130 skills · sorted by relevance
Use when the diff touches login, password storage, sessions, cookies, JWT verification, OAuth/OIDC or SAML flows, MFA and step-up, passkeys/WebAuthn, account linking and recovery, password reset, webhook signatures, API keys, mTLS identity or headers used to identify a caller
The English summary is being prepared. Showing the original description.
Use when the diff changes a GitHub Actions workflow, a reusable action, a CI cache or artifact handoff, a Dockerfile or compose file, Terraform/HCL, Kubernetes manifests or Helm values, an environment overlay, a workload identity binding or a cloud OIDC trust policy - judged only where concretely exploitable
The English summary is being prepared. Showing the original description.
Use when a backend or worker service needs a cloud deploy - container-first GitHub Actions deploys to Google Cloud Run (WIF) or AWS ECS/App Runner (OIDC), with migrate-before-deploy and a health-check gate
The English summary is being prepared. Showing the original description.
Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER), role lifecycle (CREATE/GRANT ROLE/DROP ROLE), privilege grants and denies (GRANT/DENY/REVOKE on graph, database, DBMS), property-level access control, sub-graph access control, SHOW PRIVILEGES inspection, and auth provider config reference (LDAP, OIDC/SSO). Use when an agent needs to manage users, roles, or privileges programmatically via Cypher on the system database. Does NOT handle Cypher query writing — use neo4j-cypher-skill. Does NOT handle cluster ops or backups — use neo4j-cli-tools-skill. Property-level security and ABAC require Enterprise Edition.
The English summary is being prepared. Showing the original description.
Sub-skill de agent-ready-cloudflare: Implement OAuth/OIDC Discovery
The English summary is being prepared. Showing the original description.
Design CI/CD pipelines for GitHub Actions, GitLab CI, and CircleCI with matrix builds, test sharding, caching, Docker layer caching, OIDC auth, deployment strategies (rolling, blue-green, canary), auto-rollback, self-hosted runners, and environment protection with manual approvals. Use when user asks to set up CI/CD, write a pipeline, configure GitHub Actions/GitLab CI/CircleCI, automate deployments, or set up build/test/deploy workflows. Do NOT use for Dockerfile authoring (use docker), K8s manifests (use kubernetes), or Terraform config (use terraform).
The English summary is being prepared. Showing the original description.
Implement authentication and authorization with OWASP Top 10 standards, OAuth 2.0 + OIDC, WebAuthn/Passkeys, session management, and RBAC/ABAC. Use when user asks to implement login, signup, authentication, authorization, JWT, OAuth, SSO, passkeys, MFA, or role-based access. Do NOT use for API key management (use api-forge), encryption at rest, or network-level security (firewalls, WAF).
The English summary is being prepared. Showing the original description.
Identity, authentication, authorization, and token management for cloud platforms. Covers Keystone-style scoped tokens, OAuth 2.0 flows, OpenID Connect, JWT structure and pitfalls, federation with SAML/OIDC, service-to-service auth with mTLS and SPIFFE, principle of least privilege, IAM role design, and the service catalog pattern (public/internal/admin endpoints). Use when designing authn/authz for a multi-tenant cloud service, integrating with an identity provider, or reviewing IAM policies for over-privilege.
The English summary is being prepared. Showing the original description.
OpenStack Keystone identity service skill for deploying, configuring, operating, and troubleshooting the authentication and authorization backbone of an OpenStack cloud. Covers identity management, token lifecycle (Fernet provider with rotation), service catalog registration, RBAC policy customization, domain/project/user hierarchy, federation basics (SAML/OIDC), credential encryption, and endpoint management. Use when deploying Keystone via Kolla-Ansible, managing users and projects, debugging 401 errors, rotating Fernet keys, configuring RBAC policies, or integrating services through the service catalog.
The English summary is being prepared. Showing the original description.
Build, customize, or update AuthCrunch authentication portal themes using Go HTML templates, CSS, and SVG branding. Use for responsive layouts, login QR controls, cross-device approval views, filesystem overrides, UI/static-asset configuration, internationalization, and OIDC page styling. The embedded React profile application has a separate build.
The English summary is being prepared. Showing the original description.
Maintain upstream OAuth identity-provider directive parsers, shared configuration dispatch, injectable OAuth login storage, OAuth/OIDC discovery, GitHub identity claims, JWKS and static public PEM verification, EdDSA/Ed25519 token validation, key refresh, and real portal OAuth E2E tests. Excludes portal signing-key publication and gatekeeper-owned direct OAuth sessions.
The English summary is being prepared. Showing the original description.
Maintain the local RSA-PSS PS256 signing plugin, its public parser, refresh-engine composition, public JWKS, and strict core verification. Excludes portal or OIDC signer selection and remote KMS backends.
The English summary is being prepared. Showing the original description.
Maintain portal cookie configuration, reusable cookie directive parsing, common prefixes and explicit names, domain attributes, factory issuance/deletion, and cookie interoperability with OIDC, refresh, OAuth, and gatekeepers.
The English summary is being prepared. Showing the original description.
Maintain the local SQLite refresh-storage plugin, its public parser, atomic rotation and replacement, replay history, durability and lifecycle, and refresh-engine consumer tests. Excludes automatic portal backend selection and storage for OIDC or OAuth sessions.
The English summary is being prepared. Showing the original description.
Maintain conditional authentication challenge policies, reusable authchal and user-transform FromDirectives parsers, safe claim substitution, GitHub ID/organization transforms, registered-factor inventory, passwordless WebAuthn selection, verified AMR access claims, and policy revalidation across portal login, refresh, OIDC, and direct authentication.
The English summary is being prepared. Showing the original description.
Maintain host-independent persistent runtime state, its reusable directory parser, encrypted records and generated keys, portal and portal-free OAuth sessions, refresh/OIDC replay history, local identity epochs, restart E2E tests, and embedding lifecycle contracts.
The English summary is being prepared. Showing the original description.
CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runners/agents, poisoned pipeline execution, artifact/cache abuse, dependency confusion, third-party Action trust, GitOps/registry poisoning, workload identity/OIDC, and emerging agentic CI/CD. Use this skill when the operator has access to a CI/CD system, source repository, build/deploy configuration, runner/agent, artifact/package/registry path, or software delivery trust chain.
The English summary is being prepared. Showing the original description.
Use when cutting, debugging, or verifying a pythinker-code (TSC monorepo) release — changesets flow, the ci release-packages version PR, release.yml anatomy, npm Trusted Publishing OIDC, native assets, brew tap, CDN redeploy, and their failure modes. Invoked by /release.
The English summary is being prepared. Showing the original description.
Implement web authentication: sessions, OAuth/OIDC, MFA, passwordless, and session security. Use when adding login and access control to apps.
The English summary is being prepared. Showing the original description.
Use when implementing Django authentication - local accounts, OAuth, email verification, MFA, OIDC, django-organizations
The English summary is being prepared. Showing the original description.
Identify and exploit logical flaws in OAuth 2.0 and OpenID Connect workflows. Use this skill when testing "Sign in with Google/Facebook/Apple" features, focusing on Authorization Code interception, Implicit flow token leakage, standard CSRF bypassing via missing `state` parameters, and redirect logic flaws.
The English summary is being prepared. Showing the original description.
Authentication and credential security assessment. Tests password brute-force, credential stuffing, password spraying, default credential testing, credential harvesting, lockout analysis, MFA bypass, OAuth/OIDC abuse, session token entropy, Kerberos attacks, and intelligent wordlist generation. Uses hydra, john, ncrack, medusa, cewl, crunch, netexec, impacket, kerbrute, and nuclei default-login templates. Covers OWASP A07:2021 Identification and Authentication Failures.
The English summary is being prepared. Showing the original description.
Scaffold or migrate a repository onto release-please. Generates release-please-config.json, .release-please-manifest.json, and a release-please.yml workflow, plus an opt-in menu of tag-keyed deploy/publish templates (Docker/ECR matrix, frontend host deploy, npm OIDC publish, GitHub Release asset, Fly.io deploy, generic). Supports monorepo (mutual exclude-paths matrix), single-package, and mixed-language (node/simple/python) repos. Use when user runs /release-please-setup, mentions "release please", "set up release please", "automate releases", "conventional-commit releases", "monorepo release automation", or "migrate to release-please".
The English summary is being prepared. Showing the original description.
Guidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.
The English summary is being prepared. Showing the original description.