Use when working in any FaasJS repo and no narrower FaasJS skill is already selected, or when a task spans project conventions, validation gates, security boundaries, and multiple FaasJS subsystems. For focused work, also load the relevant FaasJS skill: faasjs-project-workflow, faasjs-react-ant-design…
Scan code for injection, hardcoded secrets, XSS, dynamic code execution, and unsafe shell use. Use after writing or modifying code that handles user input, builds queries or commands, touches authentication, or adds a dependency — and whenever the user asks for a security check, audit, or review. Runs locally with no…
Security vulnerability audit — check for OWASP top risks, hardcoded secrets, injection points, and dependency CVEs. Use when auditing code for security vulnerabilities, reviewing authentication/authorization logic, or checking for secrets leakage before merge.
Use ao avaliar sistemas de IA/ML para injeção de prompt, vulnerabilidades de jailbreak, risco de inversão de modelo, exposição a envenenamento de dados ou abuso de ferramentas por agents. Cobre mapeamento de técnicas MITRE ATLAS, detecção de assinaturas de injeção e pontuação de robustez adversarial.
Interactively validate and triage Hacktron findings against the actual source code and (optionally) a live deployment, separate true positives from false positives, adjust severity, then either propose fixes and commit them or set the finding's state in Hacktron (truepositive, falsepositive, acceptedrisk, resolved).…
Create, feed, modify, improve, and maintain Estorides source and tool YAMLs (HTTP APIs, systemapp Kali tools, LAN discovery tools). Use when adding a new OSINT origin, wiring a Kali binary, changing contact class, parser, appliesto, or category.
Systematically audit Solidity smart contract codebases for security vulnerabilities using a 4-phase approach - load a vulnerability cheatsheet, sweep code with grep and semantic analysis, deep-validate candidates against reference files, and output a severity-ranked findings.
Use on Windows for unexpected ALEGO sandbox access denials: workspace writes or listing fail, or an ordinarily readable path cannot be read. One bundled command inspects the path and every ancestor and repairs the ACL problems it proves in that same run. Expected confinement denials need no ACL repair.
A skill for using IDA and the WPeGPT plugin to analyse executable files in PE or ELF formats. It produces a structured report about the program, network indicators, suspicious functions, and possible vulnerabilities.
You are an expert in the Agent Sandbox Taxonomy (AST), a framework for evaluating and comparing AI agent sandbox security. This skill enables two capabilities.
Diagnose a denied Tenuo call and make the legitimate call work with the smallest change to authority. Use when a call, test, or agent step fails with a Tenuo denial, monotonicity, proof-of-possession, chain, expiry, approval, or unknown-argument error. Do not use to design new authority from scratch (use…
Audit framework mappings — an existing entity's mappings, the whole corpus, or a candidate value proposed for an entity not yet in the corpus — against the framework mappings style guide. Use when reviewing, auditing, or pre-PR authoring mapping changes for risks.yaml, controls.yaml, or personas.yaml.
Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology. Use when asked to audit a smart contract repo from a URL or local path, auto-prepare the environment, find high-severity loss-of-funds vulnerabilities, validate exploitability, propose safe…
Render and read Markdown in the browser with the Secutils.dev Markdown Preview tool. Reading-first: the rendered preview is the default full-width view, with on-demand source editing, threaded review comments stored in the Markdown, and self-contained HTML/PDF export. Supports GitHub-flavored Markdown, Mermaid…
Run local commands with API keys stored in EnvLatch instead of copying credentials between .env files or shell profiles. Use when an agent, CLI, script, SDK, test, or build needs a saved credential environment variable on macOS.
Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, analyze media intelligence, and tell people from AI agents on a website (Agent Detection) using direct Resemble AI API calls.
Perform a security-focused code review of smart contracts, frontends, backends, and mobile apps. Use this skill for a security review, audit, vulnerability scan, or check of code for security issues, including reviewing a pull request, diff, or changed files, or asking "is this safe to merge or ship." Covers Solidity…
Running autonomous loops for nexus-autoloop. Generates script sets from goals, designs operation contracts, audits live loops, and recovers state — runners that complete reliably.
Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on…
★not rated 97▲
+2 4mo agoA106 tokens
originalMIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: