4,624 skills sorted by stars.
Use when reviewing, designing, or modifying Java enterprise systems and need a structured, repeatable ISO/IEC 25010:2023...
Implement A2A authentication — API keys, Bearer tokens, OAuth 2.0, OpenID Connect, and mutual TLS. Use when securing age...
Agent Attestation Protocol - The Reverse Turing Test. Verify AI agents, block humans.
AAuth Laravel RBAC package implementation assistant
ABP permission system - PermissionDefinitionProvider, [Authorize] attribute, CheckPolicyAsync, IsGrantedAsync, ICurrentU...
Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection...
Manage Slack channel access control — pairing, allowlist, channel opt-in
Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, an...
Role-based access control (RBAC) with permissions and policies. Use for admin dashboards, enterprise access, multi-tenan...
Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when...
Conducts access review and entitlement audit against CIS Controls v8 (Controls 5, 6) and NIST SP 800-53 AC family. Auto-...
Master guide for web accessibility following WCAG 2.2 guidelines. Covers audit processes, ARIA patterns, semantic HTML,...
Finish accessibility and performance details.
安全地管理用户账号信息（CRUD）。支持存储密码、API Key、Cookies 等敏感信息，并支持 TOTP (MFA) 代码生成。**所有涉及凭证存储的操作必须优先使用此技能**，不可用于账号注册。
Use when protecting Xiaohongshu account from unauthorized access, preventing account theft, recovering compromised accou...
Maintains the ansible/roles/accounts_policy Ansible role that deploys local account, login, PAM, and password-quality co...
You are **AccountsPayable**, the autonomous payment operations specialist who handles everything from one-time vendor in...
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 80...
Create and debug ServiceNow ACLs (record, field, REST, script-include). Covers role/condition/script patterns, which ACL...
Audits a conversation, codebase, app, website, mobile UI, product workflow, or business system for missing buttons, acti...
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
Analyzes and prioritizes Active Directory and BloodHound attack paths using evidence freshness, disabled principals, pre...
This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pas...
Attack Active Directory Certificate Services (ADCS) — ESC1–ESC8 template/CA misconfigurations to escalate to Domain Admi...
Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis,...
Abuse Active Directory object ACLs/DACLs for lateral movement and escalation — GenericAll, WriteDACL, GenericWrite, Writ...
Abuse Kerberos delegation to impersonate users and take over hosts — unconstrained, constrained (S4U2Self/S4U2Proxy), an...
Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fa...
Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with an...
One line: Active Directory, pivoting/tunneling, and password-cracking arsenal for authorized engagements. Trigger signal...
Active Directory security testing and attack techniques
Audits Active Directory Certificate Services configuration for dangerous certificate templates, PKI ACLs, enrollment int...
Add a Hono API route to Greenhouse: core route under apps/api/src/routes (endpoint comment block, chained new Hono<AppEn...
Scaffold a new Express API route file with JWT auth, org-isolation middleware, zod validation, Prisma queries, and stand...
Implement tamper-evident audit logging with hash chain verification for admin actions (project)
Add authorization methods for a new entity to AuthorizationService. Use after creating a resource service. Triggers on "...
Generate Row Level Security policies for a Supabase table following Arch Systems department isolation patterns
Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the...
Pre-review/pre-commit gate that enforces ADR and spec linkage for non-trivial changes — a change that makes an architect...
Scaffold, accept, index, and link Architectural Decision Records (ADRs). Use when the user says "write an ADR", "record...
Audit paid-ad landing pages for message match, mobile experience, performance, accessibility, trust, forms, consent, tra...
Advanced attack classes beyond the OWASP Top 10 baseline including state desynchronization, cache poisoning, replay atta...
LLM guardrails with NeMo, Guardrails AI, and OpenAI. Input/output rails, hallucination prevention, fact-checking, toxici...
Multi-Agent Adversarial Analysis System for code security
Routes adversarial engineering work to the right review or testing method. Use when the user asks to red-team, adversari...
Review code through hostile perspectives to find bugs, security issues, and unintended consequences the author missed. U...
Non-sycophantic code critique that finds concrete bugs, edge cases, silent failures and security issues with failing inp...