Loading...
Loading...
Found 10 Skills
Analyze CVE vulnerabilities in Java and JavaScript components, determine false positives, and provide upgrade recommendations. Use this when users provide a CVE number and affected object, e.g., CVE-2024-38816 and spring-webmvc-5.3.39.jar. Supports false positive analysis, compatibility risk assessment, and standard report generation.
Specialized in reverse-engineering compiled binaries (JARs, DLLs). Use this when the user asks to compare versions, find security fixes, or analyze binary patches.
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
Deep architectural context building for security audits. Use when conducting security reviews, building codebase understanding, mapping trust boundaries, or preparing for vulnerability analysis. Inspired by Trail of Bits methodology.
PHP Web Source Code Authentication Mechanism Audit Tool. Identify all authentication/authorization implementations from the source code, analyze risks, and output route-authentication mapping and vulnerability analysis (including PoC and repair suggestions).
Whole-codebase vulnerability analysis leveraging 1M context window. Loads entire project source, runs deep security analysis in a single pass. Opus 4.6 found 500 zero-day vulnerabilities in pre-release testing — this skill weaponizes that capability.
Guides discovery and documentation of Solana DeFi protocol risks from public code and chain state—Anchor/native programs, PDAs, CPIs, oracles, pools, SPL mechanics, and historical tx reconstruction. Use when the user asks for Solana program security review, DeFi vulnerability triage, PDA or CPI safety, oracle or liquidity-pool risk, launchpad/bonding-curve issues, or evidence-backed severity findings without exploits or private keys.
Reviews a code diff for exploitable security vulnerabilities in a fresh-context read-only subagent, reporting only high-confidence findings with an exploit scenario and fix. Use when the user says "security review", or when asked for a security review of code, a diff, a branch, or a PR. Not for general review; use reviewing-code. Not for a third-party clone; use auditing-repo-security.
Paranoid OWASP-style security analysis of ONE unit (a PR, spec, or branch diff) — severity-ranked findings, non-obvious attack vectors, same-pattern hotspots, and "go deeper" follow-up runs. Writes a redacted report (live exploitable details withheld), kept local by default or shipped as a docs PR, or a fragment for `om-auto-sec-report`. Use for "security review of PR 123".
CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.