Build a dependency-tree map of a project (npm or Python) and trace the path from each known-vulnerable transitive package back to one or more direct dependencies.
Scan a source-code tree for hardcoded credentials embedded in source files: AWS access keys, GitHub tokens, Stripe keys, Slack tokens, Anthropic API keys, OpenAI keys, JWT signing…
Audit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness.
Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval /…
Read findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding…
Scan a source tree for unsafe-by-default deserialization APIs: Python pickle.loads / cPickle / shelve / dill, Ruby Marshal.load / YAML.load (pre-3.1 default), Java…
Probe a target for accidentally-served secret-bearing files in the web root — `.git/`, `.env`, `.DS_Store`, backup files, database dumps, key files, CI configs, IDE configs.
Scan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated…
Audit a target's TLS certificate beyond protocol/expiry — chain ordering, OCSP stapling, revocation status, Certificate Transparency presence, key-usage flags, and over-broad…
Compose an exec-readable summary from a unified findings JSONL plus the OWASP coverage report. Computes a single engagement risk score (0-100, severity-weighted with OWASP-breadth…
Package an engagement's findings, scan outputs, evidence, and signed ROE into a timestamped archive with a SHA-256 manifest covering every file.
Audit a project's dependency licenses against an explicit policy (allow-list / deny-list / review-required) and flag incompatibilities before they ship to production.
Probe a target for HTTP methods that should not be enabled in production — TRACE (XST attack), unrestricted PUT/DELETE, DEBUG/CONNECT, WebDAV (PROPFIND/MKCOL/COPY/MOVE), and Allow…
Identify the server software, framework, and component versions a target is running from its HTTP response signatures — Server header, X-Powered-By, Via, X-AspNet-Version,…
Probe a target for accidentally-public admin / debug / introspection endpoints — Spring Boot Actuator, Apache server-status, Prometheus metrics, GraphQL playground, Swagger UI,…
Parse the ROE scope definition, enumerate every in-scope target (hostnames, IPs, CIDRs, URLs, cloud accounts, SaaS tenants), validate syntax, detect overlap with out-of-scope or…
Audit a target's HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin trio (COOP, COEP, CORP).
Verify that a penetration test has explicit, written, signed authorization before any scanning begins.
Probe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory,…
Scan a source tree for command-injection vulnerable patterns: shell=True calls in Python subprocess, os.system / os.popen with interpolated strings, Node child_process.exec with…
Analyze a target's TLS configuration — negotiated protocol version, cipher suite, certificate chain, expiry, and downgrade vectors.
Annotate every pentest finding with its OWASP Top 10 (2021) category by applying a deterministic rule table keyed on source skill, finding category, detail keywords, and CWE…
Audit a Node.js project's installed npm dependency tree for known CVEs by wrapping the npm audit JSON output and emitting findings in the canonical penetration-tester schema.
Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled…
Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical…
Inspect and validate Vertex AI Agent Engine deployments including Code Execution Sandbox, Memory Bank, A2A protocol compliance, and security posture.
Universal document consistency auditor. Runs deterministic drift checks across docs, code, tests, and CI, resolves conflicts through a per-fact-class authority registry…
Generate production-ready Google Cloud code examples from official repositories including ADK samples, Genkit templates, Vertex AI notebooks, and Gemini patterns.
Dolt and DoltHub-aware workflow for the beads (bd) task tracker. Diagnoses why bead work is not visible on DoltHub (no Dolt remote configured), applies the bd dolt remote — from…
Comprehensive codebase cleanup across 11 quality dimensions: dead code, duplication, weak types, circular deps, defensive cruft, legacy code, AI slop, type consolidation,…
Deploy and orchestrate Vertex AI ADK agents using A2A protocol. Manages AgentCard discovery, task submission, Code Execution Sandbox, and Memory Bank.
Dolt and DoltHub-aware workflow for the beads (bd) task tracker. Diagnoses why bead work is not visible on DoltHub (no Dolt remote configured), applies the bd dolt remote — from…
Use when a prompt is rough, vague, or under-specified and you want it rewritten to high quality before running it.
Validate a Claude Code plugin directory against the official Anthropic spec and Intent Solutions enterprise standard.
Use when the user wants to manually flush a deferred-commit queue from a prior or interrupted chain. Reads .hyperflow/commits-queue/manifest.json, fast-forwards the staging branch…
Skill Refiner, the eval-guided improvement loop for SKILL.md files. Runs the bootstrap, score, propose, apply, and status cycle as a thin wrapper over the published…
Analyzes public X/Twitter complaints to detect, cluster, and triage bugs with repo evidence and owner routing. Use when monitoring product health from social signals.
Validate a SKILL.md file against the four-tier validation system: Tier 0 (locate), Tier 1 (standard or marketplace grading per the IS 100-point rubric), Tier 2 (static production…
Use when the user wants to set auto-routing mode: on (every task-shaped message routes), auto (intent-verb messages route — default), or off (no auto-routing).
Validate production readiness of Vertex AI Agent Engine deployments across security, monitoring, performance, compliance, and best practices.
Sns Topic Config - Auto-activating skill for AWS Skills. Triggers on: sns topic config, sns topic config Part of the AWS Skills skill category.
Step Functions Workflow - Auto-activating skill for AWS Skills. Triggers on: step functions workflow, step functions workflow Part of the AWS Skills skill category.
Authenticate production Podium integrations and survive the auth-side failures —
Production reference architecture for Attio CRM integrations -- layered project structure, sync patterns, webhook processing, and multi-environment setup.
Audit access control implementations for security vulnerabilities and misconfigurations. Use when reviewing authentication and authorization.
Test automatically generate comprehensive unit tests from source code covering happy paths, edge cases, and error conditions.
Forecast Generator - Auto-activating skill for Data Analytics. Triggers on: forecast generator, forecast generator Part of the Data Analytics skill category.
Collect BambooHR debug evidence for support tickets and troubleshooting. Use when encountering persistent issues, preparing support tickets, or collecting diagnostic information…
Diagnose and fix the top Replit errors: container sleep, port binding, Nix failures, DB limits. Use when encountering Replit errors, debugging failed deployments, or…
Handle Kling AI API rate limits with backoff and queuing strategies. Use when hitting 429 errors or planning high-volume workflows.
Configure CI/CD pipelines for testing Lindy AI agent integrations. Use when setting up automated testing, configuring GitHub Actions for webhook receiver tests, or validating…
Deploy OneNote integrations with MSAL token persistence, health checks, and container best practices.
Execute comprehensive load and stress testing to validate API performance and scalability. Use when validating API performance under load.
Optimize Speak API costs through usage monitoring, tier selection, and efficient audio processing. Use when implementing cost tuning, or managing Speak language learning platform…
Apple Notes cost optimization — it is free, focus on iCloud storage management. Trigger: "apple notes cost".
Build production Firebase Genkit applications including RAG systems, multi-step flows, and tool calling for Node.js/Python/Go.
Implement Exa webhook signature validation and event handling. Use when setting up webhook endpoints, implementing signature verification, or handling Exa event notifications…
Apply production-ready FireCrawl SDK patterns for TypeScript and Python. Use when implementing FireCrawl integrations, refactoring SDK usage, or establishing team coding — from…
Collect Anima SDK debug evidence for support tickets and troubleshooting. Use when filing Anima support requests, debugging code generation issues, or collecting diagnostic data…
Optimize Hex API performance with caching, batching, and connection pooling. Use when experiencing slow API responses, implementing caching strategies, or optimizing request…