Use when drafting or revising prose for a USENIX Security Symposium paper — threat-model-first structure, calibrated security claims, disclosure narrative woven into the text,…
Entry point for open-source intelligence, investigation and verification work. Routes any identifier — a name, phone number, email address, username, domain, company, photo,…
Configura el perfil del usuario y establece reglas de interacción para el agente. USA esta skill cuando el usuario mencione 'configurar', 'setup', 'perfil', 'reglas', o cuando el…
Author a complete test-case suite FROM a user-flow or feature document — a PDF (preferred), markdown, doc, text, or screenshots of an app's flows — and output an importer-ready…
Use when a task needs the judgment of an usher, lobby attendant, or ticket taker — staffing doors and scanner lanes before a show or game, deciding when to hold or admit a late…
Use at the START of any task in a compass-enabled repo, or whenever you're unsure which capability fits.
Implements compile-time regex using GeneratedRegexAttribute Source Generator. Use when working with Regex patterns for better performance and AOT compatibility.
ITSOL router: planning, tech context, agent-browser dogfood, TDD, review, UI/UX, security.
Dual-mode skill for github.com/LerianStudio/lib-commons v5, Lerian's shared Go library — the non-observability surface.
Dual-mode skill for github.com/LerianStudio/lib-observability v1.0.0, Lerian's OpenTelemetry foundation.
Use when building, editing, validating, testing, or debugging an n8n workflow through the n8n-mcp MCP server — designing a flow, configuring a node, writing an expression or Code…
Use when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon,…
Use at the start of any session — establishes the cognitive contract that pandastack skills must be checked BEFORE any response or action, including clarifying questions.
Use when creating a git worktree for a Rails project that uses SQLite - copies the main working tree's development SQLite databases (including Rails 8 Solid Queue/Cache/Cable)…
Use when the user wants to run ad-hoc SQL against a database from the shell - postgres, mysql, sqlite, mssql, oracle, snowflake, bigquery, redshift, cockroachdb, clickhouse,…
usql is a universal command-line interface for SQL databases including PostgreSQL, MySQL, SQLite, Oracle, SQL Server, and dozens more.
Römisches Recht: Usucapio Ersitzung. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Römisches Recht: Usus Modernus. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Prepare Kubernetes environment infrastructure by generating K8s manifests for all 3rd party supporting applications for a single target environment defined in CLAUDE.md.
Engineer at global scale in the style of UUNET (now Verizon Business). Emphasizes massive infrastructure resilience, "plumbing" the internet, pragmatic problem solving, and the…
Use after execute to attack the change and demonstrate how it's broken. Default stance — the change is broken; prove and demonstrate it.
Review UI/UX for Safe OpenSig, a verification tool that helps enterprise Safe signers eliminate blind signing by showing the real intent of transactions through simulation before…
Hand-built fixture for AST08 scenario AST08-S02 (Obfuscated Instruction), labeled vulnerable. — from security/security-misc
Hand-built fixture for AST01 check AST01-S11 (Hidden Prompt Injection in Skill Output), labeled vulnerable.
Hand-built fixture for AST08 scenario AST08-S07 (Scanner Host Compromise and Resource Exhaustion), labeled vulnerable.
Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns.
Complete security architecture overhaul for claude-flow v3. Addresses critical CVEs (CVE-1, CVE-2, CVE-3) and implements secure-by-default patterns.
15-agent hierarchical mesh coordination for v3 implementation. Orchestrates parallel execution across security, core, and integration domains following 10 ADRs with 14-week…
Hand-built fixture for AST08 scenario AST08-S08 (Bytecode Cache Poisoning), labeled vulnerable.
Security-first Uniswap v4 hook development. Use when user mentions "v4 hooks", "hook security", "PoolManager", "beforeSwap", "afterSwap", or asks about V4 hook best practices,…
Checks if a POC provided by some JS and d8 flags is a vulnerability or just a regular bug.
Guides the initial analysis and impact assessment of a V8 security report, strictly excluding implementation or fixing.
Develop and review SAP ABAP, CDS, HANA SQLScript/AMDP, RAP, OData/Fiori, integrations, enhancements, testing, and security with Clean Core guidance.
Validate that a branch or pull request implementation matches introduced product, technical, security, and related specs.
Deployment validation pipeline — 4 fasi (static, security, smoke, score). Valida un deploy Vercel (preview o production) con TypeScript, ESLint, Jest coverage su file toccati,…
Validate a brand profile end-to-end — required fields, voice/audience completeness, connector reachability, credentials health, and compliance prerequisites — without exposing…
Audit an existing Sim webhook trigger against the service's webhook API docs and repository conventions, then report and fix issues across trigger definitions, provider handler,…
Determine whether a specific vulnerability claim is valid, reachable, exploitable, and impactful in an authorized environment.
Validate authentication mechanisms for security weaknesses and compliance. Use when reviewing login systems or auth flows.
Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection,
Validate CORS policies for security issues and misconfigurations. Use when reviewing cross-origin resource sharing.
Validate CSRF protection implementations for security gaps. Use when reviewing form security or state-changing operations.
Comprehensive vulnerability assessment and penetration testing skill leveraging Secator, NetExec, Metasploit, and raw Python for advanced exploitation chaining across Linux,…
API de Variações de Produtos da Tray. Utilize quando o desenvolvedor precisar gerenciar variantes de produtos (SKUs) como diferentes tamanhos, cores ou modelos.
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security…
Systematically hunt for every variant of a discovered vulnerability across the entire codebase. Use when a bug is found and all instances of the same root cause pattern must be…
Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings.
Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration.
Manage training data and model artifacts securely on Vast.ai GPU instances. Use when transferring data to instances, managing checkpoints, or implementing secure data lifecycle on…
Apply Vast.ai security best practices for API keys and instance access. Use when securing API keys, hardening SSH access to GPU instances, or auditing Vast.ai security…
Provider account and authenticator setup through Matrx Vault. Use when creating a service account, saving its login, enrolling 2FA, or verifying agent sign-in with Vault…
HashiCorp Vault — secrets management, dynamic secrets, encryption, auth methods, policies
Manages secret lifecycle through the HashiCorp Vault HTTP API v1. Rotates database credentials via Vault dynamic secrets engine and syncs to Kubernetes via External Secrets…
Verifies encryption workflows with HashiCorp Vault Transit endpoints like `/encrypt`, `/decrypt`, and `/rewrap`, plus key metadata inspection.
Security suite for OpenClaw agents. Encrypted secret storage (AES-256-GCM), real-time activity monitoring via gateway WebSocket, policy enforcement, and native x402 payment wallet…
Use when scanning code for security vulnerabilities. Use when user says "scan security", "kiểm tra bảo mật", "security audit", "review security", or invokes `/vbs-scan-security`.
Technical due diligence before stabilization. The vibe-coding weekend got the app to launch. Now we find the taped-together auth, god tables, and silent failures.
Final outward ship skill. Turns "done in the repo" into "safe, visible, deployable, discoverable, and launchable in the world." Covers release mechanics, deployment topology,…
Inject VCP security and architecture standards into context. Run this at session start or after context compaction so the AI internalizes rules while writing code.
Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test…