Use the AWF (Agentic Workflow Firewall) to run commands with network isolation and domain whitelisting. Provides L7 HTTP/HTTPS egress control for AI agents.
Audit or apply GitHub branch protection, tag rulesets, repo security settings, and signing requirements based on the active profile.
Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.
Crea tareas y subtareas en ClickUp para implementaciones de GoHighLevel. Usar SIEMPRE que el usuario quiera subir workflows de GHL a ClickUp, registrar tareas de automatización, o…
Scan, tag, validate, and catalog files using the Ghost Catalog semantic file header system (SOM-XXX-NNNN-vX.X.X).
Ghost is an open-source publishing platform built for modern blogs, newsletters, memberships, and headless CMS use cases.
Ghostfolio is an open-source wealth management application for tracking stocks, ETFs, and cryptocurrencies across multiple platforms.
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD.
Manage git-crypt encrypted repositories with seamless worktree support. Handles unlock/lock operations, key management, and the critical worktree smudge filter issue that causes…
Backup Clawdbot workspace and config to GitHub with git-crypt encryption. Use for daily automated backups or manual backup/restore operations.
Audit local git history to identify commits that likely fixed vulnerabilities, infer the underlying bug from the diff, turn those patches into a reusable bug-fix reference set,…
Analyze Infrastructure-as-Code (IaC) in git repositories to extract cloud architecture and security configurations for threat modeling.
Review pull requests for code quality, security issues, and best practices. Use when reviewing PRs, checking code changes, or analyzing diffs before merge.
Detects leaked secrets in Git repositories using pattern-based scanning with Gitleaks rule definitions and the GitHub Secret Scanning API.
Scans Git repositories for leaked secrets using Gitleaks, TruffleHog, and custom regex patterns. Detects API keys, AWS credentials, private keys, and database connection strings…
Git security best practices for 2025 including signed commits, zero-trust workflows, secret scanning, and verification
Pre-commit security validation and secret detection. Runs gitleaks scan and validates configuration, integrates with pre-commit hooks to prevent credential leaks.
GitHub Actions CI/CD guide for the dotfiles repository. Use when creating or modifying GitHub Actions workflows, adding CI/CD pipelines, setting up build/test automation,…
Use when the user wants to create, generate, or set up a GitHub Actions workflow. Handles CI/CD pipelines, testing, deployment, linting, security scanning, release automation,…
Build production CI/CD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning.
Load GitHub Actions automation workflows documentation including CI/CD pipelines, security scanning, and maintenance automation
Quick reference for GitHub Actions security patterns. Copy-paste snippets for action pinning, token permissions, secrets, runners, and workflow hardening.
Build comprehensive GitHub Actions workflows for CI/CD, testing, security, and deployment. Master workflows, jobs, steps, and conditional execution.
Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted…
World-class #1 expert GitHub developer specializing in Git operations, GitHub Actions CI/CD, Pull Requests, Issues, GitHub CLI (gh), GitHub API, Copilot, Pages, Security,…
Generate, export, load, and verify forensic evidence from GitHub sources. Use when creating verifiable evidence objects from GitHub API, GH Archive, Wayback Machine, local git…
GitHub platform health assessment with 7 phases, per-finding triage (Fix/Defer/Skip/Suppress), scoped single-phase mode, session-begin quick check, and inline fix execution.
foundational definitions for GitHub skills, safety rules, tool escalation, and security boundaries
GitHub API operations - repositories, issues, pull requests, actions, code security, discussions, gists, and more.
Use when implementing GitHub OAuth + GitHub App authentication with Nango - provides two-connection pattern for user login and repo access with webhook handling
Pre-merge functional reviewer skill. Invoke for GitHub PR quality, contract validation, and release readiness. Do not invoke for deep security audit of auth/secrets/permissions.
Utility scripts for GitHub pull request management. Includes tools for fetching bot-generated review comments (linters, security scanners, dependabot), replying to review threads…
GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL). Use for project setup, Actions workflows, security scanning, or encountering YAML syntax, workflow…
Configure GitHub Secret Protection — secret scanning, push protection, custom patterns, and partner alerts.
Analyze GitHub repository security alerts and generate remediation plans. Use when the user asks to review security alerts, fix vulnerabilities, check dependabot alerts, review…
Diagnose and fix GitHub authentication issues on Windows when pushing fails with "Repository not found" or wrong-account errors.
Gitleaks is an open-source SAST tool for detecting hardcoded secrets like passwords, API keys, and tokens in Git repositories, files, and directories.
A multifaceted OSINT and forensics tool for GitHub repositories that detects fake stargazers, tampered commits, infected releases, leaked PGP keys, and suspicious contributor…
Přidání nové featury end-to-end přes všechny vrstvy bez zapomenuté permission, route nebo DI bindingu.
Error tracking (Sentry) na BE i FE — hlásí jen neočekávaná selhání (paniky, terminálně padlé joby, Vue chyby), obohacuje event o uživatele/request/breadcrumbs, je vypnuté bez DSN.
Plan, create, and configure production-ready Google Kubernetes Engine (GKE) clusters using the golden path Autopilot configuration.
Elite U.S. corporate + commercial-litigation lawyer persona with a Florida specialty. Use for: reviewing/ drafting loan, financing, secured-lending, M&A and entity-governance…
Elite FBI/forensic-investigator + financial-crimes (Fintech) division case-builder. Connects dots across large evidence sets (chats, bank records, PDFs, contracts), uncovers…
Adversarial RED-team for a 409A/IP valuation memo — a relentless IRS valuation examiner + audit-defense appraiser who attacks every input, method, and number to DESTROY the FMV…
GLBA expert for financial institutions. Deep knowledge of Gramm-Leach-Bliley Act including Safeguards Rule (16 CFR Part 314), Privacy Rule (16 CFR Part 313), FTC enforcement,…
Token security: Indexing tokens have write access -- never expose in frontend. Trigger: "glean security basics", "security-basics".
Scan prompts for prompt injection attacks before sending them to any LLM. Detect jailbreaks, data exfiltration, encoding bypass, multilingual attacks, and 25+ attack categories…
Use when configuring or troubleshooting Gmail access for this plugin — checking that the .env credentials exist and IMAP login works.
Go API development guidelines using the standard library (1.22+) with best practices for RESTful API design, error handling, and security
Apply Go project conventions — Go 1.25.x toolchain pinned via toolchain directive and GOTOOLCHAIN=local, vendored deps via go mod vendor, golangci-lint v2 strict (~50 enabled…
Database patterns for Go services: database/sql, connection management, transactions, migrations, query builders, and ORM usage (sqlc, GORM, ent).
Audit Go module dependencies: detect outdated packages, check for known vulnerabilities, review go.mod hygiene, identify unused or redundant deps, and evaluate dependency quality.
Run a grouped, bisectable Go dependency security sweep on the Fission repo. Use when the user asks to upgrade outdated/vulnerable Go dependencies, run a dep security pass, or…
Pre-release Go checklist for services, libraries, and CLIs (tests + race + lint + govulncheck + allowed-modules + TDD ceremony + CHANGELOG + API docs).
Security review for Go applications: input validation, SQL injection, authentication/authorization, secrets management, TLS, OWASP Top 10, and secure coding patterns.
Go coding standards, clean code, and security rules. Use when writing, reviewing, or refactoring Go code.
Prüft entgegenstehenden Willen, öffentliches Interesse, Unterhaltspflichten und Schadensersatz bei aufgedrängter Hilfe.
Römisches Recht: Goa Vergleich. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
God-level cloud security skill covering CSPM (Cloud Security Posture Management), CWPP (Cloud Workload Protection), CIEM (Cloud Infrastructure Entitlement Management), AWS-native…
Jailbreak API-served LLMs using G0DM0D3 techniques — Parseltongue input obfuscation (33 techniques), GODMODE CLASSIC system prompt templates, ULTRAPLINIAN multi-model racing,…