Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Run a bounded red-teaming autoresearch loop to generate LLM guardrail training data. You (the agent running the skill) are the attacker and the judge: you craft attacks and label every response. The only model the harness calls is the target under test, over any OpenAI-compatible API (OpenRouter, Moonshot/Kimi, Fireworks, Ubicloud, OpenAI, or custom), with its key in `.red-team/.env`. Every attempt (pass and fail) is written to JSONL ready for fine-tuning guardrails in Llama Guard format. Use when asked to red-team or stress-test an LLM for harmful content, jailbreaks, prompt injection, or backdoor/trigger behavior; to build a safe/unsafe dataset; or to mine novel attacks at scale. Complements the hacker skill (code/infra exploitability): this skill targets model behavior and produces data.
Implementation of sandbox evasion and anti-analysis techniques. Use when a malicious payload needs to bypass automated sandbox analysis (AnyRun/Cuckoo/CAPE/Joe/Windows Defender Sandbox). Covers implementation methods for mainstream evasion techniques such as environment detection, timing evasion, user interaction detection, and virtualization detection.
Audit codebases, infrastructure, AND agentic AI systems for security issues. Covers traditional security (dependencies, secrets, OWASP web top 10, SSL/TLS, file permissions) PLUS agentic security (prompt injection scanning, identity spoofing detection, memory poisoning checks, multi-agent communication audit, OWASP Agentic Top 10). Use when scanning for vulnerabilities, detecting hardcoded secrets, reviewing agent workspace configuration, checking prompt injection vectors, or auditing agent permissions and boundaries.
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.
Detect, audit, and remediate Security Misconfiguration vulnerabilities (OWASP A02:2025) in Python web applications — especially FastAPI and Flask. Use this skill whenever a user asks about: hardening a Python/FastAPI/Flask app, checking for debug mode leaks, missing security headers, exposed API docs, hardcoded secrets, insecure cookie flags, XXE vulnerabilities, or any OWASP A02 misconfiguration issue. Also trigger for tasks like "security audit", "pen test prep", "production checklist", "find misconfigs", or "harden my app". This skill covers static analysis patterns, runtime checks, tooling (Bandit, OWASP ZAP), and remediation code snippets for each sub-category of misconfiguration.
Comprehensive senhasegura PAM platform skill for secrets management, credential vaulting, SSH key rotation, and DevOps secrets integration. Use when working with senhasegura A2A APIs, DSM CLI, MySafe, credential management, password rotation, External Secrets Operator integration, or any senhasegura PAM operations.
A complete reference for advanced sqlmap usage. Use when SQL injection is confirmed and you need to exploit it automatically with sqlmap. Covers POST/Cookie/Header injection, tamper script selection, precise control with --technique, second-order injection, OS shell/file read and write, and database extraction optimization
Generate a verifiable TDIR weekly report suitable for direct delivery by a bot. Analyze only iOA and CWP; keep the two sections completely separate and identical in structure. Use the fixed sequence: “Overall situation → Endpoint overview → Threat insights → Items to watch → Top 5 compromised tenants → Top 5 compromise scenarios”. Does not provide remediation recommendations, ticket closure, cross-source aggregation, or statistics from other sources.
Use uncover to aggregate queries across cyberspace search engines. Use when exposed assets need to be discovered quickly from engines such as Shodan/Censys/FOFA/Hunter/Quake/ZoomEye. uncover unifies the query interface of multiple search engines, querying several engines with a single command. This skill should be used in any scenario involving asset discovery, internet mapping, or attack surface review.
Use when a Backstage plugin needs to gate UI behind permissions (frontend) or authorize actions in route handlers (backend). Covers createPermission, the usePermission hook and RequirePermission component, the coreServices.permissions service for backend authorization, and resource permissions for per-instance checks. Triggers on phrases like "require permission", "gate this UI", "check authorization", or imports of @backstage/plugin-permission-common, @backstage/plugin-permission-react, or @backstage/plugin-permission-node.
Store, version, compare for equality, archive, restore, and explicitly share arbitrary encrypted files in personal or project VaultContext vaults through a CLI. Use for sensitive file storage, including private configuration files; excludes inspecting or executing file contents and cloud provisioning.
Receive and verify Zoom webhooks. Use when setting up Zoom webhook handlers, debugging signature verification, completing the endpoint.url_validation handshake, or handling meeting and recording events like meeting.started, meeting.ended, meeting.participant_joined, or recording.completed.
Design and audit account recovery, password reset, MFA reset, passkey recovery, SSO fallback, device change, email/phone change, account ownership proof, support escalation, anti-takeover controls, lockouts, notifications, and recovery analytics. Use when users can lose access or attackers can exploit recovery to take over an account.
Kerberos delegation attacks (unconstrained/constrained/RBCD). Use when BloodHound reveals delegation configurations, or when you have control of a service account or machine account with an SPN. Abuse of the S4U protocol enables impersonating any user across services, and is commonly used for domain privilege escalation and lateral movement.
Use Adinfo for Active Directory information gathering. Use when you have obtained domain user credentials and need to quickly collect domain environment information. Adinfo is a fast AD information gathering tool that outputs key information such as domain controller lists, domain admin users, trust relationships, GPOs, SPNs and delegation configurations with a single command — far faster than manual LDAP queries. Use this skill for the first step of information gathering after discovering a domain environment
Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.
Mint a tamper-evident, post-quantum-signed receipt for a consequential agent action (deploy, delete, pay, grant-access, model decision) so it can be verified later from the certificate alone. Use when an autonomous agent takes a side-effecting action that may need to be proven later, or when satisfying EU AI Act Article 12 record-keeping. Three decisions: whether an action needs a receipt, minting it, verifying it. Signing is delegated to the open-source OpenAgentOntology package. Not after-the-fact log analysis; not a hosted notary; not a legal opinion.
Methodology for security testing of AI system identity and authorization. Use when the target system involves agent authentication, multi-agent permission management, role-setting safety, session management, or MCP/API credential control. Covers: role escape (hypothetical scenario/hypothetical role/forgetting technique/goal hijacking), privilege escalation (Action overreach/unauthorized MCP resource access), multi-agent identity spoofing, session hijacking, credential leakage and abuse.
Guides APEC Cross-Border Privacy Rules system certification process including self-assessment against the APEC Privacy Framework principles, accountability agent selection, intake questionnaire completion, certification decision, annual recertification, and Global CBPR Forum transition. Keywords: APEC, CBPR, cross-border privacy, accountability agent, certification, Global CBPR.
Design and audit API rate limits, quotas, fair-use policy, burst handling, concurrency limits, usage tiers, overages, retry headers, developer dashboards, webhooks, abuse controls, tenant isolation, enterprise overrides, and migration communication. Use when launching APIs, SDKs, developer platforms, AI endpoints, marketplace APIs, or usage-priced products.
Router skill for API penetration testing across REST, GraphQL, gRPC, and WebSocket. Covers OWASP API Top 10 (2023) including BOLA/BFLA/BOPLA, JWT attack chains, GraphQL introspection abuse, and mass assignment. Invoke when the user asks to pentest an API, analyze OpenAPI/Swagger, test auth/authorization, fuzz endpoints, or find API vulnerabilities.
APT emulation and intelligence-driven red team methodology. Design red team action plans based on the TTPs (MITRE ATT&CK) of known APT groups. Use when you need to emulate a specific threat group, design high-fidelity attack exercises, or formulate attack strategies based on threat intelligence
Guides privacy audit evidence collection processes including evidence planning, sampling strategies, documentation standards, chain of custody, interview techniques, system walkthrough procedures, and evidence evaluation. Covers ISO 19011 evidence categories (records, statements of fact, observations) and ISACA audit evidence requirements for privacy compliance assessments. Keywords: audit evidence, evidence collection, sampling, chain of custody, audit documentation, interview techniques.
Receive and verify Auth0 webhooks delivered via Custom Log Streams (HTTP). Use when setting up an Auth0 log stream HTTP endpoint, validating the configured Authorization token, or handling batched authentication log events like s (success login), f (failed login), ss (signup), and sepft (password-grant token exchange).
Implements automated data deletion workflows for GDPR Article 17 right to erasure and retention period expiry. Covers cascading deletion across dependent systems, dependency handling for referential integrity, confirmation logging, and audit trail generation. Activate for automated deletion, erasure automation, data purge, retention expiry queries.
Generates Records of Processing Activities automatically from IT system inventories including Active Directory, cloud service catalogs, API gateway logs, and database schemas. Covers automated field population, data flow discovery, and system-to-RoPA mapping. Activate for automated RoPA, system inventory, data discovery, auto-population, IT-driven records.
Overall methodology for penetration testing Azure cloud environments. Use when the target uses Azure/Microsoft 365/Entra ID, when Azure-related assets are discovered (Blob Storage/App Service/Azure VM/Azure Functions), when Azure credentials are obtained (Service Principal/Managed Identity/Access Token), or when a security assessment of an Azure environment is required. Provides a full decision tree from unauthenticated enumeration to Entra ID attacks, service privilege escalation, and Cloud-to-OnPrem lateral movement. Covers the attack surface of 35+ Azure services
Receive and verify Bitbucket Cloud webhooks. Use when setting up Bitbucket webhook handlers, debugging X-Hub-Signature verification, or handling repository and pull request events like repo:push, pullrequest:created, pullrequest:updated, pullrequest:fulfilled, or pullrequest:rejected.
Use when testing application-specific workflow and business-rule flaws that scanners cannot find — price/quantity/parameter tampering, workflow and state-machine bypass, race conditions and TOCTOU, replay, and abuse of coupons/refunds/limits. Requires understanding what the app is supposed to do.
Full-workflow management tool for LLM security evaluation. Supports creating/updating model and agent evaluation assets, querying available resources, initiating compliance evaluation tasks, initiating security evaluation tasks, and analyzing evaluation results.
Receive and verify Calendly webhooks. Use when setting up Calendly webhook handlers, debugging Calendly signature verification, or handling scheduling events like invitee.created, invitee.canceled, invitee_no_show.created, or routing_form_submission.created.
Use ccupp to generate weak password dictionaries based on social engineering information. ccupp is the most complete password profiling tool for Chinese-language scenarios — input the target's name, birthday, phone number, ID card number and other information, and it automatically generates a password dictionary combining pinyin variants, date variants and cultural numbers (520/1314/888). Use this skill when you need targeted weak password brute-forcing against a person, social engineering password guessing, or a customized dictionary because generic weak password dictionaries are insufficient
Use CDK for container environment penetration and escape. Use when you have entered a container environment (Docker/K8s Pod) and need to assess escape possibilities, exploit container vulnerabilities, or perform information gathering inside the container. CDK integrates container environment assessment, multiple escape techniques (privileged/mount/cgroup/lxcfs/runc/kernel vulnerabilities) and in-container lateral movement. Running the CDK assessment should be the first step after obtaining a container shell. Use this skill in scenarios involving container escape, Docker penetration, K8s security or container privilege escalation
Methodology for CI/CD pipeline and supply chain attacks. Use when the target uses CI/CD systems such as GitHub Actions/Jenkins/GitLab CI/CircleCI/Terraform Cloud/Atlantis, when pipeline security needs to be tested, or when configuration files such as .github/workflows/Jenkinsfile/.gitlab-ci.yml are discovered. Covers the three PPE (Poisoned Pipeline Execution) attack patterns (D-PPE/I-PPE/3PE), the VCS repository attack surface (code leakage/Webhook abuse/branch protection bypass), Pipeline Secrets theft and lateral movement, and paths from CI/CD into cloud environments
Audit an entire project for bugs, security vulnerabilities, code quality problems, performance issues, missing tests, documentation gaps, and concrete improvement or feature ideas—then produce a prioritized, actionable report with file:line references. Read-only by default; only edits or commits when the user explicitly asks for a fix afterwards. Use when someone says “review my project”, “audit the codebase”, “find bugs”, “check for security issues”, “what could be improved”, “suggest improvements”, “are there any vulnerabilities”, “do a code quality review”, or the Hungarian equivalents “nézd át a projektet”, “auditáld a kódot”, “találj hibákat”, “milyen biztonsági problémák vannak”, “javasolj fejlesztéseket”, “mit lehetne javítani”. Trigger whenever the user wants a holistic assessment of a project rather than a fix to one specific thing—even without the word “audit”. Not for reviewing a single diff or PR, debugging one known error, or carrying out a refactor.
Receive and verify Coinbase Commerce webhooks. Use when setting up Coinbase Commerce webhook handlers, debugging X-CC-Webhook-Signature verification, or handling cryptocurrency payment events like charge:created, charge:confirmed, charge:failed, charge:pending, charge:delayed, and charge:resolved.
CORS configuration and HTTP security headers. CORS middleware, preflight requests, Content-Security-Policy, CSRF protection, Helmet.js, and secure cookie configuration. USE WHEN: user mentions "CORS", "cross-origin", "CSP", "Content-Security-Policy", "CSRF", "security headers", "Helmet", "preflight", "Access-Control" DO NOT USE FOR: authentication tokens - use `jwt` or `oauth2`; encryption - use `cryptography`
Methodology for cross-domain attack chains between web and AI. Use when the target system contains both traditional web applications and AI/LLM components, and you need to assess the impact of web vulnerabilities on the AI system or the impact of AI vulnerabilities on the web system. Covers bidirectional attack chains: Web→AI (XSS to steal conversations/SSRF to call model APIs/SQLi to poison RAG/RAG poisoning via file upload) and AI→Web (injection generating stored XSS/agent executing SQL commands/tools reading sensitive files/sandbox escape RCE).
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.