Analistas de seguridad de la información

Audit Workflow

Use when: code audit, technical audit, security audit, performance audit, scalability audit, database audit, audit markdown, GitHub audit issues, findings reconciliation, labels sync, close resolved audit issues, create new audit issues.

FlorianDrevet0

Clawsec Suite

ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills.

flosrn0

Calidad de Código

Security Best Practices

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

FlorinSenoner0

Patrones de Arquitectura

Convex Security Audit

Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations

FlorinSenoner0

Finanzas e Inversión

Threat Model

Threat modeling methodology and risk assessment process. Use when designing new features, reviewing architecture for security, performing STRIDE analysis, creating attack trees, or assessing risk with CVSS/DREAD. Also use when authentication/authorization is added, data flows cross trust boundaries, third-party integrations are introduced, sensitive data handling changes, or analyzing security incidents. Essential for data flow diagrams and security design reviews.

Cloud

Aws

AWS infrastructure security review process. Use when reviewing IAM policies and roles, auditing S3 bucket configurations, securing Lambda functions, reviewing CloudFormation/CDK/Terraform, or configuring VPC and security groups. Also use when IAM policies use wildcards, S3 buckets might be public, Lambda has broad permissions, security groups allow 0.0.0.0/0, or secrets appear in environment variables. Essential for KMS encryption, Secrets Manager, least privilege, and AWS security scanning with Prowler or Checkov.

Cloud

Azure

Azure infrastructure security review process. Use when reviewing RBAC and managed identities, auditing Storage account configurations, securing Azure Functions and App Service, reviewing Bicep/ARM templates or Terraform, or configuring VNet and NSGs. Also use when service principals use secrets, Storage allows public blob access, Azure SQL uses SQL auth instead of Azure AD, or NSG rules allow 0.0.0.0/0. Essential for Key Vault integration, Microsoft Defender, private endpoints, and Azure security scanning.

Security

Security review process and vulnerability prevention. Use when reviewing code for security issues, implementing authentication or authorization, handling user input or secrets, adding API endpoints, or approving code that touches security boundaries. Also use for OWASP Top 10 analysis, secret scanning, dependency auditing, or when code handles forms, file uploads, sessions, tokens, database queries, or shell commands. Essential when someone says 'it's just a small change.'

OWASP Top 10: Mitigation Patterns

Web application security for Next.js and Supabase stacks. Master OWASP Top 10 vulnerabilities including injection attacks, broken authentication, XSS, CSRF, and sensitive data exposure. Implement production-grade security headers, Content Security Policy, Row-Level Security, input validation, and secrets management. Harden authentication with JWT best practices, MFA, PKCE flow, and session management. Prevent SQL injection, XXE attacks, and insecure deserialization. API security, rate limiting, webhook verification, and security audit checklists included. CSP headers, HSTS, sanitization patterns, and NEXT_PUBLIC_ environment variable rules. Built-in Server Actions CSRF protection, DOMPurify integration, parameterized queries, and OAuth state parameter validation. Complete vulnerability remediation patterns for the modern web stack.

CutTheChexx0

Documentos

Nessus Export Skill

Export Nessus vulnerability scan results to Excel (.xlsx) and native .nessus format. Uses Selenium + Chrome to access the Nessus web portal at https://127.0.0.1:8834, logs in via the browser UI, exports the scan using the built-in Export button, scrapes the vulnerability table to match the exact count shown in the UI, and produces colour-coded Excel + .nessus files. USE FOR: export nessus vulnerabilities, nessus scan to excel, nessus report export, download nessus results, vulnerability export, nessus to xlsx, nessus scan report, get nessus vulnerabilities.

c-wann0

Security Best Practices

Implement security best practices for web applications and infrastructure. Use when securing APIs, preventing common vulnerabilities, or implementing security policies. Handles HTTPS, CORS, XSS, SQL Injection, CSRF, rate limiting, and OWASP Top 10.

Cwuzto0

Grader Oh Poc

Grade PoC (Proof-of-Concept) exploit generation quality from session logs. Two-dimensional scoring: feasibility assessment + quality evaluation. Infeasible tasks scored 0-60 based on analysis depth; feasible tasks scored 0-100 based on PoC success and iteration count. Output format: CAO_SCORE=<integer 0-100>

cxm950

Security Grader

Grade security scan output against a task's objectives. Triggered automatically by the CAO plugin after task completion. Use when you need to evaluate the quality, completeness, and accuracy of a security assessment, vulnerability scan, or code audit. Also triggers on "grade this", "evaluate output", "score this scan", "CAO_SCORE".

cxm950

LLM & AI

Security Awareness

Security awareness training for AI agents. Teaches recognition and defense against malicious skills, prompt injection attacks, and social engineering. Use when installing new skills, processing untrusted content, or when instructions feel suspicious.

Cyan-Society0

Kali

Comprehensive pentesting toolkit using Kali Linux Docker container. Provides direct access to 200+ security tools without MCP overhead. Use when conducting security assessments, penetration testing, vulnerability scanning, or security research. Works via direct docker exec commands for maximum efficiency.

Cyb3rDudu0

Wallet Verification

Use this skill when you need blockchain forensics for wallet addresses. User cases: investigating wallet funding sources, screening sanctions compliance, detecting money laundering patterns, identifying bot automation, assessing wallet trustworthiness, evaluating counterparty risk, or gate-checking wallets in automated systems.

Contratos Inteligentes

Solidity Code Verification

Use this skill when you need security analysis of Solidity smart contract code. User cases: auditing Solidity contracts, identifying re-entrancy bugs, detecting access control issues, reviewing unsafe external calls, evaluating code before deployment, gate-checking contracts in transaction pipelines, or performing security assessments.

cybercentry-cybercentry-agent-skills-skills-cyber-security-consultant-skill-md

Use this skill when you need security expertise: threat intelligence, vulnerability assessment, compliance guidance, incident response advice, or architecture reviews. Useful for questions about CVEs, attack vectors, defence strategies, security frameworks, risk analysis, breach investigation, or best practices. Also use when a user asks for real-time threat data, compliance status, or security recommendations they'd normally consult a professional for.

Contratos Inteligentes

Ethereum Token Verification

Use this skill when you need to verify Ethereum or EVM token contracts for security. User cases: checking token legitimacy, scanning for rug pulls, detecting hidden taxes, assessing liquidity risks, analysing holder distribution, evaluating tokens before purchase or investment, or gate-checking tokens in automated pipelines. Works with 44+ blockchain explorers across all major EVM networks.

Private Data Verification

Use this skill when you need Zero-Knowledge Proofs or data integrity validation. User cases: verifying identity claims without exposure, proving login status, creating trustless proof of action, validating sensitive data authenticity, privacy-preserving verification in Web3, or generating cryptographic proof receipts.

Quantum Cryptography Verification

Use this skill when you need secure encryption with quantum-resistant algorithms. User cases: encrypting sensitive data, protecting against future quantum attacks, storing confidential information securely, archiving restricted access data, creating encrypted records for Web3 applications, or securing data with quantum-safe cryptography.

Web Application Verification

Use this skill when you need security scanning for websites or dApps. User cases: finding XSS vulnerabilities, identifying insecure APIs, assessing frontend security, evaluating web application vulnerabilities, securing dApp frontends, or performing OWASP compliance checks on web interfaces.

Openclaw Ai Agent Verification

Use this skill when you need to audit OpenClaw AI agent configurations for security risks. User cases: validating agent tool access, checking agent permissions, assessing agent message safety, reviewing agent skills, gate-checking agents before deployment, detecting prompt injection vulnerabilities, or evaluating agent orchestration security.

Red Team Auditor

Advanced security skill that constructs Program Dependency Graphs (PDG) and scans for tainted data flow.

Cyberdad2470

Gestión de Proyectos

Infra Security

Infra Security — project lifecycle skill

cyberpunk0420

Fleet Security Contribution

How DevSecOps produces security_requirement contributions — specific actionable controls, not generic advice. Threat assessment, auth, input validation, deps, secrets.

cyberpunk0420