AI Agent Skills

Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via…

Expert knowledge for Azure Advisor development including best practices, decision making, limits & quotas, security, configuration, and integrations & coding patterns. U…

Performs a technical code review of recently changed files for bugs, security issues, and standards compliance, then writes a report. Use before committing, as a pre-com…

Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 a…

Develop secure smart contracts using OpenZeppelin Contracts libraries. Use when users need to integrate OpenZeppelin library components — including token standards (ERC2…

Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability clas…

16-dimension security posture assessment with adaptive activation, health scoring, and remediation plan. Covers application security, infrastructure, auth, crypto, priva…

Specialist subagent: CI/CD security, SAST/DAST pipelines, supply chain security, container scanning, and security automation specialist. Use when securing CI/CD pipeline…

Role 07 of the Phoenix Security spec pipeline. Turns Phoenix Security requirements into precise implementable contracts: REST API endpoints with Phoenix auth patterns, t…

Enforce traceability from natural-language intent to machine predicates, final observables, evidence, and owner-readable acceptance. Use when conducting any audit, revie…

A Metabase AI-governance coach, covering the *controls and rollout* side of AI: who may use Metabot, what it can see, what it costs, where the model runs, and the audit…

Decide what the system should become before /spec commits an implementation plan. Runs inline in the active coding-agent session, grounds every claim in current reposito…

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-po…

Role 08 of the Phoenix Security spec pipeline. Maps every MUST/MUST NOT to a concrete proof method using Phoenix's proof type hierarchy: unit-test, integration-test, con…

A Metabase AI-readiness coach, covering the *data groundwork* that makes AI answers trustworthy: modeling with Transforms, table and field metadata, the Glossary, saved…

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.