Orquestador maestro del Financial Intelligence System. ACTÍVALO SIEMPRE como primer paso ante cualquier consulta financiera de mediana o alta complejidad.
Use during the review stage of an Orchex-governed run to assess correctness, completeness, security, and workflow-contract compliance.
Review a pull request or branch for correctness, regressions, security, operational risk, and missing evidence.
Answer questions about the orkid media engine. Routes to specialized sub-skills for threading, reflection, filesystem, graphics, UI, audio, ECS, asset catalog, Python bindings,…
Identify orphan earthquakes far from mapped faults that indicate unmapped active structures. Use when analyzing microseismicity, finding dark earthquake source faults, or…
Evita errores por comandos incompatibles verificando SIEMPRE el SO antes de sugerir instalaciones. Trigger: "instalar", "upgrade", "apt", "brew", "winget", "configurar sistema",…
Expertise on OSCAL (Open Security Controls Assessment Language) — what document types exist, when to use each, schema versioning, FedRAMP/eMASS/CSPM integration, round-trip…
OSINT Investigator v2.1 — comprehensive open-source intelligence skill. Triggers on: OSINT, recon, digital footprint, dorking, social media investigation, username lookups, email…
Performs deep OSINT analysis on domains using Shodan API, SecurityTrails DNS history, and WHOIS RDAP lookups.
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.
Comprehensive operational skill specification for Anthropic Claude to automate, script, troubleshoot, and optimize OsiriX MD, PACS DICOM networking (C-STORE/C-FIND/C-MOVE — from…
对象存储（S3/OSS/COS/OBS）Bucket 误配利用。当发现 AWS S3、阿里云 OSS、腾讯云 COS、华为云 OBS 等对象存储服务，或在 HTTP 响应中看到 x-amz-*、x-oss-*、x-cos-* 等 Header 时使用。覆盖 Bucket 枚举、ACL 误配检测、公开读写利用、Bucket 接管、Object…
Audits and guides OSS project release readiness across the full lifecycle: community standards, README quality, launch strategy, distribution pipeline, and governance/security…
Find unclaimed open source issues that match the user's skills and experience level. Searches for issues created by maintainers/org admins, checks contribution eligibility, and…
GRIMSEC Agent 11: Evidence-backed forensic investigation of open-source GitHub repositories. Use when investigating supply chain incidents, suspicious commits, compromised…
Designs an issue and pull-request triage system a maintainer team can sustain - response targets sized against real capacity, the label taxonomy, intake cuts through structured…
OWASP Open Source Software Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in open source software dependencies.
OSV-Scanner is Google's open-source vulnerability scanner that checks project dependencies against the OSV.dev database.
Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
Prüft OT, SPS, Produktionsnetze und industrielle Steuerung im Nis2 Cybersecurity Compliance.
Prep a Sui Move package for an OtterSec security audit. Use when the user mentions OtterSec or wants audit prep.
Coordinate an authorized security audit of Ouros repositories and QA/local services. Use when the user asks for a broad security review, red-team-style assessment, attack-surface…
Authenticates to Microsoft Graph API using MSAL with Mail.ReadWrite and Calendars.ReadWrite permissions.
View and edit encrypted credentials in an Output.ai project. Use when adding secrets, updating API keys, verifying credential values, or retrieving a specific credential.
Wire encrypted credentials to environment variables using the credential: convention. Use when setting up LLM provider keys (ANTHROPIC_API_KEY, OPENAI_API_KEY) or any env var that…
Initialize encrypted credentials for an Output.ai project. Use when setting up credentials for the first time, adding environment-specific credentials, or adding per-workflow…
Store and reference encrypted secrets in Output SDK workflows using @outputai/credentials. Use when integrating API keys, database passwords, or third-party tokens.
Crypto-/DLT-Dienstleister und Node Provider auslagern: DORA, MaRisk, § 25b KWG, Verwahrung, Daten, Schlüssel, Subdienstleister, Audit-Rechte und Exit in Krypto-Projekten prüfen.
Operational Resilience und Konzentrationsrisiken bei Bankdienstleistern prüfen: kritische Funktionen, Auslagerungscluster, Cloud-Konzentration, DORA, Exit, Stresstest und — from…
Patentanwälte: outsourcing von zeichnungen - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit, Belegplan…
Map a target's internet-exposed hosts and services with the `shodan` source, capture host reports, brief the exposure, and optionally stand up a monitor for newly exposed services.
Uses Managed Agents' 14.5-hour runtime to audit an entire codebase overnight. Security, performance, accessibility, dependency issues. You wake up to a full report.
Audit what your public online presence quietly reveals — and tighten it — before a stranger, employer, or scammer uses it.
Design and review OVHcloud network topology including vRack private network segmentation, VLAN configuration, Public Cloud private network attachment, dedicated server…
Systematic audit against the OWASP 2021 Top 10 web application security risks with severity-rated, file-level findings.
OWASP API Security Top 10 testing patterns, injection payloads, auth bypass vectors, and security test generation for REST APIs.
Assess a REST or GraphQL API against the OWASP API Security Top 10 (2023), producing a per-category finding set with severity and remediation.
OWASP Top 10 for Agentic Applications 2026 (ASI) classification framework. Use for mapping security findings to standardized risk categories.
Operational skill for OWASP ASVS: selecting levels, mapping requirements to controls, evidence for reviews, and gap triage.
Audit application source code against the OWASP Top 10 (2021) vulnerability categories — broken access control, cryptographic failures, injection, insecure design, security…
Runs an OWASP ASVS/MASVS + BSI IT-Grundschutz security compliance audit (plus curated NIST SSDF/SLSA subsets) via orchestrated subagents, producing report.md/report.html and a fix…
Vérifie un projet contre le OWASP Top 10 et propose des remédiations. À utiliser pour vérifier la conformité OWASP.
OWASP Top 10 for LLM applications — full checklist for AI agent systems. Prompt injection, insecure output, training data poisoning, DoS, supply chain, sensitive info disclosure,…
Use when performing security audits, vulnerability assessments, or compliance checks on Flutter or mobile applications.
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings.
Look up and map to the right OWASP Top 10 family — Web, API, LLM, or Mobile — and give the canonical category ID/name for a finding.
Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security.
Provides comprehensive security standards and checklists based on OWASP Top 10:2025. Includes language-specific secure coding patterns for 20+ languages, guidance on Agentic AI…
Revisa o endurece una aplicación web de frontend (React, Next.js, SPA) frente al OWASP Top 10 y a los riesgos propios del navegador.
Automated OWASP Top 10 vulnerability detection and assessment. Run OWASP ZAP automated scans, detect injection vulnerabilities, identify broken authentication patterns, check for…
Незаблокирующая проверка по OWASP Top 10 2025 при реализации. Используй для: безопасность, проверь авторизацию, права доступа, секреты, инъекции, XSS, SSRF, цепочка поставок,…
Theoretical mechanics of critical web vulnerabilities, static analysis, and secure architecture remediation.
Assess a web application against the OWASP Top 10 (2021), producing a per-category finding set with severity and remediation.
Runs OWASP ZAP active security scans via the ZAP API daemon with custom scan policies. Generates SARIF reports compatible with GitHub Advanced Security code scanning alerts.
Automates REST API security testing using the OWASP ZAP Python SDK. Runs active scans, SQL injection probes, and XSS tests against OpenAPI specs with structured vulnerability…
Orchestrates OWASP ZAP active and passive scans against REST and GraphQL endpoints using ZAP's Python API client.
Automates OWASP ZAP scans against REST APIs using the ZAP Python API client. Imports OpenAPI/Swagger specs for targeted scanning and generates SARIF-format reports for GitHub…
Runs automated DAST scans against REST and GraphQL APIs using OWASP ZAP daemon API. Detects injection flaws, broken auth, and CORS misconfigurations with detailed remediation…
Runs automated penetration tests using OWASP ZAP API with spider crawling, active scanning, and AJAX-aware testing.
Runs OWASP ZAP active and passive scans against target URLs using the ZAP Docker API. Parses JSON reports to flag XSS, SQLi, and CSRF vulnerabilities with severity scoring.