Loading...
Loading...
Found 4 Skills
Scans a repo's GitHub Actions workflows for the ten critical CI/CD attack vectors — template injection, fork code executed with privileges (pwn requests), cache poisoning, impostor action SHAs, secrets dumps, GITHUB_ENV hijack, write-token untrusted triggers, credentials in caches/artifacts, unverified remote code execution (curl|bash and mutable fetch-and-run), and dependency install scripts running in a job that holds secrets — reports every finding with a plain-English attacker scenario, plus pass/fail config hygiene checks, and fixes selected findings via per-finding subagents. Deliberately NOT comprehensive — critical exploit-chain checks only (references/why-these-ten.md). Use when: the user asks to audit or review CI/CD or GitHub Actions security posture, "is my CI secure", "audit my CI security", or names ci-secure / /ci-secure. Do NOT trigger for: CI speed, cost, or wall-clock audits ("why is CI slow") — use ci-speedup; CI config best-practices grading ("grade my CI", "CI score") — use ci-score.
Autonomous bug bounty agent framework with 50 agents, hunt loops, exploit chains, MCP servers for platform integration and writeup search
Comprehensive vulnerability assessment and penetration testing skill leveraging Secator, NetExec, Metasploit, and raw Python for advanced exploitation chaining across Linux, Windows, Unix, macOS systems, network devices (switches, routers, firewalls), protocols, webapps and APIs (REST, GraphQL, gRPC). Uses OSSTMM and OWASP standards. Supports blackbox, greybox, and whitebox pentests with false-positive resistance, verified exploit confirmation, detailed step-by-step remediation, and full documentation. Use when performing security assessments, penetration tests, vulnerability scans, exploit validation, network enumeration, or security auditing.
This skill should be used when the user asks to "simulate attacks", "build attack trees", "model exploit chains", "score exploitability", or is running PASTA stage 6. Also triggers when the user asks about attack scenarios, red team simulation, DREAD scoring, or detection gap analysis in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 6 of 7).