913 skills found · Page 19 of 31
rmyndharis / firmware-analystExpert firmware analyst specializing in embedded systems, IoT
rmyndharis / error-debugging-multi-agent-reviewCoordinate specialized code, security, architecture, and performance reviewers and consolidate their results
BlackSnufkin / LitterBoxA self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.
rohitg00 / verification-gatesCreates explicit validation checkpoints (verification gates) between project phases to catch errors early and ensure quality before proceeding
rohitg00 / structured-code-reviewPerforms a structured five-stage code review covering requirements compliance, correctness, code quality, testing, and security/performance. Each stage uses targeted checklists and categorized feedback (Blocker/Major/Minor/Nit) with actionable suggestions and rationale
daymade / qa-expertSets up QA testing processes: test strategies, Google Testing Standards test cases, P0-P4 bug tracking, quality metrics, progress reports, autonomous execution via master prompts, and OWASP security testing, with third-party QA handoff docs
daymade / marketplace-health-checkRuns an evidence-based health audit of this skills marketplace repo — code safety, docs/SSOT, security/PII, PR/issue triage, manifest integrity — via a parallel workflow, then verifies findings by priority.
daymade / repomix-safe-mixerSafely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing
CloudAI-X / security-patternsImplements authentication, authorization, encryption, secrets management, and security hardening patterns
first-fluke / oma-securityScan application source, agent skills, and MCP components; run
first-fluke / oma-qaReview changes for correctness, security, accessibility, and
utkusen / sast-fileuploadDetect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-pathtraversalDetect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results).
utkusen / sast-ssrfDetect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-sstiDetect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results).
utkusen / sast-xssDetect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results).
utkusen / sast-xxeDetect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results).
utkusen / sast-reportConsolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete
Anil-matcha / home-assistantRead entity states and call services on your Home Assistant instance. Service calls are confirmed first. Trigger phrases: home assistant, smart home, turn on the light.
utkusen / sast-analysisPerform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill
uphiago / hunt-api-misconfigHunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies.
uphiago / hunt-llm-aiHunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10).
uphiago / hunt-supabaseHunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organization_id check, RPC function abuse returning cross-organization data, Storage bucket listing, Auth signUp/signIn with anon key, multi-t…
uphiago / scada-hikvision-isapiEnumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.
uphiago / hunt-fastapiHunt FastAPI-specific vulnerabilities: dependency injection gaps, Pydantic coercion, and OpenAPI mining.
uphiago / hunt-mcp-securityHunt Model Context Protocol (MCP) vulnerabilities in AI-tool integration systems.
uphiago / hunt-nestjsHunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.
uphiago / hunt-djangoHunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation.
uphiago / cross-attack-chainsUse when two or more verified findings may combine into a higher-impact authorized attack path.
uphiago / email-securityDMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis
