978 skills found · Page 22 of 33
rmyndharis / code-reviewerElite code review expert specializing in modern AI-powered code
rmyndharis / comprehensive-review-full-reviewCoordinate code quality, architecture, security, performance, testing, and documentation reviews
rmyndharis / deployment-engineerExpert deployment engineer specializing in modern CI/CD pipelines,
rohitg00 / verification-gatesCreates explicit validation checkpoints (verification gates) between project phases to catch errors early and ensure quality before proceeding
rohitg00 / structured-code-reviewPerforms a structured five-stage code review covering requirements compliance, correctness, code quality, testing, and security/performance. Each stage uses targeted checklists and categorized feedback (Blocker/Major/Minor/Nit) with actionable suggestions and rationale
daymade / qa-expertSets up QA testing processes: test strategies, Google Testing Standards test cases, P0-P4 bug tracking, quality metrics, progress reports, autonomous execution via master prompts, and OWASP security testing, with third-party QA handoff docs
daymade / marketplace-health-checkRuns an evidence-based health audit of this skills marketplace repo — code safety, docs/SSOT, security/PII, PR/issue triage, manifest integrity — via a parallel workflow, then verifies findings by priority.
daymade / repomix-safe-mixerSafely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing
CloudAI-X / security-patternsImplements authentication, authorization, encryption, secrets management, and security hardening patterns
tjboudreaux / thinking-red-teamFor authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reproducible exploit path and verified mitigation.
tjboudreaux / thinking-theory-of-constraintsWhen throughput or latency is pipeline-limited, identify the single binding constraint and exploit, subordinate, elevate, then recheck—ignore non-constraints.
first-fluke / oma-securityScan application source, agent skills, and MCP components; run
first-fluke / oma-qaReview changes for correctness, security, accessibility, and
utkusen / sast-fileuploadDetect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-jwtDetect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, miss…
utkusen / sast-pathtraversalDetect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results).
utkusen / sast-ssrfDetect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-sstiDetect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results).
utkusen / sast-xssDetect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results).
utkusen / sast-xxeDetect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-businesslogicDetect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results).
utkusen / sast-reportConsolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete
Anil-matcha / home-assistantRead entity states and call services on your Home Assistant instance. Service calls are confirmed first. Trigger phrases: home assistant, smart home, turn on the light.
utkusen / sast-analysisPerform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill
uphiago / hunt-api-misconfigHunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies.
uphiago / hunt-firebaseHunt Firebase / Firestore / GCP exploitation — Firebase API key discovery in JS bundles, anonymous auth via signUp endpoint, Firestore collection enumeration with anon key, Realtime Database read/write without auth, Firebase Storage bucket listing, Firebase Hosting detection, GCP service account JSO…
uphiago / wp-plugin-rest-auth-bypassScan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification, and data leakage.
uphiago / deep-invadeDeep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.
uphiago / firebase-supabase-attackExploit Firebase/Supabase for data via JS config leak probe.
uphiago / xmlrpc-exploitationExploit XMLRPC multicall, pingback for brute force and SSRF.
