1.9K skills · sorted by relevance
Create, update, or reuse a repository threat model: a document describing system architecture, attacker capabilities, trust boundaries, and potential security failures. Produce a Markdown model grounded in source evidence for standalone use or a security scan.
Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.
Review agent skills before installation or during use by inspecting their files without running code. Local checks identify risks such as credential theft, permission abuse, and differences between stated purpose and actual behavior.
Inspect agent skills, plugins, and MCP servers locally before installation. Use a reviewed scanning policy to identify malicious instructions, risky commands, secret exposure, and dependency risks, then summarize findings and recommended next steps.
Install Holoscan SDK natively on Ubuntu via apt. Use for C++ installs on Ubuntu; pair with /holoscan-install-wheel for Python.
The English summary is being prepared. Showing the original description.
Scans a Power Pages site project for security issues in source code and dependencies. Runs static analysis and dependency scanning, then surfaces findings by category (code patterns, vulnerable packages, secrets, license issues). Use when the user wants to review code for security problems, check for vulnerable packages, find hard-coded secrets, run a code scan, or asks "is my code safe?", "check my dependencies", "find security issues in my source" — even if they say "audit my code" without mentioning specific tools.
The English summary is being prepared. Showing the original description.
Scan code, dependencies, containers, IaC and SBOMs with Snyk via its first-party MCP server: authenticate, trust a folder, run the right scanner, read the findings, fix and re-scan. Includes package-health checks before adding a dependency.
The English summary is being prepared. Showing the original description.
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.
The English summary is being prepared. Showing the original description.
Hoyeon developer community scan workflow for Codex. Use when the user invokes "$hoyeon-dev-scan" or asks for developer reactions, community opinions, or cross-community sentiment on technical topics. This adapter loads the canonical dev-scan skill and follows its Codex runtime surface.
The English summary is being prepared. Showing the original description.
Adds a searchable text layer to a scanned PDF with ocrmypdf. Installs the toolchain at runtime in ~18s. Use when a PDF's pages are images and the deliverable is a file to keep, grep, or hand to another tool: 'make this PDF searchable', 'OCR this scan', 'I can't select the text in this PDF', 'search across these scanned pages', 'the pdf skill returned nothing'. Handles non-English scans via tesseract language packs. NOT for charts, diagrams, handwriting, or slide layouts. Route those to transcribing-images.
The English summary is being prepared. Showing the original description.
教師なし分析と EDA 前処理（欠測 / 欠損 / NaN / 補完 / imputation / 外れ値処理、クラスタリング / セグメンテーション / k-means / 階層クラスタリング / GMM / DBSCAN、次元削減 / PCA / 主成分分析 / 因子分析 / UMAP / t-SNE、異常検知 / anomaly detection / 不正検知）を実行したら必ずセットで出す図と値のルーター。fillna, dropna, fill_null, SimpleImputer, IterativeImputer, missingno, KMeans, AgglomerativeClustering, DBSCAN, GaussianMixture, silhouette_score, dendrogram, PCA, FactorAnalysis, calculate_kmo, TSNE, umap.UMAP, IsolationForest, LocalOutlierFactor, pyod がコードに現れたとき、またはユーザーが「欠損を埋めて」「クラスタリングして」「主成分で 要約して」「異常を検知して」「データをきれいにして」と言ったときに使う。安定性・k の根拠・平行分析・ベースラインに 言及がなくても適用する。SKILL.md のルーティング表で手法を特定し、対応する references/<手法>.md を読んでから実行する。 教師あり予測は predictive-modeling-diagnostics、回帰・検定は statistical-inference-diagnostics を使う。
The English summary is being prepared. Showing the original description.
Design a dependency scanning program — CVE detection, license checks, and CI gates. Use when asked to "scan our dependencies", "set up CVE detection", or "add a dependency CI gate".
The English summary is being prepared. Showing the original description.
コードベースの不要なフォールバック・互換性コード・デッドコードを 3つの専門エージェント（scanner + historian + verifier）が協調して検出・安全性検証する監査スキル。 scanner が自律探索で候補を発見し、historian が git 履歴から時間軸の文脈を付与し、 verifier が「消してデグレしないか」を検証する。任意のリポジトリで実行可能。 Use when: コードのクリーンアップをしたい、技術的負債を可視化したい、 不要な互換性コードや deprecated コードを探したい、 リリース前に dead code を確認したい。 Triggers: "cruft", "code sweep", "dead code", "デッドコード", "不要なコード", "互換性コード", "fallback", "フォールバック", "deprecated", "技術的負債", "code audit", "コード監査", "cleanup", "クリーンアップ", "TODO整理"
The English summary is being prepared. Showing the original description.
Use when user asks to setup endorctl, install endorctl, run endorctl scan, scan for vulnerabilities, run endor scan or run Endor Labs scan or when any endorctl command fails with 'command not found', 'no such file or directory', authentication errors, 'unauthorized', '403', 'tenant not found', EOF error, or namespace/access errors.
The English summary is being prepared. Showing the original description.
Scan code, dependencies, containers, IaC and SBOMs with Snyk via its first-party MCP server: authenticate, trust a folder, run the right scanner, read the findings, fix and re-scan. Includes package-health checks before adding a dependency.
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
The English summary is being prepared. Showing the original description.
Use when working with Burp Suite — portSwigger Burp Suite Enterprise Edition for automated dynamic application security testing (DAST). Covers scan management, vulnerability findings, site configuration, scan scheduling, and issue reporting. Use when reviewing DAST scan results, analyzing web application vulnerabilities, managing scan schedules, or tracking remediation of web security issues.
The English summary is being prepared. Showing the original description.
Use when working with Checkov — checkov infrastructure-as-code security scanning. Covers Terraform, CloudFormation, Kubernetes, and Dockerfile scanning, policy management, custom checks, compliance frameworks, and suppression management. Use when scanning IaC for security misconfigurations, evaluating compliance, managing custom policies, or reviewing scan results.
The English summary is being prepared. Showing the original description.
Configure GitHub secret scanning and push protection, triage secret alerts, and run local pre-commit secret audits. Use when enabling secret scanning, handling blocked pushes, defining custom patterns, or checking a repo for accidental credentials before commit.
The English summary is being prepared. Showing the original description.
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret Tespit.
The English summary is being prepared. Showing the original description.
ペネトレーションテストを対話的に実行するスキル。認可確認(Authorization Gate)→カテゴリ選択（Methodology, Reconnaissance, Scanning, VulnerabilityScanning, WebAppTesting, APITesting, PasswordAttacks, Exploitation, PrivilegeEscalation, ActiveDirectory, PostExploitation, WirelessAttacks, NetworkAttacks, SocialEngineering, CloudPentesting, MobileAppTesting, ContainerK8s, BinaryExploitation, OWASPTop10, Reporting, EmailSecurity, DatabaseAttacks, VPNRemoteAccess の全23カテゴリ）→ツール選択→コマンド実行→発見記録(Finding)→レポート生成をステップバイステップで進行。スコープ/除外チェック・ガードレール付き。「ペンテスト実行」「pentest」「侵入テスト」「脆弱性診断」「セキュリティテスト」「pentest executor」で発火。
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
The English summary is being prepared. Showing the original description.