20 skills · sorted by relevance
Plan and coordinate Strix security assessments across source code, running applications, APIs, and continuous integration pipelines. Combine findings into one prioritized remediation plan based on demonstrated impact, removing duplicates and documenting gaps in test coverage.
Turn Trail of Bits Testing Handbook content into Claude Code skills for security testing. Creates or refreshes SKILL.md files using templates for tools, fuzzers, techniques, and subject areas, then validates structure and links between skills.
Reviews application security and guides AppSec design. Use when reviewing auth, authentication, authorization, sessions, data handling, supply chain, or AppSec architecture.
The English summary is being prepared. Showing the original description.
Analyze a codebase to identify valuable assets, attack entry points, and realistic abuse paths. Produce a concise Markdown threat model that explains risk priorities, distinguishes existing protections from proposed mitigations, and makes assumptions explicit.
Analyze a codebase to identify valuable assets, attack entry points, and realistic abuse paths. Produce a concise Markdown threat model that explains risk priorities, distinguishes existing protections from proposed mitigations, and makes assumptions explicit.
Create a Markdown threat model grounded in a codebase. Identify valuable assets, boundaries between trusted and untrusted components, realistic attack paths, and mitigations, then prioritize risks using explicit assumptions about likelihood and impact.
Prepare one Markdown article for both WeChat drafts and RedNote posts. The skill formats long articles, uploads images, converts content into shorter social posts with tags, and provides previews and batch processing.
Prepare Markdown or HTML content for a WeChat Official Account and save articles as drafts through an API or browser. It also supports short image posts, article themes, and checks for titles, summaries, and cover images.
Plan welcome messages and customer-service replies for WeChat official accounts, including triggers and handoff rules. Send customer-service text to a specified recipient only after the user confirms the target and message.
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
The English summary is being prepared. Showing the original description.
Multi-agent source security audit with a coverage ledger, independently verified findings, and machine-checked records. Use when asked to audit a codebase, find vulnerabilities, or run a source-level pen test.
The English summary is being prepared. Showing the original description.
Create a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit threat-modeling requests, not general architecture or code review.
The English summary is being prepared. Showing the original description.
Audit application source code against the OWASP Top 10 (2021) vulnerability categories — broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity, logging failures, SSRF. Use when the user mentions 'OWASP,' 'OWASP Top 10,' 'security audit,' 'security review,' 'secure code review,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'appsec review,' 'application security audit,' 'check for security issues,' 'broken access control,' 'IDOR,' 'SQL injection,' 'XSS,' 'SSRF,' or wants to check their codebase for common security weaknesses.
The English summary is being prepared. Showing the original description.
Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.
The English summary is being prepared. Showing the original description.
Formats all confirmed pentest findings from findings.json into copy-pasteable GitHub issue markdown blocks, following the AppSec reporting guide template.
The English summary is being prepared. Showing the original description.
Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level prioritization.
The English summary is being prepared. Showing the original description.
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
The English summary is being prepared. Showing the original description.
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
The English summary is being prepared. Showing the original description.
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Use when the user explicitly asks to threat model a codebase or path, enumerate abuse paths, or perform AppSec threat modeling.
The English summary is being prepared. Showing the original description.
Performs a comprehensive security review of code changes in a GitHub PR or issue. Checks out the branch, analyzes changed files against a 9-category security checklist, and produces PASS/WARNING/FAIL verdicts. Use when reviewing pull requests for security vulnerabilities, hardcoded secrets, injection flaws, auth bypasses, or insecure configurations. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.
The English summary is being prepared. Showing the original description.