Навыки: Безопасность

Source Code Security Audit

实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/S...

Practical SRC / crowdsource testing / bug bounty vulnerability hunting workflow skill. Includes: 5-phase methodology (in...

Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tu...

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH...

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH...

Teaches TLS/SSL: certificates, handshakes, ACME, mTLS, cipher hygiene, and debugging certificate errors. Use when config...

Inspect a domain's TLS certificate — expiry, issuer, SANs

Let's Encrypt, certbot, auto-renewal, wildcard DNS challenge, SSL troubleshooting with Cloudflare proxy

TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certi...

Manage SSL/TLS certificates with Let's Encrypt and internal PKI. Configure secure HTTPS, certificate renewal, and cipher...

SSL/TLS configuration testing including certificate validation, cipher suite analysis, protocol version checks, and HSTS...

Single Sign-On (SSO) enables users to authenticate once and access multiple applications. This skill covers implementing...

Use this skill when a system security plan has to be written, rebuilt or brought up to date before an assessment, and so...

Hunt Server-Side Request Forgery (SSRF) — internal network access, cloud metadata exploitation, gopher/file/dict protoco...

Use when testing a web application for Server-Side Request Forgery on an authorized engagement. Covers finding server-fe...

Detects HTTP requests to user-controlled URLs that can reach internal services or cloud metadata endpoints. Use when wri...

Provide a quick reference for stack-minimality skills and scope without changing repository behavior.

Execute DeFi operations on Starknet including token swaps via avnu aggregator, DCA recurring buys, STRK staking, and len...

Register AI agents on-chain using the ERC-8004 Trustless Agents standard. Manage agent identity as NFTs, build reputatio...

Reference for building Starknet applications using starknet.js v9.x SDK, including contract interaction, account managem...

Use when the user wants to audit Starknet contracts for security vulnerabilities, scan Cairo contracts for Starknet-spec...

Create and manage Starknet wallets for AI agents. Transfer tokens, check balances, manage session keys, deploy accounts,...

Use only when the user explicitly asks for a Mermaid statechart, a user-visible chart of a TLA+ model or counterexample,...

Binary reverse engineering - PE/ELF analysis, Ghidra, capability detection

Integrate automated static analysis tools (Slither, Mythril, Aderyn, Semgrep) into the audit workflow to catch known vul...

Integration with security-focused static analysis tools

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning p...

Show all active projects across all Metapowers domains

Blockchain-native AI agent — manages USDC wallet on Base, executes DeFi trades, pays for APIs, and earns revenue by sell...

Assist with Stellar XLM transactions, anchors, memo requirements, and cross-border payments.

Architect bare-metal and HAL-driven STM32 firmware with direct register manipulation, DMA, and NVIC controllers.

Research public companies and listed securities with current market, company, ownership, and filing data through SandBas...

Use when the user asks for an end-to-end orientation on a listed company they don't yet understand, especially when the...

S3 resiliency, security, and data protection review. Assesses one or many S3 buckets across nine dimensions — versioning...

Reuse and recover authorized Apple App Store Connect, Apple Developer, or Google Play Console logins in an existing visi...

Use this skill for STORM-style multi-perspective research, contradiction mapping, evidence-grounded synthesis, and self-...

Receive and verify Strava webhooks (Webhook Events API). Use when setting up Strava push subscriptions, implementing the...

Fetch current Stripe account balance (test mode)

Look up a Stripe customer by email or ID

Send a Stripe invoice to a customer

Initiate a Stripe payout to the connected bank account

Verify and process Stripe webhooks safely against the real-world failure modes. Covers signature verification against th...

Install, configure, and operate Strix for AI-driven application security testing. Use when you need to run authorized vu...

Design bounded sequential lenses of codenavi-agent with a single deliverable, explicit evidence packet, minimal tools an...

The implementation engine. Routed to by /sprint (full plan, autonomous) and by executing-plans (scoped batch, checkpoint...

Template for structured sub-agent output including YAML log format, task completion reports (WHY/WHAT/TRADE-OFFS/RISKS),...

Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weig...