Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Assign the required Omni permission sets to provisioned agent users. TRIGGER when users ask to assign Omni permissions to agents, grant Omni-Channel access, add Omni_Agent permissions, repair missing Omni permission assignments, or prepare agents to use the Omni widget. DO NOT TRIGGER for arbitrary permission-set authoring, agent creation, or queue membership.
Classify Splunk upgrade, advisory, vulnerability, compliance, and post-change incident requests; preserve the minimum applicability and ownership context; ask one route-changing question when necessary; and hand each outcome to the exact public-product, upgrade-readiness, vulnerability/compliance, platform-operations, Cloud-administration, app-lifecycle, or provider owner. This skill routes only. It does not answer product or advisory questions, assess exposure, plan or execute changes, implement controls, or troubleshoot incidents.
Assess cited Splunk Enterprise and Splunk Cloud version, maintenance, and security-patch readiness. Use when a planned version change or Splunk security advisory needs one evidence-labeled applicability and readiness decision covering compatibility, prerequisites, sequencing, change control, recovery, validation, and Cloud-versus-Enterprise ownership without executing the change.
Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.
Use when testing REST, GraphQL, gRPC, or WebSocket APIs against the OWASP API Security Top 10 — object- and function-level authorization (BOLA/BFLA), excessive data exposure, mass assignment, unrestricted resource consumption, and GraphQL-specific abuse. For apps you own or are authorized to test.
Use Babel AST for layered, revertible targeted deobfuscation of JavaScript. Applies to `_0x` identifiers, string tables, self-executing decoder wrappers, dispatcher objects, fake constant branches, `while/for + switch` control-flow flattening, `if (literal === opcode)` dispatch chains, and scenarios where a dedicated script must be switched based on site or obfuscation-family signatures. Also use this skill when the user explicitly mentions reese84, 顶象, 极验4, 同花顺, 网易易盾, 小红书, OB variants or similar site adaptations.
Uses the Codacy Cloud CLI to query repositories, issues, security findings, pull requests, tools, and patterns on Codacy Cloud. Use whenever the user mentions Codacy, asks about code quality metrics, wants to check issues or findings in a repo, inspect a pull request analysis, browse security vulnerabilities, enable or disable tools, search patterns, trigger a reanalysis, or interact with any remote Codacy data — even if they don't say "Codacy CLI" explicitly.
Performs complete code reviews of GitLab merge requests, analysing code quality, security, performance, and best practices. Use when the user says "code review" or asks to review merge requests or analyse a branch's changes before merging.
Expert guidance for Keycloak identity and access management including realm configuration, client setup, user federation, authentication flows, role-based access control, and integration with applications. Use this when setting up authentication, configuring SSO, managing users and roles, or integrating Keycloak with applications.
Reviews LLM-powered applications against the OWASP Top 10 for Large Language Model Applications (2025 edition). Auto-invoked when reviewing code that integrates LLM APIs, builds RAG pipelines, or deploys AI-powered features. Produces a structured findings report mapped to LLM01-LLM10 with severity ratings, CWE mappings, and prioritized remediation guidance.
Use when storing credentials in OCI Vault, troubleshooting secret retrieval failures, implementing secret rotation, or setting up application authentication to Vault. Covers vault hierarchy confusion, IAM permission gotchas, cost optimization, temp file security, and audit logging.
"Audits Move contracts for security vulnerabilities before deployment using 7-category checklist. Triggers on: 'audit contract', 'security check', 'review security', 'check for vulnerabilities', 'security audit', 'is this secure', 'find security issues'."
Use to assign the Salesforce-shipped standard ContactCenterSupervisor PermissionSet (default) to N existing supervisor users via PermissionSetAssignment DML. Idempotent — SOQL detects existing (user, perm-set) pairs before POST, and DUPLICATE_VALUE is treated as reused. The standard set carries its own permission-set license and assigns cleanly on Service-Cloud-enabled orgs; a user whose license lacks the entitlement surfaces FIELD_INTEGRITY_EXCEPTION so the operator can fix the profile/license. Triggers: assign the supervisor permset, grant supervisor perms, complete supervisor provisioning. Do not use on production orgs or to assign agent permsets.
Provides comprehensive guidance for Spring Security including authentication, authorization, OAuth2, JWT, and security best practices. Use when the user asks about Spring Security, needs to implement security in Spring applications, configure authentication, or work with security features.
Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on user data, or deploy AI in regulated industries. Produces a structured assessment mapped to NIST AI RMF 1.0 and OWASP LLM02:2025 (Sensitive Information Disclosure).
Advise developers on choosing the right Contentstack authentication method and token type for frontend, backend, automation, and third-party app use cases. Include security guidance, rate-limit awareness, and SSO considerations. Use when developers ask about authentication, token types, API keys, rate limits, SSO integration, or credential security.
Guidance for Microsoft Entra Conditional Access (CA) and multifactor authentication — the Zero Trust policy engine that enforces grant/block decisions based on user, device, location, app, and risk signals. Covers a baseline 6-policy set, authentication strengths for phishing-resistant MFA, report-only rollout, break-glass exclusions, session controls, and policy lifecycle. WHEN: Conditional Access, MFA enforcement, require compliant device, block legacy authentication, Zero Trust access policy, phishing-resistant MFA, FIDO2, passkey, session controls, sign-in frequency, CA policy design, require MFA for admins, baseline CA policies, report-only mode, What If tool, exclude break-glass, named locations, app protection policy grant, terms of use. DO NOT USE for risk-based detection signal sources (use entra-id-protection) or PIM activation (use azure-pim).
A security audit tool for WordPress framework features. Performs white-box static auditing of common WordPress mechanisms such as nonce/capability/check_admin_referer, AJAX actions, escape/sanitize, redirects, secure uploads, and remote requests, and maps them to a general vulnerability type taxonomy (AUTH/CSRF/XSS/SQL/CFG/SSRF, etc.).
Yii framework security audit tool. Performs white-box static auditing of Yii (usually Yii2) access control (AccessControl/RBAC), CSRF, input filtering rules, output encoding strategies, and URL/redirect security, and maps findings to a generic vulnerability taxonomy (AUTH/CSRF/XSS/CFG/LOGIC, etc.).
Salla webhooks end to end — registering/subscribing, choosing a security strategy (signature = HMAC of the raw body; token = plain equality of the Authorization header; or none) and verifying each correctly, the payload envelope, idempotency, fast 200, conditional rules, and versions (v1/v2). Use when building a webhook server (Node/Express `@salla.sa/webhooks-actions` or Laravel/PHP / Salla CLI), subscribing events, or debugging delivery. Prefer an App Function (salla-app-functions) when a trigger exists. Lifecycle → salla-app-lifecycle; tokens → salla-app-auth.
Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI integration patterns.
Generate, validate, and explain `auth.md` files — the open protocol for AI agent registration. Use when making apps agent-ready, generating Protected Resource Metadata (RFC 9728), validating auth.md files, or implementing agent registration endpoints. Triggers on "auth.md", "agent registration", "agent auth", "make my app agent-ready", "ID-JAG", "identity_assertion", "service_auth", "protected resource metadata", "agentic registration".
Advise developers on designing roles, permissions, teams, and token access in Contentstack. Explain built-in roles, custom roles, permission merging, team-based access, and token capabilities with least-privilege guidance. Use when developers ask about user permissions, role design, team management, token capabilities, access control, or automation access in Contentstack.
Power BI deployment, CI/CD, governance, and administration. PROACTIVELY activate for: (1) Power BI deployment pipelines (Service deployment pipelines, fabric-cicd, custom workflows), (2) CI/CD for Power BI via GitHub Actions or Azure DevOps, (3) workspace management and roles, (4) row-level security (RLS) and object-level security (OLS), (5) capacity management (Premium, PPU, Fabric SKUs F2-F2048), (6) tenant settings and governance, (7) Power BI Report Server deployments, (8) service principal setup for automation, (9) data-gateway management. Provides: deployment-pipeline templates, GitHub Actions and Azure DevOps YAML, RLS/OLS implementation patterns, capacity sizing guidance, and service-principal auth recipes.
Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule, New-InboxRule), external mail forwarding rules, and unusual Microsoft Graph API access or OAuth token use. Use when investigating suspected business email compromise (BEC), account takeover, or mailbox persistence via malicious inbox rules.
Discover, compare, and deploy pre-built Ludus cyber range environments for security training, attack simulation, and detection engineering. Use when users ask to choose a lab, verify prerequisites, or deploy known environments such as GOAD, SCCM, Elastic, or Vulhub.
Use when the user asks to "design cloud architecture", "set up Terraform infrastructure", "optimize cloud costs", "plan disaster recovery", "configure multi-region failover", "audit IAM policies", "migrate to cloud", "set up VPC networking", "compare AWS vs GCP vs Azure", or "right-size cloud instances". Expert cloud architecture covering AWS, GCP, Azure, multi-cloud strategy, cost optimization, security, and infrastructure automation.
Help with ABAP authorization and IAM (Identity and Access Management) including authorization objects, authorization checks, IAM apps, business catalogs, business roles, restriction types, CDS access control (DCL), privilege access annotations, and role-based access in ABAP Cloud and on-premise. Use when users ask about authorization, AUTHORITY-CHECK, authorization object, IAM app, business catalog, business role, restriction type, CDS access control, DCL, access control, privilege annotation, role assignment, PFCG role, S_DEVELOP, or securing ABAP applications. Triggers include "authorization check", "create authorization object", "CDS access control", "IAM app", "business catalog", "business role", "PFCG", "restrict access", or "role-based security".
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.