Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Run a sustained, multi-agent vulnerability-discovery campaign against a target: split its attack surface into slices, have builder agents hunt each slice, and have a separate critic with fresh context adversarially refute every candidate against the real artifact (a reproduced crash, a working request, a proven bypass) before it counts as a finding. Use when tasked with finding previously unknown bugs across a whole codebase, a binary, or a named live target; when you want to fan out many agents and loop until findings are proven rather than plausible; or when a single audit pass has stalled and you need builder/critic separation so the hunter never grades its own work. Dispatches auditing-code-for-vulnerabilities, analyzing-binaries, and testing-web-applications as per-slice hunters and hands proven findings to reporting-security-findings
Builds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. Use during complex forensic investigations that need cross-source event correlation, or when standard log analysis is insufficient to establish the sequence of activities for reporting findings.
Run a security and reliability health check on a Portaly Vibe payment integration before deployment. Trigger when the user mentions Portaly health check, payment security audit, pre-deploy check, sentry scan, callback verification audit, integration safety check, or wants to verify their Portaly payment integration is safe to go live.
Full Linux post-exploitation workflow: information gathering → privilege escalation → credential harvesting → lateral movement preparation. Use after obtaining a Linux shell via RCE/webshell/SSH. Privilege escalation covers sudo abuse, SUID/SGID, Capabilities, Cron hijacking, PATH hijacking, Docker/LXD groups, NFS no_root_squash, writable /etc/passwd, kernel vulnerabilities (DirtyPipe/PwnKit/DirtyCow), and component privilege escalation. Regardless of whether the current privilege is www-data or root, this methodology should be executed first. Any operation after getting a Linux shell — privilege escalation, finding credentials, finding flags, preparing lateral movement — starts with this skill
Review privacy, data retention, deletion, export, consent, telemetry, analytics, backups, account closure, children/minors, store disclosures, and data lifecycle for SaaS, apps, games, desktop utilities, developer tools, marketplaces, and support systems. Use when product decisions touch user data, tracking, storage, privacy claims, compliance risk, or trust.
This skill should be used when establishing comprehensive QA testing processes for any software project. Use when creating test strategies, writing test cases following Google Testing Standards, executing test plans, tracking bugs with P0-P4 classification, calculating quality metrics, or generating progress reports. Includes autonomous execution capability via master prompts and complete documentation templates for third-party QA team handoffs. Implements OWASP security testing and achieves 90% coverage targets.
Perform comprehensive code audits of Ruby on Rails applications based on thoughtbot best practices. Use this skill when the user requests a code audit, code review, quality assessment, or analysis of a Rails application. The skill analyzes the entire codebase focusing on testing practices (RSpec), security vulnerabilities, code design (skinny controllers, domain models, PORO with ActiveModel), Rails conventions, database optimization, and Ruby best practices. Outputs a detailed markdown audit report grouped by category (Testing, Security, Models, Controllers, Code Design, Views) with severity levels (Critical, High, Medium, Low) within each category.
Software-cracking gateway. Orchestration: unpack the protected binary first → locate authorization checks → patch/keygen. Subskills: [[re-license]] [[re-patching]] [[re-keygen]] [[re-drm]]. Triggers: 破解, crack, registration code, serial number, license verification, bypass verification, patch, keygen, key generator, license bypass.
Review cryptographic implementations and protocol usage for misuse — weak primitives, nonce and IV handling, key management, authentication of ciphertext, randomness, timing side channels, TLS and JWT configuration, and password storage. Use when auditing code that encrypts, signs, hashes, or authenticates, or when assessing TLS and token configurations.
Audit an Agent Skill (or a repo/plugin of skills) for safety before installing or trusting it. Use whenever the user wants to vet, review, audit, or check whether a skill, plugin, or its scripts are safe, asks "is this skill safe to install", pastes a skill repo/URL to evaluate, or is about to install a third-party skill from GitHub, npx skills, or a plugin marketplace. Runs static analysis only (never executes the target) and reports network egress, process execution, secret access, dynamic code, filesystem writes, obfuscation, npm install-time scripts, MCP server declarations, symlinks leaving the skill tree, shipped binaries, recorded agent transcripts carrying opaque reasoning blocks, and prompt-injection instructions hidden in SKILL.md, tiered by whether the code runs automatically, on invocation, or on demand.
Review and investigate Teleport session recordings. Use when the user asks to review or audit recorded sessions, find out what happened in a session, or search sessions by what occurred in them (e.g. "sessions that touched production databases", "who ran sudo on prod"). Covers common security workflows such as SOC risk triage of the riskiest sessions, periodic compliance reviews of production access, threat hunting for techniques (privilege escalation, persistence, data exfiltration, SSH config tampering, secret exposure), and incident-response pivots ("what did this user do on that host"). Also lists recent SSH/db/Kubernetes/desktop recordings, summarizes a session, and downloads or plays one back. Trigger on phrases like "review session recordings", "search session recordings", "what happened in session <id>", "find risky sessions", or any mention of Teleport session recordings or session summaries. Also trigger when following up on a session from a previous command.
Performance optimization, API design & compatibility, security vulnerabilities, and standards spec compliance for workerd code review. Covers tcmalloc-aware perf analysis, compat flags, autogates, web standards adherence, and security patterns. Load this skill when reviewing API changes, performance-sensitive code, security-relevant code, or standards implementations.
Use when the user asks to review, audit, or check the quality of ADVPL/TLPP code for TOTVS Protheus before merge or deploy -- covering best practices (RecLock/MsUnlock pairing, variable scope, area management, error handling), performance bottlenecks, security vulnerabilities (SQL injection, credential exposure), and modernization opportunities (TLPP migration readiness). Also triggers on Portuguese phrasing like "revisar codigo", "revisar fonte", "auditar rotina", "checar boas praticas", "code review advpl", or requests to apply the official TOTVS SonarQube ruleset (CA/BG/CS codes).
Analyze iOS applications at the binary level: decrypt FairPlay-protected IPAs with frida-ios-dump or bagbak, inspect Mach-O load commands, recover Objective-C headers with class-dump, and read Swift metadata. Use when working with an IPA or .app bundle, when a downloaded App Store binary shows cryptid=1, when class-dump returns nothing, or when analyzing iOS frameworks and app extensions
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
Flag hunting strategy for CTF challenges. Use after gaining target access via RCE/LFI/SQLi/webshell and failing to find the flag with regular ls/cat commands. Covers all possible flag storage locations: filesystem, databases, environment variables, source code, memory. Search priority ordered by success rate - try standard paths first, then scan the whole disk.
DDD4J Sa-Token authentication extension skill. Covers the StpKit extension payload pattern (write user/org/role at login, read with StpUtil.getExtra), SaTempKit one-time tokens, integration with ApiRestResponse exception handling, cross-service Same-Token configuration, and how to use @SaCheckPermission in DDD4J Controllers. Use this skill when the user uses Sa-Token for authentication in a DDD4J project, needs login extension payloads (uuid/username/orgId), or generates one-time temporary tokens. Use together with the ddd4j-core and sa-token skills.
Comprehensive guide for Dependency-Track - Software Composition Analysis (SCA) and SBOM management platform. USE WHEN deploying Dependency-Track, integrating with CI/CD pipelines, configuring vulnerability scanning, managing SBOMs, setting up policy compliance, troubleshooting installation issues, or working with the REST API.
Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.
GitHub security research methodology: search GitHub for evasion/Loader/C2 technique repositories, analyze code patterns, extract new techniques into the knowledge base. Use when the knowledge base lacks evasion techniques for the current detection environment - first search high-star GitHub repositories, analyze the code, then write to evasion-techniques-db.json or loader-components-db.json.
Use this skill when the user needs a comprehensive review of frontend code, including React, Vue, Angular or plain JavaScript/TypeScript projects. Applies to code review, Pull Request review, performance audits, security checks and similar scenarios.
Configures and operates the Kubernetes Pod Security Admission (PSA) controller that enforces Pod Security Standards: namespace enforce/audit/warn labels, cluster-wide defaults via AdmissionConfiguration, exemptions for usernames, runtime classes and namespaces, version pinning, and troubleshooting pods the controller rejected. Use when wiring PSA up on a cluster, setting cluster-wide default enforcement, exempting system namespaces, debugging why a pod was rejected or why enforcement is not firing, or reading PSA audit and warning output. Keywords: Pod Security Admission, PSA, admission controller, AdmissionConfiguration, pod-security.kubernetes.io labels, enforce audit warn, exemptions, kube-apiserver. Do not use for choosing which security profile a workload needs - use implementing-kubernetes-pod-security-standards.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.