Audit CVE/vulnerability source coverage for a technology stack. Maps each component (container, library, base image, runtime) to authoritative CVE feeds, flags gaps, and produces…
Use when wiring a repo to maintained DETERMINISTIC scanner gates (SAST, dependency-CVE/SBOM, secret-history, IaC/container, mutation, fuzz) that produce ground-truth observables —…
Seed-diverse multi-pass find: run the same target through THREE independent find passes — blind, threat-model-first, and CVE/history-seeded — union the candidates with…
Read findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding…
Quick routine security checks for secrets, dependencies, container images, and common vulnerabilities.
Expert skill for protocol fuzzing, vulnerability discovery, and security testing
Packages and runs a local SAST pipeline scan to identify source code vulnerabilities.
Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security…
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common…
DAST fuzzer defensivo AUTORIZADO — dispara payloads maliciosos contra um endpoint em localhost e reporta rotas que quebram (500/stack trace vazado).
Security review and vulnerability scanning for Buildkite plugins (Bash, Docker, Go). Use when auditing or hardening a plugin, reviewing plugin code for vulnerabilities before…
Research CVEs and security advisories for project dependencies. Uses Exa, NVD API, OSV.dev, and GitHub Advisory Database to find known vulnerabilities.
Scan project dependencies for known CVEs using native audit tools (npm, pip, composer, cargo, go, bundler, dart)
Pull CVEs against the current dependency set (osv.dev / GHSA) and classify each as exploitable / theoretical / not-applicable
Configure and operate the kube-logging logging-operator (formerly Banzai Cloud) on Kubernetes — the CRD-driven log pipeline: Fluent Bit collector → fluentd or syslog-ng aggregator…
Analyze CVSS severity data from OSV vulnerability records. Triggers on mentions of CVSS scores, vulnerability severity assessment, risk rating, or when user needs to evaluate the…
Migrate off the Rancher-bundled `rancher-logging` chart (cattle-logging-system, rancher/mirrored-kube-logging-* images) to the upstream kube-logging logging-operator ≥6.7.0 —…
Static application security testing (SAST) for changed source files — Vulnetix''s built-in rule set plus optional Semgrep augmentation when `.semgrep` config is present.
Watch one upstream GitHub repo for new HIGH/CRITICAL Security Advisories in the last 24h, add each as a sast-benchmark case following the PR #5 methodology, open a PR, then run…
Register a new upstream GitHub repo as a sast-watch target. Validates the repo, seeds the state file from the current manifest, writes a per-target launchd plist to…
Take a system from "merged" to reliably serving users in production, and keep it there: deployment & release strategy, infrastructure-as-code & config, observability, monitoring &…
CVE and CWE database querying and management
Run security scans including SAST, dependency scanning, and secret detection
Create your operational excellence skill in one prompt, then learn to improve it throughout the chapter
Overview e regras universais do projeto Sankhya Addon Studio 2.0 (Wildfly/EJB + JAPE SDK) — Java 8 strict, Lombok, ISO-8859-1, Guice DI, MapStruct, JapeRepository, convenção de…
Work through the first hours and days after a disaster — a fire, flood, storm, or evacuation — in the right order: safety and people first, then documenting for insurance and aid,…
Expert database administrator specializing in high-availability systems, performance optimization, and disaster recovery.
Traces data flow from entry points to dangerous operations. Cross-file reasoning to determine which entries can reach which dangers, and what validation exists in between.
Security scanning for Agent Skills and MCP servers using Snyk agent-scan. Use when installing new skills, auditing existing skills, reviewing MCP server security, or when user…
Author-guideline skill for Q1/Q2 agriculture journals from society, academy, and regional publishers not covered by a dedicated publisher skill: Soil (Copernicus), Plant Soil and…
Evaluate AI solutions across 4 dimensions — Confidence, Risk, Effort, Soundness — before accepting any recommendation. Prevents blind plan acceptance and production disasters.
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues.
Review Alibaba Cloud workload HA and BCDR designs — RDS High-Availability Edition failover, PolarDB Global Database Network, ACK multi-zone, ECS disaster recovery cross-region,…
Design Alibaba Cloud solutions — product selection (PolarDB vs RDS, ACK vs ASK vs SAE, MaxCompute vs AnalyticDB), architecture patterns, landing zone design, and disaster recovery…
Manage Alibaba Cloud Backup and Disaster Recovery Center (BDRC) via OpenAPI/SDK. Use for listing resources, creating or updating configurations, querying status, and…
Walk a security team member through allocating a CVE for an tracking issue. Prints the ASF Vulnogram allocation URL and a CVE-ready title (the issue title strip — from…
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements.
Use when a task needs the judgment of an Application Security Engineer — checking whether an endpoint verifies object-level authorization (not just authentication), running threat…
灾备恢复演练系统 - 定期的备份恢复测试与改进： 1. 全局考虑：覆盖演练计划、执行、评估、改进全流程 2. 系统考虑：计划→执行→验证→报告→改进闭环 3. 迭代机制：根据演练结果优化灾备策略 4. Skill化：标准接口，可按层级独立演练 5. 流程自动化：定时自动执行恢复演练
OpenStack backup operations skill for protecting cloud infrastructure through systematic backup strategies and disaster recovery procedures.
Backup, restore, disaster recovery, and migration for OpenClaw. Encrypts and stores ~/.openclaw/ locally and to cloud destinations (S3, R2, B2, GCS, Google Drive, rsync).
Implement backup strategies, disaster recovery plans, and data restoration procedures for protecting critical infrastructure and data.
Create and manage etcd backups for OpenShift control plane disaster recovery, including automated backup procedures and verification.
Design backups around tested restores, point-in-time recovery, and backup security. Use when setting up database backups or verifying that existing backups would actually work in…
バグバウンティレポートの下書きをプロのトリアージャー視点でレビューし、「報告に値する脆弱性か」「良いレポートとして合格ラインか」を13観点・100点満点で体系的にスコアリングするスキル。HackerOne / Bugcrowd / Intigriti / YesWeHack…
Expert for Business Continuity Management (BCM) with deep knowledge of ISO 22301, ISO 22313, and integration with ISO 27001.
Bearer CLI is an open-source static application security testing (SAST) tool that scans source code to identify, filter, and prioritize security vulnerabilities and privacy risks.
Implement a vulnerability aging dashboard and SLA tracking system to measure remediation performance against
Deploy DefectDojo as a centralized vulnerability management dashboard with scanner integrations, deduplication,
Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature…
API de Características de Produtos da Tray. Utilize quando o desenvolvedor precisar gerenciar características (propriedades) dos produtos, incluindo cadastro, atualização,…
Comprehensive Cisco Catalyst 8000 SD-WAN engineering skill. Covers Catalyst 8000v (Cat8000v) edge router configuration, IOS XE SD-WAN CLI, vManage/vSmart/vBond orchestration, OMP,…
Fetches dependency vulnerabilities from Vanta, Snyk, Dependabot, or GitHub Security Advisories, creates a tracking issue in Jira/Linear/GitHub Issues, then fixes, commits, pushes,…
Secure sync for OpenClaw memory and workspace. Use /sync to push, /restore to pull, /sync-status to check. Supports versioned backups and disaster recovery.
Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis…
Complete ClickHouse operations guide for DevOps and SRE teams managing production deployments. Provides practical guidance on monitoring essential metrics (query latency,…
API de Clientes da Tray. Utilize quando o desenvolvedor precisar gerenciar dados de clientes da loja: listagem, consulta, cadastro, atualização e exclusão.
Build disaster recovery around RTO/RPO tiers, verified backups, and drills that prove the numbers. Use when writing a DR plan or testing whether the existing one actually works.