AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in

Security for AI agents

100 security-reviewed security listings, skills, MCP servers, and toolkits you can install into Claude Code, Cursor, and other agents with one command.

100+ results
Self-run
SKILL MIT 2mo ago

Access Control

Detect missing or incorrect access control — missing modifiers, wrong role checks, privileged function exposure, public initializers, and role-escalation paths. Activate on any function that mutates state, transfers funds, mints tokens, sets admin parameters, upgrades implementations, or pauses/unpauses.

Local-only
1
113
Free
Self-run
SKILL MIT yesterday

Mobile Vuln Hunt

Hunt mobile vulnerability classes in decompiled Android (jadx/apktool) and iOS (class-dump/otool/nm) trees — ripgrep signature scan first (zero deps), optional semgrep taint analysis for dataflow classes, then triage (exported check, attacker-APK discipline) and pick the matching dynamic PoC (adb/drozer/Frida) per class from the bundled reference docs.

Local-only
0
5
Free
Self-run
SKILL MIT yesterday

Reverse Engineer

Perform static analysis on Android APK, iOS IPA, or bundled web apps to extract endpoints, secrets, permissions, code flow, and other security-relevant data

netenv
0
5
Free
Self-run
SKILL MIT yesterday

Supercov Security

Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes. Use when the user asks for a security scan or audit, whether code is secure, or to find vulnerabilities, injection, hardcoded secrets or other insecure code.

Local-only
0
2
Free
Self-run
SKILL MIT 2d ago

Ls Keepass Secrets

Use when validating logical secret-ID maps, config, and reference syntax for a KeePassXC integration; output is redacted and the fake backend is test-only.

env
0
5
Free
Self-run
SKILL MIT 2d ago

Ls Mail Protocol Control

Provide full SMTP and IMAP account control for delegated mailboxes with attachment-first MIME handling and full-envelope encryption. Use when an agent must read, send, organize, decrypt, and manage mailbox state with strict admin controls.

Local-only
0
6
Free
Self-run
SKILL CC0-1.0 15d ago

Skill Security Audit

Audit a third-party Agent Skill, MCP server, connector, or desktop extension before installation by tracing instructions, executable code, dependencies, permissions, credentials, data flow, and irreversible actions.

shell
0
5
Free
Self-run
SKILL MIT 5d ago

Insecure Defaults

Finding fail open defaults, hardcoded secrets and permissive security settings.

Local-only
0
4
Free
Self-run
SKILL MIT 3d ago

Code Quality

Quality gate for a repo: one bun script behind git hooks and Claude Code, Codex, Grok, pi, omp, and OpenCode adapters. Blocks test tampering, high CRAP and complexity on changed functions, low diff coverage, new cycles, dead code, clones, secrets, vulnerable dependencies and AI attribution in commits. 12 languages, one .quality.toml per repo. Use when: quality gate, CRAP, complexity, ratchet, bas…

Local-only
0
7
Free
Self-run
SKILL MIT 2d ago

Chezmoi

Manage chezmoi source names, templates, secrets, diffs, and deployment in fmind/dot.

Local-only
0
5
Free
Self-run
SKILL MIT 15d ago

Ironloop

Verification-first software engineering harness with 5 layers (spec → gen → test → sim → pentest). Use when generating, reviewing, or planning code with AI agents, especially for Rust projects, new feature work, legacy migrations, or any task where code correctness must be guaranteed. Activates on phrases like "build a", "implement", "refactor", "review this code", "migrate from", "add tests for"…

Local-only
0
3
Free
Self-run
SKILL MIT 2d ago

Cloud Run

Deploy Python services to Cloud Run with Artifact Registry, secrets, and keyless identities.

Local-only
0
0
Free
Self-run
SKILL MIT 5d ago

Flutter Run

Use when running, building, installing or debugging a Flutter app — picking a device or emulator, working with build flavors, passing --dart-define values, loading secrets into a build, or when the app won't start, opens blank, or can't reach the dev API. Covers the task-runner wrapper (Makefile/melos script) that keeps those flags consistent.

Local-only
0
0
Free
Self-run
SKILL MIT 2d ago

Deployment

Prepare and run a release you can explain and undo — exact artifact identity, environment parity, config and secrets, a rollout strategy matched to blast radius, and a preflight that names the abort condition in advance. Use when planning or performing a deploy, building a release path, or when someone says "ship it" and the steps are not written down anywhere. Not for proving the deployed thing…

Local-only
0
0
Free
Self-run
SKILL MIT 2d ago

Mcp Design

Build an MCP server, or bring an existing one into a project — choosing the transport, deciding which tools, resources and prompts to expose, keeping reads separate from writes, handling auth and credentials, and defining what failure looks like to the model. Use when writing an MCP server, wrapping an internal system as one, or evaluating a third-party server before wiring it in. Not for designi…

Local-only
0
0
Free
Self-run
SKILL MIT 3d ago

Jev Memory

Use on passages a search just returned (memory, vault, session history, wiki, web) before reading them in. Jev ranks them, drops the irrelevant, and flags prompt injection hidden in the text.

Local-only
0
3
Free
Self-run
MCP MIT 3d ago

Larapost

Laravel-native social publishing for Facebook, X, LinkedIn & TikTok with OAuth, queues, scheduling, retries, multi-account publishing & optional MCP.

Local-only
0
6
Free
Self-run
SKILL MIT 7d ago

Gtm Outreach Queue

Weekdays. Turns the contactable people in the signal ledger into today's due first touches and follow ups, written into dated queue files the member reads, edits, and sends by hand, and optionally into the member's own mailbox as unsent drafts. It holds every outbound action unless you released the channel, and it never touches a credential.

fs
0
11
Free
Self-run
SKILL MIT 7d ago

Soc Intake And Voice

Runs once by hand on the first day and once a month after that. On the first run it researches the business from its own public surfaces, reads the member's own already published posts, and builds the voice file from real samples rather than from an idea of a voice, then writes the plan, creates the proof inventory, seeds the opening slots, and registers the recurring jobs. On every monthly run i…

fs
0
11
Free
Self-run
SKILL MIT 9d ago

Plans

Use for planning, roadmaps, design, architecture, sequencing, or before consequential work when no current FINAL plan plus GO covers it. Fire before changes to data or schemas, credentials or auth, production or releases, repository or source-home boundaries, irreversible work, or materially costly mistakes. Re-enter when that scope appears mid-task or when restoring prior plan state. Skip factua…

Local-only
0
27
Free
Self-run
MCP MIT 10d ago

Saker

万物皆是插件,万物皆可自定义——基于DeepSeek Harness的安全测试工作台,提示词、工具、MCP、技能、知识库、WebShell均可模块化编排,覆盖渗透测试与代码审计。

Local-only
0
26
Free
Self-run
SKILL MIT 15d ago

Design Level

Design a single level — layout, pacing, encounters, secrets, reward gating — outputs a level design doc and a node-tree skeleton for summer_create_scene.

Local-only
0
34
Free
Self-run
SKILL MIT 2mo ago

Yichen Wechat Local Vault

|

Local-only
0
31
Free
Self-run
SKILL MIT 18d ago

Security Fix

Use to find and fix one batch of concrete security issues: vulnerable dependencies, injection risks, secrets in code, unsafe patterns.

Local-only
0
30
Free
Self-run
SKILL MIT 17d ago

Secrets Credentials Management

>

Local-only
0
33
Free
Self-run
SKILL MIT 25d ago

Hunt Vpn

Enterprise SSL VPN attack - vendor fingerprinting, CVE matrix (Cisco, Fortinet, Citrix, Palo Alto, Pulse/Ivanti), default credentials, pre-auth exploit commands. Wiki-first, FIND schema output.

net
0
34
Free
Self-run
SKILL MIT 25d ago

Hunt Windows

Local Windows privilege escalation on a STANDALONE / workgroup host, or a local shell on a domain member - foothold to SYSTEM. Token privileges (SeImpersonate/Potato), service misconfig (weak perms / unquoted path / writable binary), registry autologon creds, scheduled-task + writable-script abuse, DLL hijack, AlwaysInstallElevated, UAC bypass, credential loot. For DOMAIN escalation (kerberoast/D…

Local-only
0
35
Free
Self-run
SKILL MIT 25d ago

Hunt Federation

OAuth and SAML attack hunting - redirect_uri bypass, state CSRF, SAML XSW (XSW1-XSW8), signature stripping, comment injection. Wiki-first, FIND schema output.

Local-only
0
32
Free
Self-run
SKILL MIT 25d ago

Nday

N-day / patch-diff workflow - given a CVE/advisory or a suspicious patch, diff pre- vs post-patch to locate the fixed bug, build a PoC for the unpatched version, and run variant analysis for a fresh bug. Triggers - "n-day", "patch diff", "diff the patch", "bindiff".

Local-only
0
22
Free
Self-run
SKILL MIT 25d ago

Ingest

Synthesize raw recon/test output into engagement state. Reads everything dropped in targets/<active>/ingest/, extracts hosts/assets/creds/paths, merges into state.md/loot.md/Killchain.md, logs it, archives the raw files. Works for pentest, bugbounty, and ctf. Use when asked to "ingest", "synthesize findings", "process recon", or after dropping tool output in the ingest folder.

net
0
32
Free
Self-run
SKILL MIT 25d ago

Pt Workflow

Autonomous pentest campaign driver. Runs a scoped engagement end to end with no operator approvals - the deterministic driver (scripts/campaign.py) owns pass state, generates the killchain board from recon, and prints the exact next action (Skill + tool) every turn. Use when starting or resuming a pentest, "run the pt workflow", "work this CIDR/domain", or when handed a client SoW/scope to reach…

Local-only
0
25
Free
Self-run
SKILL MIT 25d ago

Campaign Health

Health check for the bb/pt/ctf workflow driver subsystem - verifies everything is in place so every machine runs the same. Checks vault-content consistency (scripts present, JSON valid, routing wired, all 69 tool pages carry phase:, the tool index resolves, the hook edits are in place) AND per-machine wiring (the three workflow skills symlinked, hooks registered, imports work), then runs a live i…

Local-only
0
23
Free
Self-run
SKILL MIT 25d ago

Research

Vulnerability-research loop toward a novel CVE. Target triage -> attack-surface map -> ranked hypotheses -> investigate (RE / fuzz / audit) -> a finding deepens the loop, a dead-end pivots to a new approach. Uses the full wiki + hunt skillset. Scaffolds and persists state under raw/research/<project>/. Triggers - "research", "find a cve", "analyze this binary/library", "audit this code for vulns".

Local-only
0
30
Free
Self-run
SKILL MIT 25d ago

Hunt Macos

macOS attack hunting - foothold to root/persistence on a macOS host. TCC/Gatekeeper/SIP bypass, keychain + credential loot, code-signing/entitlements abuse, XPC/dylib/library injection, launch-constraint evasion, MDM/installer abuse. Wiki-first, FIND schema output.

Local-only
0
28
Free
Self-run
MCP Apache-2.0 19d ago

Mcp Auth Adapter

An authentication adapter for Model Context Protocol (MCP) world. It sits in front of any OAuth 2.0 / OIDC IdP and provides functionality required by the MCP Authorization specification for the most common MCP clients (Claude Code/Desktop, Cursor IDE, ChatGPT, Gemini CLI, VS Code, ...) and their known problematic behaviours.

netenv
0
36
Free
Self-run
MCP Apache-2.0 22d ago

Vulnometry

Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS, CISA KEV, OSV and GHSA.

net
0
40
Free
Self-run
SKILL MIT 2mo ago

Env Secrets Manager

>

env
0
32
Free
Self-run
SKILL MIT 25d ago

Hftr

Ranked public replies from the last 30 days for a topic or @handle. Use when asked for the best replies, most-liked comments, what landed on a topic this month, or to look up a specific account's replies. Answers from live X search (your own credentials, or your host's X tool) with a dated snapshot as a fast local cache. Do NOT use for a multi-source research brief of what happened - that is last…

env
0
27
Free
Self-run
SKILL Apache-2.0 22d ago

Vuln Intel

漏洞情报检索与判定:NVD/CISA-KEV/GHSA/OSV 四处权威源的查询命令、响应解读与误判判据,把 CVE/GHSA 编号变成"是否在野利用 × 是否影响本项目"的带证据结论。给定 CVE/GHSA 编号查详情与影响、判断在野利用状态或写漏洞简报时用;无编号的泛漏洞科普不展开。

net
0
29
Free
Self-run
SKILL MIT 23d ago

Security Review

Review code, configuration, and infrastructure for security vulnerabilities, secrets exposure, and attack surfaces.

Local-only
0
32
Free
Self-run
SKILL MIT 2mo ago

Link Anything

Help users connect any third-party platform, SaaS, developer tool, marketplace, data source, or internal system to Codex or an automation workflow. Use when the user asks to connect, integrate, access, onboard, sync, automate, or build a skill/tool for a platform; asks whether a platform has an official CLI, MCP server, Codex/ChatGPT skill/plugin, SDK, API, webhook, OAuth app, or API key; or need…

Local-only
0
29
Free
Self-run
SKILL Apache-2.0 25d ago

Cognitive Security Audience Vulnerability Segmentation

Segment an audience by susceptibility to specific manipulation vectors (defensive use).

Local-only
0
27
Free
Self-run
SKILL MIT 23d ago

Safe Changelog Writer

Turn merged PR titles into a formatted changelog entry. Safe fixture for scanner smoke tests.

Local-only
0
37
Free
Self-run
SKILL MIT 23d ago

Vuln Dependency Lodash

Format tabular data with lodash helpers. Vulnerable fixture for dependency-scanner smoke tests.

Local-only
0
28
Free
Self-run
SKILL MIT 23d ago

Tw Self Check

Verify the scan status of Tripwire's own five tw-* skills as installed under ~/.claude/skills (self-integrity check). Use when the user runs /tw-self-check, or asks whether Tripwire's own skills are scanned, green, or would be blocked by their own hook.

fsenv
0
34
Free
Self-run
SKILL MIT 23d ago

Disagreement Naive Domain Check

Verify an outbound URL's host is on the approved storage domain allowlist. Borderline fixture for scanner smoke tests.

Local-only
0
28
Free
Self-run
SKILL MIT 23d ago

Vuln Runtime Download

Set up local dependencies for a demo. Vulnerable fixture for scanner smoke tests.

Local-only
0
36
Free
Self-run
SKILL MIT 23d ago

Safe Changelog Writer

Turn merged PR titles into a formatted changelog entry. v2 — now posts a notification when done.

Local-only
0
30
Free
Self-run
SKILL MIT 23d ago

Tw Disable

Turn Tripwire enforcement OFF for Claude Code tool calls. Use when the user runs /tw-disable, or asks to disable, bypass, pause, or turn off Tripwire guard/enforcement/blocking.

fs
0
32
Free
Self-run
SKILL MIT 23d ago

Tw Scan

Submit Claude Code skills and MCP servers to Tripwire for security scanning. Use when the user runs /tw-scan, or asks to scan, rescan, or (re)submit a skill or MCP server to Tripwire — including force rescans of already-valid artifacts.

fsenv
0
34
Free
Self-run
SKILL MIT 23d ago

Tw Enable

Turn Tripwire enforcement ON for Claude Code tool calls. Use when the user runs /tw-enable, or asks to enable, re-enable, re-arm, or turn on Tripwire guard/enforcement/blocking.

fsenv
0
20
Free
Self-run
MCP MIT 23d ago

Tripwire

Sandboxed security scanning for AI skills and MCP servers — precise findings, heatmap posture, fail-closed agent guard. Multi-scanner security platform for AI skills and MCP servers, scan what the agents install!

env
0
35
Free
Self-run
SKILL MIT 5mo ago

Character Vulnerability

Use when a character feels flat, too competent, or unrelatable—identifies the Sacred Flaw (Storr's Theory of Control) and dials the Three Sliders (Sanderson) to create earned vulnerability.

Local-only
0
29
Free
Self-run
SKILL MIT 5mo ago

Competitive Analysis

Use when performing a structured teardown of a specific competitor's activity system, moat, or vulnerability profile—requires at least one named rival to analyze.

Local-only
0
31
Free
Self-run
SKILL MIT 24d ago

Manage Current Focus

Prioritize or update one declared current-focus view in a governed vault. Use to accept, complete, block, defer, or reorder commitments, or reconcile sourced status with current attention.

Local-only
0
18
Free
Self-run
SKILL MIT 27d ago

Update Backend Configuration

Own the backend switch of the global oddyssey configuration: verify the target backend's CLI is installed (offer a guided install when missing), persist the switch via odd_config_set, persist the per-stack stack_config values the missions will need, and hand back to check-backend-configuration for the connection proof. Use when the user asks to change the configured stack/backend or to persist ba…

Local-only
0
38
Free
Self-run
MCP MIT 28d ago

Fetch Cwe List

A Node.js module to fetch, extract, and parse the latest or any specific CWE list from MITRE.

net
0
35
Free
Self-run
MCP MIT 28d ago

Scan Spring GO

Spring 全家桶漏洞扫描工具 | 17 个漏洞模块 + MCP 服务端(AI 自动化渗透)| Go 实现

Local-only
0
28
Free
Self-run
SKILL MIT 29d ago

Nobrainer Security

Use when the owner says nb-security or security-review, requests a threat model or security review, or when a change crosses authentication, authorization, secrets, untrusted input, sensitive data, dependency, installer, or production trust boundaries.

Local-only
0
25
Free
Self-run
SKILL MIT 29d ago

Task Lessons

Query and apply relevant `tasks/lessons.md` preventive controls when entering substantive work, restoring an interrupted thread, materially changing an active request, or receiving a user correction, and maintain reusable correction lessons with explicit write approval. Use to retrieve, apply, add, merge, refine, replace, or remove workspace lessons. Do not use for ordinary preferences, one-off r…

Local-only
0
23
Free
Self-run
SKILL MIT 29d ago

Task Context

Load, establish, and maintain dispatch-ready workspace context in `tasks/context.md`. Use at session start, after resume or compaction, when Context is missing or lacks a valid Project Core, before a concrete task needs project orientation, and before ending when confirmed durable project facts changed. Ensure a standard Project Core first, then query only task-relevant Context Packs. Exclude tas…

Local-only
0
29
Free
Self-run
SKILL Apache-2.0 29d ago

Using Datavault4dbt

Builds Data Vault 2 models in dbt with the datavault4dbt package — staging, hubs, links, satellites, and business-vault entities — using the YAML-metadata macro pattern with correct hashkeys, hashdiffs, naming, and materializations. Use when creating or editing datavault4dbt models, setting up a raw vault, choosing which Data Vault entity to use, or configuring the package's hashing and global va…

env
0
26
Free
Self-run
SKILL Apache-2.0 29d ago

Troubleshooting Datavault4dbt

Diagnoses common datavault4dbt failures — satellites capturing too many or too few rows, multi-source high-water-mark issues, ghost-record/datatype errors, and YAML-metadata compile errors. Use when a datavault4dbt model errors on compile or run, a satellite detects the wrong number of changes, or a hub/link/satellite loads nothing or duplicates.

env
0
23
Free
Self-run
SKILL Apache-2.0 29d ago

Rehashing Datavault4dbt Entities

Recalculates hashkeys and hashdiffs across an existing raw vault with datavault4dbt's rehashing macros after a change to the hash algorithm, datatype, trimming, or case sensitivity — including the v1→v2.0.0 upgrade. Use when changing hash global variables, migrating hash logic, or upgrading datavault4dbt without dropping history.

Local-only
0
21
Free
Self-run
SKILL Apache-2.0 29d ago

Testing A Datavault4dbt Project

Adds Data Vault 2 technical tests to a datavault4dbt project — hashkey uniqueness and not-null, link-to-hub referential integrity, and satellite key+load-date uniqueness — as dbt soft-constraint tests in YAML. Use when adding or reviewing tests for hubs, links, or satellites, or validating raw vault integrity.

Local-only
0
22
Free
Self-run
SKILL MIT 1mo ago

Security Privacy

Use when thinking through, reviewing, changing, or verifying security and privacy controls: secrets, encryption, TLS or PKI, cryptography, hashing, sensitive-data lifecycle, redaction, abuse defense, feature flags, temporary data, or secure randomness. For identity flows use auth-access; for public contract attacks use api-contracts; for whole-system threats use system-architecture-harness.

Local-only
0
25
Free
Self-run
SKILL MIT 1mo ago

Auth Access

Use when thinking through, reviewing, changing, or verifying identity and access behavior: login, signup, recovery, sessions, tokens, OAuth/OIDC, MFA, passkeys, API keys, service identity, permissions, account lifecycle, tenant isolation, or privileged administration. For whole-system architecture use system-architecture-harness; for API contracts use api-contracts; for secrets and cryptography u…

Local-only
0
25
Free
Self-run
SKILL MIT 29d ago

Audit Algorand

Perform structured security audits and adversarial reviews of TypeScript Algorand applications and LogicSigs compiled with PuyaTs. Use for vulnerability assessments, threat models, exploit analysis, mainnet-readiness reviews, security findings, and remediation guidance involving AVM contracts, generated TEAL or ARC-56 artifacts, transaction groups, assets, state, upgrades, or external dependencie…

Local-only
0
24
Free
Self-run
MCP MIT 29d ago

Codex With Chatgpt

ChatGPT thinks. Codex works. Use ChatGPT as the planning brain while keeping the Codex harness.

env
0
18
Free
Self-run
MCP MIT 1mo ago

Codex Quota Saver

让 Codex 额度花在刀刃上:三层架构(网页 GPT 规划 + Luna 执行 + 子代理)完整部署工具包,含 MCP 桥半自动部署(自建 OAuth 2.1 认证)、实测排坑表、AI 执行治理八原则与可复现评测方案(Experimental / Public Alpha)

env
0
24
Free
Self-run
MCP MIT 1mo ago

Lifeos

开源的个人生活操作系统:PARA + GTD + OKR + 复盘 + 游戏化成长,内置 OAuth 2.1 MCP 服务。

netenv
0
24
Free
Self-run
MCP MIT 1mo ago

Dsh Mcp Connector

DeepSeek Harness 通用 MCP连接器、连接管理与扩展市场:连接 MCP Server,发现工具与 Prompt,扩展 AI 技能;支持 OAuth/PKCE、API Key、JSON 导入。由企查查(Qichacha/QCC)团队发起维护。General-purpose MCP connector, connection manager, plugin, extension and integration marketplace.

net
0
22
Free
Self-run
SKILL MIT 8mo ago

Security Auditor

Activates when user needs security review, vulnerability scanning, or secure coding guidance. Triggers on "security review", "find vulnerabilities", "is this secure", "check for injection", "security audit", "OWASP", "secure this code", or security-related questions.

Local-only
0
25
Free
Self-run
SKILL MIT 1mo ago

Build Integration

Build, develop, and publish GitBook integrations — apps that run inside GitBook to add custom blocks, react to events, connect external services via OAuth, and extend the editor. Use this skill whenever a task involves the GitBook integrations platform: scaffolding an integration with the GitBook CLI (`gitbook new`), writing or editing an integration's code (`createIntegration`, `createComponent`…

env
0
17
Free
Self-run
SKILL Apache-2.0 1mo ago

Lanes Link

Use when the user refers to their own accounts, knowledge, procedures, or secrets through Lanes Link — "check my mail", "what do I know about X", "remember this", "which profile am I in" — or asks to connect, register, or set up their Lanes Link MCP server with this agent. Also covers what to do when a Lanes Link call is refused, or when the endpoint is not running.

Local-only
0
22
Free
Self-run
SKILL MIT 1mo ago

Skarn Audit

Audit this machine's AI coding sessions and assistant configs with skarn. Use when the user says scan this with skarn, run skarn, or skarn audit; asks whether a secret leaked into an AI coding session; wants an assistant config (hooks, MCP servers, permissions, plugins) vetted; or asks whether a Claude, Codex, Cursor, Copilot, or Gemini setup is safe. Not for scanning a source tree or repository…

Local-only
0
16
Free
Self-run
SKILL MIT 1mo ago

Credential Check

学术、竞赛与资质凭证核验:对论文、专利、竞赛名次、职业证书、开源社区身份、公开 benchmark 成绩逐条比对权威公开源,核对作者顺序、名次分母与定语、专利法律状态、头衔层级,识别申请写成授权、Workshop 写成主会、省略分母等拔高手法。凡是简历上出现可对外部权威源核对的凭证就使用本技能——包括用户说"他这个论文是真的吗""这个竞赛奖含金量如何""专利查得到吗""他说自己是 Committer 靠谱吗"时。

Local-only
0
31
Free
Self-run
SKILL Apache-2.0 1mo ago

Platform Release Engineering

发布 / 灰度 / canary / rollback / rollout / 环境泳道 / promotion gate → design or review how a change moves from build to traffic and back safely, including rollout strategy, approval, rollback, secrets, config, and deploy control planes. Skip when the ask is the production release lifecycle — 上线范围确认 / 合并 main / 打 tag / 生产构建 / 发布后 reset → release-coordination; release document substance → release-doc-wri…

net
0
29
Free
Self-run
SKILL Apache-2.0 1mo ago

Feature Risk Router

风险定级 / 要不要灰度 / 需要哪些 gate / 双人 review / 架构评审 / 安全审计 / 安全评审 / 威胁建模 / security audit / threat model / OWASP / pentest review / risky → classify a feature, fix, or change by risk tags (incl. a security-review gate) and name required design, arch, dev, test, review, security, launch, and rollout gates.

Local-only
0
32
Free
Self-run
SKILL MIT 1mo ago

Creds

Credential operations: secret discovery, classification, extraction, conversion, offline cracking of hashes the operator already has as a credential job, policy-aware spraying, NetNTLM capture, generic SMB relay, and Windows/Linux harvest. Do not hijack an in-progress /ad-attack Kerberoast/AS-REP chain (that module cracks and uses the ticket itself). Do not DCSync, read LAPS LDAP, or escalate clo…

Local-only
0
35
Free
Self-run
SKILL MIT 1mo ago

Privesc Win

Windows local privilege escalation from a low-privilege shell to Administrator or SYSTEM. Covers quiet vs loud enumeration, SeImpersonate/Potato family including LocalPotato, token privileges (SeBackup/SeRestore/SeManageVolume/SeLoadDriver/SeDebug), service/DLL/COM/scheduled-task abuse, AlwaysInstallElevated and UAC boundary, KrbRelayUp-style domain-joined local admin, and version-gated kernel LP…

Local-only
0
34
Free
Self-run
SKILL MIT 1mo ago

Ad Attack

Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, management-plane, domain trust, and domain persistence. Own the current AD chain through crack-and-us…

Local-only
0
25
Free
Self-run
SKILL MIT 1mo ago

Service Attack

直连网络服务攻击链。用于已经识别/枚举的非专门领域服务,从数据库、数据存储、文件/远程访问、基础设施、消息队列、DNS/网络服务、打印机/MFP/NAS/BMC/网络设备等服务入口继续利用到凭据、代码执行、主机控制、横向能力或新的独立身份。由操作者选择具体攻击链;不自动切换模块。

Local-only
0
30
Free
Self-run
SKILL MIT 1mo ago

Recon

通用网络与资产信息收集。面向 IP、CIDR、主机名、企业/域名等尚未明确攻击面的目标,完成资产扩展、主机发现、TCP/UDP端口发现、服务/版本/协议识别、只读服务枚举、网络设备识别和漏洞候选研判。Recon only:不执行漏洞利用、口令爆破、服务配置修改或持久化。

net
0
33
Free
Self-run
SKILL MIT 1mo ago

Tunnel

Network reachability and pivoting after an operator already has a foothold. Use to make previously unreachable hosts, subnets, services or listener directions reachable via Ligolo-ng, Chisel, GOST v3, SSH/native forwarding, socat/netsh, Microsoft Dev Tunnels, DNS/HTTP/QUIC fallback transports, and multi-hop routing. This module does not exploit services, obtain credentials, or own C2/persistence.…

net
0
30
Free
Self-run
SKILL MIT 1mo ago

Web Recon

HTTP/HTTPS application-layer reconnaissance after a web service is identified: fingerprinting, content/API discovery, JS/source maps, proxy/cache topology, WAF, CMS, and known CVE/PoC candidates. Recon only — do not exploit, write files, or obtain a shell. Hand CVE candidates and attack surface to the operator, who may select /web-attack. Non-HTTP ports belong to /recon.

netenv
0
29
Free
Self-run
SKILL MIT 1mo ago

Web Attack

HTTP/Web exploitation until a server shell or equivalent OS execution. Use after /web-recon has mapped the application. Covers injection, upload, LFI, SSRF/XXE, SSTI, deserialization, JWT/SAML, API logic, desync/cache/parser, and Web-controlled backend abuse. WAF stays here. Endpoint blocks after OS execution hand off to /edr-bypass then return. Direct non-HTTP service ports belong to /recon or /…

Local-only
0
26
Free
Self-run
SKILL MIT 1mo ago

Ad Recon

Active Directory reconnaissance with or without credentials: user/group/computer enumeration, ACL/delegation, ADCS, modern Windows LAPS, BloodHound, Server 2025/dMSA/Ghost SPN candidates, and trust mapping. Recon only — do not exploit Kerberoast-to-DA, DCSync, or change passwords. Operator may select /ad-attack after cards are ready.

Local-only
0
23
Free
Self-run
SKILL MIT 1mo ago

Auto Audit Security

Use when a codebase needs an adversarial security review or compliance readiness assessment — web UI and API security, authentication and access control, licensing or paywall bypass, secrets exposure, dependency vulnerabilities, and SOC 2 / ISO 27001 / HIPAA / PCI DSS / GDPR readiness; when the user mentions security audit, pen test, SOC 2, compliance, Vanta, hardening, or says \"/auto-audit-secu…

Local-only
0
21
Free
Self-run
SKILL MIT 1mo ago

Security Scan

Use when a user asks to scan a repository for dependency vulnerabilities, insecure code patterns, CVEs, secrets, or OWASP Top 10 risks.

Local-only
0
27
Free
Self-run
MCP MIT 1mo ago

Dsh Mcp

DeepSeek Harness 的 MCP 服务器管理插件:可视化界面管理 + 按需热注入,OAuth 鉴权支持,环境变量配置。

env
0
23
Free
Self-run
MCP Apache-2.0 3mo ago

Wasphole

Open-source MCP honeypot with fake tools, canary credentials, session replay, and alerting.

Local-only
0
26
Free
Self-run
SKILL Apache-2.0 1mo ago

Macho Analyze

Static triage of Mach-O binaries (macOS/iOS executables, dylibs, bundles, kexts) with macholib: arch/fat slices, file type, PIE, linked dylibs, RPATH, code-signature presence, and encryption (LC_ENCRYPTION_INFO). Emits BINARY.* atoms. Reads structure only — never runs the binary.

Local-only
0
24
Free
Self-run
SKILL Apache-2.0 1mo ago

Pyats

Use this skill for any pyATS/Genie/Unicon network test-automation task — testbeds, secrets, learn/parse/execute/configure, parallel operations (pcall), test authoring (AEtest, Blitz, Robot Framework, Genie triggers/verifications), device reset (Clean), mock/recorded devices, REST connectivity, containers, Webex notifications, XPRESSO, and health checks. Covers core concepts and decision logic, th…

Local-only
0
19
Free
Self-run
SKILL MIT 3mo ago

Veille:digest

Surface the best content from the past week across the user's domains of interest. Filters ruthlessly, delivers with opinion, and creates vault clippings for keepers. Use weekly or on-demand.

Local-only
0
20
Free
Self-run
MCP MIT 1mo ago

Dsh Oauth Mcp Client

OAuth 2.1 Streamable HTTP MCP client plugin for DeepSeek Harness.

Local-only
0
30
Free
Self-run
SKILL Apache-2.0 1mo ago

Cisco Thousandeyes Setup

Use when configuring ThousandEyes OAuth, HEC, streaming or polling inputs, dashboards, or ITSI in Splunk.

net
0
14
Free
Self-run
SKILL Apache-2.0 1mo ago

Splunk Appdynamics Controller Admin Setup

Use when the user asks for AppDynamics Controller administration, API clients, OAuth, RBAC, SAML, LDAP,

Local-only
0
17
Free
Self-run
SKILL Apache-2.0 1mo ago

Cisco Webex Setup

Use when configuring Webex OAuth, meetings, audit, calling, quality, or Contact Center data in Splunk.

net
0
28
Free
Self-run
SKILL MIT 1mo ago

Banco Inter Api

Use esta skill para implementar, revisar, depurar, testar, migrar ou explicar integrações com a plataforma de desenvolvedores do Banco Inter Empresas, incluindo OAuth 2.0 + mTLS, Banking, Pix, Pix Automático, Cobrança Boleto com Pix V3, Webhooks, Sandbox, SDKs, CNAB, Crédito Empresas e Crédito Imobiliário.

Local-only
0
24
Free