Detects CNAME records pointing to cloud services that may be dangling, and configurations referencing external services vulnerable to takeover.
Subfinder is a passive subdomain discovery tool by ProjectDiscovery that finds valid subdomains for websites using curated online sources.
使用 subfinder 进行被动子域名枚举。当需要发现目标域名的子域名、扩展攻击面时使用。subfinder 是 ProjectDiscovery 出品的被动子域名发现工具，聚合 Shodan、Censys、SecurityTrails、VirusTotal 等多数据源，快速且隐蔽。任何涉及子域名枚举、攻击面发现、被动信息收集的场景都应使用此技能
Subject Matter Expert persona for answering technical questions about F5 XC product capabilities, compliance alignment, threat coverage, and platform operations.
SaaS and subscription business revenue intelligence. Track MRR/ARR, calculate churn rate, net revenue retention (NRR), customer lifetime value (LTV), cohort analysis, and payback…
Framework for rapid-fire, highly satisfying behind-the-scenes data visualizations and portfolio construction compilations.
Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks.
Review and grade code in one pass — deep findings plus a blunt A-F ship verdict by default. TypeScript, React, Next.js, OWASP, and database checklists; three depth levels; 10+…
Give a blunt A-F ship verdict for a code change across correctness, security, data, UX, verification, and deploy readiness.
Add Sui zkLogin for Google, Apple, Facebook, or Twitch sign-in. Use when the user mentions zkLogin, social login, or OAuth-based Sui auth.
Sobe um MariaDB local fiel ao de produção e roda a suíte contra ele, em vez do SQLite. Use ao mexer em consulta SQL, validação de unicidade, ordenação, migration ou qualquer coisa…
Supabase /auth/v1/authorize silently ignores redirect_to values not in uri_allow_list — falls back to site_url with no error. Add the redirect URL to allow list before use.
Apply Supabase security best practices: anon vs service_role key separation, RLS enforcement, policy patterns, JWT verification, and API hardening.
Ahli keamanan Supabase untuk audit RLS (Row Level Security), RBAC, database relasional, dan pencegahan kebocoran data (hardcoded secrets).
Make AI-powered phone calls with custom personas and goals. Uses OpenAI Realtime API + Twilio for ultra-low latency voice conversations.
Guides implementation of technical, contractual, and organisational supplementary measures for international data transfers per EDPB Recommendations 01/2020.
Supply chain security: bad-version detection, incident response, lockfile audit, artifact scan.
External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings,…
Software supply chain attack testing — dependency confusion, typosquatting, malicious packages, CI/CD pipeline
Analyze project dependencies for supply chain risks. Checks maintainer count, commit frequency, CVE history, abandonment signals, bus factor, and security policy presence for each…
Behavioural-first software supply chain defense - catches poisoned npm/PyPI packages in the publish-to-advisory window that CVE tools miss.
Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions,…
Configure install-time cooldowns for npm/bun (minimum release age) and run a sandboxed pre-install scan when the cooldown has to be bypassed.
Assess supply chain risk exposure and resilience posture. Analyzes supplier dependency mapping (Tier 1/2/3), geographic concentration risk, single-source vulnerability, disruption…
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could…
Comprehensive framework for software supply chain security incorporating Software Bill of Materials (SBOM) generation/validation, SLSA (Supply-chain Levels for Software Artifacts)…
AI-powered software supply chain security auditing skill for agentic platforms. Performs comprehensive dependency vulnerability scanning across npm, PyPI, Maven, Go modules,…
Use when the user wants crypto data — token prices, on-chain SQL, prediction-market positions, CEX order books, wallet labels/net-worth, social mindshare, news, or a Surf-1.5 chat…
Expert agent for Suricata IDS/IPS/NSM. Covers rule writing, EVE JSON logging, AF_PACKET/DPDK capture, protocol parsers, JA3/JA4 fingerprinting, file extraction, datasets,…
Analyzes Suricata EVE JSON logs to identify network threats, suspicious egress, and protocol anomalies.
Multi-agent consensus and coordination patterns for YAMTAM agent swarms. Quorum voting with majority and super-majority thresholds, security-team veto protocol, inter-agent…
Deploy full honeynet infrastructure within a multi-agent swarm. Decoy agent prompts, honey-vault canary tokens, ghost file-system monitoring, runtime mutation of compromised…
Search public GitHub broadly for leaked secrets and triage exposures when the workflow is recon and remediation, not generic secret scanning.
Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM,…
Perform a detailed SWOT analysis — strengths, weaknesses, opportunities, and threats with actionable recommendations.
SWOT 分析（Strengths, Weaknesses, Opportunities, Threats）的结构化思维工具。基于 Albert Humphrey、 Mintzberg、Porter 等 10 个来源的深度调研，提炼 5 个核心原理和完整的操作协议。…
Use when turning internal/external situation analysis into strategic options with SWOT and TOWS: strengths, weaknesses, opportunities, threats, evidence quality, SO/WO/ST/WT…
Performs a structured Strengths-Weaknesses-Opportunities-Threats (SWOT) analysis plus a Threats-Opportunities-Weaknesses-Strengths (TOWS) matrix that pairs internal strengths and…
Comprehensive reference for all 38 Symfony framework components with PHP 8.3+ and Symfony 7.x patterns.
Writes Symfony PHP — DI container, bundles, Doctrine, Messenger, Security voters, console commands. For Laravel / Eloquent / Artisan use `laravel`.
AES-256 symmetric encryption for agent memory cache protection. CryptoJS AES encrypt/decrypt, HMAC integrity, secure key derivation, and encrypting agent session state at rest.
Synchronizuje główny plik `status.md` z listą gier. Użyj tego skilla gdy chcesz zapisać wszystkie top-level gry do `status.md`, dopisać nowe gry do statusu, ujednolicić status…
Synchronize a security issue in with the state of its GitHub discussion, the mailing thread, and any PRs that fix it.
Configure Content Security Policy (CSP) for Syncfusion Blazor components across Blazor Server, WebAssembly, and Auto render modes � self-hosted and CDN scenarios
Create and manipulate PDF documents using Syncfusion Flutter PDF library. Supports two modes — generate Dart code for the user's Flutter project or provide code snippets.
Anwälte: syndikusrechtsanwalt abgrenzung - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit, Belegplan…
Syndizierte Kredite, Facility Agent und Security Trustee prüfen: Rollen, Mehrheitsentscheidungen, Sicherheitenpool, Parallel Debt, deutsches Recht, Enforcement und Sanier — from…
Syndizierte Kredite, Facility Agent und Security Trustee prüfen: Rollen, Mehrheitsentscheidungen, Sicherheitenpool, Parallel Debt, deutsches Recht, Enforcement und Sanier — from…
Generate synthetic data from scratch through an interactive dialog — ask the user table-by-table about columns, types, foreign keys, and constraints; render the data model as…
Setup Ubuntu server Nginx fail2ban backup monitoring disaster recovery — sysadmin ครบมือ
System architecture skill for designing scalable, maintainable software systems. Covers microservices/monolith decisions, API design, DB selection, caching, security, and…
Use when practitioners need to understand system-managed fields (CreatedDate, LastModifiedDate, SystemModstamp, CreatedById, LastModifiedById, IsDeleted) — their update behavior,…
Encrypted backups, integrity verification, and data retention enforcement for Greek legal requirements (5-20 year retention). AES-256.
Route a systems-language task to the right skill among 7 specialists — Go (patterns, testing), C++ (Core Guidelines coding standards, GoogleTest/CTest testing), and Perl (modern…
AATMF T5 — Model & API Exploitation. Rate-limit abuse, token-cost amplification, schema bypass, model-version manipulation.
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
Insolvenztabelle konsolidieren und Prüfungstermin nach §§ 175 ff. InsO vorbereiten. §§ 175 176 177 InsO Tabellenführung und Widersprueche.
Table hook registration and materialization/retrieval for different data frameworks. Use when working on register_table, PandasTableHook, PolarsTableHook, SQLAlchemyTableHook,…
Native database client cho developers — free, open source, fast. PostgreSQL, MySQL, SQLite, MongoDB. Swift/macOS. 4.3K stars.
Domain knowledge for the tachi orchestrator agent: input format detection, DFD classification, trust boundary notation, STRIDE-per-Element dispatch rules, coverage requirements…