Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Yaklang toolchain and plugin verification guide. Explains how to run scripts with the yaklang source engine (go run common/yak/cmd/yak.go), and how the four hot patch/codec verification commands (yak hotpatch-mitm / hotpatch-global / hotpatch-webfuzzer / codec-plugin) verify your MITM / global / Web Fuzzer hot patches and right-click codec plugins using the same execution path as real gRPC; it also explains how to locate and debug MITM issues with the yaklang repository source code. Use when the user asks "how do I verify the plugin I wrote / how do I debug incorrect MITM behavior".
Use when testing whether users can access data or actions they shouldn't — IDOR/BOLA, horizontal and vertical privilege escalation, multi-tenant isolation, forced browsing, function-level authorization (BFLA), and mass assignment. The #1 cause of real-world breaches.
Azure AD OAuth2/OIDC SSO integration for Kubernetes applications. Use when implementing Single Sign-On, configuring Azure AD App Registrations, restricting access by groups, or integrating tools (DefectDojo, Grafana, ArgoCD, Harbor, SonarQube) with Azure AD authentication.
Receive and verify Linear webhooks. Use when setting up Linear webhook handlers, debugging Linear signature verification, or handling Linear issue tracking events like Issue, Comment, Project, Cycle, IssueLabel, and IssueSLA create/update/remove actions.
Cryptographic primitives used by the Midnight node — Blake2-256 hashing, sr25519/ECDSA/Ed25519 signatures, twoxhash storage keys, and how they map to consensus, P2P, and state. Use when debugging node crypto, signature verification, or hash function choices.
Use when designing OCI networks, troubleshooting connectivity, optimizing egress costs, or configuring VCN security. Covers Service Gateway cost savings, VCN CIDR immutability, Security List vs NSG tradeoffs, VCN peering limitations, and Load Balancer subnet requirements.
Generate a Transilience-branded PDF report (pentest, vuln assessment, compliance, threat intel) from a single findings JSON using the bundled ReportLab generator. Use whenever an engagement needs its final report/deliverable PDF in Transilience house style.
zkLogin on Sui — architecture, protocol flow, integration, and security. Use when explaining how zkLogin works, integrating zkLogin into a Sui application, choosing an OpenID provider, understanding the address derivation scheme, debugging session lifetime or proof issues, or answering questions about zkLogin security properties (salt, ephemeral keys, JWT privacy). Also use when the user asks about OAuth-based wallet-less login on Sui.
Receive and verify Anthropic Claude Managed Agents (CMA) webhooks. Use when setting up Claude Managed Agents webhook handlers, debugging signature verification, or handling agent session and vault events like session.status_idled, session.status_terminated, session.thread_created, vault.created, or vault_credential.refresh_failed.
Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team posture review of the lateral-movement -> privilege-escalation -> exfiltration -> evasion chain.
This skill should be used when the user asks to “perform cloud penetration testing,” “assess Azure or AWS or GCP security,” “enumerate cloud resources,” “exploit cloud misconfigurations,” “test O365 security,” “extract secrets from cloud environments,” or “audit cloud infrastructure.” It provides comprehensive techniques for security assessment across major cloud platforms.
Configures SQL audit logging on CockroachDB clusters to capture security-relevant events including authentication, privilege changes, and sensitive data access. Use when enabling audit logging for compliance, setting up role-based audit policies, or verifying audit configuration.
Comprehensive cybersecurity analysis for any local project. Scans for dependency vulnerabilities (SCA), code security patterns (SAST), leaked secrets, authentication/authorization flaws, cryptographic weaknesses, misconfigurations, supply chain risks, and CI/CD security. Covers all OWASP 2025 Top 10 and CWE Top 25. Generates a prioritized report with remediation guidance. Use when the user says "security audit", "vulnerability scan", "check for security issues", "find vulnerabilities", "security review", "pentest", "security check", or invokes /cyber-neo.
Guidance for Docker security hardening across the full lifecycle — image security (minimal base images, non-root users, pinned versions), runtime security (seccomp/AppArmor/SELinux, capabilities, read-only rootfs, no-new-privileges), secrets management (BuildKit secrets, Docker secrets in Swarm), Docker Bench Security auditing, CIS compliance checklist, and supply-chain security (image signing, content trust, SBOM). Use when the user asks about Docker security, image hardening, non-root containers, seccomp, AppArmor, Docker Bench, secrets management, or securing containers. 使用场景：docker 安全、镜像安全、非root运行、seccomp、AppArmor、security、Docker Bench、secret管理.
Perform dynamic security testing against running web applications and APIs to discover vulnerabilities through active probing and fuzzing. Use when the user requests dynamic application security testing or provides relevant inputs for this workflow.
Build a zero-knowledge loan application on Midnight Network — privately evaluate credit score, income, and employment tenure inside a Compact circuit with Schnorr attestation, record only loan outcomes on-chain, and wire attestation API + CLI + optional Next.js frontend. Covers zkloan-credit-scorer.compact (witness-derived identity, tiered eligibility, PIN migration, admin governance), Jubjub Schnorr verification, attestation provider registration, and low-level deploy/call via 1AM wallet. Use for private credit scoring, attested witness data, lending dApps, or teaching disclose()/witness patterns with off-chain trusted signers. Triggers: ZK loan, credit scorer, attestation API, Schnorr signature Compact, requestLoan, private credit score, loan eligibility tiers, PIN identity, zkloan. Also use when extending leaderboard-dapp or locker-dapp wallet/provider patterns to multi-service monorepos.
Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns. Use when hunting for web shells after a public-facing app compromise, when EDR/SIEM alerts fire on webserver process anomalies, or during incident response on internet-facing infrastructure.
Interpret and use `mcpjam` probe, doctor, OAuth, XAA (Cross-App Access / ID-JAG), apps conformance, tools, resources, and prompts output conservatively against MCP 2025-11-25. Use when interacting with MCP servers, executing tools, triaging findings, performing security reviews, debugging enterprise-managed authorization, deciding whether a CLI finding is real or overstated, or turning inspection output into an engineer-facing report with severity and confidence.
Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.
Generate and analyze AI Bill of Materials (AIBOM) for Python projects using AI/ML components. Identifies AI models, datasets, tools, and frameworks for security and compliance tracking. Use this skill when: - User asks to scan for AI components - User wants to know what AI models a project uses - User mentions "AI BOM", "AI inventory", or "ML security" - User is working with Python AI/ML projects (PyTorch, TensorFlow, HuggingFace) - User needs AI component compliance documentation
Authorization and other preconditions as compile-time proofs in TypeScript, with the gdp-ts library (Ghosts of Departed Proofs). Use when adding, changing or reviewing authorization, entitlement or ownership checks in a TypeScript codebase that uses gdp-ts (imports of `name`, `Named`, `Proof` or `defineProof`), when adopting the pattern in a codebase, or when fixing type errors that mention `Named<...>` or proof types.
AI-powered JavaScript reverse engineering tool. Senior JavaScript reverse engineering expert assistant. Actions: collect, search, deobfuscate, understand, summarize, detect-crypto, browser, debugger, breakpoint, debug-step, debug-eval, debug-vars, script, hook, stealth, dom, page. Capabilities: obfuscated code analysis, VM cracking, Webpack unpacking, AST transformation, Puppeteer/CDP automation, anti-detection, fingerprint spoofing, crypto identification, parameter extraction, algorithm recovery, Canvas/WebGL fingerprinting, WebDriver hiding, CDP debugging, breakpoint analysis, dynamic tracing, hook injection, DOM inspection, page control.
Receive and verify Notion webhooks. Use when setting up Notion webhook handlers, debugging Notion signature verification, completing the verification_token handshake, or handling workspace events like page.content_updated, page.properties_updated, comment.created, or data_source.schema_updated.
Comprehensive Odoo security auditor for model access rules, HTTP route authentication, sudo() usage, SQL injection risks, and record rule completeness across Odoo 14-19. <example> Context: User wants a full security audit user: "Run a complete security audit on my HR module" assistant: "I will audit access rules, HTTP routes, sudo usage, and SQL injection risks across all files in the module." <commentary>Full audit trigger - comprehensive security review.</commentary> </example> <example> Context: User wants to check access rules user: "Check if all models have proper access rules in ir.model.access.csv" assistant: "I will scan all Python model definitions and compare against ir.model.access.csv to find missing read/write/create/unlink rules." <commentary>Access check trigger - ir.model.access.csv completeness.</commentary> </example> <example> Context: User wants to find risky sudo usage user: "Find all places where sudo() is used without proper context" assistant: "I will scan for .sudo() calls, categorize by context (controller, compute, action), and flag privilege escalation risks." <commentary>Sudo finder trigger - privilege escalation risk analysis.</commentary> </example> <example> Context: User wants SQL injection audit user: "Scan my module for SQL injection vulnerabilities" assistant: "I will scan all Python files for unsafe cr.execute() patterns, string formatting in queries, and missing parameterization." <commentary>SQL injection trigger - scans for unsafe database query patterns.</commentary> </example>
Onchain randomness on Sui. Use when generating random values in Move smart contracts, working with the Random object (0x8) or RandomGenerator, securing randomness-consuming functions against composition attacks, PTB attacks, or state leakage, implementing commit-reveal patterns, balancing gas across execution paths, or integrating randomness from TypeScript. For general Move security patterns, see the `move-security` skill. For Move language fundamentals, see the `sui-move` skill. For TypeScript SDK patterns, see the `sui-sdks` skill.
OpenTelemetry in Java — Javaagent zero-code instrumentation, Spring Boot Starter, manual autoconfigure SDK, declarative YAML configuration, BOM dependency management, sensitive-data capture and redaction (url.query, headers, request parameters, SQL sanitization). Use when adding, reviewing, or configuring OpenTelemetry in a Java service. Triggers on "setup otel in java", "java telemetry", "javaagent", "Spring Boot otel", "GlobalOpenTelemetry", "AutoConfiguredOpenTelemetrySdk", "TracerProvider java", "url.query redaction", "capture request headers", or any Java-related OTel question.
Use when the user is working on who can sign in to Spree 6 and what they may do—staff roles and permission keys, secret-key scopes, registering permission scopes for an extension, 403 errors with `required_permission` / `required_scope`, storefront ownership rules (`Spree::Storefront::AccessPolicy`), custom login strategies (SSO, OIDC, Auth0/Okta/Entra/Firebase), JWT audiences, or swapping the customer/admin user class. Common phrasings include “Spree roles”, “staff permissions”, “add a role”, “read_orders permission”, “Spree.permissions.register_scope”, “API key scopes”, “403 Missing permission”, “who can see this order”, “SSO for the dashboard”, “OIDC login”, “custom authentication strategy”, “Spree.customer_class”, “admin_user_class”, “CanCanCan in Spree 6”. Spree 6.
Analyzes project dependencies for known vulnerabilities, license risks, and supply chain integrity. Auto-invoked when package manifests (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml) are shared or when discussing dependency security. Produces an SBOM assessment with CVE findings triaged by EPSS and CISA KEV, license compliance check, and supply chain risk rating.
Receive and verify Google Gemini API webhooks. Use when setting up Gemini webhook handlers for batch jobs, video generation, or Interactions API function-calling LROs, debugging signature verification, or handling events like batch.succeeded, batch.failed, video.generated, or interaction.completed.
Receive and verify Hugging Face webhooks. Use when setting up Hugging Face webhook handlers, debugging X-Webhook-Secret verification, or handling events on models, datasets, and Spaces — repo updates, new commits and tags (repo.content), config changes (repo.config), discussions, Pull Requests, and discussion comments.
Receive and verify Intercom webhooks. Use when setting up Intercom webhook handlers, debugging X-Hub-Signature verification, or handling customer messaging events like conversation.user.created, conversation.admin.replied, contact.user.created, or ticket.created.
Use this skill when the user asks to “set up a web server”, “configure HTTP or HTTPS”, “perform SNMP enumeration”, “configure SMB shares”, “test network services”, or needs guidance on configuring and testing network services for penetration testing labs.
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed secrets, and licences, generating CycloneDX or SPDX SBOMs. Use when integrating Trivy into CI/CD, deploying the Trivy Kubernetes operator, scanning non-image targets, or triaging results at scale. Keywords: Trivy, trivy k8s, operator, SBOM, CycloneDX, SPDX, misconfig, secret scanning. Do not use for a single Docker image scan - use scanning-docker-images-with-trivy.
Receive and verify Scrapfly webhooks. Use when setting up Scrapfly webhook handlers for async scrape, extraction, screenshot, or crawler jobs, debugging X-Scrapfly-Webhook-Signature verification, or routing on X-Scrapfly-Webhook-Resource-Type.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.