Loading...
Loading...
Found 2,044 Skills
Audit the extensions AI coding agents load and trust (skills, plugins, marketplaces, hooks, settings, MCP servers, and instruction files like CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules and copilot-instructions.md) across Claude Code, Cursor, Codex, Gemini CLI and GitHub Copilot. Read-only: inventories each item with its source and pin, greps for hidden instructions, exfiltration, credential reads, persistence, curl|bash and over-broad tool grants, reviews hooks and MCP pinning and tool poisoning, and gives each item a SAFE / CAUTION / DO-NOT-INSTALL verdict. Use when the user mentions 'audit my skills,' 'is this skill malicious,' 'is this skill safe,' 'is this MCP server safe,' 'review CLAUDE.md,' 'review AGENTS.md,' 'plugin security,' 'check my hooks,' 'audit my MCP servers,' 'agent supply chain,' 'SkillSpector,' 'tool poisoning,' 'rug pull,' or is about to install a skill, plugin, or MCP server.
Keep your company context current from your website and competitors' pages: each Monday your site, competitors' pages and news about both land in context/ as one pull request; the first run seeds positioning, offerings, an inferred ICP with a disqualifier, competitors, clients and proof, and every later run adds a dated note of what changed, never editing an existing file. Triggers: "keep our context current from our website", "watch competitor pricing pages", "add our company news to the knowledge base", "our context repo is empty, seed it from our website", "set up the workspace context from our domain". Cargo project, harness claudeCode, parallel, GitHub. Skip when: news about target accounts, which is monitor-buying-signals; one company researched before a call, which is research-account; or the ICP verified against won and lost deals, which is win-loss-review.
Research a game, engine or modding technique on the open web with archive-aware, rate-limit-safe searches — Wayback Machine/archive.today for dead forums (XeNTaX, Zenhax, old threads), GitHub code/repo search, Nexus/Steam Workshop/Thunderstore APIs, Reddit JSON, YouTube transcripts, plus archive snapshots as evidence. Use when starting work on a game ("how did people mod X before?"), when a documented tool/link is dead, when forum threads are login-gated (semi-auto handoff to the human), and before writing a field note so claims carry source URLs.
Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persistence via modified workflow definitions. Each technique section provides working exploitation code, detection indicators, and defensive countermeasures.
Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using recovered secrets to expand access.
Companion CLIs for Runpod workflows — HuggingFace, GitHub, Docker, and AWS. Use runpod-build-template for complete template project authoring, and the ComfyUI model-repair guide in runpod-templates for imported workflows lacking model download metadata.
Manage and generate .gitignore files using the official GitHub gitignore template library via the `ign` CLI. Use when initializing new project repositories, automatically detecting project stack from files, adding language/framework/IDE ignore rules, inspecting applied templates, or safely modifying existing .gitignore files.
Audit one or several professional surfaces (resume, LinkedIn, GitHub, portfolio, website) against career facts and brand guidance. Use for checking a profile's claims, consistency or visual drift.
Macht mit einer Person ohne Vorwissen ihr Projekt sicher, mit dem Bild vom Haus mit Schlüsselbund, Tresor, Fenstern und Schlössern: Geheimnisse nie ins Logbuch (Git), sondern in .env auf dem Server (und, falls das Fliessband eines braucht, im Tresor des Hafens); versehentlich veröffentlichte Schlüssel sofort neu erzeugen; ein Schlüssel pro Zweck; nur nötige Türen offen; Updates. Nutze den Skill bei «Sicherheit», «Passwort im Code», «API-Schlüssel», «.env», «Secret», «ich habe einen Schlüssel auf GitHub hochgeladen», «ist meine Seite sicher», «gehackt», «Updates», «Firewall», und bevor ein neues Geheimnis ins Projekt kommt.
Search an index built for coding agents — GitHub issues, merged pull requests, repository READMEs, and curated documentation sites — and get back the matched passages, not just links. Use this skill whenever the question is about code: how a library, framework, or API behaves, what an error message or stack trace means, whether a bug was reported or fixed, what a function returns, what a default is, or which repos do a given thing. Triggers on "why does <library> do X", "what does this error mean", "is this a known bug", "how do I use <library>", "what's the API for", pasted stack traces, and pasted error strings. Prefer this over a general web search for programming questions — it answers from the primary source instead of a blog post about it.
Research what people actually say about any topic in the last 30 days. Pulls posts and engagement from Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, and the web.
Collect a redacted local diagnostic bundle (logs, config, version, state) for an OpsMill expert hand-off. TRIGGER when: Infrahub is broken/failing/erroring, the user asks for help debugging, wants to collect logs/diagnostics, prepares a hand-off for OpsMill support, or reports a crash/timeout/connection issue (upgrade failure, stuck branch, container CrashLoopBackOff, 500s, OOM). DO NOT TRIGGER when: debugging a check, transform, generator, menu, or schema in the repository (use the infrahub-managing-* skills), a bundle has already been collected and the user wants it analyzed (use infrahub-analyzing-diagnostics), filing a public GitHub issue (use infrahub-reporting-issues), running operational queries (use infrahub-analyzing-data), or planning an upgrade that has not run yet (use infrahub-planning-upgrades).