Threat-model, implement, review, and verify defensive security for web frontends, backends, APIs, data stores, dependencies, build pipelines, and deployments.
Use to plan web authentication — session vs token model, httpOnly cookies vs localStorage risks, CSRF, SSR/middleware auth on Next.js, OAuth/managed-provider evaluation, refresh…
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", " — from…
Expert 10x engineer with comprehensive knowledge of web development, internet protocols, and web standards.
Explore an authorized URL with headless Chrome DevTools/CDP, build a bounded SPA state-and-action graph, capture and classify browser traffic, optionally harvest browser-loaded…
Gather security intelligence for Proteus hypotheses: expected behavior, public-known status, advisories, changelogs, issues, PRs, docs, tests, affected-version timeline, duplicate…
Run a website launch as a verification-gated process, not a to-do list. Use when taking a site (or a major site section) to production — scoping a launch, building or walking a…
Documentação e integração do pacote npm @lina-openx/web-lina-pay-sdk (Lina OpenX / Open Finance). Use este skill sempre que o utilizador pedir ajuda com este SDK: exemplos de…
Web kategorisi SKILL.md — SQLi, XSS, SSRF tarayıcı ve exploit araçları kurma rehberi
Authorized web application penetration testing — reconnaissance, vulnerability analysis, proof-based exploitation, and professional reporting.
Web search using DuckDuckGo Instant Answer API (no API key required). Use when you need to search the web for information, definitions, calculations, conversions, or quick facts.
OWASP Top 10, security headers, CSP, XSS prevention, and vulnerability prevention.
Expert guidance on identifying and mitigating common web vulnerabilities from a bug hunter's perspective.
Hardens websites against common attacks — security headers, CSP policies, input validation, CORS configuration, dependency auditing, and OWASP Top 10 mitigation.
Security best-practices and hardening review for JavaScript/TypeScript web applications. Use when asked to harden an app, review security posture or secure defaults, assess OWASP…
Security code review for JavaScript/TypeScript web applications. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP…
Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.
单目标 Web 深度漏洞扫描策略。当已知目标 URL、需要对一个 Web 应用进行深度漏洞测试时使用。与 recon-full（资产发现）不同——本技能假设目标已确定，聚焦漏洞层面的深度测试。覆盖指纹驱动的扫描策略选择、自动化+手动测试结合、漏洞优先级排序。优先发现 RCE、SQL注入等高危漏洞
OWASP Top 10 for Web Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in web application environments.
Generate comprehensive web application vulnerability assessments with OWASP-aligned checklists, r。Use when 需要安全检测、合规审计、漏洞扫描、加密防护时使用。不适用于渗透测试未授权目标。适用于独立开发者、企业团队和自动化工作流场景。
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing…
Complete reference for 18 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples.
AI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discovery.
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay,…
Smart contract and DeFi security auditing for maximum bounty payouts. Use when auditing Solidity/Vyper contracts,
Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control,…
Expert in building crypto-native communities - token holder communities, NFT communities, DAO governance, alpha groups, and navigating the unique dynamics of Web3 culture.
Analyse and compare consensus mechanisms — PoW, PoS, BFT, DA, based sequencing — with security properties, finality guarantees, MEV, and economic incentive alignment.
Two services in one skill: (1) Web3 on-chain data via Chainbase CLI — use when the user asks about blockchain data, token holders, wallet addresses, token prices, ENS dom — from…
Two services in one skill: (1) Web3 on-chain data via Chainbase CLI — use when the user asks about blockchain data, token holders, wallet addresses, token prices, ENS dom — from…
Analyse DeFi protocols — AMMs, lending, stablecoins, derivatives, intents, solver networks — across protocol mechanics, economic security, MEV protection, and composability risks.
Design and audit on-chain and off-chain governance — token voting, delegation, quadratic voting, timelock, multisig, oSnap, Zodiac, EIP-7702 delegation — with attack vectors and…
Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability classes.
ZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, which patterns block all 10…
Analyse Layer-2 scaling solutions — Rollups (optimistic, ZK), validiums, based sequencing, shared sequencing — with security assumptions, data availability, and cost trade-offs.
Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting up a fork test, using Foundry…
Go-to-market strategy for web3 builders - protocols, products, services, and solo founders. Use when planning growth for a crypto protocol, building developer community, crafting…
Use when writing, reviewing, or deploying Solidity smart contracts — token contracts, signature-gated claim systems, merkle-gated staking vaults, allocation modules, role-based…
Master index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT.
Bug triage validation system, Immunefi report format, and 20 real paid bounty examples dissected. Use this when validating a finding before submitting, writing an Immunefi report,…
Automated web application vulnerability scanner and exploit generator starting from domains or URLs. Tests for SQLi, XSS, SSRF, IDOR, SSTI, authentication bypass, file upload…
Web server vulnerability scanner for identifying security issues, misconfigurations, and outdated software versions.
Probes a web app for what it exposes or leaks - passively from captured traffic (missing security headers, insecure cookies, secrets, error/stack-trace pages, outdated-tech…
Security auditing for {{project.name}}, a browser-delivered web app. Covers dependency hygiene, XSS prevention, secret leakage in client bundles, validation of third-party data,…
Automated SQL injection detection and exploitation tool for web application security testing. Use when: (1) Testing web applications for SQL injection vulnerabilities in…
Web security assessment. USE WHEN web assessment, pentest, security testing, vulnerability scan. SkillSearch('webassessment') for docs.
Usar esta habilidad SIEMPRE que el usuario quiera realizar pruebas de penetración, auditoría, análisis automático o explotación de vulnerabilidades sobre un portal web, aplicación…
Execute Webflow production deployment checklist — token security, rate limit hardening, health checks, circuit breakers, gradual rollout, and rollback procedures.
Apply Webflow API security best practices — token management, scope least privilege, OAuth 2.0 secret rotation, webhook signature verification, and audit logging.
Authentication production — Auth.js, OAuth, JWT, RBAC, session, CSRF. Không lỗ hổng bảo mật, HTTP-only cookie.
Add a contact form to a new-website site that needs no server and no setup: the visitor fills in a few fields, presses a button, and their own email program opens with a message…
Add a photo place whose photos take turns by themselves, with one dot per photo, to a new-website site: a component, one script of the site's own (so a strict…
Validates AWS readiness for website deployment. Checks CLI tools, credentials, SES, Route 53, and ACM. Produces a report with pass/fail and action items.
Transport and HTTP-header security for a website — HTTPS/TLS, HSTS, Content Security Policy, X-Content-Type-Options, clickjacking protection, cookie attributes, and security.txt.
Read WeChat local data from SQLite databases. Supports listing contacts, chat sessions, searching messages, and viewing favorites.
Expert WeChat Mini Program developer specializing in 小程序 development with WXML/WXSS/WXS, WeChat API integration, payment systems, subscription messaging, and the full WeChat…
Generate articles, manage drafts, publish to «发表记录», send customer-service messages, manage menus and pull stats on a WeChat Official Account (微信公众号 / 服务号 / 订阅号) via the WeChat MP…
Receive and verify WeChat Pay (APIv3) webhook notifications. Use when setting up WeChat Pay webhook handlers, debugging Wechatpay-Signature RSA-SHA256 verification, decrypting the…
Audit dependencies across configured repos for security advisories, open triage issues
6-pillar architecture review framework. Adapted from AWS Well-Architected for use by great_cto's architect agent on every non-nano ARCH document.