员工侵犯商业秘密风险评估与防控方案。 为企业评估员工侵犯商业秘密风险，识别高风险主体，制定防控方案：竞业限制协议有效性审查、 保密协议执行评估、员工带走信息的技术手段防护（上网行为管理/USB管控/邮件审计）、 离职交接流程规范性检查、证据保全与快速响应机制。 适用情形：员工离职带走商业秘密风险评估、商业秘密保护制度建设、竞业限制与保密协议审查、…
Audit env var usage vs .env.example and code references — surface drift, unused vars, missing docs, and security risks.
Generate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target.
Search for exploits across all vulnerabilities with filtering by ecosystem, severity, source, and EPSS
Reviews file upload and handling for path traversal, type validation, storage, and related logic flaws. Use when auditing file upload or processing security.
Fetch the consolidated financial snapshot for a given tax year from a DocVault instance (tax docs, sales, mileage, retirement, brokerage, crypto, bank accounts, real estate).
Generuje gotowy post na Instagram o projekcie Finora w formacie karuzeli 7 slajdów — format zoptymalizowany pod algorytm Instagrama (maksymalne swipe-through, czas spędzony,…
Zero-tolerance code quality enforcement. Fixes ALL errors, warnings, suppressions, and security issues.
Verifies that git commits address security audit findings without introducing bugs. This skill should be used when the user asks to "verify these commits fix the audit findings",…
Flutter development skill for Miqotul Khoir TV (MKT) project. Use for: implementing new Flutter features, fixing UI bugs, modifying widgets, creating Cubit state management,…
Cross-agent self-inspection of your AI-agent stack. Audits skills, MCP servers, hooks, plugins, commands, credentials, and memory files across Claude Code, Codex, OpenClaw, and…
Use when the user asks to audit, inventory or back up client FortiGate firewalls, or read FortiManager or FortiGate Cloud: grades every FortiGate in a devices file for firmware,…
Analyze a TypeScript/Node project (Angular, React, or Vue), read its dependencies, flag deprecated/EOL packages and known vulnerabilities, and produce a careful stepwise…
Generate images, videos, icons, audio, and more using Freepik's AI API. Supports Mystic, Flux, Kling, Hailuo, Seedream, RunWay, Magnific upscaling, stock content, and 50+ models.
Plan een klus als een reeks kleine, toetsbare stappen voor attended uitvoering met /fwd:steps-run — de lichte tegenhanger van fwd:mission-plan.
Fast single-pass FXA-specific commit review covering security, conventions, logic/bugs, tests, and migrations. No subagents — runs directly in the main context.
Assess non-functional requirements covering performance, scalability, reliability, and security. Use when "assess NFRs" or /gaia-nfr.
Self-serve a free Vulnetix VDB API key — install the CLI if missing, then run the browser device login so the user approves a code and the CLI stores the credential.
Formats all confirmed pentest findings from findings.json into copy-pasteable GitHub issue markdown blocks, following the AppSec reporting guide template.
Bump Go version across multiple OSS repositories. Use when the user wants to update Go across repos, says "bump go version", "update go", "go version bump", "upgrade go", or…
Security-first audit of the per-repo GitHub setting "Allow GitHub Actions to create and approve pull requests" (can_approve_pull_request_reviews) across an account.
OpenSSF-aligned security posture audit across all repos in a GitHub account: default workflow token permissions, allowed-actions policy, branch protection, secret scanning + push…
Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data.
Enforce secure GitHub Actions posture with least-privilege tokens, pinned dependencies, runner risk controls, and workflow supply-chain checks.
Gmail email sending adapter for the 100X Outreach System. Use this skill to send emails via Gmail using the user's own OAuth2 credentials.
[FINANCIAL EXECUTION] Create and launch meme coins and crypto tokens on launchpads (Pump.fun, FourMeme, Bonk, BAGS, Flap, Klik, Clanker, etc.) via bonding curve fair launch, or…
Get crypto and meme token price charts (K-line, candlestick, OHLCV), trending meme coin rankings by volume, and newly launched tokens on launchpads (pump.fun, fourmeme, letsbonk,…
Analyze any crypto wallet by address — holdings, realized/unrealized P&L, win rate, trading history, performance stats, specific token balance, and tokens created by a developer…
[FINANCIAL EXECUTION] Buy and sell meme coins and crypto tokens on Solana, BSC, Base, or Ethereum — single swap, multi-wallet batch trading, limit orders, stop loss, take profit,…
Query GMGN token information — basic info, security, pool, top holders and top traders. Supports sol / bsc / base.
Get real-time crypto buy/sell activity from Smart Money wallets, KOL influencer wallets, and personally followed wallets via GMGN API — alpha signals, whale tracking, meme token…
GoPlus AgentGuard — AI agent security guard. Automatically blocks dangerous commands, prevents data leaks, and protects secrets.
Use when the user asks to push usage counts into Gradient MSP Synthesize for billing reconciliation, see which accounts' counts drifted since the last push, confirm a dispatched…
This skill should be used when the user asks to "send a payment", "check balance", "list transactions", "create a quote", "manage customers", "create external account", "what…
Use when the user wants Google Search Console data pulled directly into the session instead of manually screenshotting / CSV-exporting from search.google.com.
Attack your own system — under explicit authorization — to prove its defenses hold, before launch and continuously after: scope and authorize, recon, scan and enumerate, exploit…
Use when the user asks to triage their HaloPSA queue, audit SLA breaches, build a per-client situational-awareness card, reconcile contract hours, check agent workload, or run any…
Static security scan of a harness's declared MCP surface via `harness mcp-scan
`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch.
Composite Phase-2 audit worker (ADR-150). Bundles harness oia-manifest + threat-model + mcp-scan into one timestamped audit record stored in the `metaharness-audit` memory…
Run `@metaharness/darwin security bench` (upstream "Darwin Shield" / ADR-155) — evolves a champion security-detection harness against a 10-vuln / 9-decoy corpus and grades it on…
Enterprise-review-grade threat model from `harness threat-model
`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings.
Scaffold, lint, review, security-audit, test, and upgrade-verify Helm charts. Runs an interactive interview to build production-ready charts from scratch.
Create high-click-through YouTube thumbnails and vertical video covers through the Higgsfield CLI. Builds a truthful information-gap concept, preserves up to three referenced…
Validate code against HIPAA policy: PHI exposure, missing audit logging, unencrypted transmission/storage, access control gaps, temp file exposure, and missing BAA references
Every Hudu cmdlet, plus an offline SQLite mirror, cross-entity audits, and agent-native output. Trigger phrases: `hudu hygiene scorecard`, `audit hudu documentation`, `find stale…
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Hunt for malicious TLS in Suricata eve.json (event_type:tls). Detects DGA / high-entropy / word-list SNI, IP-literal and malformed SNI, high-abuse TLDs…
Use when the user asks to triage Huntress incidents across client organizations, find coverage gaps or dark agents, trace an indicator's blast radius across the fleet, reconcile…
Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags.
Every ImmyBot endpoint typed, plus a local SQLite mirror that answers the cross-tenant questions the web UI cannot.
Full-power feature implementation using parallel subagents for backend, frontend, testing, and security.
Performs a first-pass security audit of project structure and attack surface to map risk and entry points. Use as the starting point for a security review.
Run the Vibe Innovation Framework mini-gate assessment to scope, justify, and execute a loop-back. Use when evidence in the current phase suggests an earlier phase's output is…
IOC pivots for a CVE — top IPs, ASNs, geo distribution, ATT&CK technique chain, Shadowserver scan counts (1d/7d/30d/90d averages), CrowdSec community sightings, merged in-the-wild…
Use when the user asks to find a device, contact, or serial number across every IT Glue client, rank clients by documentation completeness, audit stale passwords for SOC2 /…
Heuristic security scan of installed skills — prompt-injection phrases, hidden unicode instructions, credential-store access, network-pipe-to-shell and payload-smuggling patterns.
Reviews or implements Spring Security configuration — JWT authentication, OAuth2, method-level security, CORS, and CSRF.
Quick OWASP security scan for injection risks, hardcoded secrets, weak crypto, and Spring Security misconfigs.