2.3K skills ・ Works with: AWS · sorted by popularity
Create and validate mirrord.json settings for isolated database copies used in development and testing. Configure connection sources, copying scope, migrations, and authentication so experiments can run without affecting shared databases.
Update application code so a developer’s mirrord session identifier travels across service calls, queues, and storage events. Reuse existing tracing tools where possible, then report which request flows carry the identifier and where it still disappears.
Run OpenClaw tests and reproduce bugs on remote machines through Crabbox. Choose a suitable execution provider, verify realistic user workflows, and report the actual provider, environment ID, logs, and timing.
Turn specialized knowledge and repeatable workflows into an Agent Skill. Work through concrete usage examples, write SKILL.md, organize reusable scripts and resources, and validate the package before producing a distributable .skill file.
Inspect public repositories, build artifacts, and container images for software supply chain risks. The skill identifies exposed internal package names, unsafe workflow configurations, and leaked secrets, while requiring build evidence before treating unclaimed package names as exploitable.
Find test inputs and filter bypass examples for web security checks, organized by vulnerability type. Includes URL classification patterns, discovery wordlists, and examples of combining findings to demonstrate concrete security impact.
Turn validated vulnerabilities into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Platform templates help organize demonstrated impact, reproducible steps, supporting evidence, severity reasoning, and concrete fixes in language reviewers can follow.
Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.
Support authorized external security reconnaissance, the discovery of exposed systems and information. The skill provides search queries, probe references, secret detection patterns, and scoring guidance to help identify assets and organize findings with evidence and confidence levels.
Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.
Investigate XXE, an XML parsing flaw, in APIs and document uploads. The skill guides entry point discovery, external callback checks, and evidence collection to establish whether files or internal services are actually exposed.
Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.
Investigate subdomain takeover risks caused by DNS records pointing to abandoned services. The skill covers discovery, provider error checks, resource claimability, and evidence collection, then examines potential effects on login flows, shared cookies, and trusted content.
Investigate SSRF, where supplied URLs cause unintended server requests, in previews, imports, proxies, and PDF generation. Confirm outbound connections, identify the responsible input, and establish whether internal services or sensitive responses are accessible.
Assess on-premises SharePoint Server for exposed information, legacy login paths, and conditions associated with known vulnerabilities. It guides evidence collection and helps distinguish meaningful security findings from misleading error messages.
Investigate HTTP request smuggling, where a proxy and server disagree on request boundaries. The skill guides checks for different server setups, HTTP/2 conversion issues, and evidence that the mismatch affects another client's requests.
Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.
Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.
Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.
Organize a bug bounty investigation from reconnaissance through reporting. The skill helps choose a focused objective, identify the current phase, select relevant techniques and tools, and distinguish reproducible security impact from misleading test results.
Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.
Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.