Навыки: Безопасность

Live CVE feed correlation + plugin ownership-transfer detection — fetches NVD, Patchstack, and WPScan public feeds AT RU...

IP / copyright clean-room audit for a WordPress plugin — when a plugin is built in the same space as a competitor whose...

Discover every `register_rest_route()` call in a WordPress plugin and fuzz-test each endpoint with malformed payloads, m...

Supply-chain security audit — Composer + npm dependency CVE check, license compatibility (GPL-compatible only), abandone...

WordPress plugin PHP source code security review. Use when auditing WP plugin files for vulnerabilities — XSS, CSRF, SQL...

Skill for configuring and managing OpenID Connect in Orchard Core. Covers server setup, client application registration,...

Skill for configuring security and authorization in Orchard Core. Covers permission definitions, authorization services,...

Skill for managing users, roles, and permissions in Orchard Core. Covers user registration, role creation, permission de...

Sequential agent workflow for complex tasks

The auto-pi workflow procedure layer. ask-matt owns semantic routing; the deterministic workflow interpreter owns state...

Practical step-by-step walkthrough for orchestrating features end-to-end using the multi-agent system, from planning thr...

Assess the overall organization security posture

Project-orientation workflow (/orient): installs predicate's enforcement into a target project, maps its structure and g...

Functions for managing HTTP cookies in web applications.

Cryptographically sign and verify data using HMAC-SHA256.

Only procedures explicitly accepting GET can be called via HTTP GET (CSRF protection).

Identity verification via phone/email OTP and AML screening using Didit API

Verify phone numbers using SMS one-time codes via the Didit API. Use when you need to confirm a user owns a phone number...

Passive OSINT reconnaissance on domains, IPs, organizations

Open-source intelligence: full profiling protocol, breach and leak exposure, image authenticity and reverse image search...

反拦截情报搜集 — 五层防拦截采集体系（出口轮换/指纹伪装/行为节流/多源降级/OPSEC 被动优先）。使用当爬取或情报采集被 WAF/反爬/平台风控/GFW 拦截时，或需要隐蔽被动侦察。含 curl_cffi 伪装、Tor/代理轮换、指数...

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5...

Red team operations skill — reconnaissance methodology, attack surface mapping, social engineering vectors, phishing sim...

Threat intelligence skill — Shodan lookups, VirusTotal reports, SpiderFoot scans, IP/domain/hash threat assessment, brea...

Scaffold, polish, and publish open-source projects with AI-first documentation, governance, and CI. Use when: Starting a...

Operational Technology and industrial control system security — Purdue model segmentation, industrial protocol analysis...

Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol disc...

审查 ICS、SCADA、PLC 的配置、协议和资产边界

Authorized OT/ICS security assessment: Purdue-model zoning review, PLC/SCADA exposure, industrial protocol discovery, an...

Receive and verify Oura webhooks. Use when setting up Oura Ring webhook handlers, completing the subscription verificati...

Approval-gated overhaul of a project, PR, or branch: concurrent frontend and backend review, one approved repair plan, t...

Override Mechanisms allow humans to correct or reverse AI decisions, providing a critical safety net for automated syste...

Implementing human override capabilities for AI decisions with proper tracking, auditing, and feedback loops.

Audit what your public online presence quietly reveals — and tighten it — before a stranger, employer, or scammer uses i...

OWASP security guidelines and Top 10 vulnerabilities USE WHEN: user mentions "OWASP", "security audit", "vulnerability...

OWASP Top 10 security practices and secure coding patterns.

Web application security scanner with proxy and active/passive scanning

Requirements and caveats from upstream:

Check for OWASP Top 10 vulnerabilities — injection, broken auth, XSS, insecure deserialization, and misconfiguration.

Professional OWASP Guard Expert skill. Implement enterprise-grade web application security controls and encryption stand...

This skill should be used when the user mentions "prompt injection", "jailbreak", "owasp llm", "llm security", "guardrai...

OWASP Top 10 quick reference: the ten most critical web application security risks (access control, crypto, injection, i...

On-demand OWASP Top 10:2025 security scanner. Scans a single file, captures cross-file connections for follow-up, and ma...

Security testing skill based on OWASP Top 10, covering ZAP scanning, security headers, input validation, authentication,...

OWASP Top 10 — injection, broken auth, XSS, misconfig checklist.

A deep prevention reference for the OWASP Top 10 web risks — broken access control, injection, crypto failures, insecure...

Run OWASP ZAP dynamic application security testing

Deep integration with OWASP ZAP for automated security scanning, vulnerability detection, and API security testing. Exec...