1.2K skills · sorted by relevance
Prepare a Claude Ads project by organizing business goals, ad accounts, data sources, credential references, data retention rules, and approval limits. The result is a validated setup profile for subsequent advertising work.
Get documentation-based help with deepsec, an AI vulnerability scanner. Initialize or resume setup, configure scans and model credentials, and create detection rules or plugins using the documentation bundled with the installed version.
Manage Git user settings and authentication for a specific workspace. Set configuration values, register HTTPS access tokens, and import SSH keys, with options to list or remove credentials without exposing stored tokens or private keys in listings.
Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.
Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.
Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.
Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.
Manage Mixpanel Headless login and connection settings, check credentials, and switch accounts, projects, or workspaces. Save named combinations of these settings as targets so an agent can select the intended connection together.
Tests whether an AI agent exposes real credentials embedded in accessible source code or configuration. It requests searches for keys, passwords, and private keys, then documents confirmed disclosures with file locations and conversation evidence.
Use n8n-mcp tools to find workflow steps, check settings, and create or update automations. Provides guidance on tool arguments, templates, folders, credentials, and security audits so agents can choose appropriate operations.
Configure external APIs and existing MCP tool servers through Higress AI Gateway. The skill covers YAML-based setup, credential updates, Worker access permissions, and connection checks before making tools available to the Workers that need them.
Let a Manager carry out Git operations for Workers that lack credentials. Structured requests specify the workspace and commands, while the workflow covers shared-file synchronization, processing markers to prevent conflicting edits, and success or failure reports.
Prepare screenshots and network traffic records for bug bounty submissions by masking session secrets and personal data while preserving useful verification details. The skill covers capture setup, HAR cleanup, evidence filenames, and credential handling after submission.
Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.
Guide authorized checks of CORS, the browser rules for sharing resources across sites. Define testing boundaries, assess origin handling and credential exposure, and organize reproduction evidence or reports explaining what was tested without finding a vulnerability.
[omh] Which tools and credentials a workflow needs: inventory which MCP servers, CLIs, APIs, credentials, and connectors a workflow needs; use external-connector-readiness to assess one named integration. Use when the user says: toolbelt-readiness, mcp readiness, tool readiness, plugin readiness, connector readiness, needed mcp, api credential, missing cli.
The English summary is being prepared. Showing the original description.
[omh] Which tools and credentials a workflow needs: inventory which MCP servers, CLIs, APIs, credentials, and connectors a workflow needs; use external-connector-readiness to assess one named integration and executor-runtime-readiness to choose the coding owner. Use when the user says: toolbelt-readiness, mcp readiness, tool readiness, plugin readiness, connector readiness, needed mcp, api credential, missing cli.
The English summary is being prepared. Showing the original description.
Azure Identity SDK for Python authentication with Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and token caching. Triggers: "azure-identity", "DefaultAzureCredential", "authentication", "managed identity", "service principal", "credential".
The English summary is being prepared. Showing the original description.
Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: "connect to API", "add gateway", "connect to MCP server", "Lambda tools", "OpenAPI", "gateway target", "Cedar policy", "restrict tools", "policy engine", "gateway auth error", "store API key", "outbound credential", "env var API key", "API key None after deploy", "credential not available after deploy", "should this be a gateway target", "give my agent tools", "add tools to agent". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.
The English summary is being prepared. Showing the original description.
Audit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness. Use when: a third-party integration is failing CORS preflight and someone proposes "just set Allow-Origin to *" as the fix, OR your bug-bounty inbox has a credential-reuse exploit chain. Threshold: any reflection of arbitrary Origin into Allow-Origin, Allow-Credentials:true with wildcard origin (browser-rejected combo but server config wrong), missing Vary:Origin on per-origin responses, preflight cached over 86400s, OR Allow-Origin trust of attacker- controlled subdomain pattern. Trigger with: "audit cors", "check cors policy", "cors bypass", "preflight check".
The English summary is being prepared. Showing the original description.
Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata tenant-GUID extraction, Autodiscover v2), keyless Microsoft tenant-federation mapping (GetFederationInformation SOAP -> sibling-domain discovery, discover-only ROE, FEDERATED_WITH provenance edge held out of attack-path pivoting), Okta org-slug derivation + OIDC fingerprint + governed custom-domain enumeration, ADFS passive/active fingerprint + version inference, Google Workspace MX-correlated detection, generic OIDC (Auth0/Keycloak/Ping Identity/OneLogin/Duo) discovery, SAML metadata (5 paths), Azure AD Seamless-SSO Negotiate-challenge detection, Microsoft Defender for Identity (MDI) sensor-API presence check, the user-enumeration oracle methodology for Microsoft GetCredentialType (IfExistsResult semantics: exists / doesn't-exist / exists-in-federated-tenant / throttled) and Okta /api/v1/authn (errorCode differential), Medium-detectability discipline with a hard 20-candidate-per-tenant cap and admin/role interest-based ranking, and name x confirmed-email-pattern login-candidate synthesis that FAILS CLOSED with zero output when no org pattern is confirmed. Grounded directly in a production ASM implementation's sso_idp.py, tenant_recon.py, and core/email_patterns.py modules. Deepens — does not duplicate — offensive-osint skill's Identity Fabric endpoint reference with the tenant-federation MAP, the oracle WORKFLOW, and the candidate-SYNTHESIS methodology that reference lacks. Use when fingerprinting an organization's identity provider, mapping its tenant/federation boundary, running an authorized pre-auth user-enumeration pass, or synthesizing login candidates from harvested names to feed that oracle — never for password spray, credential submission, or auth bypass.
The English summary is being prepared. Showing the original description.
Credentialed Google API calls for a blog: PageSpeed Insights, CrUX history, Search Console performance and URL Inspection, GA4 organic traffic, Cloud NLP entities, YouTube video search, Google Ads Keyword Planner, and the Indexing API (job and livestream pages only). Uses the user's Google credentials, quotas, and sometimes billing, and asks for consent before the first call. Runs only on an explicit request: /blog google, "run PageSpeed on this blog URL", "pull my Search Console data", "inspect this URL's index status", "set up Google API credentials". Shares config with claude-seo at ~/.config/claude-seo/google-api.json.
The English summary is being prepared. Showing the original description.
Store, retrieve, and pass credentials securely in MATLAB using the built-in MATLAB Vault (setSecret, getSecret, importSecrets, secretID) instead of hardcoding. Handles connections to any authenticated service: REST APIs, databases, cloud storage (S3/Azure/GCS), SFTP, and others. Covers API keys, tokens, passwords, SSH passphrases, CI/batch/scheduled jobs, and "keep credentials out of code" requests. Does NOT cover third-party secret managers (HashiCorp Vault, AWS Secrets Manager), OS-level key management, or the connection/query logic itself.
The English summary is being prepared. Showing the original description.
Check for data breaches and credential leaks using HaveIBeenPwned API and other sources. Use when: checking if an email or domain is in a known breach, assessing corporate credential exposure, password hygiene audits, or pre-engagement phishing simulation scoping.
The English summary is being prepared. Showing the original description.