4,624 skills sorted by stars.
Performs a PCI DSS v4.0 compliance review across all 12 requirements and their sub-requirements. Auto-invoked when discu...
Pci Dss Validator - Auto-activating skill for Security Advanced. Triggers on: pci dss validator, pci dss validator Part...
Audit PDF files for metadata leakage, page count, encryption, JavaScript, embedded files, and version. Use before sendin...
安全审计
PDPA (Personal Data Protection Act) is Thailand's comprehensive data protection law that regulates how organizations col...
Show or change Peephole's enforcement mode (guided (default), audit, strict, hardened, off). Use when the user says /pee...
Code review skill — auto-scopes from git changes, reads DOJO.md for project conventions, and produces structured finding...
This skill enables automated penetration testing of web applications. It uses the penetration-tester plugin to identify...
Ultimate Offensive Security Master Skill. Covers Ethical Hacking Methodology, Infrastructure Attacks (AD, AWS), Web Vul...
Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitatio...
Network/infrastructure penetration testing with AD attacks
Orchestrate a penetration test against an approved companion-app engagement — reads scope post-Gate-1, dispatches execut...
Assess Active Directory identity attack paths including roasting, relay, and delegation abuse.
Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.
Test authentication and session management controls for bypass and account takeover scenarios.
Set up authorized C2 simulation workflows and measure defensive detection outcomes.
Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough prepar...
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "pr...
Assess AWS, Azure, and GCP controls for IAM escalation and cloud service exposure.
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "cr...
Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, passwo...
Test Docker and Kubernetes security controls for RBAC abuse, breakout, and secret exposure.
Test egress and DLP controls using synthetic canary data across authorized exfiltration channels.
Define legal scope, rules of engagement, and authorization artifacts for downstream pentest execution.
Assist authorized penetration testing — recon methodology, vulnerability identification, and report writing.
Systematically test authorized targets for SQL, XSS, SSTI, XXE, command, and request-smuggling injection classes.
Assess lateral movement and pivot paths across authorized internal trust boundaries.
Assess mobile applications with static and dynamic analysis aligned to OWASP MASTG and MASVS.
Run controlled exploitation against confirmed vulnerabilities while enforcing scope and authorization gates.
Actively enumerate in-scope hosts and services, then produce normalized network mapping artifacts.
Assess Linux and Windows privilege escalation vectors from existing authorized footholds.
Perform passive reconnaissance and leak intelligence collection with no direct contact to target systems.
Coordinate autonomous pentest skills with dependency enforcement, deconfliction, and emergency stop controls.
Retest remediated findings, detect regressions, and generate remediation status and certification artifacts.
Write a clear penetration-test report from findings of an authorized engagement. Use when documenting a pentest, securit...
Aggregate findings and generate multi-format pentest reports with remediation roadmap and risk scoring.
Write a penetration test scope document. Use when the user says "pentest scope", "pen test scope document", "penetration...
Design phishing and social engineering simulations with explicit authorization and measurable outcomes.
Use when a task involves selecting and operating security-testing tools for a permitted assessment with an auditable sco...
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agen...
Correlate scanner results with CVE and exploit intelligence and prioritize by CVSS and exploitability.
Assess web applications against OWASP WSTG and OWASP Top 10 with reproducible evidence capture.
Evaluate authorized wireless networks for handshake, PMKID, rogue AP, and enterprise auth weaknesses.
Research LinkedIn professional profiles and public business-contact data, including email/phone lookup, people search, a...
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->