Audit Model Context Protocol server configurations and apply least-privilege scoping. Covers MCP inventory, capability risk-tiering, secret detection in configuration, malicious…
Secure NATS, RabbitMQ, Kafka, and similar message buses against misconfiguration and cross-tenant leakage.
Find Next.js-specific security issues across App Router, Pages Router, and Server Actions. Covers the middleware-bypass class, NEXT_PUBLIC environment leakage, RSC over-fetch, CSP…
Harden Payload CMS deployments against access-control and upload-related issues. Covers collection and field-level access functions, hook safety, file upload validation, GraphQL…
Find, rotate, and prevent leaked credentials across repositories and disk. Covers leak detection with gitleaks and trufflehog, rotation order (the leaked secret first, then…
Audit a public-facing site or server for common misconfigurations without sending exploit traffic. Covers DNS hygiene, TLS and HSTS, security headers, exposed paths (.git, .env,…
Verify and process Stripe webhooks safely against the real-world failure modes. Covers signature verification against the raw body, idempotency keys, replay protection, event-type…
Baseline-harden a Debian or Ubuntu VPS in roughly thirty minutes. Covers SSH key-only authentication, UFW firewall, fail2ban with web-app jails, unattended security upgrades,…
Authenticate and manage credentials for the gws CLI — login, logout, status, scopes, service accounts, and credential storage.
Quick install of the Google Workspace CLI (gws) on an additional machine using existing OAuth credentials. Requires client_secret.json from a previous gws-setup.
Set up the Google Workspace CLI (gws) from scratch. Guides through GCP project creation, OAuth credentials, authentication, and installing 90+ agent skills for Claude Code.
Self-service diagnostics — query Hope Agent's local SQLite databases (logs / sessions / async jobs) directly via the `exec` tool to investigate problems, analyze usage, and locate…
Answer 'how do I use X / where is setting Y / what does panel Z do' questions about Hope Agent from the built-in bilingual user guide instead of guessing from memory.
Read, update, preview, and publish Habr article drafts through the user's encrypted Habr login cookies.
Use when starting web application testing, API security assessment, bug bounty hunting, or authorized penetration testing.
Performs offensive security scanning of a workspace like an attacker would. Runs secrets grep, dependency audit, route protection analysis, injection testing, and HTTP header…
Monitors Hacker News for user-configured keywords, deduplicates against a local SQLite cache, and sends Slack alerts for new matching posts.
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.
Draft and file a security vulnerability report to a HackerOne bug-bounty program through the browser, and prepare its PoC package + a concise copy-paste README for a user-filmed…
All-in-one terminal hacking toolkit — 185+ security tools across 20 categories with unified menu, search, and
Lets an agent exercise REST, GraphQL, and gRPC authorization paths with YAML-defined role tests so BOLA, BFLA, broken authentication, and related API flaws are caught before…
Whitebox security review agent — checkpointed pentest workflow: recon → scenario routing → expert agents (12 OWASP families) → triage → findings.
Wirtschaftsprüfer: haftpflicht und schadenanzeige - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit,…
Notare: haftpflicht und schadenmeldung - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit, Belegplan und…
Anwälte: haftpflichtversicherung deckungsluecke - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit,…
Steuerberater: haftpflichtversicherung und schadenmeldung - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik,…
Agentic finance engine for the Agent OS — x402 machine-to-machine payments, on-chain settlement, per-task revenue billing, and wallet management.
Notare: handelsregisteranmeldung fehler - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit, Belegplan und…
Für Red-Team Qualitätssicherung für Handelsvertreter-Rechtsdokumente: prüft Ergebnis, Beweislast und Gegenposition; Ergebnis: Gegenprüfung mit Beweis- und Fristencheck.
Use when a vulnerability is reported from OUTSIDE the team (a security researcher, a user, a bug bounty, an embargoed upstream CVE) — triage it without shooting the messenger,…
File attachment handling for XMTP agents. Use when sending or receiving images, files, or any encrypted remote attachments.
Use when inspecting, probing, or reporting on any credential-bearing file (.mcp.json, .env, *.pem, ~/.git-credentials, ~/.netrc, a secret store) or when clearing a "no secrets" /…
Use when you, your group, or someone you advise is being attacked with calculated personal insult, mockery, nickname-branding, or ridicule — not as a loss of temper by the…
Agent arasi iletisim sablonlari. Standard handoff, QA verdict (PASS/FAIL), escalation, bug report, security finding ve status update formatlari.
How to draw hands in drawn-by-code, in any style. Use it before drawing, redrawing or reviewing any hand, and whenever a character holds, grips, carries, throws, touches or points…
Create a comprehensive, self-contained hands-on workshop for any technical topic. Use when the user invokes /handson-workshop (e.g., /handson-workshop "git internals",…
Pakai saat mengerjakan project hanoman: orchestrator + dashboard workflow docs-driven untuk nafanesia.id — perencanaan produk, arsitektur (Fastify + SQLite/Prisma + node-pty/tmux…
You are an expert in Hapi.js, the configuration-centric enterprise framework for Node.js. You help developers build production APIs with built-in input validation (Joi),…
Expert Harbor container registry administrator specializing in registry operations, vulnerability scanning with Trivy, artifact signing with Notary, RBAC, and multi-region…
Applies Ben Horowitz's "The Hard Thing About Hard Things" framework (The Struggle, wartime vs. peacetime CEO, no-easy-answers decision making, the Law of Crappy People, hiring for…
Hardcoded Credential Finder - Auto-activating skill for Security Fundamentals. Triggers on: hardcoded credential finder, hardcoded credential finder Part of the Security…
Detect hardcoded secrets in code or configuration accessible to the target agent. Focuses on secrets embedded in source, configs, or IaC, not runtime leaks.
Defensive methodology for API-layer abuse across REST, gRPC, and WebSocket: broken object- and function-level authorization (BOLA/BFLA), broken authentication and token replay,…
GATT access control and pairing hardening for Bluetooth Low Energy devices that treat the radio link as the trust boundary: privileged GATT characteristics left open without…
Discovery and SDP exposure reduction for Bluetooth Classic (BR/EDR) devices left inquiry-scannable with an open Service Discovery Protocol database, letting a nearby attacker…
Use when recommending controls or evaluating whether a system is secure by construction — apply the classic security principles (least privilege, fail-safe defaults, complete…
Defensive methodology against exploitation of broken application cryptography: CBC padding oracles, AES-GCM and stream-cipher nonce/IV reuse, and weak-primitive misuse (ECB,…
Harden IoT and embedded devices against firmware tampering, hardware-interface abuse, and RTOS/ICS compromise: firmware replacement, root shells on open UART or JTAG/SWD ports,…
Defensive methodology for Kubernetes cluster attacks: over-privileged RBAC and stolen service-account tokens driving the API server, interactive access to running workloads, and…
Harden the LoRaWAN join procedure and session keys against capture, replay, and injection on sub-GHz (433/868/915 MHz) IoT networks, where an attacker sniffs OTAA joins, replays…
Review and improve macOS defensive posture after a threat assessment, incident, or general security request.
Static and runtime hardening for Android and iOS apps running on devices an attacker controls: APK/IPA reverse engineering, rooted or jailbroken devices, Frida or Xposed hooking,…
Harden-Runner by StepSecurity is a CI/CD security agent that works like an EDR for GitHub Actions runners.
Cipher and protocol hardening plus config scanning for TLS/SSL endpoints against downgrade and weak-crypto abuse: deprecated protocols (SSLv2/SSLv3, TLS 1.0/1.1), weak ciphers…
Defensive methodology for web application firewall evasion, where an attacker wraps an injection payload (SQLi, XSS, RCE, path traversal) in encodings the WAF misses but the…
Defensive hardening methodology for Windows trust boundaries and access tokens: the UAC and integrity-level boundary between medium and high integrity, token theft, duplication,…
WPA2/WPA3-Enterprise (802.1X/EAP) credential-theft defense against evil-twin APs backed by a rogue RADIUS server, which harvest the inner identity and PEAP-MSCHAPv2 or EAP-TTLS…
WPA3-SAE transition-mode and downgrade hardening for Wi-Fi. Transition mode lets an adversary stand up a WPA2-only rogue AP with the same SSID, force clients down to WPA2 with…
Disable Wi-Fi Protected Setup (WPS) and verify access points are not exposed to online WPS PIN brute force or the offline Pixie-Dust attack, which recover the WPA/WPA2 pre-shared…
Harden Z-Wave home and building automation against network-key capture and RF sniffing on the sub-GHz band.