Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Comprehensive code review skill for TypeScript, JavaScript, Python, Swift, Kotlin, Go. Includes automated code analysis, best practice checking, security scanning, and review checklist generation. Use when reviewing pull requests, providing code feedback, identifying issues, or ensuring code quality standards.
Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.
Check and configure container infrastructure (builds, registry, scanning, devcontainer). Use when auditing container infrastructure compliance, checking multi-stage builds and non-root users, setting up container build workflows with GHCR and multi-platform support, or adding Trivy/Grype scanning to CI pipelines. Natural triggers: "configure container build", "add container scanning", "set up GHCR workflow".
CTF digital forensics and signal analysis techniques. Use when a challenge provides a disk image (.dd/.E01), memory dump (.raw/.vmem), network capture (.pcap/.pcapng), steganographic image/audio, or Windows event logs (.evtx). Covers the full forensics chain: Volatility memory analysis, Wireshark traffic reconstruction, binwalk steganography extraction, file system recovery, and more
CTF miscellaneous challenge techniques. Use for CTF challenges that do not fall under pwn/crypto/web/reverse/forensics/osint, such as encoding puzzles, Python/Bash sandbox escapes, RF/SDR signals, game/VM reversing, K8s RBAC, floating-point tricks, Z3 constraint solving, and game theory. Use this skill only after ruling out the other categories
CTF open-source intelligence (OSINT) techniques. Use when a challenge requires finding clues from public information — such as tracing an identity from a given username/email, geolocating from a given photo, or recovering data from historical web snapshots. Covers social media investigation, Google Dorking, reverse image search, the Wayback Machine, DNS reconnaissance, Tor relay queries, and metadata extraction
CTF general solving orchestrator. Use when facing a CTF challenge of unknown type and needing to automatically analyze the challenge type and choose the correct solving path. Automatically dispatches the corresponding specialized skill (pwn/crypto/web/reverse/forensics/osint/malware/misc); suited to scenarios where a challenge file or service endpoint is given but the category is uncertain
Source code auditing methods in CTF challenges. Use when you find a .git directory, .bak/.zip backups, or source code leaked via /proc/self/environ. Unlike real code audits — vulnerabilities in CTF source are placed intentionally and usually there are only 1-2 key points. First find the dangerous function (sink), then trace the path from the input (source) to that function. Covers dangerous functions and vulnerability patterns in PHP/Python/Node.js/Java
Overall methodology for CTF Web challenges. Use when facing a CTF range, xbow benchmark, or web security competition. Includes quick challenge-type identification, a decision tree for choosing attack strategies, common challenge-design patterns, and criteria for deciding when to change direction. Used together with the specific vulnerability skills under exploit/
Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.
Guide AI agents through Electron app development with React including security patterns, type-safe IPC, React integration, packaging with code signing, and testing. Keywords: electron, electron-vite, electron-forge, contextBridge, IPC, security, react, packaging, code signing, notarization, playwright, desktop app. Use when building secure Electron apps with React/TypeScript (IPC, packaging, testing).
Use when evaluating projects for production or enterprise readiness, implementing supply chain security (SLSA, cosign, SBOMs, pnpm), hardening CI/CD pipelines, establishing quality gates (TYPO3: CI matrix PHP 8.2-8.5 x TYPO3 12.4/13.4/14.3 LTS), pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold) or OSPS Baseline levels, reviewing code quality, writing ADRs, or configuring Git hooks and CI pipelines.
Proactively harden a cloud account or organization before an incident — prioritizing IAM and identity risk over checkbox findings, closing the exposures that become attack paths (public storage, over-broad roles, missing audit logging, unencrypted data), reading CSPM output critically, and enforcing guardrails at the org level. Use when reviewing a cloud environment's security posture, triaging a Prowler/ScoutSuite/Security Hub report, deciding which misconfigurations actually matter, or setting preventive controls across AWS, Azure, or GCP.
Run hypothesis-driven threat hunts across endpoint, network, cloud, and identity telemetry using stack counting, outlier analysis, and ATT&CK-based hypotheses, with SIEM query patterns for Splunk, KQL, and Elastic. Use when proactively searching for undetected compromise, validating an intel report against your environment, or converting a hunch into a repeatable hunt
Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets outward (infisical-secret-syncs), or human SSO login (infisical-sso).
Find new skills on GitHub or check a specific skill before installing. Use when the user wants to search for skills, evaluate a skill URL, check overlap and security risk before installing, or compare a local skill against alternatives. Trigger with '/janitor-discover'.
Java and Spring Boot security patterns. Covers Spring Security, dependency auditing, secure coding practices, and OWASP for Java ecosystem. USE WHEN: user works with "Java", "Spring Boot", "Spring Security", asks about "Java vulnerabilities", "Maven security", "Gradle security", "Java injection", "Java authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Python security - use language-specific skills
Expertise in LLVM security features including sanitizers, hardening techniques, exploit mitigations, and secure compilation. Use this skill when implementing security-focused compiler features, analyzing vulnerabilities, or hardening applications.
Audit macOS app release readiness including app bundle identity, signing, notarization, sandboxing, hardened runtime, permissions, keychain, app support data, launch agents, login items, menu bar, Dock behavior, file associations, universal builds, auto-update, crash logs, backup, uninstall, and support diagnostics. Use when shipping or reviewing macOS desktop apps and utilities.
Code and product quality gates for shipping with confidence. Runs code review, QA testing, performance checks, and security audits. Use when the user says 'review my code', 'is this ready to ship', 'check quality', 'run QA', 'test this', 'security check', 'pre-launch review', or wants a quality assessment before deploying.
NetBox server administration: configuration, authentication backends (local/LDAP/SAML/OIDC), object permissions, API tokens, performance tuning, backups, upgrades, and housekeeping. Use when managing a NetBox instance rather than consuming its API.
Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.
Produce cyber threat intelligence by pivoting on indicators to find related infrastructure, tracking actors and campaigns, enriching and contextualizing IOCs, applying attribution discipline and analytic confidence, and packaging finished intel products tied to a consumer's decision. Covers the intelligence lifecycle, the Diamond Model and Pyramid of Pain, STIX/MISP/OpenCTI storage, TLP sharing, and passive enrichment via passive DNS, crt.sh, Shodan, Censys, GreyNoise, and VirusTotal. Use when pivoting from a domain, IP, hash, or certificate to related infrastructure, tracking a threat actor or campaign, enriching raw indicators, writing a finished intel report, assessing an external report's relevance to your org, or building a threat model of adversaries that matter to you
Python security patterns for Django, FastAPI, and Flask. Covers Bandit, Safety, secure coding practices, and OWASP for Python ecosystem. USE WHEN: user works with "Python", "Django", "FastAPI", "Flask", asks about "Python vulnerabilities", "pip security", "Bandit", "Python injection", "Python authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Java security - use language-specific skills
The independent review step, second to last in the QA process. After qa-test-runner finishes execution, review the code itself from an independent perspective — checking architecture, security, concurrency correctness, data consistency, regression risk, and test coverage gaps — uninfluenced by the executor's conclusions. Produce code-review.json (with severity-graded findings and readiness constraints) which, together with the assert-code-review gate, forms the code review evidence passed to qa-report-generator for the final report. P0/P1 security issues, funding logic defects, permission vulnerabilities, and data inconsistency risks are marked as blocking. Not applicable to: generating test cases, executing tests, modifying product code (unless the user explicitly asks), report generation.
Receive and verify Razorpay webhooks. Use when setting up Razorpay webhook handlers, debugging X-Razorpay-Signature verification, or handling payment events like payment.captured, payment.failed, order.paid, refund.processed, or subscription.charged.
Reverse engineering and static analysis of AI model files: ONNX/PyTorch/Safetensors/TFLite format parsing, network structure reconstruction, weight extraction, and file-level watermark analysis (weight patterns/metadata/tensor hashes/embedding anomalies). Trigger terms: model files, weight extraction, ONNX parsing, safetensors, pth analysis, pt files, model structure reconstruction, file-level watermarking
Android cryptography system audit (crypto audit): analyze AndroidKeyStore keys (aliases/algorithms/uses/hardware backing), audit Cipher/KeyInfo, and hook cryptographic call sites (intercept key aliases and uses with Frida). Trigger terms: Keystore, AndroidKeyStore, Cipher, KeyInfo, StrongBox, cryptography audit, crypto hook, key alias
Automotive reverse engineering: CAN buses, ECU firmware, AUTOSAR Classic (RTE/runnable/BSW) and Adaptive (Execution Management/manifest). Trigger terms: automotive, CAN, ECU, in-vehicle, OBD, UDS, AUTOSAR, RTE, runnable, SWC, BSW, E_OS_ACCESS, Adaptive, ARA, Execution Management, Function Group, Machine State, Execution Manifest
Memory forensics/threat intelligence gateway. Workflow: dump source → memory forensics → indicator extraction → intelligence correlation. Subskills: [[re-mem-forensics]] [[re-disk-forensics]] [[re-ti]], [[re-attribution]], [[re-hunting]], [[re-mobile-forensics]]. Trigger terms: memory forensics, memdump analysis, threat intelligence, sample context, VirusTotal, MISP, forensics, threat intelligence.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.