460 skills · sorted by relevance
Review CI/CD pipelines, the workflows that build and release software, for unsafe code execution, exposed secrets, and excessive permissions. Combine automated scanning with manual checks to document reproducible findings and suggested fixes.
Review EVM and Solana tokens for hidden minting, blocked sales, fee changes, and liquidity withdrawal risks. Combine code scanning with checks of privileged controls to identify mechanisms that could enable a rug pull, or issuer exit scam.
Guides authorized security assessments with Metasploit, from scanning and vulnerability testing to payload generation, code used during a test, and post-exploitation investigation. It also covers session management and recording evidence of findings.
Security-focused code review checklist and automated scanning patterns. Use when reviewing pull requests for security issues, auditing authentication/authorization code, checking for OWASP Top 10 vulnerabilities, or validating input sanitization. Covers SQL injection prevention, XSS protection, CSRF tokens, authentication flow review, secrets detection, dependency vulnerability scanning, and secure coding patterns for Python (FastAPI) and React. Does NOT cover deployment security (use docker-best-practices) or incident handling (use incident-response).
The English summary is being prepared. Showing the original description.
Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.
The English summary is being prepared. Showing the original description.
AgentShield security audit with 5 scanning categories, 102 static analysis rules, and optional red-team simulation.
The English summary is being prepared. Showing the original description.
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
The English summary is being prepared. Showing the original description.
Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI
The English summary is being prepared. Showing the original description.
Build OCR pipelines in MATLAB using the ocr() function. Use this skill when the user wants to read text from images, documents, signs, meters, displays, license plates, gauges, receipts, or seven-segment displays. Covers image preprocessing, text detection (CRAFT, MSER), ROI-based recognition, multi-language OCR, and custom model training. Use when: OCR, text recognition, extract text from image, character recognition, document scanning, meter reading, gauge reading, receipt scanning, digitize text from photo.
The English summary is being prepared. Showing the original description.
Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management.
The English summary is being prepared. Showing the original description.
Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.
The English summary is being prepared. Showing the original description.
A set of tools for working with miRNA affinity models (KdModels), efficiently scanning for miRNA binding sites, and predicting target repression. It supports scanning using miRNA seeds, full miRNA sequences (enabling 3' alignment) and KdModels, and includes the prediction of slicing and TDMD sites. Finally, it includes utility and plotting functions (e.g. for the visual representation of miRNA-target alignment).
The English summary is being prepared. Showing the original description.
Use when you need to review, improve, or build Spring Boot 4.0.x applications — including proper usage of @SpringBootApplication, component annotations (@Controller, @Service, @Repository), bean definition and scoping, configuration classes and @ConfigurationProperties (with @Validated), component scanning, conditional configuration and profiles, constructor injection, @Primary and @Qualifier for multiple beans of the same type, bean minimization, graceful shutdown, virtual threads, Jakarta EE namespace consistency, and scheduled tasks. This should trigger for requests such as Review Java code for Spring Boot application; Apply best practices for Spring Boot application in Java code; Improve Spring Boot configuration properties and beans; Review Spring Boot component scanning and profiles; Tune Spring Boot graceful shutdown or virtual threads. Part of Plinth Toolkit
The English summary is being prepared. Showing the original description.
Detects PII in unstructured data including emails, documents, images, and logs using NER-based detection with spaCy and Microsoft Presidio, regex patterns, OCR integration, and confidence scoring. Keywords: PII detection, unstructured data, NER, spaCy, Presidio, OCR, regex, email scanning, document scanning.
The English summary is being prepared. Showing the original description.
Comprehensive methodology for auditing website cookies and tracking technologies. Covers automated scanning, cookie categorization, lifecycle documentation, and compliance gap analysis referencing the Planet49 CJEU ruling (C-673/17).
The English summary is being prepared. Showing the original description.
Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit. Use for CI/CD security gates, pre-deployment audits, compliance requirements, or encountering CVE detection, outdated packages, license compliance, SBOM generation errors.
The English summary is being prepared. Showing the original description.
Scan project dependencies for known vulnerabilities, generate software bills of materials, and enforce license compliance across the software supply chain. Use when the user requests dependency scanning or provides relevant inputs for this workflow.
The English summary is being prepared. Showing the original description.
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.
The English summary is being prepared. Showing the original description.
Use when managing or interacting with favorite blogs via the BlogWatcher CLI—adding/removing blogs, scanning for new posts, listing articles, marking read/unread, or modifying related CLI behavior, scanning, storage, and tests.
The English summary is being prepared. Showing the original description.
AI-first security scanning with Medusa. 3,000+ detection patterns covering AI/ML, agents, MCP, RAG, prompt injection, and traditional SAST vulnerabilities. Wraps Medusa CLI with SARIF/JSON parsing, structured finding output, OWASP mapping, and remediation guidance.
The English summary is being prepared. Showing the original description.
Use when you need to submit a URL for live scanning via URLScan.io and retrieve results, or search existing scans for a domain. Returns verdict, final URL after redirects, resolved IP, contacted domains/IPs, and screenshot URL. Commonly invoked by /url-investigation and /domain-investigation.
The English summary is being prepared. Showing the original description.
Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.
The English summary is being prepared. Showing the original description.
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
The English summary is being prepared. Showing the original description.
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
The English summary is being prepared. Showing the original description.