Навыки: Безопасность

MEMO-ONLY prior-work overlap advisory: surfaces the two ADVISORY taxonomy signals neither a tool nor a model can decide...

NPM registry configuration template (.npmrc.template) and validation logic for GitHub Packages authentication with pnpm...

Use this skill when configuring, troubleshooting, or extending NPSP Customizable Rollups (CRLP) — including rollup defin...

Use this skill when working with NPSP (Nonprofit Success Pack) objects, namespace prefixes, GAU allocations, recurring d...

Use when working with NPSP (Nonprofit Success Pack) objects, namespace prefixes, GAU allocations, recurring donation obj...

Run nuclei v3.11 template scans for CVEs, exposures, default logins, panels, takeovers and misconfigurations, with rate...

Installs and runs ProjectDiscovery Nuclei template-based HTTP scanning: selects templates via `-t {path}` and `-tags`/`-...

Detects untrusted numeric input that flows through a conversion, cast, or parser into a length, size, index, or authoriz...

The Nutanix storage read surface across four namespaces: `storage_execute` for storage containers and volume groups, `vo...

Canary skill for auto-injection detection

GDPR LIA template, CCPA thresholds, ethical OSINT principles, data retention policies, and clear boundaries for what CAN...

Tool safety protocols, adversarial output validation, error recovery patterns, and I/O contracts for research operations

Agent safety boundaries - input validation, output filtering, scope constraints, and document creation policy

Database security (encryption, access control, injection prevention), data governance (lineage, quality, MDM), and compl...

Receive and verify Nylas webhooks. Use when setting up Nylas webhook handlers, debugging x-nylas-signature verification,...

面向新西兰政府机构及其供应链的《新西兰信息安全手册》（NZISM）专家顾问。用于 NZISM 控制指引、差距分析、机构安全义务、分类框架（从'非保密'到'绝密'）、安全风险管理、系统认证和 GCSB/NCSC NZ 合规。触发词：NZISM...

Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use f...

OAuth 2.0/OIDC flows, provider integration, and token handling.

Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client c...

OAuth 2.0 and OpenID Connect implementation patterns. Use when implementing authentication, authorization flows, or inte...

OAuth 2.0 and OpenID Connect implementation

OAuth 2.0 authorization code flow, PKCE, token refresh, OpenID Connect, social login providers, and security considerati...

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Implement OAuth 2.0 authentication flows including authorization code with PKCE, client credentials, and device code for...

Use when testing OAuth 2.0 and OpenID Connect logins on an authorized engagement. Covers mapping the authorization flow,...

Configure oauth client setup operations. Auto-activating skill for API Integration. Triggers on: oauth client setup, oau...

Automate OAuth login flows with user confirmation via Telegram. Supports 7 providers: Google, Apple, Microsoft, GitHub,...

Detects weak JWT validation, loose redirect_uri matching, and missing state parameters in OAuth/OIDC flows. Use when wri...

Implement OAuth 2.0 authentication with GitHub and Microsoft Entra (Azure AD) in Cloudflare Workers and other edge envir...

Architect, implement, and audit OAuth 2.0, OpenID Connect (OIDC), and JSON Web Token (JWT) authentication and authorizat...

Complete OAuth login flow and store tokens for verification. Use when browser verification requires authenticated sessio...

Hunt OAuth 2.0 and OIDC flaws — redirect_uri abuse, state CSRF, PKCE bypass, scope manipulation, implicit-flow token the...

Expert in implementing OAuth 2.0 and OpenID Connect (OIDC) authentication flows. Specializes in secure token handling, s...

OIDC flows, PKCE implementation, token refresh strategies, social login integration, and secure session management.

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (pat...

OAuth 2.0認可フローの実装パターンとセキュリティベストプラクティス。Authorization Code Flow、PKCE、Refresh Token Flowの正確な実装を提供。Web/SPA/モバイルアプリでの安全な認可フロー...

Assists with implementing OAuth 2.0 and OpenID Connect for secure authentication and authorization. Use when configuring...

Use when configuring Spring Boot as an OAuth2 resource server, validating JWTs from an external auth provider (Keycloak,...

Use when designing or testing logs, metrics, alarms, SLOs and notification routing. Use incident-response for an active...

Audits source code for observability gaps — missing telemetry, poor observability practices, and code structure that res...

Helper skill to retrieve OAuth tokens from the correct OpenShift cluster context when multiple clusters are configured

Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass trad...

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgr...

Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake captur...

Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full at...

IDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalati...

- **Cache Partitioning**: Partition CDN caches by auth headers; avoid cacheable 200/304 for private resources.

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EE...