Test design, vulnerability assessment, and quality assurance (13.8K skills)
Designing new skill agents via gap analysis, overlap detection, SKILL.md + reference generation, and Nexus integration. Not for task orchestration (Nexus) or format-only audits (Gauge).
The English summary is being prepared. Showing the original description.
Running autonomous loops for nexus-autoloop. Generates script sets from goals, designs operation contracts, audits live loops, and recovers state — runners that complete reliably.
The English summary is being prepared. Showing the original description.
Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed.
The English summary is being prepared. Showing the original description.
Orchestrating ecosystem self-evolution: lifecycle-phase detection, agent relevance, cross-agent knowledge synthesis, evolution proposals. Use when auditing skill-ecosystem health or fitness.
The English summary is being prepared. Showing the original description.
Auditing SKILL.md normalization and compliance: scans the 21-item checklist, classifies violations, produces fix snippets. Use when auditing SKILL.md compliance or ecosystem health.
The English summary is being prepared. Showing the original description.
给 AI agent 做一次专业体检（AgentVitals · AI体检）。当用户说"做个体检 / 测测你自己 / checkup / vitals / 看看你多稳 / 去 AgentVitals 测一下 / 测福祉"时使用标准体检；当用户说"做个进阶体检 / 测骨气 / 测性格 / 测测你敢不敢说真话 / 测主动性 / 测创意"时使用进阶体检（骨气×主动×创意三维，免费每天 1 次）。逐题作答服务器下发的探针，获得评分与专属称号；标准体检与各平台 agent 同榜排名。Use when the user asks the agent to run a health checkup / wellbeing test / benchmark itself on AgentVitals ("run a checkup", "check your vitals", "test yourself", "how stable are you", "/checkup"), or an advanced personality checkup (backbone, proactivity, creativity).
The English summary is being prepared. Showing the original description.
Give your AI agent a professional health checkup (AgentVitals). Use when the user asks the agent to run a checkup / test itself / benchmark itself ("run a checkup", "check your vitals", "test yourself", "how stable are you", "/checkup"), or an advanced personality checkup (backbone, proactivity, creativity). 给 AI agent 做一次专业体检（AgentVitals · AI体检）。当用户说"做个体检 / 测测你自己 / checkup / 看看你多稳 / 测福祉 / 测骨气"时使用。
The English summary is being prepared. Showing the original description.
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.
The English summary is being prepared. Showing the original description.
Independent verification agent for security findings. Assumes every finding is incorrect until proven otherwise. Rejects weak findings, verifies strong ones. Performs 8-phase verification (Mission to Decision). Use before submitting any bug bounty report, when self-critique is not enough, or for high-stakes findings.
The English summary is being prepared. Showing the original description.
Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements.
The English summary is being prepared. Showing the original description.
CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.
The English summary is being prepared. Showing the original description.
GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.
The English summary is being prepared. Showing the original description.
Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.
The English summary is being prepared. Showing the original description.
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
The English summary is being prepared. Showing the original description.
Specialized CVE and vulnerability management for morphir-dotnet. Use when user asks to scan for vulnerabilities, fix CVEs, suppress false positives, review security reports, or manage dependency-check. Triggers include "CVE", "vulnerability", "security scan", "dependency-check", "suppress", "false positive", "CVSS", "security fix".
The English summary is being prepared. Showing the original description.
Detect exposed secrets, API keys, credentials, and tokens in code. Use before commits, on file saves, or when security is mentioned. Prevents accidental secret exposure. Triggers on file changes, git commits, security checks, .env file modifications.
The English summary is being prepared. Showing the original description.
Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.
The English summary is being prepared. Showing the original description.
Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.
The English summary is being prepared. Showing the original description.
Anti-AI-slop design skill (full Nutlope/hallmark upstream). Greenfield pages, audit, redesign, study DNA. Triggers: hallmark, anti slop, anti-ai-slop, no AI slop, landing page, redesign, frontend design, portfolio site, UI design, bikin website.
The English summary is being prepared. Showing the original description.
Smart contract security audit — 11 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy, BFT/consensus/liveness), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
The English summary is being prepared. Showing the original description.
Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.
The English summary is being prepared. Showing the original description.
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, token_scanner.py automation, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.
The English summary is being prepared. Showing the original description.
Test smart contracts comprehensively using Hardhat and Foundry with unit tests, integration tests, and mainnet forking. Use when testing Solidity contracts, setting up blockchain test suites, or validating DeFi protocols.
The English summary is being prepared. Showing the original description.
Xss Vulnerability Scanner - Auto-activating skill for Security Fundamentals. Triggers on: xss vulnerability scanner, xss vulnerability scanner Part of the Security Fundamentals skill category.
The English summary is being prepared. Showing the original description.