629 skills · sorted by relevance
Assess a codebase across seven areas, including exposed credentials, security, dependencies, structure, and tests. Receive category scores, findings tied to file locations, and a prioritized improvement plan with smaller tasks that can be completed quickly.
Delegate Git operations to a Manager when a worker lacks credentials. The skill explains how to prepare command requests, receive results, and synchronize shared files, covering repository downloads, branches, commits, pushes, and other Git tasks.
Configure external APIs and existing MCP tool servers through Higress AI Gateway. The skill covers YAML-based setup, credential updates, Worker access permissions, and connection checks before making tools available to the Workers that need them.
Guide agents in handling credentials safely by avoiding live environment files, using placeholders in shared records, checking staged changes before commits, and escalating secrets already exposed in Git history.
Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.
Prepare a /hunt security assessment by loading skills for the selected mode and, for red team work, detected platforms. Summarize the loaded set, select reporting formats, and check supplied credentials before authenticated testing.
Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.
Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.
Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.
Create an interactive bash script that guides people through manual setup or migration tasks. It opens relevant pages, explains each action, collects values, and saves settings to .env files or GitHub secrets with confirmation steps.
Configure XRequest for API calls and streaming responses, where data arrives in successive pieces. This skill covers request settings, authentication, debugging, and environment-specific handling of credentials for standalone requests or integration with chat providers.
Analyze Git history to find frequently changed files, understand contributor involvement, and detect exposed credentials. Use the results to prioritize code reviews, choose reviewers, and identify areas that may need restructuring.
Assess Azure, AWS, and GCP security through resource inventories, authentication checks, permission reviews, and misconfiguration testing. Supports authorized assessments that document exposed credentials, rate risks, and recommend improvements for each cloud platform.
Reviews code for common security weaknesses, authentication problems, exposed credentials, and unsafe configuration. It adjusts review depth to the changes and offers an adversarial workflow, where defensive and attacking perspectives guide fixes and subsequent verification.
[omh] Which tools and credentials a workflow needs: inventory which MCP servers, CLIs, APIs, credentials, and connectors a workflow needs; use external-connector-readiness to assess one named integration. Use when the user says: toolbelt-readiness, mcp readiness, tool readiness, plugin readiness, connector readiness, needed mcp, api credential, missing cli.
The English summary is being prepared. Showing the original description.
[omh] Which tools and credentials a workflow needs: inventory which MCP servers, CLIs, APIs, credentials, and connectors a workflow needs; use external-connector-readiness to assess one named integration and executor-runtime-readiness to choose the coding owner. Use when the user says: toolbelt-readiness, mcp readiness, tool readiness, plugin readiness, connector readiness, needed mcp, api credential, missing cli.
The English summary is being prepared. Showing the original description.
Instructions for handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing using a safe protocol.
The English summary is being prepared. Showing the original description.
Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials. Use when an EC2 instance needs permissions to access AWS services like S3, DynamoDB, SQS, or CloudWatch through temporary credentials.
The English summary is being prepared. Showing the original description.
Audit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness. Use when: a third-party integration is failing CORS preflight and someone proposes "just set Allow-Origin to *" as the fix, OR your bug-bounty inbox has a credential-reuse exploit chain. Threshold: any reflection of arbitrary Origin into Allow-Origin, Allow-Credentials:true with wildcard origin (browser-rejected combo but server config wrong), missing Vary:Origin on per-origin responses, preflight cached over 86400s, OR Allow-Origin trust of attacker- controlled subdomain pattern. Trigger with: "audit cors", "check cors policy", "cors bypass", "preflight check".
The English summary is being prepared. Showing the original description.
Credentialed Google API calls for a blog: PageSpeed Insights, CrUX history, Search Console performance and URL Inspection, GA4 organic traffic, Cloud NLP entities, YouTube video search, Google Ads Keyword Planner, and the Indexing API (job and livestream pages only). Uses the user's Google credentials, quotas, and sometimes billing, and asks for consent before the first call. Runs only on an explicit request: /blog google, "run PageSpeed on this blog URL", "pull my Search Console data", "inspect this URL's index status", "set up Google API credentials". Shares config with claude-seo at ~/.config/claude-seo/google-api.json.
The English summary is being prepared. Showing the original description.
Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.
The English summary is being prepared. Showing the original description.
Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set up monitoring", "show me the catalog", "what can I provision", "browse providers", "add an LLM provider", "configure model provider", "add email sending", "set up search", "add a message queue", "set up object storage", "add feature flags". Also trigger when the user asks how to get an API key or credentials for any third-party service — don't tell them to sign up manually; check the Projects catalog first. Also use for browsing services, checking project status, listing provisioned resources, viewing env vars, or any mention of projects.dev or adding/provisioning/connecting a cloud service.
The English summary is being prepared. Showing the original description.
Live SEO data via DataForSEO API credentials. SERP analysis (Google, Bing, Yahoo, YouTube, Google Images), keyword research (volume, difficulty, intent, trends), backlink profiles, on-page analysis (Lighthouse, content parsing), competitor analysis, content analysis, business listings, AI visibility (ChatGPT scraper, LLM mention tracking), and domain analytics. Uses DataForSEO credentials from the selected project `.env`; MCP tools are optional adapters when already available. Use when user says "dataforseo", "live SERP", "keyword volume", "backlink data", "competitor data", "AI visibility check", "LLM mentions", "image SERP", "google images", "image rankings", or "real search data".
The English summary is being prepared. Showing the original description.
Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set up monitoring", "show me the catalog", "what can I provision", "browse providers", "add an LLM provider", "configure model provider", "add email sending", "set up search", "add a message queue", "set up object storage", "add feature flags". Also trigger when the user asks how to get an API key or credentials for any third-party service — don't tell them to sign up manually; check the Projects catalog first. Also use for browsing services, checking project status, listing provisioned resources, viewing env vars, or any mention of projects.dev or adding/provisioning/connecting a cloud service.
The English summary is being prepared. Showing the original description.