Навыки: Безопасность

External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetS...

Microsoft Entra Agent ID (preview) for creating OAuth2-capable AI agent identities via Microsoft Graph beta API. Covers...

Create Agent Users in Microsoft Entra ID from Agent Identities, enabling AI agents to act as digital workers with user i...

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registra...

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally call...

Use when adding any cross-cutting change - a new gate, limit, permission check, or rule that must apply everywhere.

Run CloudFox's read-only Describe/List/Get enumeration (all-checks, role-trusts, secrets, endpoints, and permissions com...

Env & Secrets Manager

Env & Secrets Manager

Use when updating environment secrets like GITHUB_TOKEN, NPM_TOKEN, or API keys on the user's machine

Drafts a U.S.-compliant Exporter of Record (EOR) Agreement appointing a third party as USPPI for international export tr...

An institutional grade security token contract that provides interfaces for the management and compliant transfer of sec...

Audit CLI, API, MCP or SDK discovery, first use and error recovery. Use when: designing an agent-facing tool or investig...

Patterns for implementing role-based authorization in erify_api with JSONB roles/permissions, AdminGuard, and multi-scop...

Use when designing error hierarchies, propagating errors across service boundaries, implementing retry and backoff logic...

Intelligent error handling — silently auto-fix routine errors (missing imports, undefined variables, type mismatches, mi...

Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the u...

Sizes escrow and indemnity against the diligence risk register, with caps, baskets, and survival periods, for use when p...

Develop lightweight Wi-Fi connected IoT sensors, HTTP/MQTT clients, and low-power telemetry on ESP8266.

PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Assist with Ethereum transactions, gas optimization, token approvals, and L2 bridges.

Conducts authorized security testing to identify vulnerabilities, exploits, and attack vectors before malicious actors c...

This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "pe...

This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "pe...

Use this skill when the user asks for ethical thinking (including naming it or directing use/apply/run with obvious miss...

Bias detection and mitigation, fairness metrics, privacy frameworks, consent models, transparency requirements, and acco...

Receive and verify Ethoca (Mastercard) Alerts webhooks. Use when setting up an Ethoca Alerts Push API receiver, securing...

Deep hermeneutic interpretation of the conversation itself — verbose, earnest, self-aware, eloquent. Take the chat thus...

Ethereum knowledge corrections and onchain building patterns — gas costs, L2s, DeFi, security, verified addresses.

Guides EU Code of Conduct adherence under GDPR Articles 40-41 including EDPB approval requirements, monitoring body accr...

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability h...

Manage Eufy Security (HomeBase S380 + SoloCam S340/E340) from the `eufy` CLI—capture snapshots, forward alarms to the Tu...

Use when picking software for EU customers, GDPR-driven replacements, digital-sovereignty contexts, or when user asks fo...

Broad, pre-curation evidence reconnaissance for a declared Gaia skill, intake batch, upstream repository, or proposed ge...

Evaluate AI security guardrails, moderation layers, prompt-injection detectors, policy engines, classifiers, and rule-ba...

Design or audit an evaluation for retrieval-augmented generation, semantic search, or answer retrieval using a versioned...

When designing loosely coupled systems that react to state changes asynchronously.

Shield Event Monitoring: event log types, downloading logs via REST API and SOQL, real-time event monitoring with stream...

Plan what evidence to collect for each ISO 27001:2022 or SOC 2 control before collection starts: an auditor-style PBC re...

审核结构化主张与证据引用的映射、内容指纹、来源定位和独立来源数量，并按关键主张权重计算覆盖率，适用于报告交付前的证据完整性门禁。

Resolve complex or high-impact problems when the cause, solution path, requirements, or proof boundary is genuinely unce...

Sanitize security evidence before sharing, reporting, or writing up findings. Use for bug bounty reports, guided MCP ass...

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mas...

Automatically audit evidence whenever a request depends on factual accuracy, current web information, research, comparis...

Read-only EVM client: wallets, tokens, gas across 8 chains.

Deep EVM bytecode analysis and decompilation capabilities for smart contract security, gas optimization, and reverse eng...

Identifies and patches CVE-2025-32433 in Erlang/OTP SSH server source code by inserting an authentication-state check in...

Evolve AICP's three extension surfaces — skills (`.claude/skills/*/SKILL.md`, 84 today), MCP tools (`aicp/mcp/server.py`...