AI Agent Skills

Forge and re-sign captured JWTs to test signature validation - algorithm confusion (alg:none, RS256 to HS256), key injection, and secret cracking. Use when testing JWT o…

Owns data understanding BEFORE any model is designed. Places and executes `data/eda.py` (a jupytext `# %%` script) via the shared in-process runner, reads the streamed d…

A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network

Codebase intelligence for TypeScript and JavaScript. Static analysis reports changed-code risk, cleanup opportunities, duplication, circular dependencies, complexity hot…

React2Shell Ultimate - The most comprehensive CVE-2025-66478 Scanner for Next.js RSC RCE vulnerability. Multi-mode detection, WAF bypass, local scanning.

Detect HTTP request smuggling by desynchronising front-end and back-end request parsing, using raw-socket timing and differential probes. Use when testing for HTTP desyn…

Burp-Automator: A Burp Suite Automation Tool with Slack Integration. It can be used with Jenkins and Selenium to automate Dynamic Application Security Testing (DAST).

Web application vulnerability scanner

Backend engineering judgment, distilled from a stronger model - invoke when CHOOSING a tech stack, language, database, queue, or architecture; designing a service, API,…

Comprehensive project audit — security, dependencies, code quality, architecture, performance, infra, docs, and mesh analytics. Use when needing a full 8-dimension healt…

Security-first auditing of AI-generated code — Level 1 quick checks during /toh-dev and /toh-test (hardcoded secrets, dangerous code execution, obvious injection vectors…

Skill hub for the solana-ai-kit Claude Code plugin. Routes the bundled go-to-market skills and the opt-in add-on catalog, and points to upstream marketplaces (and the in…

Defensive security engineering judgment, distilled from a stronger model - invoke when THREAT MODELING a system or feature; making security-relevant design decisions (au…

NoSql Injection CLI tool, for finding vulnerable websites using MongoDB.

Pre-implementation red-team analysis. Use when a plan is high-risk, critical path, or expensive to reverse. Challenges plans before code is written — finds edge cases, s…

squirrelscan audits websites for SEO, performance, security, accessibility, content, and structured data issues (260+ rules) and scores site health, via the squirrel CLI…