Audits, threat modelling and secure coding.
Reverse engineer apps, firmware and web targets using REA runtime evidence.
Tests REST, GraphQL, and gRPC APIs for broken authorization and other OWASP API flaws.
Reviews codebases, APIs, and services for vulnerabilities and runs pen-test workflows.
Assesses REST, GraphQL, WebSocket, and SOAP APIs for authorization and rate-limit flaws.
Explains decrypting Windows DPAPI secrets in authorized red-team engagements.
Reviews an agent skill before install for safety, permissions, and malicious behavior.
Aggregates cybersecurity annual reports across vendors and categories for analysis.
Runs AppSec tests across a product and ranks reachable issues into a fix plan.
Finds curated web security learning resources by topic, difficulty, and language.
Writes IDA Pro Python scripts for disassembly, decompilation, and binary analysis.
Performs security audits, threat modeling, OWASP checks, and incident response.
Plans authorized multi-stage attack paths across recon, access, escalation and impact.
Describes Active Directory attack methods for authorized internal red team work.
Takes over AD accounts via key credentials and recovers NT hashes for testing.
Decompiles APK and JAR files and extracts API endpoints and call flows.
Describes internal domain attacks on AD, ADCS and NTLM for authorized testing.
Runs the deepsec AI scanner on a repo, branch or uncommitted changes.
Finds code vulnerabilities and proves them with working exploits in a sandbox.
Runs C, C++ and Rust code under AddressSanitizer to catch memory errors.
Adapts a C and C++ ASAN vulnerability pipeline to another target class.
Finds risky dependencies, malicious plugins and untrusted update sources.
Audits a repo or subsystem for security, correctness and maintainability risks.
Describes linguistic evasion patterns for authorized AI red team testing.
Strips AI provenance marks, watermarks and C2PA metadata from files.
Black-box tests a live AI agent for tool hijacking, memory poisoning and excess permissions.
Decompiles and scans Android APKs for secrets, exposed components and risky intents.
Migrates function names and offsets between binary versions with LLM-based diffing.
Add Claude Code hooks that block destructive git commands before they run.
Adversarial security review of Thunderbolt's end-to-end encryption.
Patches root causes of pentest findings and reruns Strix to prove each fix holds.
Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery.
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and...
Security auditing for code, configs, and infrastructure.
Warns before destructive shell commands run.
Operate a selective workspace for complex reasoning, long tasks, repository...
Use when Codex is already in the attack-path-analysis phase of a security scan or the...
Flag customer, prospect, partner, or outside-person identities in the diff.
Create cross-platform agent skills from workflow descriptions.
Use deepsec (an AI-powered vulnerability scanner), one-shot initialization, resumable...
Proactive threat hunt over web/application logs, no alert in hand.
Use this skill whenever the user asks to add, absorb, migrate, port, update, merge...
Builds the backend of an app clone: auth, database migrations and access rules...
Write Python in n8n Code nodes (native Python, `language` pythonNative, n8n 2.x).
AATMF T3, Reasoning & Constraint Exploitation.
Comprehensive code review assistant that analyzes code quality, security, and best...
Triggered when the user submits code or requests a comprehensive code quality analysis.
The anti-PUA.
Audits code for security issues and proposes reproductions and fixes.
