Loading...
Loading...
Found 3,212 Skills
Find and review Google Drive files shared outside the organization.
Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.
Check and interpret data-breach exposure for an email, username, or phone. Use when checking Have I Been Pwned, investigating breach or leak exposure, finding which services an account used, or assessing credential compromise.
Audit and harden Convex authorization: identity-from-arg impersonation, missing per-document ownership checks, PII-leaking public queries, and writes into containers the caller doesn't own. Deterministic scan + canonical requireIdentity/requireOwner fix + tsc verify. Use for 'secure my app' / 'audit auth' / 'who can access this data', not generic code review.
Passive reconnaissance workflow for a domain, website, or IP — maps DNS, subdomains, infrastructure, tech stack, history, and ownership without touching the target.
Investigate an email address — validate it, find linked accounts and breaches, and pivot to the owner's identity, usernames, and other contact selectors.
Mine GitHub, GitLab, and git history for people, infrastructure, and leaked secrets. Use when investigating a developer or org on GitHub, finding leaked API keys or credentials in code, or pivoting from commits, emails, and repos.
Craft advanced search-engine queries to surface hidden or specific content. Use when building Google dorks, using search operators (site, filetype, intext, inurl), finding exposed files or documents, or narrowing searches for a name, email, or leak.
Find internet-exposed hosts, services, and devices from third-party scan data. Use when searching Shodan or Censys, finding open ports and banners, identifying an IP's tech stack, or discovering exposed databases, cameras, or industrial devices — without scanning the target yourself.
Look up domain registration and DNS records. Use when running WHOIS/RDAP, querying DNS records (A, MX, TXT, NS, SPF, DKIM, DMARC), finding a domain's registrant, nameservers, or mail setup, or resolving IPs and ASNs.
Mine GitHub, GitLab, and git history for identities, infrastructure, and leaked credentials using commit author emails, GitHub code search, the commit .patch endpoint, trufflehog, gitleaks, git log pickaxe, and full-ref history scans. Use when investigating a developer or organisation on GitHub, finding leaked API keys, AWS access keys or tokens in code, enumerating org members and their personal repos, recovering secrets deleted from HEAD but present in history or forks, or checking exposed .git directories, gists, and CI logs.
Establish who registered and who operates a domain using WHOIS, RDAP, and DNS. Use when running a whois lookup, querying RDAP, digging A/AAAA/MX/NS/TXT/SOA/CAA records, reading SPF includes, DKIM selectors or DMARC rua addresses, finding the registrar, registrant, or nameservers, doing reverse DNS/PTR or ASN and netblock lookups, or hunting historical WHOIS and passive DNS for a domain.