Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
IoT protocols: MQTT/CoAP/BLE/Zigbee; BLE link layer (advertising parsing/pairing encryption) and NFC/smart cards (ISO14443/APDU/MIFARE). Trigger terms: MQTT, CoAP, BLE, Zigbee, IoT protocols, BLE link, BLE sniffing, advertising parsing, pairing encryption, GATT, NFC, smart cards, MIFARE, APDU, ISO14443
Run digital forensics and incident response: triage, evidence acquisition with chain of custody, host and cloud artifact analysis, timeline reconstruction, scoping, containment, eradication, and postmortem. Use during a suspected compromise, when analyzing a disk or memory image, reconstructing an attacker timeline, or answering how far an intrusion spread
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.
A browser environment emulation skill for Web/JS reverse engineering, covering Proxy-based environment dumping, prototype chain fixes, native toString protection, descriptor protection, and modular environment analysis and construction for navigator/document/storage/canvas/WebGL/crypto/performance/WebRTC/Worker and more. Use when the user explicitly mentions "补环境", "浏览器环境模拟", "Proxy吐环境", "document.all", "webdriver", "plugins/mimeTypes", "指纹", "jsdom/vm/node 补环境", "补环境 skill", or "验证码/风控环境修补".
Audit Windows app release readiness including installer/MSIX identity, code signing, SmartScreen reputation, services, startup tasks, tray behavior, registry and file associations, notifications, credential storage, AppData/ProgramData, firewall prompts, auto-update, rollback, uninstall cleanup, crash logs, Microsoft Store certification, and support diagnostics. Use when shipping or reviewing Windows desktop apps and utilities.
Active Directory Certificate Services (ADCS) certificate attacks. Use when a CA server, ADCS Web Enrollment, or misconfigured certificate templates are found in the domain. Covers all ESC1-ESC11 certificate abuse paths, the Certipy toolchain, certificate forgery, and NTLM relaying to ADCS. Always use this skill when ADCS/CA/certificate/certsrv content is found
Add Arcjet Guard protection to AI agent tool calls, background jobs, queue workers, and other code paths where there is no HTTP request. Covers rate limiting, prompt injection detection, sensitive information blocking, and custom rules using `@arcjet/guard` (JS/TS) and `arcjet.guard` (Python). Use this skill whenever the user wants to protect tool calls, agent loops, MCP tool handlers, background workers, or any non-HTTP code from abuse — even if they describe it as "rate limit my tool calls," "block prompt injection in my agent," "add security to my MCP server," or "protect my queue worker" without mentioning Arcjet or Guard specifically. Uses the Arcjet CLI (`npx @arcjet/cli` or `brew install arcjet`) for authentication and site/key setup.
Reverse engineer Go binaries by recovering function names and types from pclntab and moduledata using GoReSym, redress, and IDA/Ghidra Go plugins, and by reading Go's non-standard calling convention, interface dispatch, and string layout. Use when a binary contains Go runtime strings, when strings show runtime.main or go:buildid, when a stripped binary is unexpectedly large, or when analyzing Go malware or a Go-based service.
Analyze suspected malware safely — containment, static triage, sandboxed detonation, unpacking, capability and C2 extraction, IOC production, and YARA rule authoring. Use when handed a suspicious file, hash, or sample, when triaging an alert artifact, or when producing detection content from a specimen.
Multi-layered anti-fraud and bot detection system for registration flows. Use when implementing: (1) Registration form security, (2) Bot detection and shadow banning, (3) Behavioral analysis (keystroke, mouse tracking), (4) Risk scoring systems, (5) Honeypot field implementation, (6) Disposable email detection, or any fraud prevention for user registration
Guides privacy audit report writing including executive summary drafting, findings classification (critical, high, medium, low), evidence referencing, root cause analysis documentation, recommendation formulation, management response tracking, and report distribution protocols. Covers report structure from scope definition through appendices and sign-off. Keywords: audit report, findings documentation, executive summary, recommendations, report structure, privacy audit deliverables.
Use this skill whenever you need to audit, test, or fix Authentication Failures (OWASP A07:2025) in Python web applications — especially FastAPI and Flask. Triggers include: any mention of JWT security, session management, brute force protection, credential stuffing, password policy, MFA enforcement, login rate limiting, session fixation, token validation, or auth-related error messages. Also trigger for requests to "check authentication", "audit login flows", "test auth security", "find auth bugs", or any task involving CWEs: CWE-287, CWE-307, CWE-384, CWE-521, CWE-798, CWE-613. Use proactively whenever the user shares auth-related code (routes, middleware, decorators, token handlers) even if they haven't explicitly mentioned security testing.
Use when an AWS account's IAM API is blocked by an MFA-required policy — `sts:GetCallerIdentity` works but `iam:*` is rejected with `InvalidClientTokenId` — or when FIDO2 passkey MFA can't be used from the CLI. Trigger it from symptoms like "access denied", "token expired", or "only IAM operations fail" related to aws-vault / aws-cli / MFA / passkey (even if the user doesn't name aws-vault explicitly).
Cloud metadata exploitation. Use when the cloud instance metadata service is reachable via SSRF or a shell you already have. Covers metadata endpoints for AWS/Azure/GCP/Alibaba Cloud/Tencent Cloud, IAM/CAM credential extraction, IMDSv2 bypass, and the full attack chain from metadata to cloud service enumeration. Use this skill in any SSRF scenario, or whenever 169.254.169.254 or 100.100.100.200 is reachable from the internal network
Provides comprehensive code review covering 6 focused aspects - architecture & design, code quality, security & dependencies, performance & scalability, testing coverage, and documentation & API design. Use this skill for deep analysis with actionable feedback after significant code changes.
(NS) Senior Tech Lead code review on SOLID, clean code, performance, security, and testability. Use proactively after writing or modifying code, before opening PRs, after implementation closure, or when the user asks for a code review, PR review, or issue review gate — even if they do not name this skill. For GitLab issue execution with ISSUE_URL, use Issue review mode. Do NOT use for root-cause debugging (use code-investigator).
Diagnose a broken or untrusted codebase and plan the fix. Runs the app for real, fans out parallel specialist sub-agents (security, database, core logic, frontend/UX, architecture), audits the git/CI/deploy setup, verifies the headline claims independently, then gives a plain-English findings list ranked by real-world cost, writes FINDINGS.md into the repo, and delivers a rebuild-or-fix-in-place verdict (fix in place wins by default, and having real users can veto a rebuild outright) before handing off to cs-build-import-codebase and creating the Kanban tasks. Works on any codebase in any language. Triggers, "my app is a mess", "audit my codebase", "what's wrong with my app", "diagnose this codebase", "should I rebuild or fix this", "find the bugs in my app", "review my whole app".
CTF malware analysis techniques. Use for CTF malware analysis challenges such as obfuscated script analysis, C2 traffic reconstruction, reversing PE/.NET malware samples, parsing custom encryption protocols, writing YARA rules, and Shellcode analysis. Covers static analysis (IDA/Ghidra), dynamic debugging (Frida/x64dbg), traffic analysis (Wireshark), memory forensics, and more
Data validation patterns including schema validation, input sanitization, output encoding, and type coercion. Use when implementing validate, validation, schema, form validation, API validation, JSON Schema, Zod, Pydantic, Joi, Yup, sanitize, sanitization, XSS prevention, injection prevention, escape, encode, whitelist, constraint checking, invariant validation, data pipeline validation, ML feature validation, or custom validators.
Analyze disk images and file systems for forensic investigation. Use when investigating data theft, insider threats, malware persistence, deleted file recovery, or any incident requiring analysis of storage media. Supports NTFS, FAT, EXT, HFS+, and APFS file systems.
Build, test, and tune detection content — Sigma, YARA, Suricata, and EDR/SIEM queries — mapped to MITRE ATT&CK with explicit false-positive analysis and detection-as-code practices. Use when writing or reviewing a detection rule, converting IOCs or TTPs into alerts, measuring detection coverage, or reducing alert fatigue.
Evasion technique integration: implant evasion techniques (API obfuscation, string encryption, syscalls, anti-debugging, AMSI bypass, etc.) into existing Loader code. Use when adding new loading techniques to an existing Loader, or when an existing Loader is detected and its components need replacing. First read references/evasion-techniques-db.json to confirm the component library contains the technique you need, then perform the integration
Comprehensive code security checks and server security audit skill. Use for: (1) Code vulnerability scanning - detect OWASP Top 10 vulnerabilities such as SQL injection, XSS, and SSRF, (2) Dependency security checks - identify outdated or vulnerable third-party libraries (e.g. React2Shell CVE-2025-55182, Next.js CVE-2025-66478), (3) Server configuration audit - check security configurations for SSH, firewalls, permissions, and more, (4) Sensitive information leak detection - detect hardcoded API keys, passwords, tokens, and more, (5) Container security scanning - audit Docker images and Kubernetes configurations, (6) CI/CD security checks. Trigger keywords: "安全检查", "漏洞扫描", "代码审计", "security audit", "vulnerability scan", "penetration test", "SAST", "DAST", "dependency check", "CVE 检测", etc.
Use httpx for HTTP probing, fingerprinting, and information gathering. Use when you need to check HTTP/HTTPS service liveness in bulk, identify web technology stacks, extract page titles/status codes/response headers, detect CDNs, or take screenshots. httpx is a multi-purpose HTTP probing tool from ProjectDiscovery and a key bridge between port scanning and vulnerability scanning in penetration testing pipelines. This skill should be used in any scenario involving HTTP liveness checks, web fingerprinting, technology stack identification, or bulk URL probing
Detect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP malleable C2 profile pattern matching, and beacon jitter/interval analysis, built with Zeek network logs, Suricata IDS rules, and Python PCAP analysis. Use when hunting for Cobalt Strike beacon callbacks in network traffic or building detection rules for this C2 framework.
Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry (Event ID 4688, Sysmon 1/11) for 7-Zip/RAR/tar archive creation, unusual temp or hidden folder access, and anomalous consolidation of files from multiple directories. Use when hunting for pre-exfiltration staging behavior, building detection rules for archiver abuse, or validating monitoring coverage for T1074.
Implements a simplified Signal Protocol-style end-to-end encryption scheme for messaging, covering key exchange, forward secrecy, and the core cryptographic components so no server or intermediary can decrypt messages. Use when designing or building E2EE messaging, or evaluating forward-secrecy and key-management tradeoffs for a messaging system.
Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at admission time. Use when enforcing custom policy-as-code at admission on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint, Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles that Pod Security Admission already covers - use implementing-pod-security-admission-controller.
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
iOS system-level exploitation methodology. Covers iOS kernel exploitation (UAF/heap overflow/type confusion), Safari/WebKit exploitation, PAC bypass, sandbox escape, the Corellium research environment, and analysis of known CVEs (CVE-2020-27950, CVE-2021-30807, iMessage zero-click). Triggers when an agent needs to analyze iOS system-level vulnerabilities, conduct kernel exploitation research, or understand iOS exploit chains.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.