785 skills found · Page 18 of 27
first-fluke / oma-securityScan application source, agent skills, and MCP components; run
first-fluke / oma-qaReview changes for correctness, security, accessibility, and
utkusen / sast-fileuploadDetect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-pathtraversalDetect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results).
utkusen / sast-ssrfDetect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-sstiDetect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results).
utkusen / sast-xssDetect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results).
utkusen / sast-xxeDetect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-reportConsolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete
Anil-matcha / home-assistantRead entity states and call services on your Home Assistant instance. Service calls are confirmed first. Trigger phrases: home assistant, smart home, turn on the light.
utkusen / sast-analysisPerform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill
uphiago / hunt-api-misconfigHunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies.
uphiago / hunt-llm-aiHunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10).
uphiago / hunt-supabaseHunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organization_id check, RPC function abuse returning cross-organization data, Storage bucket listing, Auth signUp/signIn with anon key, multi-t…
uphiago / scada-hikvision-isapiEnumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.
uphiago / hunt-fastapiHunt FastAPI-specific vulnerabilities: dependency injection gaps, Pydantic coercion, and OpenAPI mining.
uphiago / hunt-mcp-securityHunt Model Context Protocol (MCP) vulnerabilities in AI-tool integration systems.
uphiago / hunt-nestjsHunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.
uphiago / hunt-djangoHunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation.
uphiago / cross-attack-chainsUse when two or more verified findings may combine into a higher-impact authorized attack path.
uphiago / email-securityDMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis
BankrBot / wake-token-spotter-analysisGet the WAKE engine's analysis of any Base token by contract address. Returns a transparent 0-100 score across five criteria (deployer quality, liquidity health, contract safety, market signals, social signals), launch protocol classification (Bankr/Clanker/direct), security flags from GoPlus, contr…
BankrBot / trustlayer-sybil-scannerFeedback forensics for ERC-8004 agents. Detects Sybil rings, fake reviews, rating manipulation, and reputation laundering across 20 chains. No API key needed.
BankrBot / berry-juicerSingle-sided token-supply yield on Base, paid as AI inference
BankrBot / blueagent-x402Security OS for autonomous agents and builders on Base. 31 pay-per-use tools across Quantum Security, Agent Safety, Research, Data, and Earn. Built for AI agents, Zero-Human Companies (ZHC), and Base ecosystem builders. Pay USDC per call via x402 protocol — no subscription, no API key needed.
BankrBot / token-scam-analysisDeep on-chain scam / rug / soft-rug analysis for EVM tokens (especially Clanker, Doppler, Bankr-style single-admin ERC-20s)
pashov / solidity-auditorSecurity audit of Solidity code while you develop. Trigger on "audit", "check this contract", "review for security", "loop mode", "run the auditor in loop mode", "run 3 passes". Modes - default (full repo) or a specific filename.
itsmostafa / ec2AWS EC2 virtual machine management — instances, security groups, key pairs, AMIs, EBS volumes, Auto Scaling Groups, Spot Instances, Session Manager, placement groups, and instance lifecycle automation.
itsmostafa / iamAWS Identity and Access Management for users, roles, policies, and permissions
brycewang-stanford / ccs-artifact-evaluationUse when packaging ACM CCS artifacts for the artifact-evaluation committee and the ACM badges — Artifacts Available, Artifacts Evaluated Functional, Artifacts Evaluated Reusable, and Results Reproduced — covering what security evaluators inspect, how to make attacks and defenses turnkey, and how to…
