Loading...
Loading...
Found 7 Skills
Deep architectural context building for security audits. Use when conducting security reviews, building codebase understanding, mapping trust boundaries, or preparing for vulnerability analysis. Inspired by Trail of Bits methodology.
PHP Web Source Code Authentication Mechanism Audit Tool. Identify all authentication/authorization implementations from the source code, analyze risks, and output route-authentication mapping and vulnerability analysis (including PoC and repair suggestions).
Guides discovery and documentation of Solana DeFi protocol risks from public code and chain state—Anchor/native programs, PDAs, CPIs, oracles, pools, SPL mechanics, and historical tx reconstruction. Use when the user asks for Solana program security review, DeFi vulnerability triage, PDA or CPI safety, oracle or liquidity-pool risk, launchpad/bonding-curve issues, or evidence-backed severity findings without exploits or private keys.
Reviews a code diff for exploitable security vulnerabilities in a fresh-context read-only subagent, reporting only high-confidence findings with an exploit scenario and fix. Use when the user says "security review", or when asked for a security review of code, a diff, a branch, or a PR. Not for general review; use reviewing-code. Not for a third-party clone; use auditing-repo-security.
Paranoid OWASP-style security analysis of ONE unit (a PR, spec, or branch diff) — severity-ranked findings, non-obvious attack vectors, same-pattern hotspots, and "go deeper" follow-up runs. Writes a redacted report (live exploitable details withheld), kept local by default or shipped as a docs PR, or a fragment for `om-auto-sec-report`. Use for "security review of PR 123".
CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.
Memory corruption root-cause analysis and patch engineering covering stack and heap buffer overflows, use-after-free (UAF), type confusion, integer overflow calculations, and compiler sanitizer verification.