Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Assess Splunk-related advisories, CVEs, scanner or package findings, remediation and exception evidence, and vulnerability or compliance readiness. Use when Splunk administrators, security operators, compliance owners, or reviewers need an evidence-backed environment exposure decision, remediation or exception plan, reviewer-ready pass/fail/unknown assessment, or cited guidance for documented Splunk vulnerability and compliance surfaces.
Yakit MITM hot patch topic. Use when the user needs to dynamically hijack or modify requests and responses with code in the MITM proxy, mirror traffic for analysis, tag and color flows before they are stored, or add mock guardrails for dangerous operations. Covers all hooks of hijackHTTPRequest / hijackHTTPResponseEx / the mirror series / hijackSaveHTTPFlow / mockHTTPRequest and the forward/drop semantics.
Receive and verify Slack Events API webhooks. Use when setting up Slack webhook handlers, debugging Slack signature verification, handling the url_verification challenge, or processing events like app_mention, message, reaction_added, team_join, or app_home_opened.
The main entry point and routing for yak-skills. When the user wants to do Yaklang programming, Yak hot patching (MITM / Web Fuzzer / global), Yakit secondary development, or MCP testing, start here to decide which topic skill to enter. This page explains the three-layer hot patch system, the YAK_MAIN debugging conventions, and the go run testing method, and routes requests to yakit-basic / yakit-ui-binding / mitm-hotpatch / webfuzzer-hotpatch / global-hotpatch / yaklang-syntax / yaklang-database / yakit-native-plugin / yakit-rightclick-plugin / yaklang-toolchain / yakit-data-extract-plugin.
Yakit Global Hot Patch topic. Use when the user needs a single configuration that lets MITM and all Web Fuzzer tabs share the same set of hooks: site-wide transparent encryption/decryption, unified signature/authentication injection, dynamic challenge responses, site-wide highlighting and masking, and guardrails for dangerous operations. Global hooks run before module hooks, and only one can be enabled at a time. Reuses beforeRequest / afterRequest / hijackHTTPRequest / hijackSaveHTTPFlow / mockHTTPRequest.
Audit a local macOS app's telemetry / reporting behavior using static analysis only. Reverse-engineers an .app bundle to identify embedded SDKs (AppLog/TEA, Parfait, TTNet, mars, MMKV, Sentry, Firebase, Bugly, Umeng, etc.), mapped upload endpoints, local on-disk queues, and privacy-relevant fields — without packet capture, network requests, debugger attach, or DRM bypass. Use when user asks to investigate, audit, or reverse-engineer a macOS app for telemetry, reporting, data upload, privacy, or SDK fingerprinting. Targets /Applications, ~/Applications, /Library/Input Methods, /Library/PrivilegedHelperTools, and similar local install paths.
Test LLM applications for prompt injection vulnerabilities — jailbreak attempts, system prompt extraction, context manipulation, guardrail bypass techniques, direct injection, indirect injection, multi-stage attacks, and reconnaissance. USE WHEN prompt injection, jailbreak, LLM security, AI security assessment, pentest AI application, test chatbot, guardrail bypass, direct injection, indirect injection, RAG poisoning, multi-stage attack, complete assessment, reconnaissance.
Guidance for designing security architecture using Zero Trust, the Microsoft Cybersecurity Reference Architectures (MCRA), Cloud Adoption Framework Secure methodology, and Well-Architected Security pillar. Covers the six Zero Trust pillars, defense-in-depth, and reference architecture alignment. WHEN: security architecture, Zero Trust design, MCRA, defense in depth, security reference architecture, CAF secure methodology, Well-Architected security pillar, end-to-end security design, security strategy, target state. DO NOT USE for tactical product configuration (use the product-specific skill) or for SOC tooling design (use sentinel / unified-secops-platform).
Full web app security assessment — app understanding, threat modeling, OWASP testing, ffuf fuzzing, Playwright automation, AI-assisted vuln analysis. Coordinates with Recon and PromptInjection skills. USE WHEN web assessment, pentest, security testing, vulnerability scan, threat model app, understand application, create threat model, vulnerability analysis, Gemini analysis, ffuf, fuzzing, bug bounty, OSINT, browser automation, Playwright.
Use when bootstrapping a repo (apply branch protection before first PR), PRs won't merge or BLOCKED, AI reviewer pushback, auto-merge fails for Dependabot/Renovate, branch protection or rulesets, CI fails, authoring or consuming reusable workflows, editing a repo's own .github/workflows, harden-runner, or CODEOWNERS/PR templates.
Privacy audit checklist, data leak patterns, and defensive Compact contract patterns for Midnight Network. Use when a user asks about what data is publicly visible on-chain, how to prevent accidental disclosure, how to audit a contract for privacy issues, how to implement commitment/nullifier patterns, domain separation, replay protection, witness trust, or front-running resistance. Also covers transaction semantics (guaranteed vs fallible phase), partial success implications, and what an observer can infer from the public transcript even when witness data is hidden.
Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing secrets, configuring CORS, implementing rate limiting, or when asked about JWT, OAuth, password hashing, API keys, RBAC, or security best practices.
Use when an application issues and validates its own first-party JWT access and refresh tokens, including authentication filters, password encoding, RBAC, and method security. For JWTs issued by Keycloak, Auth0, Okta, Cognito, or another authorization server, use oauth2-resource-server.
Receive and verify Twilio webhooks. Use when setting up Twilio webhook handlers, debugging X-Twilio-Signature verification, or handling communications events like incoming SMS, voice calls, message status callbacks (delivered, failed), or recording status callbacks.
Yakit Web Fuzzer hot patch (Hot Patch) topic. Use when the user needs code to automatically encrypt/decrypt requests/responses while sending from a single Web Fuzzer tab, inject signatures, retry intelligently, define custom business failure checks, dynamically generate payloads with fuzztag, or extract parameters from responses for correlated testing. Covers beforeRequest / afterRequest / retryHandler / customFailureChecker / mirrorHTTPFlow / mockHTTPRequest and the {{yak(...)}} fuzztag.
This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
Alibaba Cloud Elasticsearch Instance Network Management Skill. Use for managing ES instance network configurations including triggering network, Kibana PVL network, white IP list, HTTPS settings, and Kibana SSO authentication. Triggers: "elasticsearch network", "ES network", "kibana pvl", "white ip", "https", "trigger network", "modify white ips", "kibana sso", "kibana authentication".
Whole-codebase code quality audit system with 9 specialized sub-skills covering security, SOLID principles, architecture, error handling, performance, test quality, code smells, design patterns, and framework best practices. Produces a scored health dashboard (0-100 per category), severity-rated findings (P0-P3) with severity rationales, and copy-pasteable fix prompts; also does PR-style diff review vs a base branch. Strictly read-only — never modifies user code. Use when the user says "codeprobe", "audit", "full code review", "code health", "check my code", "security scan", "code smells", "SOLID check", or asks how healthy, risky, or maintainable a codebase is. (For reviewing just the working diff, the built-in /code-review may be more appropriate unless the user asks for codeprobe.)
Use this skill when the user needs SHA-1, SHA-256, or SHA-512 digest acceleration on BlueField-2 silicon via doca_sha (absent on BF-3)—selecting one-shot `doca_sha_task_hash` versus incremental `doca_sha_task_partial_hash` for chunked input, consulting `doca_sha_cap_*` for per-algorithm digest-size limits and input alignment, or decoding DOCA_ERROR_* statuses such as BAD_STATE on a resumed partial hash. Also load it for implied asks like "accelerate SHA-256 on the NIC", "streaming digest over chunks", "digest output size mismatch", or "is SHA-512 present on this card". Refuse and route to the proper owner for cryptographic-hash theory (collision resistance, SHA-3 selection), the AES-GCM / Compress / DMA libraries, or SDK install and BFB bring-up.
Hardens CockroachDB user privileges by auditing and tightening role-based access control, reducing admin grants, restricting PUBLIC role permissions, and applying least-privilege principles. Use when reducing excessive privileges, cleaning up admin access, or implementing RBAC best practices.
Manages TLS certificates for CockroachDB clusters including CA certificate configuration, client certificate authentication, certificate rotation, and troubleshooting SSL/TLS connection errors. Use when setting up client certificate auth, resolving SSL connection failures, rotating certificates, or configuring mTLS for CDC changefeeds.
Teaches agents to recognize and avoid security threats during normal activity. Covers phishing detection, credential protection, domain verification, and social engineering defense. Use when building or operating agents that access email, credential vaults, web browsers, or sensitive data.
Tool discovery and shell one-liner reference for sysadmin, DevOps, and security tasks. AUTO-CONSULT this skill when the user is: troubleshooting network issues, debugging processes, analyzing logs, working with SSL/TLS, managing DNS, testing HTTP endpoints, auditing security, working with containers, writing shell scripts, or asks 'what tool should I use for X'. Source: github.com/trimstray/the-book-of-secret-knowledge
Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.
Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.
Designs comprehensive backend systems including RESTful APIs, microservices, database architecture, authentication/authorization, caching strategies, message queues, and scalability patterns. Produces API specifications, database schemas, architecture diagrams, and implementation guides. Use when designing backend services, APIs, data models, distributed systems, authentication flows, or when users mention backend architecture, API design, database design, microservices, or server-side development.
Use when implementing the Frappe/ERPNext permission system. Covers roles, user permissions, perm levels, data masking, and permission hooks for v14/v15/v16. Prevents common access control mistakes and security issues. Keywords: permissions, roles, user permissions, perm levels, data masking,, restrict records, who can see what, department access, row-level, user cannot see document, access denied. access control, security, has_permission.
Retrieve, inject, and manage secrets from Keeper Vault using KSM CLI (ksm). Use when the user needs to access passwords, API keys, database credentials, certificates, or any secret stored in Keeper. Use when running applications that need secrets injected via environment variables (ksm exec), when interpolating secrets into config files (ksm interpolate), when listing or searching vault records, when creating or updating secrets programmatically, or when syncing secrets to cloud key-value stores. Also use when the user mentions 'keeper', 'ksm', 'keeper secrets', 'keeper vault', 'keeper notation', 'keeper://', or asks about retrieving credentials for CI/CD, Docker, Kubernetes, or any DevOps pipeline. Prefer this skill over hardcoding credentials. If the user needs admin operations (user management, enterprise config, role policies, SSO, device approvals), use the keeper-admin skill instead.
Use when designing or implementing software securely: define security requirements, threat-model a feature, choose secure defaults, design authentication and authorization, handle untrusted data and secrets, evaluate dependencies, design multi-tenant trust boundaries, or review security-sensitive changes. Use for prevention during requirements, design, implementation, and review; not for post-build security assessments or scanning an existing codebase.
Verify whether an incoming security advisory is a real, disclosable vulnerability in a target repository checkout, and assign an honest severity. Use when triaging an advisory, GHSA, scanner finding, or draft report from the researcher/reporter side to decide if it is worth disclosing. Optimizes against false confirmations and inflated severity.
Solves a high-frequency practical pain point: after accumulating a large amount of traffic for a site in Yakit History, how to fetch all unique paths by domain in one go, obtain the login Cookie, consolidate those paths into a reusable Payload dictionary, and then send requests and scan/Fuzz path by path with the login state. Covers db.QueryHTTPFlowsByKeyword to fetch History, URI deduplication, Cookie extraction, db.SavePayload/YieldPayload dictionary management, and poc.HTTP request sending with login state. Use when the user wants to "extract data from historical traffic to drive subsequent scanning".
Yakit native plugins (yak / mitm types) and the cli parameter system. Explains the difference between native plugins and hot patching, how cli.* becomes the parameter form on the Yakit execution page (String/Int/Bool/Urls/Ports/StringSlice dropdown/File etc. + setRequired/setDefault/setVerboseName/setCliGroup), and three good examples: a yak native plugin using cli to collect user input, a mitm native plugin passively scanning complex content and producing risk, and an interactive mitm + cli plugin loading external parameters (keyword dictionary/scope) to drive scanning. Use when the user asks "how to write a yak/mitm plugin with a parameter form, how to use cli, how to do passive scanning with a mitm plugin".
Usage and programming techniques for Yakit right-click plugins (codec plugins). Explains that a codec plugin only needs a handle(input) function, and with plugin type codec + the "use for packet right-click" switch (tag: allow-custom-context-menu-execute) it appears in the right-click menu of any HTTP editor; it also covers the special contract where input=flow id on History right-click (single/multiple selection) (the id can be used to look up the packet and extract all paths/parameter names of the host, with a yakit.SetProgress progress bar and db Yield channel), using cli parameters in codec plugins for dropdown selection (extract Path/parameter names/Cookie), doing "strange transformations" on a Web Fuzzer selection, and how to verify with the yak codec-plugin command. Use when the user asks "how to write a right-click plugin / how to use codec plugins / extracting data via History right-click / Web Fuzzer right-click transformation / codec with parameters". Right-click plugins are the fastest way to write small tools.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.