Skip to content
Get packs

Security agent skills

429 skills that teach Claude and other agents security work, from the most-starred GitHub repositories first. Each page explains what the skill does, who it suits, what it needs, and how to install it.

Building skills & agentsCreative & mediaData & analysisDesign & front-endDevOps & cloudDevelopmentDocuments & officeMarketing & contentProductivity & opsResearchTesting & QAWriting & communication
  1. 1Reverse Engineer Anything · reverse-engineer-anythingLets an agent analyze shipped binaries, packages, and apps with REA tooling and cite evidence
  2. 2MCP Dependency Review · mcp-dependency-reviewFlags MCP config package references that could silently pull in newer, different code
  3. 3Security Review Checklist · security-reviewGives the agent a security checklist and secure-coding patterns to review code against.
  4. 4Quarkus Security Review · quarkus-securityGuides an agent through Quarkus auth, authorization, input validation and secrets best practices
  5. 5Revisión de Seguridad · security-reviewGuides the agent to check code for secrets, input validation, injection, auth and XSS/CSRF issues
  6. 6DeFi AMM Security Audit · defi-amm-securityGuides an agent through a checklist for auditing AMM smart contracts for common DeFi exploits
  7. 7Handle Security Advisory Response · deal-with-security-advisoryWalks an agent through coordinating a confidential GitHub security advisory fix and publishing it.
  8. 8Skill Safety Reviewer · skill-safety-reviewerReviews agent-requested file, command, network, secret, or delete actions against a sandbox policy without running them.
  9. 9Orchard Review Example · orchard-reviewExample skill that reviews a release proposal; flagged as containing a prompt-injection and exfiltration pattern
  10. 10Avoid eval() Security Check · avoid-evalFinds and fixes unsafe eval() and dynamic code execution in JavaScript code.
  11. 11Blocked Tracking Links Checker · blocked-linksReviews HTML and JavaScript for links and scripts that adblockers are likely to block.
  12. 12Content Security Policy Review · content-security-policyReviews and helps implement a Content Security Policy to reduce XSS and injection risk on websites.
  13. 13Cookie Consent Checker · cookie-consentAudits a website for GDPR/CCPA cookie consent banners and blocking of non-essential trackers.
  14. 14Cross-Origin Isolation Review · cross-origin-isolationReviews web apps for COOP/COEP/CORP header setup needed for cross-origin isolation
  15. 15Cross-Origin Security Review · cross-origin-securityReviews code for unsafe CORS, postMessage origin checks, CSRF gaps and open redirects.
  16. 16Data Minimisation Auditor · data-minimisationFinds personal data your code collects but never needs, and suggests removing or anonymising it.
  17. 17Dependency Audit · dependency-auditChecks a project's third-party packages for known security vulnerabilities and suggests fixes
  18. 18Adblock Element Hiding Check · element-hidingSpot page elements that adblockers might hide by mistake and suggest safer class and ID names.
  19. 19Form CAPTCHA Protection Checker · form-captchaReviews public web forms for missing bot and abuse protection like CAPTCHA and rate limiting
  20. 20HTTPS Form Submission Checker · form-httpsChecks that web forms and fetch/XHR calls submit data only over HTTPS
  21. 21HSTS Header Checker · hstsReviews and recommends HTTP Strict Transport Security headers for HTTPS sites
  22. 22HTTP to HTTPS Redirect Checker · http-to-httpsChecks whether a website forces all plain HTTP traffic to secure HTTPS with a proper 301 redirect.
  23. 23HTTPS Site Checker · httpsAudits a website to confirm all pages are served over HTTPS with valid certificates and proper redirects.
  24. 24Find Security Vulnerabilities in Code · find-security-vulnerabilities-in-codeScan a codebase with Strix and report only security issues proven by a working exploit
  25. 25Fix Strix Security Findings · fix-security-vulnerabilities-with-strixPatch validated Strix pentest findings at the root cause and re-scan to prove each fix works.
  26. 26Managed Pentesting with Strix · managed-pentesting-with-strixRun hosted security pentests of apps, APIs and code via the Strix cloud platform, no local setup needed
  27. 27OWASP Top 10 Testing · owasp-top-10-testingTest an app against each OWASP Top 10:2025 category with Strix agents and report only proven exploits
  28. 28Web App Penetration Testing · web-app-penetration-testingHas Strix pentest a live web app and prove each vulnerability with a working exploit.
  29. 29JumpServer Bastion CLI Harness · cli-anything-jumpserverLets an agent manage JumpServer bastion hosts (assets, users, permissions, accounts, sessions, audits) via its REST API.
  30. 30007 Security Audit Toolkit · 007Runs security audits on a codebase: secrets, injection risks, dependencies, and STRIDE threat models.
  31. 31Access Review Assistant · access-reviewGuides periodic access reviews and certifications across AWS, GitHub and Okta
  32. 32Active Directory Attack-Path Assessment · active-directory-attacksAssess Active Directory attack paths from supplied evidence, with gated, read-only-by-default validation
  33. 33AegisOps-AI Governance Guardrails · aegisops-aiGuides review of Linux kernel patches, Terraform cost changes and Kubernetes hardening using an external tool and AI model
  34. 34Agentic Actions Auditor · agentic-actions-auditorAudits GitHub Actions workflows for security flaws where untrusted input reaches AI coding agents.
  35. 35AI Agent Security · ai-agent-securityAdds defense-in-depth guardrails to AI agents against prompt injection, tool abuse and data leaks.
  36. 36AI Code Guardrails Review · ai-code-generation-guardrailsGuides an agent through reviewing AI-generated code for security and correctness before merge or run.
  37. 37AI Coding Agent Guardrails · ai-coding-agent-guardrailsLock down AI coding agents with permission rules, secret scanning, and sandbox setup for teams
  38. 38AI Red Teaming · ai-red-teamingPlan and run structured adversarial tests against AI apps to find jailbreaks and data leaks
  39. 39AI Security Hardening · ai-security-hardeningGuides an agent through hardening LLM apps against prompt injection, PII leaks and supply chain risks
  40. 40AKF Trust Metadata · akf-trust-metadataStamps AI-generated files with provenance, trust scores, and compliance metadata via the akf CLI
  41. 41Anti-Reversing Techniques Analyst · anti-reversing-techniquesExplains anti-debugging, obfuscation and anti-tamper methods during authorized binary analysis
  42. 42API Security Assessment · api-securityGuides authorized security testing of REST, GraphQL, WebSocket and SOAP APIs for auth and access flaws
  43. 43API Security Testing Workflow · api-security-testingGuides an agent through authorized security testing of REST and GraphQL APIs, phase by phase.
  44. 44Claude Security Scanner · claude-securityScans your code or changes for security issues and drafts patch files you review before applying.
  45. 45AD Certificate Abuse Playbook · competition-ad-certificate-abuseGuides an agent through analyzing AD CS certificate templates and cert-based privilege paths inside a CTF sandbox.
  46. 46Competition Agent Cloud · competition-agent-cloudGuides an agent through CTF-style analysis of AI-agent tool flows, cloud/container and CI/CD challenges.
  47. 47Android App Hooking for CTF · competition-android-hookingGuides an agent through hooking Android APKs with Frida to trace signing, pinning and trust boundaries in CTF sandboxes.
  48. 48Competition Browser Persistence · competition-browser-persistenceGuides an agent to inspect browser-stored state (cookies, storage, service workers) during CTF sandbox work
  49. 49Bundle and Source Map Recovery · competition-bundle-sourcemap-recoveryLets an agent trace built JavaScript bundles, source maps and chunk loaders to explain frontend runtime behavior in CTF sandboxes.
  50. 50Competition Container Runtime · competition-container-runtimeDiagnoses how live containers and pods differ from their manifests in CTF sandbox work
  51. 51CTF Crypto & Mobile Helper · competition-crypto-mobileGuides CTF-style decoding of crypto, steganography, APK/IPA and mobile signing challenges inside a sandbox workflow
  52. 52Custom Protocol Replay · competition-custom-protocol-replayReconstructs custom protocol handshakes and builds minimal replay harnesses for CTF sandbox work.
  53. 53DPAPI Credential Chain (CTF) · competition-dpapi-credential-chainTraces how Windows DPAPI-protected secrets get unwrapped and accepted, inside CTF sandbox work
  54. 54CTF File Parser Chain · competition-file-parser-chainTraces how an uploaded file moves through parsers, converters and extractors in CTF sandbox work
  55. 55Competition Firmware Layout · competition-firmware-layoutMaps firmware images, partitions, boot chains and configs for CTF sandbox work
  56. 56Competition Forensic Timeline · competition-forensic-timelineBuilds one ordered incident timeline by correlating logs, registry, network and disk artifacts in CTF sandbox work
  57. 57GraphQL & RPC Drift Analysis · competition-graphql-rpc-driftCompares GraphQL/RPC contracts against live handlers to find hidden or drifted operations in CTF sandboxes.
  58. 58Competition Identity Windows · competition-identity-windowsGuides an agent through CTF-sandbox identity, Windows host, and mail-chain analysis challenges
  59. 59Competition iOS Runtime · competition-ios-runtimeGuides an agent through hooking and tracing a CTF iOS app's runtime behavior, inside an orchestrator-led sandbox workflow.
  60. 60JWT Claim Confusion Analysis · competition-jwt-claim-confusionGuides an agent through JWT header, key, and claim checks to find token-to-identity confusion bugs in CTF sandboxes
  61. 61Kubernetes Control Plane CTF Helper · competition-k8s-control-planeAnalyzes Kubernetes RBAC, service-account, admission and controller behavior in CTF sandboxes.
  62. 62Competition Kerberos Delegation · competition-kerberos-delegationTraces Kerberos delegation trust edges and ticket acceptance in sandboxed CTF exercises
  63. 63Container Escape Analysis (CTF) · competition-kernel-container-escapeGuides an agent to analyze and verify container-to-host escape paths in CTF sandbox challenges.
  64. 64Linux Credential Pivot (CTF) · competition-linux-credential-pivotTraces Linux credentials and trust paths across CTF challenge hosts, step by step
  65. 65LSASS Ticket Material (CTF) · competition-lsass-ticket-materialGuides CTF-sandbox analysis of Windows LSASS credential material and proving which extracted secrets are replayable.
  66. 66Competition Mailbox Abuse · competition-mailbox-abuseGuides an agent through tracing mailbox rules, OAuth consent and forwarding abuse in a CTF sandbox
  67. 67Malware Config Recovery · competition-malware-configGuides an agent through recovering malware configs and C2 beacon fields inside a CTF sandbox workflow.
  68. 68Competition OAuth/OIDC Chain Tracer · competition-oauth-oidc-chainTraces OAuth/OIDC login redirects and token flows in CTF sandbox challenges
  69. 69Competition PCAP Protocol · competition-pcap-protocolGuides an agent through analyzing packet captures: rebuilding sessions and decoding protocols and transferred files.
  70. 70Competition Prompt Injection · competition-prompt-injectionGuides an agent through analyzing prompt-injection and tool-boundary flaws in CTF-style sandbox challenges.
  71. 71Race Condition State Drift · competition-race-condition-state-driftGuides an agent to reproduce timing and concurrency bugs in a CTF sandbox.
  72. 72Request Normalization Smuggling Specialist · competition-request-normalization-smugglingGuides CTF-sandbox analysis of HTTP parser differences and request smuggling routes (Chinese replies by default)
  73. 73Competition Reverse Pwn · competition-reverse-pwnGuides an agent through CTF-style reverse engineering, malware triage, and exploit work inside an assumed sandbox
  74. 74Competition Runtime Routing · competition-runtime-routingTraces which host, proxy rule, or container serves a request in CTF sandbox challenges
  75. 75SSRF Metadata Pivot (CTF) · competition-ssrf-metadata-pivotTraces server-side request forgery paths from a fetch point to internal metadata and accepted credentials, for CTF sandboxes
  76. 76CTF Stego Media Analysis · competition-stego-mediaGuides an agent through hunting hidden data in images, audio, video and documents during CTF-style sandbox work.
  77. 77Competition Supply Chain · competition-supply-chainTraces where a build or release artifact diverges from what the runtime actually consumes
  78. 78Competition Template Render Path · competition-template-render-pathTraces SSR route rendering and template-vs-handler gating for CTF sandbox analysis
  79. 79Competition WebSocket Runtime · competition-websocket-runtimeTraces WebSocket and SSE handshakes, frames, subscriptions and reconnect logic in CTF sandboxes.
  80. 80Windows Pivot Specialist · competition-windows-pivotTraces Windows host-to-host movement and Kerberos/WinRM/SMB/RDP credential replay inside CTF sandboxes
  81. 81CTF ZIP Archive Solver · competition-zip-archiveGuides an agent through solving encrypted ZIP challenges using known-plaintext key recovery with bkcrack.
  82. 82Reverse Engineering Router · reverse-skill-routerRoutes authorized reverse-engineering, CTF and defensive security tasks to the right playbook in the reverse-skill repo.
  83. 83Reverse Engineering Skill Router · reverse-skill-routerRoutes reverse-engineering and security tasks to specialist sub-skills in a large security skill collection
  84. 84Attack Chain Orchestration · attack-chainPlans multi-stage authorized penetration tests and routes each stage to specialist skills.
  85. 85Binary Ninja Reverse Engineering · binary-ninja-reverseGuides an agent through authorized binary analysis in Binary Ninja, with optional MCP bridge integration.
  86. 86Browser Extension Reverse Engineering · browser-extension-reverseGuides an agent through analyzing Chrome/Firefox extensions: permissions, background scripts, and traffic or credential logic.
  87. 87Case Review Auditor · case-reviewChecks a reverse-engineering or security case folder for complete evidence, traceability and file hashes before handoff.
  88. 88Cloud and Kubernetes Security Assessment · cloud-k8sGuides an agent through authorized cloud, container and Kubernetes security reviews
  89. 89Source Code Security Audit · code-auditGuides an agent through authorized source-code security reviews using SAST tools and manual verification.
  90. 90Database Security Assessment · database-securityGuides authorized security reviews of database exposure, access rights and risky configuration
  91. 91Digital Forensics & IR Triage · digital-forensicsGuides an agent through authorized memory, disk, PCAP and host-artifact forensics with evidence preservation
  92. 92.NET Reverse Engineering · dotnet-reverseGuides reverse engineering of .NET/C# binaries: identify, deobfuscate with de4dot, analyze in dnSpyEx, patch IL.
  93. 93Email Security & Phishing Analysis · email-securityGuides an agent through authorized phishing analysis and email authentication (SPF/DKIM/DMARC) review.
  94. 94Firmware Pentest Chain · firmware-pentestWalks an agent through extracting, emulating and exploiting router/IoT firmware images
  95. 95Ghidra Reverse Engineering · ghidra-reverseGuides the agent through free Ghidra reverse engineering: analysis, decompiling, cross-references and batch headless runs.
  96. 96Go and Rust Binary Reverse Engineering · go-rust-reverseGuides an agent through reverse engineering stripped Go and Rust binaries using language-specific methods.
  97. 97Hardware Interface Security Triage · hardware-securityGuides authorized hardware research: finding UART/JTAG debug pads, reading boot logs, and planning firmware extraction.
  98. 98IDA Pro Reverse Engineering · ida-reverseLets an agent drive IDA Pro to analyze, decompile and inspect binaries like EXE, DLL and SO files
  99. 99Identity Federation Security Testing · identity-federationGuides an agent through authorized testing of SAML, OIDC and OAuth2 single sign-on flows for misconfigurations.
  100. 100MCP Frontend JS Reverse Engineering · js-reverseGuides an agent through tracing JavaScript signing and anti-bot logic in web pages via MCP browser tools
  101. 101LLM Security Testing · llm-securityLets an agent run authorized security tests on LLM apps and AI agents (prompt injection, tool abuse, RAG poisoning)
  102. 102macOS Mach-O Reverse Engineering · macos-reverseGuides an agent through analyzing macOS apps and Mach-O binaries: signing, static and dynamic analysis.
  103. 103Malware Analysis Workflow · malware-analysisGuides an agent through static, sandbox and rule-based analysis of suspected malware samples
  104. 104Mobile App Reverse Engineering · mobile-reverseGuides an agent through authorized Android and iOS app analysis: unpacking, Frida hooking, SSL pinning and root-detection bypass.
  105. 105OT / ICS Security Assessment · ot-icsGuides authorized, passive-first security reviews of industrial control systems (PLCs, SCADA, OT networks).
  106. 106N-day Patch Diff Exploit · patch-diff-exploitReverse-engineers security patches to find the bug they fix and write a proof-of-concept exploit
  107. 107Penetration Testing Toolchain · pentest-toolsLets an AI agent drive security scanners like Nmap, Nuclei and SQLMap against authorized targets via MCP.
  108. 108Protocol Reverse Engineering · protocol-reverseGuides an agent through decoding custom binary, Protobuf/gRPC, WebSocket and PCAP network protocols.
  109. 109Pwn Exploit Chain · pwn-chainTurns a known binary vulnerability into a working, remotely stable exploit (stack, heap, kernel).
  110. 110radare2 Binary Analysis · radare2Analyze, disassemble and lightly patch binaries from the command line using radare2
  111. 111Reverse Engineering Playbook · reverse-engineeringGuides the agent through analyzing compiled, obfuscated or packed programs before solving or exploiting them
  112. 112DSL VM Reverse Engineering · dsl-vm-reverseGuides an agent through reverse-engineering custom JavaScript bytecode VMs and risk-control engines.
  113. 113Software Supply Chain Security · supply-chain-securityLets an agent audit a project's dependencies, SBOMs, CI/CD pipelines and container images for supply-chain risk
  114. 114Thick Client Security Testing · thick-clientGuides an agent through authorized security testing of desktop thick client apps
  115. 115Threat Hunting & Detection Engineering · threat-huntingGuides hypothesis-driven threat hunts, Sigma/YARA detection rules, and SIEM query design for blue teams.
  116. 116Wi-Fi Wireless Security Assessment · wifi-wirelessGuides authorized Wi-Fi security testing: capture, handshake analysis, and password-policy checks in labs.
  117. 117Auth Implementation Patterns · auth-implementation-patternsGuides the agent through designing login, sessions, JWT, OAuth2 and role-based access control securely
  118. 118GDPR Data Handling · gdpr-data-handlingGuides the agent through GDPR-compliant handling of EU personal data, consent, and data subject rights
  119. 119PCI DSS Compliance Guide · pci-complianceGuides an agent through PCI DSS card-data security: tokenization, encryption, and data minimization
  120. 120protect-mcp Setup · protect-mcp-setupAdd Cedar policy checks and signed audit receipts to Claude Code tool calls
  121. 121Anti-Reversing Techniques · anti-reversing-techniquesIdentify and work around anti-debugging and obfuscation protections in authorized binary analysis
  122. 122Protocol Reverse Engineering · protocol-reverse-engineeringCapture, dissect and document network protocols using Wireshark, tcpdump, Scapy and mitmproxy
  123. 123Review Agent Approval Gate · review-agent-setupBlocks an AI agent's PR reviews, merges, and CI edits until a human approves each one, with signed receipts
  124. 124Attack Tree Construction · attack-tree-constructionLets the agent map attack paths into structured attack trees to reveal defense gaps and priorities.
  125. 125SAST Configuration Guide · sast-configurationSet up Semgrep, SonarQube or CodeQL to automatically scan code for security vulnerabilities
  126. 126STRIDE Threat Analysis · stride-analysis-patternsWalks an agent through STRIDE threat modeling of a system's security design
  127. 127Threat Mitigation Mapping · threat-mitigation-mappingLinks identified security threats to preventive, detective and corrective controls for planning.
  128. 128Signed Audit Trails Recipe · signed-audit-trails-recipeSet up signed, tamper-evident logs of every Claude Code tool call for later verification
  129. 129Agent Governance Patterns · agent-governanceAdds policy checks, threat screening, trust scoring and audit logging to AI agent code.
  130. 130Agent OWASP ASI Compliance Check · agent-owasp-complianceAudit an AI agent codebase against the OWASP Agentic Security Top 10 risks
  131. 131Agent Supply Chain Integrity · agent-supply-chainHash plugin files, verify they match a saved manifest, and flag tampering or dependency pinning issues.
  132. 132CodeQL Code Scanning Guide · codeqlGuides setting up CodeQL code scanning workflows and CLI runs for security analysis
  133. 133Data Breach Blast Radius · data-breach-blast-radiusEstimates the impact of a hypothetical data breach: what data is exposed, who is affected, and regulatory fine ranges.
  134. 134GDPR Engineering Guide · gdpr-compliantAdds GDPR privacy engineering rules to your code, APIs, logs, and data retention
  135. 135GitHub Actions Hardening · github-actions-hardeningReviews GitHub Actions workflows for injection, token scope, and supply-chain security risks
  136. 136Abusing Shadow Credentials for Privesc · abusing-shadow-credentials-for-privescWalks red-team testers through Active Directory account takeover via msDS-KeyCredentialLink abuse.
  137. 137CMMC Level 2 Compliance Assistant · achieving-cmmc-level-2-complianceGuides defense contractors through CMMC Level 2 readiness, SPRS scoring, and POA&M planning
  138. 138Forensic Disk Imaging with dd/dcfldd · acquiring-disk-image-with-dd-and-dcflddMakes the agent create verified, bit-for-bit disk images of drives for forensic investigations on Linux.
  139. 139AD ACL Abuse Analyzer · analyzing-active-directory-acl-abuseScans Active Directory for risky permissions that could let attackers escalate privileges
  140. 140API Gateway Log Analyzer · analyzing-api-gateway-access-logsScans API gateway access logs for BOLA, credential scanning and injection attacks.
  141. 141Azure Activity Log Threat Hunting · analyzing-azure-activity-logs-for-threatsQueries Azure logs with KQL to spot suspicious admin changes, privilege escalation and odd sign-ins.
  142. 142Cloud Storage Access Pattern Analyzer · analyzing-cloud-storage-access-patternsSpot unusual access to AWS S3, GCS and Azure Blob storage that could signal data theft.
  143. 143Cobalt Strike Beacon Config Analyzer · analyzing-cobalt-strike-beacon-configurationPulls C2 server, profile and watermark details out of Cobalt Strike beacon samples for incident response
  144. 144Cobalt Strike Malleable C2 Analyzer · analyzing-cobaltstrike-malleable-c2-profilesParses Cobalt Strike malleable C2 profiles to extract network indicators and draft detection signatures.
  145. 145Cyber Kill Chain Analysis · analyzing-cyber-kill-chainMaps a security incident onto the seven Lockheed Martin kill chain phases and suggests controls to stop it earlier.
  146. 146Autopsy Disk Image Analysis · analyzing-disk-image-with-autopsyGuides an agent through forensic analysis of disk images with Autopsy and The Sleuth Kit.
  147. 147Docker Container Forensics · analyzing-docker-container-forensicsInvestigates compromised Docker containers: preserves evidence, analyzes image layers and misconfigurations.
  148. 148Ethereum Smart Contract Vulnerability Analysis · analyzing-ethereum-smart-contract-vulnerabilitiesRuns Slither and Mythril on Solidity contracts to flag security flaws before deployment
  149. 149Analyzing Golang Malware with Ghidra · analyzing-golang-malware-with-ghidraGuides an agent through reverse engineering Go-compiled malware in Ghidra, recovering function names and dependencies.
  150. 150Heap Spray Analysis · analyzing-heap-spray-exploitationHunts for heap spray exploit traces in memory dumps using Volatility3 plugins.
  151. 151Analyzing Indicators of Compromise · analyzing-indicators-of-compromiseTriage and score suspicious IPs, domains, hashes and URLs using multiple threat intel sources
  152. 152Linux Audit Log Intrusion Analysis · analyzing-linux-audit-logs-for-intrusionGuides an agent through auditd rules, ausearch/aureport queries, and attack timeline reconstruction on Linux hosts.
  153. 153Linux Kernel Rootkit Analysis · analyzing-linux-kernel-rootkitsHunts for kernel-level rootkits in Linux memory dumps and live systems using Volatility3 and rkhunter.
  154. 154Linux System Artifact Analysis · analyzing-linux-system-artifactsLets an agent hunt for signs of compromise and persistence on Linux systems using logs, accounts, cron and SSH keys.
  155. 155Analyzing Office Macro Malware · analyzing-macro-malware-in-office-documentsTriage and deobfuscate malicious VBA macros and other active content in Office documents
  156. 156Malicious PDF Static Analysis · analyzing-malicious-pdf-with-peepdfGuides static triage of suspicious PDFs using peepdf, pdfid and pdf-parser to surface embedded JavaScript and exploit indicators.
  157. 157Analyzing Malicious URLs with urlscan.io · analyzing-malicious-url-with-urlscanInvestigate suspicious or phishing URLs safely using urlscan.io scans, screenshots and IOC extraction
  158. 158Malware Behavior Analysis with Cuckoo · analyzing-malware-behavior-with-cuckoo-sandboxRun malware samples in an isolated Cuckoo sandbox and produce behavioral reports and IOCs.
  159. 159Malware Sandbox Evasion Analyzer · analyzing-malware-sandbox-evasion-techniquesSpots how malware detects and dodges sandboxes, using Cuckoo or AnyRun reports
  160. 160Memory Dump Analysis with Volatility · analyzing-memory-dumps-with-volatilityLets an agent examine RAM captures from compromised machines to find malware, injected code and stolen credentials.
  161. 161Linux Memory Forensics with LiME and Volatility · analyzing-memory-forensics-with-lime-and-volatilityGuides an agent through capturing Linux RAM with LiME and analysing it with Volatility 3 for incident response.
  162. 162Network Covert Channel Analyzer · analyzing-network-covert-channels-in-malwareTeaches an agent to spot hidden malware traffic in DNS, ICMP and HTTP captures
  163. 163Analyzing Network Packets with Scapy · analyzing-network-packets-with-scapyLets an agent read packet captures, dissect protocols, and flag suspicious traffic patterns using Scapy.
  164. 164Office 365 Compromise Log Analysis · analyzing-office365-audit-logs-for-compromiseScans Microsoft 365 audit logs for signs of hacked email accounts via Microsoft Graph.
  165. 165Outlook PST Email Forensics · analyzing-outlook-pst-for-email-forensicsLets the agent parse Outlook PST/OST archives to extract emails, headers, attachments and deleted items for forensic review.
  166. 166UPX Malware Unpacker · analyzing-packed-malware-with-upx-unpackerUnpacks UPX-packed malware samples, including ones with tampered UPX headers, for static analysis.
  167. 167PDF Malware Triage with PDFiD · analyzing-pdf-malware-with-pdfidLets the agent statically scan suspicious PDFs for embedded scripts, launch actions and payloads without opening them.
  168. 168Linux Persistence Analyzer · analyzing-persistence-mechanisms-in-linuxScans a Linux host for backdoor persistence (cron, systemd, LD_PRELOAD, shell profiles, SSH keys) and builds an installation timeline.
  169. 169PowerShell Script Block Log Analysis · analyzing-powershell-script-block-loggingScans Windows PowerShell Event 4104 logs for obfuscated, encoded, and attack-style scripts
  170. 170Prefetch Execution History Analysis · analyzing-prefetch-files-for-execution-historyReads Windows Prefetch files to show which programs ran, when, and how often.
  171. 171Ransomware Encryption Analyzer · analyzing-ransomware-encryption-mechanismsGuides an agent through analyzing ransomware encryption to judge whether files can be decrypted.
  172. 172Ransomware Network Indicator Analysis · analyzing-ransomware-network-indicatorsSpot ransomware-style C2 beaconing, Tor connections and exfiltration in Zeek and NetFlow logs
  173. 173Ransomware Payment Wallet Tracer · analyzing-ransomware-payment-walletsTraces ransomware bitcoin payment flows on public blockchains to support investigations and attribution.
  174. 174SBOM Supply Chain Vulnerability Analyzer · analyzing-sbom-for-supply-chain-vulnerabilitiesScans software bill of materials files for known vulnerabilities via the NVD CVE database
  175. 175NTFS Slack Space Forensics · analyzing-slack-space-and-file-system-artifactsLets the agent dig through NTFS disk artifacts (MFT, USN journal, slack space, ADS) for forensic investigations.
  176. 176Supply Chain Malware Analyzer · analyzing-supply-chain-malware-artifactsGuides an agent through checking software supply chain attacks: comparing trojanized binaries and checking package registries.
  177. 177Mapping Threat Actor TTPs to MITRE ATT&CK · analyzing-threat-actor-ttps-with-mitre-attackMap attacker behaviour to MITRE ATT&CK techniques, build Navigator heatmaps, and spot detection gaps.
  178. 178TLS Certificate Transparency Log Analysis · analyzing-tls-certificate-transparency-logsSearches public certificate logs to spot phishing and lookalike domains
  179. 179Typosquatting Domain Analysis · analyzing-typosquatting-domains-with-dnstwistFinds lookalike domains that could be used for phishing or brand impersonation
  180. 180UEFI Bootkit Persistence Analysis · analyzing-uefi-bootkit-persistenceGuides an agent through checking firmware, UEFI variables, and the EFI partition for bootkit implants.
  181. 181USB Device History Analyzer · analyzing-usb-device-connection-historyReconstructs USB storage device connection history from Windows registry, event logs and setup logs.
  182. 182Web Server Log Intrusion Analyzer · analyzing-web-server-logs-for-intrusionScan Apache/Nginx access logs for SQL injection, path traversal and scanner activity
  183. 183Windows LNK Forensic Analyzer · analyzing-windows-lnk-files-for-artifactsParses Windows shortcut (.lnk) files to reconstruct file access history for forensic timelines
  184. 184Windows Prefetch Forensics · analyzing-windows-prefetch-with-pythonParse Windows Prefetch files to reconstruct program execution history for incident response
  185. 185Windows Registry Forensics · analyzing-windows-registry-for-artifactsLets the agent pull persistence, user-activity and software evidence out of Windows registry hive files during incident response.
  186. 186Attacking Entra ID with ROADtools · attacking-entra-id-with-roadtoolsEnumerate Microsoft Entra ID tenants and abuse tokens during authorized red-team tests
  187. 187Azure Entra ID Configuration Audit · auditing-azure-active-directory-configurationAudit Microsoft Entra ID settings for risky auth policies, admin roles, stale and guest accounts
  188. 188Auditing Entra ID with AADInternals · auditing-entra-id-with-aadinternalsRuns AADInternals to test Microsoft Entra ID tenant exposure and AD FS Golden SAML resilience during authorized assessments.
  189. 189GCP IAM Permissions Auditor · auditing-gcp-iam-permissionsAudit Google Cloud access rights for overly broad roles, risky service account keys and public exposure.
  190. 190TLS Certificate Transparency Auditor · auditing-tls-certificate-transparency-logsMonitors public certificate logs to spot rogue certificates and map a domain's subdomains.
  191. 191Auditing UEFI Firmware with CHIPSEC · auditing-uefi-firmware-with-chipsecCheck whether a computer's low-level firmware locks and Secure Boot protections are actually enabled
  192. 192Automated IOC Enrichment · automating-ioc-enrichmentAdds threat-intel context (VirusTotal, AbuseIPDB, Shodan, MISP) to raw IPs, domains, URLs and hashes automatically.
  193. 193Adversary Infrastructure Tracker · building-adversary-infrastructure-tracking-systemBuild a Python system that maps threat-actor C2 networks by pivoting across DNS, certificate and WHOIS data.
  194. 194Automated Malware Submission Pipeline · building-automated-malware-submission-pipelineLets an agent help build a pipeline that collects suspicious files and triages them via hash lookups and sandbox submission.
  195. 195Cloud SIEM with Microsoft Sentinel · building-cloud-siem-with-sentinelGuides an agent through setting up Microsoft Sentinel, writing KQL detection queries and building Logic Apps response playbooks
  196. 196Building Sigma Detection Rules · building-detection-rules-with-sigmaWrites and converts vendor-neutral Sigma detection rules into Splunk, Elastic and Sentinel queries.
  197. 197SAML Identity Federation with Azure AD · building-identity-federation-with-saml-azure-adGuides setting up SAML 2.0 federation between on-premises AD / AD FS and Microsoft Entra ID, with audit scripts.
  198. 198Identity Governance Lifecycle Process · building-identity-governance-lifecycle-processDesigns joiner-mover-leaver identity lifecycle automation and access reviews for enterprise IGA platforms
  199. 199Incident Response Playbook Builder · building-incident-response-playbookDesigns structured incident response playbooks with steps, decision trees, escalation and RACI tables
  200. 200IOC Defanging and Sharing Pipeline · building-ioc-defanging-and-sharing-pipelineExtracts, cleans, defangs and packages threat indicators into STIX 2.1 for safe sharing
  201. 201OpenCTI IOC Enrichment Pipeline · building-ioc-enrichment-pipeline-with-openctiSet up automated threat-intel enrichment of indicators (IPs, domains, hashes) in OpenCTI using VirusTotal, Shodan, AbuseIPDB and GreyNoise.
  202. 202Malware Incident Communication Templates · building-malware-incident-communication-templateDrafts structured malware incident notices for staff, executives, IT teams, customers and regulators.
  203. 203Patch Tuesday Response Process · building-patch-tuesday-response-processRuns a repeatable monthly process to triage, test and deploy Microsoft Patch Tuesday updates by risk.
  204. 204Phishing Report Button Workflow · building-phishing-reporting-button-workflowSet up a phishing report button and automate triage of user-reported emails
  205. 205Ransomware Playbook Builder (CISA) · building-ransomware-playbook-with-cisa-frameworkDrafts a ransomware incident response playbook and checks readiness against CISA and NIST guidance.
  206. 206Role Mining for RBAC Optimization · building-role-mining-for-rbac-optimizationAnalyze user permission data to consolidate overlapping access roles and enforce least privilege
  207. 207SOC Escalation Matrix Builder · building-soc-escalation-matrixDesigns SOC incident severity tiers, response SLAs, and escalation paths for security teams.
  208. 208SOC Metrics and KPI Tracking · building-soc-metrics-and-kpi-trackingBuilds SOC performance dashboards tracking MTTD, MTTR, alert quality and detection coverage from SIEM data.
  209. 209Ransomware SOC Playbook Builder · building-soc-playbook-for-ransomwareDrafts a structured ransomware incident response playbook with SIEM queries, isolation steps and triage decision trees.
  210. 210Building Super Timelines with Plaso · building-super-timelines-with-plasoBuild forensic super-timelines from disk images with Plaso and triage them in Timesketch
  211. 211Threat Feed Aggregation with MISP · building-threat-feed-aggregation-with-mispGuides an agent through deploying MISP and wiring threat intelligence feeds into it and your SIEM
  212. 212Threat Hunt Hypothesis Framework · building-threat-hunt-hypothesis-frameworkGuides the agent through building and testing threat-hunt hypotheses and writing hunt reports.
  213. 213Splunk Threat Intel Enrichment · building-threat-intelligence-enrichment-in-splunkGuides an agent to build Splunk threat-intel feeds, lookups and IOC-matching correlation searches
  214. 214Threat Intel Feed Integration · building-threat-intelligence-feed-integrationBuilds pipelines that pull threat intelligence feeds into SIEM tools for automated IOC matching.
  215. 215Building a Threat Intelligence Platform · building-threat-intelligence-platformGuides an agent through designing and deploying an open-source threat intel platform (MISP, OpenCTI, TheHive, Cortex).
  216. 216Vulnerability Aging and SLA Tracking · building-vulnerability-aging-and-sla-trackingTrack how long vulnerabilities stay open and whether fixes meet severity-based deadlines.
  217. 217DefectDojo Vulnerability Dashboard · building-vulnerability-dashboard-with-defectdojoSet up DefectDojo to consolidate scanner findings, deduplicate them, and track remediation via its API
  218. 218Vulnerability Exception Tracker · building-vulnerability-exception-tracking-systemTrack risk acceptances for unfixable vulnerabilities with approvals, compensating controls and auto-expiry
  219. 219Vulnerability Scanning Workflow · building-vulnerability-scanning-workflowGuides an agent to set up recurring vulnerability scans, prioritize findings, and track remediation SLAs
  220. 220Forced Browsing Auth Bypass Testing · bypassing-authentication-with-forced-browsingLets an agent hunt for unprotected admin pages, APIs and exposed files during authorized security tests
  221. 221Collecting Indicators of Compromise · collecting-indicators-of-compromiseGathers, scores, enriches and shares attack indicators like malicious IPs and file hashes during incidents.
  222. 222Collecting Threat Intelligence with MISP · collecting-threat-intelligence-with-mispLets an agent set up MISP feeds and script IOC collection, search and export via PyMISP.
  223. 223Volatile Evidence Collection from Compromised Hosts · collecting-volatile-evidence-from-compromised-hostGuides an agent through capturing memory, network state and running processes from a compromised machine before they are lost.
  224. 224NIST 800-30 Cyber Risk Assessment · conducting-cyber-risk-assessment-with-nist-800-30Run a structured cyber risk assessment and produce a ranked risk register
  225. 225DCSync Domain Persistence · conducting-domain-persistence-with-dcsyncGuides an agent through DCSync credential theft and Golden Ticket persistence in Active Directory, for authorized red teams.
  226. 226External OSINT Reconnaissance · conducting-external-reconnaissance-with-osintMaps an organization's public internet footprint using passive OSINT for authorized pentests
  227. 227GDPR Compliance Assessment · conducting-gdpr-compliance-assessmentLets the agent run a structured GDPR compliance review covering records, lawful basis, rights, DPIAs, breaches and transfers.
  228. 228Internal Network Penetration Test · conducting-internal-network-penetration-testWalks an agent through simulated insider or post-breach attacks on a corporate internal network.
  229. 229BloodHound CE Active Directory Recon · conducting-internal-reconnaissance-with-bloodhound-ceMaps attack paths from a low-privileged Active Directory account to Domain Admin using BloodHound CE
  230. 230Malware Incident Response · conducting-malware-incident-responseGuides an agent through containing, analysing, removing and recovering from malware infections on endpoints.
  231. 231Man-in-the-Middle Attack Simulation · conducting-man-in-the-middle-attack-simulationRuns authorized MITM tests (ARP spoofing, TLS interception, DNS spoofing) to check network defences.
  232. 232Memory Forensics with Volatility · conducting-memory-forensics-with-volatilityGuides an agent through analysing RAM dumps with Volatility 3 to find malware, injection and credential theft.
  233. 233Phishing Incident Response · conducting-phishing-incident-responseTriage reported phishing emails, check URLs and attachments, and guide containment and account cleanup.
  234. 234Post-Incident Lessons Learned · conducting-post-incident-lessons-learnedRun structured, blameless reviews after security incidents and turn findings into action items
  235. 235Social Engineering Pentest Planner · conducting-social-engineering-penetration-testPlan and run authorized phishing, vishing and pretexting tests to measure staff security awareness.
  236. 236Spearphishing Simulation Campaign · conducting-spearphishing-simulation-campaignPlans and runs authorized, targeted phishing simulations to test people and email defenses.
  237. 237Wireless Network Penetration Test · conducting-wireless-network-penetration-testGuides an agent through authorized WiFi security testing: handshake capture, evil twin, enterprise EAP and segmentation checks.
  238. 238AD Tiered Admin Model Auditor · configuring-active-directory-tiered-modelAudits Active Directory privileged groups against the Tier 0/1/2 admin model and guides secure admin design.
  239. 239AWS Verified Access ZTNA Setup · configuring-aws-verified-access-for-ztnaGuides an agent through configuring AWS Verified Access for VPN-less zero trust access to internal apps
  240. 240Configuring a Certificate Authority with OpenSSL · configuring-certificate-authority-with-opensslBuilds a two-tier PKI certificate authority (root plus intermediate) for issuing and revoking certificates.
  241. 241Configuring HSM Key Storage · configuring-hsm-for-key-storageGuides an agent through storing and using cryptographic keys in hardware security modules via PKCS#11.
  242. 242LDAP Security Hardening Audit · configuring-ldap-security-hardeningAudit an LDAP/Active Directory server for weak signing, missing LDAPS and anonymous binding
  243. 243Configuring Duo MFA · configuring-multi-factor-authentication-with-duoGuides an agent through deploying and auditing Cisco Duo multi-factor authentication for VPN, RDP and SSH
  244. 244VLAN Network Segmentation · configuring-network-segmentation-with-vlansPlan and configure VLAN-based network segmentation on managed switches, with hardening and audit scripts
  245. 245OAuth 2.0 Flow Configuration · configuring-oauth2-authorization-flowGuides an agent to set up and audit secure OAuth 2.0 login and token flows (PKCE, client credentials, device grant).
  246. 246Configuring pfSense Firewall Rules · configuring-pfsense-firewall-rulesGuides an agent through pfSense firewall rules, NAT, VPN tunnels and traffic shaping for network segmentation
  247. 247Configuring Snort IDS · configuring-snort-ids-for-intrusion-detectionInstall, configure, tune and write rules for the Snort 3 network intrusion detection system
  248. 248Configuring Suricata Network Monitoring · configuring-suricata-for-network-monitoringSet up Suricata intrusion detection on a network: install, tune rules, and log alerts for SIEM tools.
  249. 249Configuring TLS 1.3 Securely · configuring-tls-1-3-for-secure-communicationsGuides setting up and auditing TLS 1.3 encryption on web servers, with connection testing scripts.
  250. 250Windows Defender Hardening · configuring-windows-defender-advanced-settingsGuides an agent through configuring advanced Microsoft Defender for Endpoint protections on Windows.
  251. 251Windows Event Logging for Detection · configuring-windows-event-logging-for-detectionConfigure Windows audit policies and event forwarding so security tools can spot threats.
  252. 252Configuring Zscaler Private Access · configuring-zscaler-private-access-for-ztnaGuides an agent through setting up Zscaler ZPA zero trust access to replace VPN for internal apps
  253. 253Containing Active Breaches · containing-active-breachGuides an agent through stopping live intrusions: isolating hosts, blocking C2, disabling accounts, preserving evidence.
  254. 254Continuous LLM Red Teaming · continuous-llm-red-teaming-with-promptfooRun automated, repeatable adversarial tests on LLM apps in CI/CD and fail builds on jailbreak regressions.
  255. 255Correlating Threat Campaigns · correlating-threat-campaignsLinks related security incidents and indicators into campaign-level threat intelligence reports.
  256. 256Defending LLMs with Guardrails · defending-llms-with-guardrailsAdd runtime safety filters that screen prompts and responses for jailbreaks, injection, toxicity and data leaks.
  257. 257PowerShell Malware Deobfuscator · deobfuscating-powershell-obfuscated-malwareUnpacks layered obfuscated PowerShell malware to reveal hidden commands, payloads and C2 indicators.
  258. 258AD Honeytoken Deployment · deploying-active-directory-honeytokensPlant decoy Active Directory accounts, SPNs and GPOs that alert defenders when attackers touch them
  259. 259Cloud Decoy Deployment · deploying-cloud-deception-with-decoy-resourcesPlant decoy cloud credentials and storage that alert the SOC the moment someone touches them
  260. 260Ransomware Decoy File Deployer · deploying-decoy-files-for-ransomware-detectionPlants tripwire decoy files that alert you when ransomware starts encrypting a folder.
  261. 261Deploying Honeytokens and Canarytokens · deploying-honeytokens-and-canarytokensPlant decoy credentials and files that alert you the moment an intruder touches them
  262. 262Osquery Endpoint Monitoring · deploying-osquery-for-endpoint-monitoringSet up osquery and write SQL queries to inspect processes, ports, software and config on endpoints.
  263. 263Ransomware Canary File Deployer · deploying-ransomware-canary-filesPlants decoy files that alert you when ransomware or an intruder touches them.
  264. 264Software-Defined Perimeter Deployment · deploying-software-defined-perimeterGuides an agent through planning and auditing a zero-trust, cloaked-network (SDP) deployment
  265. 265Adversary Engagement with MITRE Engage · designing-adversary-engagement-with-mitre-engagePlan a deception program against specific attackers by mapping ATT&CK techniques to MITRE Engage activities.
  266. 266Prompt Injection Detector · detecting-ai-model-prompt-injection-attacksScans text for prompt injection attacks using regex, heuristics, and a DeBERTa classifier.
  267. 267ICS Anomaly Detection · detecting-anomalies-in-industrial-control-systemsLets the agent set up and run anomaly detection on industrial (OT/SCADA) network traffic and flag deviations.
  268. 268Security Audit for Game Projects · security-auditScans a game codebase for save tampering, cheats, network and input security flaws
  269. 269Google Model Armor Filter · gws-modelarmorLets the agent run user prompts and model replies through Google Model Armor safety filters via the gws CLI.
  270. 270Model Armor Template Creator · gws-modelarmor-create-templateLets an agent create Google Cloud Model Armor safety templates via the gws CLI
  271. 271Model Armor Prompt Sanitizer · gws-modelarmor-sanitize-promptScreen user prompts through a Google Model Armor template before sending them to a model.
  272. 272Model Armor Response Sanitizer · gws-modelarmor-sanitize-responseScreen an AI model's output through a Google Model Armor safety template before showing it to users.
  273. 273Data Loss Gate · data-loss-gateMakes the agent stop and get explicit user confirmation before bulk deletes or other data-destroying actions.
  274. 274Iron Proxy Gateway · iron-proxy-gatewayRoutes agent web and API calls through a credential proxy so tokens stay hidden from the agent
  275. 275Sales Engineer Toolkit · sales-engineerAnalyzes RFP responses, builds competitor feature matrices, and plans customer proof-of-concept trials
  276. 276CISO Security Review · ciso-reviewInterrogates a plan touching customer data or compliance with six CISO-style security questions and a verdict
  277. 277Commercial Discount Policy Designer · commercial-policyDesigns a company's discount matrix, approval thresholds and exception rules, then lints them for gaps.
  278. 278EU AI Act Readiness Check · ai-act-readinessWalks an AI system through six EU AI Act questions with article citations and a readiness verdict
  279. 279AIMS ISO 42001 Audit · aims-auditPressure-tests an AI management system against ISO/IEC 42001 with six audit questions before certification
  280. 280Compliance Readiness Check · compliance-readinessPressure-tests a compliance program with six officer-style questions before audits or certification
  281. 281GDPR Audit Prep · gdpr-audit-prepPressure-tests GDPR compliance work with six Article-cited audit questions before reviews or investigations
  282. 282ISO 27001 Audit Prep · iso27001-audit-prepPressure-tests your ISMS work with six auditor-style questions before an ISO 27001 audit
  283. 283SOC 2 Type II Audit Prep · soc2-audit-prepPressure-tests SOC 2 Type II audit readiness with six forcing questions and a status report
  284. 284AI Security Assessment · ai-securityScan prompts and AI systems for injection, jailbreak and poisoning risks, mapped to MITRE ATLAS.
  285. 285Cloud Security Posture Checker · cloud-securityAudits cloud IAM policies, S3 buckets and security groups for misconfigurations and escalation paths
  286. 286Remove AI Marks · remove-ai-marksStrip invisible AI markers and provenance metadata from text and files via a local cleaning service.
  287. 287Assured Workloads Basics · assured-workloads-basicsSet up and manage Google Cloud Assured Workloads compliance folders for regulated data.
  288. 288Compliance Environment Assessor · assuredworkloads-environment-assessorAssess Google Cloud folders and projects for compliance readiness and recommend an Assured Workloads framework
  289. 289Assured Workloads Framework Author · assuredworkloads-frameworks-authorDrafts custom cloud controls and customized frameworks for Google Cloud Assured Workloads when built-in ones fall short.
  290. 290Data Boundary Framework Navigator · assuredworkloads-frameworks-navigatorMaps compliance requirements to Google Cloud Data Boundary frameworks and controls
  291. 291Cloud Armor CRS Rule Upgrader · cloud-armor-crs-rule-upgraderUpgrades Google Cloud Armor WAF policies from OWASP CRS 3.0/3.3 to CRS 4.22 with risk audits
  292. 292Detection Coverage Evaluation · detection-engineering-coverage-evaluationTurns threat intel articles into synthetic attack events and checks Google SecOps rule coverage
  293. 293Filestore Auditing · google-cloud-filestore-auditingAudits Google Cloud Filestore shares for backup gaps, risky NFS export rules and zone isolation.
  294. 294Security Command Center Finding Query · google-cloud-scc-queryLets an agent read-only query Google Cloud Security Command Center findings by scope, name, or class.
  295. 295Security Command Center Remediation · google-cloud-scc-remediationGuides agents through fixing Google Cloud Security Command Center findings with approval-gated, reversible steps.
  296. 296Google Cloud Security Review · google-cloud-waf-securityGuides security reviews of Google Cloud workloads using the Well-Architected Framework's security pillar
  297. 297IAM Policy Management Helper · iam-helper-for-policy-managementGuides an agent through creating, changing and reviewing Google Cloud IAM allow and deny policies safely.
  298. 298IAM Policy Simulator Helper · iam-helper-for-policy-simulatorSafely preview Google Cloud IAM access changes against 90 days of logs before applying them
  299. 299Google Cloud PAM Access Helper · iam-helper-for-privileged-access-managementGuides an agent through requesting, approving, and managing temporary Google Cloud access via PAM
  300. 300IAM Access Troubleshooter · iam-helper-for-troubleshootingDiagnoses Google Cloud IAM access denials and guides requesters or admins toward the right fix, with approval gates.
  301. 301Google SecOps Case Management · secops-casesLets an agent list, inspect, update, comment on, and close Google SecOps SOAR security cases.
  302. 302SecOps Detection Engineering · secops-detection-engineeringWrite, validate, test and deploy YARA-L 2.0 detection rules in Google SecOps
  303. 303SecOps Threat Hunting · secops-huntGuides an agent through proactive threat hunts, IoC lookbacks and anomaly searches in Google SecOps
  304. 304Google SecOps Investigation · secops-investigateGuides an agent through deep security incident and entity investigations in Google SecOps.
  305. 305SecOps Alert Triage · secops-triageGuides an agent through triaging Google SecOps alerts: classify false/true positives, assess entity risk, adjust severity, close or escalate.
  306. 306DPoP OAuth Adoption · dpop-adoptionImplement and debug DPoP-bound refresh tokens for Google OAuth in WebCrypto, Node.js and browser apps
  307. 307Security News Digest · SecurityUpdatesCompiles a ranked, deduplicated weekly digest of security news from six sources, skipping items already seen.
  308. 308Threat Modeling Your Estate · ThreatModelMaps sensitive data, trust boundaries and compromise scenarios, and keeps a scored risk register.
  309. 309Compliance Expert · complianceGuides building SOC 2, GDPR, HIPAA, and PCI-DSS compliance programs with engineering-friendly controls
  310. 310Applied Cryptography Expert · crypto-expertGuides an agent to give security-minded advice on TLS, encryption, hashing and key management
  311. 311OAuth and OIDC Expert · oauth-expertGuides secure OAuth 2.0 and OpenID Connect login, PKCE, and token handling
  312. 312Kernel Analysis for vphone600 · kernel-analysis-vphone600Look up symbols and addresses in vphone600 kernel dumps and compare them with XNU source
  313. 313Security Auditor · skill-security-auditorScans code, configs and dependencies for vulnerabilities, hardcoded secrets and insecure defaults
  314. 314LlamaGuard Content Moderation · llamaguardScreen user prompts and AI responses for unsafe content using Meta's LlamaGuard classifier
  315. 315NeMo Guardrails Safety Rails · nemo-guardrailsAdds programmable runtime safety checks (jailbreak, PII, toxicity, fact-checks) to LLM apps
  316. 316Prompt Guard · prompt-guardScreens prompts and third-party data for injection and jailbreak attempts before they reach an LLM
  317. 317Enrich Company & Contact Data · enrich-company-and-contact-dataBuilds sourced, decision-ready company and contact lists with fit, identity confidence, and visible data gaps.
  318. 318HubSpot CRM Workflow · hubspotReads HubSpot CRM records and drafts or makes reviewed changes within a Sales workflow
  319. 319Safe File Deletion · safe-file-deletionMakes the agent ask your permission before deleting any file.
  320. 320Security Reviewer · security-reviewerAudits code and infrastructure for vulnerabilities and writes severity-rated security reports with fixes.
  321. 3211Password CLI Setup · 1passwordInstall, sign in to, and read secrets from 1Password using the op command-line tool
  322. 322Camera Snapshot and Clip Capture · camsnapLets the agent grab snapshots, short clips, or motion-triggered events from RTSP/ONVIF cameras.
  323. 323Brigade Host Hardening · healthcheckAudits and hardens the machine running Brigade, with explicit approval before changes
  324. 324Lead Scout · lead-scoutFind local businesses that lack their own website, verified by searching their names
  325. 325OAuth account connection · oauth-setupConnect Gmail or Google APIs via a click-to-authorize link and use the sealed tokens safely
  326. 326Inspect Workspace Tool Policies · policyLets the agent read and explain its per-workspace guard rules that block risky tool calls, and suggest edits the user makes.
  327. 327Android Intent Security Auditor · android-intent-securityAudits Android manifests and code for insecure Intent handling and PendingIntent misuse.
  328. 328Android Permissions Security Auditor · android-permissions-securityAudits Android app permissions and IPC component security, and guides fixes for gaps.
  329. 329Active Directory Offensive Testing · offensive-active-directoryGuides an agent through Active Directory attack methodology for authorized red team engagements
  330. 330NetExec Active Directory Reference · offensive-netexecGives the agent full NetExec (nxc) command reference for Windows/AD network testing and attacks
  331. 331AI Pentest Checklist · offensive-ai-securityGives the agent a structured checklist for security testing of AI and LLM systems
  332. 332Offensive API Security Testing · offensive-api-securityGuides an agent through authorized security testing of REST, gRPC and WebSocket APIs
  333. 333OAuth Security Testing · offensive-oauthWalks an agent through an OAuth attack checklist for testing login and authorization flows in web apps
  334. 334Offensive CI/CD Pipeline Exploitation · offensive-cicd-pipelineGuides an agent through attacking GitHub Actions, Jenkins, GitLab and Azure DevOps pipelines, with exploit code.
  335. 335Offensive CI/CD Secrets Extraction · offensive-cicd-secretsMethodology for extracting and pivoting with credentials from CI/CD pipelines (offensive use).
  336. 336Container Escape Playbook · offensive-container-escapeGuides an agent through breaking out of Docker/containerd/Podman containers to the host.
  337. 337Kubernetes Cluster Attack Techniques · offensive-k8s-attacksGuides an agent through offensive Kubernetes attack techniques, from pod foothold to cluster-wide compromise.
  338. 338Offensive Crypto Attacks · offensive-crypto-attacksFind and exploit misused crypto in apps: padding oracles, ECB, weak MACs, RSA and PRNG flaws.
  339. 339Offensive TLS Attacks · offensive-tls-attacksGuides an agent through auditing TLS/SSL configs and known TLS attack techniques against targets.
  340. 340Exploit Development Course Roadmap · offensive-exploit-dev-courseGuides an agent through a multi-week exploit development syllabus with fuzzing labs and reading lists
  341. 341Exploit Development Guide · offensive-exploit-developmentGuides an agent through exploit development workflow, debugging, PoC building and heap/memory-corruption techniques.
  342. 342Kernel Exploit Mitigations Reference · offensive-mitigationsExplains OS exploit defenses (ASLR, SMEP, KPTI, MTE) and their known bypasses for security assessment
  343. 343Offensive TOCTOU Exploitation · offensive-toctouGuides an agent through finding and exploiting time-of-check/time-of-use race conditions in binaries, kernels and containers.
  344. 344Offensive Anti-Forensics · offensive-anti-forensicsGuides red team operators through hiding or destroying logs, timestamps and other forensic evidence on Windows and Linux targets.
  345. 345Offensive C2 Frameworks · offensive-c2-frameworksGuides an agent through configuring red-team command-and-control tools like Cobalt Strike, Sliver and Mythic
  346. 346Bug Identification Methodology · offensive-bug-identificationGuides the agent through a structured vulnerability-hunting checklist for code audits and bug bounty triage
  347. 347Advanced Red Team Operations · offensive-advanced-redteamPlans and runs authorized red team engagements: scoping, C2 infrastructure, OPSEC, evasion, and reporting.
  348. 348Keylogger Architecture Research Notes · offensive-keylogger-archExplains low-level Windows keylogger designs, their detection signatures (IOCs), and stealth tradeoffs for security research.
  349. 349Offensive Shellcode Reference · offensive-shellcodeGuides an agent through writing, packaging and evading detection for Windows/Linux shellcode payloads
  350. 350Mobile App Pentest Methodology · offensive-mobileGuides an agent through Android and iOS app security testing, from static analysis to Frida hooking.
  351. 351Offensive Network Attacks (Layer 2/3) · offensive-network-attacksGuides an agent through authorized internal network attacks: ARP/LLMNR poisoning, MITM, relay and DNS spoofing.
  352. 352Offensive Data Exfiltration Methods · offensive-data-exfiltrationTeaches an agent red-team techniques for smuggling data out of a target network via DNS, HTTPS, ICMP and cloud channels.
  353. 353Offensive Lateral Movement · offensive-lateral-movementGuides an agent through authorized red-team lateral movement: credential reuse, NTLM relay, remote execution and pivoting
  354. 354Offensive Persistence Tradecraft · offensive-persistenceGives an agent Windows and Linux persistence techniques (registry, tasks, WMI, AD backdoors) for red team engagements.
  355. 355Linux Privilege Escalation Methodology · offensive-linux-privescGuides an agent through escalating from a low-privilege Linux shell to root for authorized security tests.
  356. 356Offensive OSINT Methodology · offensive-osintGuides the agent through open-source intelligence recon on a target domain, person, or crypto address
  357. 357Offensive OSINT Methodology · offensive-osint-methodologyGuides an agent through a structured open-source intelligence investigation checklist, from target definition to reporting.
  358. 358Offensive Social Engineering · offensive-social-engineeringPlans authorized red-team social engineering: pretexts, vishing, smishing, physical access and OSINT.
  359. 359Offensive Dependency Confusion · offensive-dependency-confusionGuides an agent through dependency-confusion attack methodology and recon across package ecosystems.
  360. 360Offensive Supply Chain Attacks · offensive-supply-chainGuides an agent through red-team supply chain attack techniques like dependency confusion and typosquatting
  361. 361Pentest Report Writing · offensive-reportingWrite clear, accurate penetration test reports with CVSS scoring and executive summaries
  362. 362File Upload Vulnerability Checklist · offensive-file-uploadGuides an agent through testing web file upload features for security bypass weaknesses
  363. 363IDOR Testing Checklist · offensive-idorGuides the agent through a structured checklist for finding insecure direct object reference bugs in web apps
  364. 364Open Redirect Vulnerability Testing · offensive-open-redirectGuides an agent through finding and testing open redirect bugs in web apps
  365. 365HTTP Parameter Pollution Checklist · offensive-parameter-pollutionGuides the agent through testing web apps for duplicate-parameter flaws and WAF bypasses
  366. 366Race Condition Testing Checklist · offensive-race-conditionGuides an agent through testing web apps for race condition and TOCTOU bugs, including parallel-request attack techniques
  367. 367HTTP Request Smuggling Checklist · offensive-request-smugglingGives the agent a security-testing checklist for finding HTTP request smuggling flaws in proxies and load balancers.
  368. 368SSRF Security Testing Checklist · offensive-ssrfWalks an agent through server-side request forgery testing, bypasses, and escalation checks
  369. 369Offensive SSTI Testing Methodology · offensive-sstiGuides an agent through finding and exploiting server-side template injection in web apps.
  370. 370Offensive Bluetooth LE Testing · offensive-bluetooth-bleGuides an agent through security testing of Bluetooth Low Energy devices: GATT enumeration, pairing analysis, and sniffing.
  371. 371Bluetooth Classic Attack Methodology · offensive-bluetooth-classicGuides an agent through Bluetooth Classic (BR/EDR) offensive testing methodology against in-scope legacy devices.
  372. 372Wi-Fi Deauth Attack Playbook · offensive-deauth-disassocGuides offensive 802.11 deauth and disassociation attacks, including PMF-aware testing.
  373. 373KRACK & FragAttacks Wi-Fi Testing · offensive-krack-fragattacksGuides testing WPA2 Wi-Fi clients for KRACK and FragAttacks key-reinstall and frame-fragmentation flaws
  374. 374LoRaWAN & Sub-GHz Attacks · offensive-lorawan-sub-ghzGuides an agent through offensive testing of LoRaWAN and 433/868/915 MHz wireless devices
  375. 375Offensive Wi-Fi Reconnaissance · offensive-wifi-reconGuides an agent through passive mapping of nearby Wi-Fi networks before any active wireless testing
  376. 376WPA-Enterprise Wi-Fi Attack Playbook · offensive-wpa-enterpriseGuides an agent through attacking 802.1X/EAP corporate Wi-Fi: evil-twin credential capture, cracking, and AD pivots
  377. 377WPA2 Wi-Fi Password Attacks · offensive-wpa2-pskGuides an agent through offensive WPA/WPA2-PSK Wi-Fi password capture and offline cracking methodology
  378. 378WPA3 / SAE Attack Methodology · offensive-wpa3-saeGuides an agent through offensive WPA3/SAE Wi-Fi attack methodology for authorized testing
  379. 379Offensive WPS Attack Methodology · offensive-wpsGuides an agent through WPS PIN attacks (Pixie Dust, online brute-force) against Wi-Fi routers.
  380. 380Z-Wave Offensive Attack Methodology · offensive-z-waveGuides an agent through attacking Z-Wave smart home networks: sniffing, key flaws, replay and hub pivots.
  381. 381Zigbee, Thread & Matter Attacks · offensive-zigbee-thread-matterGuides an agent through offensive testing of Zigbee, Thread and Matter smart-home radio networks
  382. 382Vendor AI Terms Review · vendor-ai-reviewChecks vendor AI contract terms against your governance positions and flags risky clauses.
  383. 383Privacy Use Case Triage · use-case-triageDecide whether a data processing activity needs a PIA or DPIA, can proceed, or must stop
  384. 384Convex Authz Auditor · convex-authzAudits and hardens authorization in a Convex app: impersonation, missing ownership checks, data leaks
  385. 385Active Directory Attack · active-directory-attackGuides an agent through Active Directory and internal-network attack techniques for authorized pentests
  386. 386AI/LLM App Attack Testing · ai-llm-app-attackGuides an agent through security tests of LLM apps, agents, RAG systems and MCP plugins.
  387. 387Attack Surface Recon · attack-surface-reconMaps a target's attack surface using passive and active recon tools, with CDN and fingerprinting tricks.
  388. 388Binary and Mobile Reverse Engineering · binary-mobile-reversingGuides an agent through reversing APK, EXE, native libraries and firmware, including exploit chains
  389. 389Blockchain Contract Attack · blockchain-contract-attackGuides the agent through smart contract audits and DeFi/bridge attack-surface checks using common tools.
  390. 390Capability Primitive Search · capability-primitive-searchChains low-severity findings into code execution by mapping and searching attack capabilities.
  391. 391Cloud Attack Methods · cloud-attack-methodsGives an agent offensive cloud pentest playbooks: metadata abuse, IAM privilege escalation, K8s, MinIO and Aliyun FC.
  392. 392Component Vulnerability Intelligence · component-vuln-intelMakes the agent search CVE databases, PoC repos and security sites for a identified component's known flaws before attempting exploits.
  393. 393Initial Access & Phishing · initial-access-phishingGuides an agent through red-team initial-access tactics: password spraying, AiTM, device code and OAuth consent phishing.
  394. 394Pentest Agent OS Index · pentest-agent-osIndex for a penetration-testing skill suite that guides an agent through full-chain attack planning
  395. 395Pentest Project Blackboard · pentest-blackboardKeeps penetration-test findings in a project database so an agent can resume work without losing context
  396. 396Pentest Output Standards · pentest-output-standardsFormats penetration-test output: Chinese analysis, vulnerability reports, negative results, and a change ledger with rollback.
  397. 397Pentest Verification Rules · pentest-verificationEnforces evidence-based verification so pentest findings are confirmed, tentative, or recorded as negative results.
  398. 398Post-Exploitation and Cracking Playbook · post-exploitationGuides an agent through privilege escalation, lateral movement, hash cracking and crypto attacks in pentests
  399. 399Proxy Routing and Tool Bootstrap · proxy-tool-bootstrapReroutes blocked pentest requests through proxies and builds replacement tools in Python
  400. 400Red-team OPSEC discipline · redteam-opsecGuides an agent through stealthy red-team tactics: IP-ban bypass, scan pacing, traffic blending, anti-forensics.
  401. 401Source Code Hunting · source-code-huntingGuides an agent through finding leaked source, secrets, risky code and supply-chain flaws
  402. 402Specialized Attack Playbooks · specialized-attack-playbooksGives an agent detailed offensive-security playbooks for specific targets like GoEdge, BT Panel, ARP MITM, OCS and MinIO.
  403. 403Unlimited Attack Scope · unlimited-attack-scopePushes the agent to search, verify, chain and log penetration-testing findings across every security domain without stopping early.
  404. 404Web Attack Methods · web-attack-methodsGives an agent a reference of web-app attack techniques (injection, auth bypass, WAF/CDN bypass) for security testing.
  405. 405Wireless & Hardware Attack · wireless-hardware-attackGuides an agent through WiFi, BLE, RFID, SDR and hardware-interface attack techniques.
  406. 406Zero-Day Discovery Engine · zero-day-discoveryGuides an agent to find unknown vulnerabilities via variant analysis, fuzzing, taint tracing and N-day exploit rebuilding.
  407. 407deepsec Vulnerability Scanner · deepsecScans your repo or recent changes for security vulnerabilities using AI agents
  408. 408deepsec Vulnerability Scanner Guide · deepsec-docsGuides an agent through installing, configuring, running and extending the deepsec AI vulnerability scanner
  409. 409Trap Detector (杀猪盘检测器) · trap-detectorScans Chinese A-share stock tips for 8 signs of pump-and-dump scam promotion and rates the risk.
  410. 410Agentic Supply Chain Detection · agentic-supply-chain-detectionTests whether an AI agent blindly trusts untrusted plugins, tools, models or package updates.
  411. 411Authorization Bypass Detection · authorization-bypass-detectionProbes an AI agent with dialogue to find cross-user access and privilege escalation flaws.
  412. 412Cascading Failure Detection · cascading-failure-detectionProbes an agent's workflow for failures that spread across steps, retries and dependencies.
  413. 413Data Leakage Detection · data-leakage-detectionProbes an AI agent with escalating questions to test whether it reveals secrets, prompts, or user data.
  414. 414Direct Injection Detection · direct-injection-detectionProbes an AI agent with direct prompt-override attempts and reports whether it obeys them.
  415. 415File Path Traversal Detection · file-path-traversal-detectionProbes an agent for unsafe file save, upload and extract paths that escape its workspace.
  416. 416Hardcoded Secret Detection · hardcoded-secret-detectionLets an agent probe a target AI agent for API keys, passwords and private keys left in its code or config
  417. 417Human-Agent Trust Exploit Detection · human-agent-trust-exploit-detectionTests whether an AI agent can be pushed into phishing-like, unsafe, or falsely reassuring advice.
  418. 418Indirect Injection Detection · indirect-injection-detectionTests whether an agent obeys hidden instructions planted in documents, RAG chunks, or web pages.
  419. 419Inter-Agent Communication Security Check · inter-agent-comm-security-detectionTests whether an agent leaks data or lets messages be spoofed between cooperating agents
  420. 420Memory Poisoning Detection · memory-poisoning-detectionTests whether an AI agent stores and later obeys planted malicious instructions in its memory.
  421. 421Memory & RAG Poisoning Detection · memory-rag-poisoning-detectionTests whether an agent's long-term memory or knowledge base can be poisoned with planted directives.
  422. 422OWASP ASI Risk Classifier · owasp-asiTags AI agent security findings with standard OWASP agentic risk categories (ASI01–ASI10)
  423. 423Tool Abuse Detection · tool-abuse-detectionProbes an AI agent's file, code, and network tools for misuse via scripted test prompts
  424. 424Unexpected Code Execution Detection · unexpected-code-execution-detectionTests an AI agent for command injection, eval/exec misuse and remote code loading flaws
  425. 425Web Exfiltration Detection Test · web-exfiltration-detectionRed-team test for whether an agent leaks memory data via chained URL navigation from a malicious page
  426. 426AIG Agent Red-Team Drill · aig-agent-redteamGuides an agent through authorized AI-security red-team tests and evidence-based reports
  427. 427EdgeOne ClawScan Security Check · edgeone-clawscanAudits OpenClaw setups and third-party skills for security risks before you install or trust them.
  428. 428Edgeone Skill Scanner · edgeone skill scannerScans other agent skills for security risks before you install or run them.
  429. 429Throwaway Machine Sandbox · throwaway-machineRun untrusted code in a disposable VM with no network and a read-only repo, then verify isolation.