Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10).
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump.
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains.
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing…
Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM…
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One…
Use when auditing code that takes user or network input — hunt the OWASP web vuln classes by tracing untrusted input to a dangerous sink, and substantiate every finding input →…
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind…
LLM Wiki pattern + Cognee tarzı hibrit hafıza — Vector (ChromaDB) + Graph (Neo4j/NetworkX) + Relational (SQLite) üçlüsü.
Query macOS iMessage database (chat.db) via SQLite. Decode NSAttributedString messages, handle tapbacks, search conversations.
Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false
SQLite-backed index over all entity files in the project. The read-side foundation for every other MCP server.
OWASP Infrastructure Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in internal IT infrastructure environments.
Hunt for injection vulnerabilities including SQL injection, command injection, XSS, SSTI, path traversal, LDAP injection, and other input validation flaws.
Validate NoSQL injection vulnerabilities across MongoDB, Cassandra, CouchDB, Redis, and other NoSQL databases.
Auditoria de injecoes, XSS, CSRF e headers de seguranca para qualquer stack — queries parametrizadas/ORM, escaping por contexto (HTML/atributo/URL/JS/CSS), tokens CSRF, validacao…
Эксперт по санитизации ввода. Используй для XSS prevention, encoding, validation и security headers.
Identifies and fixes XSS, SQL injection, and command injection vulnerabilities with validation schemas, sanitization libraries, and safe coding patterns.
Webアプリケーションにおける包括的な入力検証とサニタイズ。型安全な検証、許可リストフィルタリング、 コンテキスト対応エンコーディングを通じて、XSS、SQLインジェクション、コマンドインジェクション、 パストラバーサルなどの入力ベースの攻撃を防止。
Insecure Deserialization Checker - Auto-activating skill for Security Fundamentals. Triggers on: insecure deserialization checker, insecure deserialization checker Part of the…
iOS Core Data architect for persistent storage, CloudKit sync, schema migrations, and SwiftData migration.
iOSアプリのセキュリティレビュー。OWASP Mobile Top 10、App Transport Security、Keychain使用をチェック。Use when: セキュリティ、脆弱性、認証、Keychain、ATS を依頼された時。
Drupal development and security patterns from Ivan Grynenko's cursor rules. Covers OWASP Top 10, authentication, access control, injection prevention, cryptography, configuration,…
Reads Microsoft Access (.mdb / .accdb) databases: lists tables, shows schemas, exports CSV, generates DDL for SQLite / PostgreSQL / MySQL / Access, extracts VBA source, dumps…
Syncs job application emails from Gmail and updates statuses in your Notion or SQLite tracker — detects offers, rejections, and interview invitations
Uses Claude CLI (WebSearch tool) to find new Data Science and Gen AI job postings across Bengaluru, Hyderabad, Mumbai, and Delhi NCR, scores them by relevance and location weight,…
Best practices for jQuery AJAX with JSON data handling including sending/receiving JSON, error handling, security (CSRF protection, XSS prevention), promise patterns, caching, and…
Full JavaScript analysis methodology for pentesting and bug bounty — JS file discovery, secret extraction, endpoint mapping, DOM XSS, prototype pollution, postMessage abuse,…
CTF flag 评判检查清单。当需要判断 CTF 挑战是否完成（flag 是否已获取）、分析攻击失败原因、或为下一步攻击提供精确指导时使用。覆盖 flag 搜索验证、漏洞发现评估、漏洞利用评估、flag 位置推断、常见题型模式匹配（SQLi/LFI/RCE/IDOR/SSRF/反序列化）
Use when a diff may introduce security risk — authZ, injection, secrets, unsafe deserialization, SSRF, XSS, mass assignment — dispatched by /review-changes, /do-and-judge, /judge.
Coleta e consulta dados de leiloeiros oficiais de todas as 27 Juntas Comerciais do Brasil. Scraper multi-UF, banco SQLite, API FastAPI e exportacao CSV/JSON. — from renat
Professional security audit for AI agents. Checks URLs for SSRF, analyzes content for prompt injection, validates commands for shell injection, integrates with skill-scanner for…
Kalender-Skill mit nutzungsadaptiver Backend-Wahl (Flag 3). Standard: lokaler SQLite-Store. Optional: Google-Calendar-MCP, Routinika oder UpToday als Backend — gesteuert über…
Local-first backlog workflow. Use when planning work, creating/updating backlog items, writing ADRs, enforcing Ready gate, generating views, or maintaining derived indexes…
Use when creating FastAPI endpoints, implementing JWT authentication, handling encrypted payloads, adding audit logging, or applying OWASP security patterns to KeyArc API…
Generates comprehensive table-driven tests for go-kratos microservices using testify/mock and testify/assert.
[recon/exploit] Fast reflected-XSS triage — reports which parameters reflect XSS-significant characters (<>\"'`) unescaped.
Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.
Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices.
Security audit worker (L3). Scans codebase for hardcoded secrets, SQL injection, XSS, insecure dependencies, missing input validation.
Use when about to accept a root cause or "just try a fix" on libsync and want to PROVE it first — a Qobuz 401 that could be expired token vs app-id mismatch vs bad signing secret,…
Maintain a local LifeOS production deployment safely. Use when cleaning test/smoke artifacts from SQLite, auditing production-vs-test jobs/agents, backfilling or improving cron…
Path-grounded multi-agent orchestration using the Liku directory hierarchy (skills.xml inheritance, todo.md + LikuErrors.md audit trail, SQLite memory).
Persistent memory plugin for OpenClaw agents. Hybrid SQLite FTS5 keyword + Ollama vector semantic search with auto-capture, auto-recall, stuck-detection, and memory consolidation.
Two-phase LinkedIn lead pipeline driven by linkedin-cli. Phase A imports leads from a search URL or filters, qualifies them against a configurable ICP via sub-agent, and stores…
Usar esta skill SIEMPRE que el usuario quiera comprobar si una IP, rango de IPs o dominio está en una lista negra (blacklist), RBL o DNSBL (Spamhaus, SORBS, Barracuda, UCEPROTECT,…
Fast lightweight local SQLite database for OpenClaw agents with minimal RAM and storage usage。Us。Use when 需要数据库操作、SQL查询、数据存储管理时使用。不适用于数据库架构设计决策。适用于独立开发者、企业团队和自动化工作流场景。
Litestream is a streaming replication tool for SQLite databases that continuously replicates changes to S3, Azure, GCS, SFTP, or local storage.
Hunt vulnerabilities in LLM-powered applications — direct/indirect prompt injection, system prompt extraction, ASCII smuggling, RCE via code tools, agentic AI exploits…
LLM is a Python CLI tool and library by Simon Willison for accessing OpenAI, Anthropic Claude, Google Gemini, Meta Llama, and dozens of other language models from the terminal.
Comprehensive security auditing framework for LLM applications covering OWASP Top 10 for LLMs, threat modeling, penetration testing, and compliance with NIST AI RMF and ISO…
OWASP Top 10 for LLM Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in large language model systems.
Checks hardcoded secrets, SQL injection, XSS, insecure deps, input validation. Use when auditing security.
Use mbox-to-sqlite when an agent needs to work across an email archive as structured data instead of parsing one message at a time.
MemGPT-style virtual context-load egy 11.11 session indulásakor. B-2 sprint Week 3 rewrite (2026-05-13): a klasszikus aggressive 15-20K token-os cat-jel helyett **lean ~5K token**…
Index Logseq markdown into SQLite, query the index quickly, and synchronize markdown updates back into the database.
Fetch current documentation for libraries used in channelhub (Bun, grammy, MCP SDK, Playwright, bun:sqlite, etc.).
Data validation patterns covering schema validation, input sanitization, output encoding, and type coercion.
Migrating LWCs from Lightning Locker Service to Lightning Web Security (LWS) — flipping the org switch safely, identifying components likely to break, removing Locker workarounds…