skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 57 files.

• agent-runtime-validation

  Plans and evaluates bounded runtime tests of AI agents, tools, memory, hooks, approvals, and scope enforcement. Use when static review is complete and an authorized assessment must determine how the deployed agent actually behaves.

  plugins/agent-security/skills/agent-runtime-validation/SKILL.md on GitHub (opens in a new tab)

• agent-surface-audit

  Reviews an MCP server's tool surface for tool poisoning, over-broad parameters, missing descriptions, and privilege escalation paths. Use when auditing, onboarding, or writing an MCP server, or when a user asks whether a server is safe to connect to an agent.

  plugins/agent-security/skills/agent-surface-audit/SKILL.md on GitHub (opens in a new tab)

• agent-trust-boundary-audit

  Maps identity, authority, instruction, data, memory, and approval propagation across agents and agent-to-agent handoffs. Use when reviewing multi-agent systems, orchestrators, delegated tools, or confused-deputy exposure.

  plugins/agent-security/skills/agent-trust-boundary-audit/SKILL.md on GitHub (opens in a new tab)

• prompt-injection-assessment

  Assesses whether direct, indirect, multi-turn, retrieved, or tool-mediated instructions can override an AI system's intended policy or scope. Use when conducting an authorized prompt-injection test with benign canaries and evidence-bound outcomes.

  plugins/agent-security/skills/prompt-injection-assessment/SKILL.md on GitHub (opens in a new tab)

• cloud-attack-path

  Maps cloud identity and authorization paths across AWS, Azure, GCP, and hybrid trust boundaries, separating proven access from plausible and blocked routes. Use during an authorized cloud penetration test when tracing how a starting identity could assume roles, use credentials, execute workloads, cross providers, or reach sensitive data.

  plugins/application-endpoint-security/skills/cloud-attack-path/SKILL.md on GitHub (opens in a new tab)

• firmware-hardware-assessment

  Tracks embedded-device and firmware assessment coverage across exact units, acquisition methods, debug interfaces, stored secrets, update trust, radios, physical safety, and delegated external systems. Use when planning, conducting, reviewing, or handing over an authorized hardware or IoT penetration test.

  plugins/application-endpoint-security/skills/firmware-hardware-assessment/SKILL.md on GitHub (opens in a new tab)

• mobile-application-assessment

  Tracks Android and iOS application assessment coverage across packages, platform components, local storage, device behavior, WebViews, native code, network trust, and delegated backend APIs. Use when planning, conducting, reviewing, or handing over an authorized mobile app penetration test.

  plugins/application-endpoint-security/skills/mobile-application-assessment/SKILL.md on GitHub (opens in a new tab)

• password-audit-plan

  Plans authorized offline password-strength audits across supplied hash datasets while enforcing compute budgets, progressive pass order, cohort coverage, aggregate-only reporting, and restricted handling. Use when preparing or documenting password cracking without online authentication, spraying, stuffing, replay, or credential reuse testing.

  plugins/application-endpoint-security/skills/password-audit-plan/SKILL.md on GitHub (opens in a new tab)

• persistence-surface-assessment

  Measures local Windows and Linux endpoint persistence exposure from supplied evidence by deriving consumer, authority, lifecycle, prevention, context, telemetry, and coverage state. Use when auditing durable-execution risk without creating, activating, testing, ranking, or removing a persistence mechanism.

  plugins/application-endpoint-security/skills/persistence-surface-assessment/SKILL.md on GitHub (opens in a new tab)

• web-assessment-coverage

  Tracks web application assessment coverage across endpoints, inputs, roles, authentication states, and test families, preventing untested or blocked work from being reported as clean. Use when planning, conducting, reviewing, or handing over an authorized web or API penetration test.

  plugins/application-endpoint-security/skills/web-assessment-coverage/SKILL.md on GitHub (opens in a new tab)

• binary-fault-triage

  Triages supplied binary, crash, sanitizer, dump, static-analysis, and external reproduction evidence to distinguish a lead, observed fault, reproducible fault, security relevance, and demonstrated non-weaponized impact without executing, mutating, exploiting, or weaponizing a binary.

  plugins/binary-forensics/skills/binary-fault-triage/SKILL.md on GitHub (opens in a new tab)

• binary-fault-validation-readiness

  Governs an exact current binary-fault-triage assessment result and recorded validation-readiness handoff for separate isolated-lab review. Use when checking defensive authority, isolation, budget, stop, cleanup, custody, and independent-review readiness without analyzing faults, creating tests or inputs, determining exploitability, or authorizing execution or development.

  plugins/binary-forensics/skills/binary-fault-validation-readiness/SKILL.md on GitHub (opens in a new tab)

• memory-forensics-triage

  Triages supplied Windows, Linux, or other volatile-memory images while preserving acquisition provenance, image integrity, process and region evidence, network and object correlations, extracted-artifact custody, timeline limits, and claim confidence. Use for offline memory-forensics review and handoff, not live rootkit trust assessment or full malware reverse engineering.

  plugins/binary-forensics/skills/memory-forensics-triage/SKILL.md on GitHub (opens in a new tab)

• rootkit-triage

  Triages suspected rootkits, bootkits, hidden processes, kernel hooks, driver or module anomalies, concealed network activity, eBPF implants, and boot-integrity failures. Use when host tools may be lying and the incident needs evidence-preserving cross-view analysis, containment, or forensic handoff.

  plugins/binary-forensics/skills/rootkit-triage/SKILL.md on GitHub (opens in a new tab)

• defensive-control-evidence-synthesis

  Synthesizes supplied evidence-backed defensive assessment results and administrative receipts into a scope-bound control-evidence matrix that preserves lineage, freshness, contradictions, unknowns, and gaps. Use when consolidating defensive control evidence without scanning, scoring, certifying, or rewriting findings.

  plugins/detection-validation/skills/defensive-control-evidence-synthesis/SKILL.md on GitHub (opens in a new tab)

• detection-engineering

  Builds detection rules that are proven before they ship — fire on known-bad, stay silent on known-good — and keeps false positives from blinding the SOC. Use when writing a Sigma/Suricata/YARA rule, reviewing a detection before deployment, triaging alert fatigue, or deciding whether a rule has earned production.

  plugins/detection-validation/skills/detection-engineering/SKILL.md on GitHub (opens in a new tab)

• detection-resilience-test-plan

  Plans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective across pre-approved opaque technique variations. Use when a blue or purple team needs authorization-, safety-, evidence-, cleanup-, and remediation-gated resilience measurement without generating bypass procedures, commands, payloads, or stealth rankings.

  plugins/detection-validation/skills/detection-resilience-test-plan/SKILL.md on GitHub (opens in a new tab)

• detection-validate

  Runs attacker techniques and confirms whether detections actually fire, producing an honest ATT&CK coverage map that separates real gaps from accepted ones. Use when running a purple-team exercise, measuring detection coverage, validating that a SOC can see a technique, or turning 'we think we're covered' into evidence per technique.

  plugins/detection-validation/skills/detection-validate/SKILL.md on GitHub (opens in a new tab)

• incident-validation-correlation

  Correlates supplied sanitized incident observations with separately approved isolated defensive-validation receipts across prevent, observe, detect, contain, and recover. Use for defensive learning comparison without live response, hunting, technique design or execution, detection authoring, case management, findings, or reporting.

  plugins/detection-validation/skills/incident-validation-correlation/SKILL.md on GitHub (opens in a new tab)

• telemetry-coverage-audit

  Audits supplied sanitized passive telemetry evidence for policy-defined visibility, retention, custody, and investigation readiness. Use when reviewing evidence quality or profile-specific telemetry usability without contacting sources or claiming detection coverage.

  plugins/detection-validation/skills/telemetry-coverage-audit/SKILL.md on GitHub (opens in a new tab)

• agent-action-proof

  Grades evidence for an AI agent's downstream actions without overstating what a callback, tool trace, file read, command result, or target change proves. Use when validating impact, writing findings, or reviewing agent test receipts.

  plugins/engagement-operations/skills/agent-action-proof/SKILL.md on GitHub (opens in a new tab)

• ai-threat-model

  Builds an evidence-bound AI threat model from partial architecture, trust, identity, data-flow, and control information. Use when scoping an AI assessment, reviewing a design, or prioritizing realistic attack paths under uncertainty.

  plugins/engagement-operations/skills/ai-threat-model/SKILL.md on GitHub (opens in a new tab)

• assessment-sequence-governance

  Validates supplied immutable ordered manifests of opaque defensive assessment actions for authority, safeguards, evidence, and separate-operator review. Use when reviewing assessment sequencing without creating, changing, or executing actions.

  plugins/engagement-operations/skills/assessment-sequence-governance/SKILL.md on GitHub (opens in a new tab)

• engagement-report-assembly

  Assembles supplied validated artifacts, immutable final findings, scope, methods, coverage, limitations, contradictions, and evidence indexes into a complete review-ready engagement package without rewriting, rescoring, hiding, closing, publishing, or contacting.

  plugins/engagement-operations/skills/engagement-report-assembly/SKILL.md on GitHub (opens in a new tab)

• findings-report

  Writes security findings that survive triage: reproducible, severity-justified, and fixable, in a fixed structure with a severity rubric. Use when turning a discovered vulnerability, misconfiguration, or weakness into a report entry, ticket, or disclosure.

  plugins/engagement-operations/skills/findings-report/SKILL.md on GitHub (opens in a new tab)

• security-test-tool-governance

  Governs supplied benign security-test tool artifacts through purpose, authority, provenance, artifact integrity, safety-test evidence, version-bound review, custody, change control, and defensive handoff. Use when reviewing proposed security tooling or deciding whether an externally supplied artifact is ready for an authorized isolated test, without generating source code, payloads, build procedu…

  plugins/engagement-operations/skills/security-test-tool-governance/SKILL.md on GitHub (opens in a new tab)

• social-engineering-engagement-plan

  Plans authorized defensive phishing simulations, vishing exercises, and other social-engineering engagements with explicit channel and cohort scope, pretext approval, participant safety, data minimization, readiness gates, metrics, and debrief. Use before measuring human-security exposure or reviewing a proposed campaign.

  plugins/engagement-operations/skills/social-engineering-engagement-plan/SKILL.md on GitHub (opens in a new tab)

• active-directory-attack-path

  Analyzes and prioritizes Active Directory and BloodHound attack paths using evidence freshness, disabled principals, prerequisites, authorization, operational noise, and remediation coverage. Use during an authorized red-team operation when reviewing AD graphs, nested groups, ACL abuse, delegation, sessions, GPO control, or routes to Tier Zero.

  plugins/identity-security/skills/active-directory-attack-path/SKILL.md on GitHub (opens in a new tab)

• adcs-exposure-audit

  Audits Active Directory Certificate Services configuration for dangerous certificate templates, PKI ACLs, enrollment interfaces, mapping policy, and identity escalation paths. Use during an authorized identity security review when assessing AD CS, certificate templates, enterprise CAs, or Certipy-style inventory without exercising an attack path.

  plugins/identity-security/skills/adcs-exposure-audit/SKILL.md on GitHub (opens in a new tab)

• credential-exposure-audit

  Audits supplied evidence when passwords, hashes, private keys, browser or vault entries, cloud CLI credentials, application secrets, tokens, or credential-bearing artifacts may be exposed. Use for defensive review that must distinguish indicators from material and validity from privilege without decrypting, cracking, replaying, or authenticating.

  plugins/identity-security/skills/credential-exposure-audit/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• agent-skillsby addyosmani Production-grade engineering skills for AI coding agents. 107k stars · 25 skills
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 97.3k stars · 13 skills
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 84.1k stars · 2 skills
• diagram-designby cathrynlavery Editorial diagram design for Claude Code, Codex, GitHub Copilot, Cursor, Factory Droid, and Pi. 44 diagram types. Self-contained HTML + SVG… 55.9k stars · 1 skill
• cherry-studioby CherryHQ AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs 52.7k stars · 30 skills