor security post-deployment, or follow the pre-deployment checklist. Triggers include "security operations", "deployment security", "security monitoring", "environment variables", "when to use middleware", "pre-deployment", "security checklist", "production security".
Load, validate, and use a user's private personal profile from Bitwarden CLI for form filling, PDF completion, applications, and identity/contact/employment/housing reuse. Use when an agent needs stable personal data backed by Bitwarden, language-aware profile values, a bundled schema for personal facts, or a safe workflow that materializes real profile values outside Git.
Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.
Guide for configuring Infisical Secret Rotation — automatically rotating credentials that already exist in a third-party system on a fixed interval, writing the new values back into Infisical secrets. Covers all 28 rotation providers (PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis, AWS IAM user secrets, Azure/Okta/Auth0 client secrets, LDAP passwords, Unix/Linux and Windows local accounts, Cloudflare, Datadog, Snowflake key pairs, OpenAI/OpenRouter/LiteLLM/Fireworks API keys, and more), the dual-phase vs single-phase rotation models, rotation intervals and rotateAtUtc scheduling, parameters and secretsMapping, and the two-user pattern for SQL databases. Use this skill when someone asks about: secret rotation, rotating credentials, automatic credential rotation, rotating a database password on a schedule, expiring API keys, rotationInterval, or 'how do I rotate my database password automatically'. For changing an EXISTING credential on a timer. Not for creating brand-new ephemeral credentials per request (infisical-dynamic-secrets), nor for App Connection credential rotation (infisical-app-connections).
Security-first bash scripting patterns for 2025 (mandatory validation, zero-trust). PROACTIVELY activate for: (1) reviewing or writing security-sensitive bash scripts, (2) preventing command injection via input validation, (3) safely handling untrusted input (URLs, filenames, env vars), (4) protecting HISTFILE and avoiding secret leakage, (5) safe temporary file creation (mktemp), (6) absolute paths and PATH hardening, (7) avoiding eval and dynamic command construction, (8) signal handling for cleanup, (9) ShellCheck SC2068 / SC2086 compliance. Provides: mandatory-validation patterns, secret-handling rules, mktemp recipes, signal-safe cleanup, and a security review checklist.
Expert knowledge for Azure Lighthouse development including decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Lighthouse delegations, AOBO/PIM access, Arc/Sentinel integrations, policies/remediation, or Marketplace offers, and other Azure Lighthouse related development tasks. Not for Azure Arc (use azure-arc), Azure Managed Applications (use azure-managed-applications), Azure Resource Manager (use azure-resource-manager), Azure Role-based access control (use azure-rbac).
Use when validating an App Builder app before submitting to Adobe Exchange, or when the user mentions Adobe Commerce app compliance, extension review, marketplace submission, or Adobe Exchange listing. Checks security requirements, project structure, documentation completeness, and dependency health; reports MUST-have blockers and NICE-to-have recommendations and walks through each finding interactively.
Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths
Microsoft Defender for DevOps integration with Azure Pipelines. PROACTIVELY activate for: (1) adding security scanning to a pipeline, (2) Microsoft Security DevOps task (MSDO), (3) SAST tools (CredScan, ESLint, BinSkim, Bandit, Semgrep), (4) dependency scanning (Dependency-Check, Snyk), (5) container image scanning (Trivy, Defender for Containers), (6) IaC scanning (Checkov, Terrascan), (7) secret scanning, (8) SARIF results upload, (9) Defender for Cloud connector setup, (10) compliance reporting and policy gates. Provides: MSDO task YAML, scanner enable/disable matrix, SARIF integration, Defender connector setup steps, and a quality-gate template
GitHub Actions 2025–2026 features and modernization. Proactively activate for: (1) 1 vCPU Linux runners (October 2025 public preview), (2) immutable releases for hardened distribution, (3) migration from Node20 to Node24, (4) reusable workflows and composite actions, (5) workflow_dispatch with rich inputs, (6) artifact attestations and provenance, (7) ARC (Actions Runner Controller) for self-hosted Kubernetes, (8) larger runners and macOS Apple Silicon runners, (9) deployment environments and protection rules, (10) OIDC federation to AWS/Azure/GCP. Provides workflow templates, a runner-selection matrix, OIDC setup recipes, attestation patterns, and Node24 migration steps
Assess SSL/TLS server configurations using the sslyze Python scanning library to evaluate supported protocol versions, cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and known vulnerabilities such as Heartbleed and ROBOT. Use when conducting a security assessment of a server's TLS configuration or verifying remediation of cipher/certificate weaknesses.
Planning skill for identity verification and fraud prevention. Qualifies the developer's needs across authentication method, channel selection, fraud risk level, and user experience to recommend the right Twilio Verify + Lookup architecture. Handles login, signup, password reset, and risk-adaptive verification.
Configure Twilio accounts for HIPAA compliance. Covers BAA requirements, HIPAA Project designation (self-service and support), eligible services list, per-product requirements (Voice, SMS, ConversationRelay, Conversation Intelligence, Flex, Verify), message redaction, and what is NOT eligible. Use this skill when developers are building healthcare workflows on Twilio.
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.
Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring OT sensors/micro agents, traffic mirroring, Zero Trust OT monitoring, SIEM/SOAR integrations, or OT network design, and other Azure Defender For Iot related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure IoT (use azure-iot), Azure IoT Hub (use azure-iot-hub).
Expert knowledge for Azure Information Protection development including best practices, decision making, configuration, and deployment. Use when choosing Azure RMS vs AD RMS, deploying RMS connectors, migrating keys/policies, or configuring MSIPC clients, and other Azure Information Protection related development tasks. Not for Azure Key Vault (use azure-key-vault), Azure Security (use azure-security), Azure Defender For Cloud (use azure-defender-for-cloud).
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.