Skill rating

Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XS

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

Legal and compliance expertise for corporate governance, contract analysis, regulatory compliance (SOX, GDPR, HIPAA), risk assessment, intellectual property, and litigation management. Use when review

Add production-ready authorization (RBAC, ABAC, ReBAC) to Convex apps with O(1) permission checks. Use when implementing roles, permissions, access control, multi-tenancy, or relationship-based author

Analyzes events through legal lens using statutory interpretation, case law analysis, legal reasoning, constitutional principles, and multiple legal frameworks (common law, civil law, international la

Vendor-neutral, governed, READ-ONLY energy/substation telecontrol data tap — the energy edition (变电/电力) of Industrial-AIOps. Monitor-direction telemetry over IEC 60870-5-104 (IEC-104: RTU link status,

AI large model / algorithm regulatory filing assistant for China's CAC requirements. Helps determine filing type, prepare required materials, generate security assessment report frameworks, guide syst

Expert in browser automation using Chrome DevTools Protocol (CDP) and WebDriver. Specializes in secure web automation, testing, and scraping with proper credential handling, domain restrictions, and a

Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and

iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage i

AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.

Create security architecture diagrams using PlantUML syntax with identity, encryption, firewall, and compliance stencil icons. Best for IAM flows, zero-trust models, encryption pipelines, and threat d

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review",

AI-powered Shopify store management through natural language prompts

Configure, optimize, and troubleshoot CDN deployments with caching strategies,。Use when 需要代码生成、编程辅助、调试测试、开发部署时使用。不适用于无明确技术栈的模糊需求。适用于独立开发者、企业团队和自动化工作流场景。

Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.

This skill enables encoding and decoding of text messages using the Hiro hieroglyphic system. It supports:

AI-powered insurance anti-fraud analysis skill — detects and prevents insurance fraud across all major insurance types. Covers claim fraud identification (10-feature engine), underwriting risk control

基于人民卫生出版社《生物化学与分子生物学》第10版的AI技能合集 — 154项核心技能，涵盖分子生物学、代谢调控、基因组学、临床诊断与精准医学。

Sora2 视频平台数据查询助手。覆盖作品详情、用户数据、搜索、评论、Cameo等全功能。

Systematically improve Threads content using real performance data and algorithm-aware drafting

Update an existing specification file for the solution, optimized for Generative AI consumption based on new requirements or updates to any existing code.

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserializati

WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.

Apply when handling credit card data, implementing secureProxyUrl flows, or working with payment security and proxy code. Covers PCI DSS compliance, Secure Proxy card tokenization, sensitive data hand

ProtonMail integration via Proton Mail Bridge for reading and sending encrypted emails.

Skills for age verification and age-appropriate content filtering.

Skills for detecting adult/inappropriate content.

Extract data from construction images using AI Vision. Analyze site photos, scanned documents, drawings.

Skills for geographic restrictions and regional compliance.

电商知识产权与合规检测一站式 AI 工具集，整合睿观知产合规检测（版权/商标/外观专利/实用新型专利/图片政策）与智慧芽专利数据查询（著录/权利要求/说明书/附图/法律状态/家族/引用/以图搜图/PDF）共 2 类底层工具、22 项子能力。

Session and cookie security auditor (OWASP A07:2021 — Identification and Authentication Failures). Scans Express/Koa/Fastify, Flask/Django/FastAPI, Go net/http, Spring Boot, and Rails source code for

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

Audits game assets for compliance with naming conventions, file size budgets, format standards, and pipeline requirements. Identifies orphaned assets, missing references, and standard violations.

Create a new specification file for the solution, optimized for Generative AI consumption.

Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.

Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next cate

抖音数据查询与工具助手。覆盖视频详情、用户数据、搜索、热榜、创作者工具、星图达人、内容指数等模块。含部分交互触发和协议工具接口（已标注）。

LinkedIn 职场数据查询助手。覆盖用户资料、公司信息、职位搜索、帖子、评论、广告等全功能，支持V1/V2双版本API。

Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

Use when essential PHP security patterns including input validation, SQL injection prevention, XSS protection, CSRF tokens, password hashing, secure session management, and defense-in-depth strategies

Write competitive research proposals for NSF, NIH, DOE, and DARPA. Agency-specific formatting, review criteria, budget preparation, broader impacts, significance statements, innovation narratives, and

Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific f

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security sc

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

Subagente autônomo especialista em Meta Ads. Cria campanhas completas via MCP (Super Prompt), gera criativos com IA, monitora métricas (CPA/ROAS/CTR), executa otimizações, pausa anúncios ruins e alert

Security advisory feed with automated NVD CVE polling for OpenClaw-related vulnerabilities. Updated daily.

Queries Huawei Cloud identity and access management resources (IAM) via read-only Python SDK. Covers users, groups, policies, agencies, AK/SK, MFA devices, login/password/ACL policies, security compli