{
"markdown": "# Security Skills\n\nSecurity skills for AI coding agents — distilled from real security work on codebases that serve 100M+ users a week.\n\nEach skill ships in the open [Agent Skills](https://agentskills.io/) format and loads automatically when the agent hits a relevant task. They turn the model itself into the auditor: encoded rules and offline scanners, not another service to wire up.\n\n## Skills\n\n\nsuperagent: configure MCP, context hooks, and signed webhooks safely
\n\nUse it when you want to connect Cursor, Claude Code, Codex CLI, or another MCP client to Superagent, enforce Context Guardrails through coding-agent hooks, set up signed webhook notifications, troubleshoot the connection, inspect findings and reports, scan context, check Contributor Trust, or manage Runtime Guardrails.\n\nThis is an explicit, opt-in remote integration. It never connects, sends data, changes MCP or hook configuration or organization webhooks, spends organization credits, deletes findings, or changes endpoint policy without the user's request and the required confirmation. API keys and webhook signing secrets stay out of tracked configuration.\n\n```\nConnect Cursor to the Superagent MCP server\nAdd Context Guardrails to my coding agent's hooks\nSet up a signed webhook for completed finding triage\nList my unresolved high-risk Superagent findings\nScan this skill with Superagent Context Guardrails\nTroubleshoot a 401 from the Superagent MCP server\n```\n\n \n\n\nhacker: offensive engagement and exploitability validation
\n\nUse it when you need an authorized offensive workflow for scoped web, network, cloud, mobile, Active Directory, bug bounty, or red-team engagement planning with phase gates, role handoffs, templates, and reports. Use `validate-findings` mode when defensive audits found issues and you need to know which are actually exploitable.\n\nIt is **instruction-only**: it ships no scanners, validators, payload builders, exploit runners, or local scripts. In `engagement` mode, it routes through Kill Chain style phases with scope gates and role-based subagent handoffs. In `validate-findings` mode, it ingests defensive JSON, then runs a bounded background autoresearch loop — hypothesize, experiment, observe, refine — for a user-defined number of cycles (it asks up front, so it never runs indefinitely), chaining confirmations and reformulating inconclusive paths on each pass.\n\nRequires explicit written scope for live validation. Never attacks production by default. Without written scope, it stays in planning or local-only validation and marks live checks `unsafe_to_test`. `recon-security` remains the focused external recon/pentest workflow; `hacker` is the broader offensive engagement orchestrator.\n\n```\nRun a hacker web-app engagement for this scoped lab\nPlan a red-team workflow with phase gates and templates\nValidate these defensive findings: deduped-findings.json\nCan any of these issues actually be exploited?\nAutonomous attack loop on deduped findings with subagents\n```\n\n \n\n\nredteam-autoresearch: generate LLM guardrail training data via a bounded red-team loop
\n\nUse it when you need to red-team an LLM and turn the results into a dataset — stress-testing a model for harmful content, jailbreaks, prompt injection, or backdoor/trigger behavior, and capturing every attempt as labeled JSONL for fine-tuning guardrails.\n\n**You (the agent running the skill) are the attacker and the judge** — you craft the attacks and label every response. The only model the harness calls is the **target** under test, over any OpenAI-compatible API: OpenRouter, Moonshot/Kimi, Fireworks, Ubicloud, OpenAI, or a custom endpoint with its key in `.red-team/.env`. Model IDs are provider-specific, so copy them from the provider catalog. The loop is bounded and gated like `hacker`'s, with the `confirmed`/`mitigated`/`inconclusive`/`false_positive`/`unsafe_to_test` outcome taxonomy. A thin harness queries the target and records your judgments; every attempt (pass and fail) is saved under an isolated `.red-team/runs//` directory, and refusals become the `safe` negatives a guardrail needs. An exporter converts the log to Llama Guard (S1–S14) and chat-classification training formats.\n\nIt is authorization-first and local-only: run it against models you are authorized to test, and keep generated content local for guardrail training. It complements `hacker` (code/infra exploitability) by targeting model behavior and producing data.\n\n```\nRed-team this model for jailbreaks and prompt injection and build a dataset\nGenerate guardrail training data across harmful content, jailbreaks, backdoors\nRun a bounded red-team autoresearch loop for N rounds against a Kimi, Nemotron, or OpenRouter model\nMine novel jailbreaks at scale and export Llama Guard training JSONL\n```\n\n \n\n\nci-cd-security: supply-chain and pwn-request bugs in GitHub Actions
\n\nUse it when you're reviewing `.github/workflows/`, hardening a release pipeline, or chasing `pull_request_target`, template injection, action pinning, or cache poisoning.\n\nEvery finding comes with a severity (P0–P3) and a concrete rewrite. It catches:\n\n- Dangerous triggers — `pull_request_target`, `workflow_run`\n- Over-broad `GITHUB_TOKEN` permissions\n- Mutable action pins (tags/branches instead of a SHA)\n- Shell/template injection in `run:` blocks\n- Untrusted checkout, cache poisoning, artifact-borne injection\n- Release hardening (OIDC, environments, provenance) and self-hosted runner risk\n\nRules track the consensus from Astral, OpenSSF, GitHub Security Lab, Chainguard, and zizmor — without running any of them.\n\n```\nReview this GitHub Actions workflow for security issues\nCheck .github/workflows/ci.yml for pull_request_target vulnerabilities\nAudit our release workflow for cache poisoning risks\n```\n\n \n\n\nrepo-security-posture: GitHub repository hardening and maintainer-facing security todos
\n\nUse it when you're reviewing or hardening a GitHub repository's security posture — branch protection, CODEOWNERS, GitHub Actions, publish/release integrity, collaborator access, security features, and dependency review.\n\nIt collects read-only GitHub configuration and repository files into a JSON inventory, marks admin-gated settings as `not_verified` instead of guessing, then produces a prioritized maintainer todo list grouped by:\n\n- Publish & release integrity\n- Branch & merge protection\n- Sensitive-path ownership\n- CI/CD workflow hardening\n- Account & access control\n- Dependency & supply-chain review\n\n```\nAudit this GitHub repo's security posture: https://github.com/org/repo\nHarden this repo against a compromised maintainer\nReview branch protection, CODEOWNERS, and Actions security for owner/name\nWhat should we fix first in this repo's GitHub security settings?\n```\n\n \n\n\nskill-security: answer \"is this skill safe to install?\"
\n\nUse it before you install or trust a skill, plugin, `SKILL.md`, or agent tool — a local folder, a `.zip`/`.skill`, or a cloned repo.\n\nIt runs in two stages. First, a deterministic, offline scanner (`scripts/scan.py` — regex, Python AST, source-to-sink taint tracking, YARA signatures) does the high-recall pass and scores the skill 0–100. Then the model judges intent and runs the contract check: does what the skill *claims* to do match what its code *actually* does? It catches:\n\n- Prompt injection and audit-manipulation attempts\n- Credential/secret exfiltration and outbound data theft\n- Persistence and agent-memory poisoning\n- Malicious code, webshells, cryptominers (YARA)\n- Supply-chain and dependency risk\n- Description-vs-behavior mismatch\n\n```\nIs this skill safe to install? ~/Downloads/some-skill.zip\nAudit ./vendor/skill-foo/SKILL.md for prompt injection or credential theft\n```\n\n \n\n\nauthz-security: broken access control (IDOR/BOLA) in your application code
\n\nUse it when you're reviewing routes, controllers, or resolvers, auditing a PR that adds or changes endpoints, or hardening a multi-tenant SaaS — anywhere you need to answer \"can one user reach another user's data?\"\n\nIt reads your source offline — routes, handlers, and data models — and reports the missing ownership or role check at `file:line` with a framework-correct fix. No running app, no credentials, no tools. Every finding comes with a severity (P0–P3) and a concrete rewrite. It catches:\n\n- Object-level gaps — IDOR / Broken Object Level Authorization (OWASP API1): objects loaded by id with no owner scoping\n- Function-level gaps — Broken Function Level Authorization (OWASP API5): privileged actions behind authentication but no role check\n- Mass assignment (OWASP API3) — request bodies that can set `role`/`owner_id`/`tenant_id`\n- Multi-tenant isolation leaks — unscoped collection and list endpoints\n- Identity trusted from client input, and authentication mistaken for authorization\n\nRules encode OWASP's #1 web risk (A01) and top two API risks, applied as a source-code read rather than a live pentest — the defensive complement to a dynamic BOLA tester.\n\n```\nReview this endpoint for broken access control / IDOR\nCan a user access another user's data through this controller?\nAudit our multi-tenant API for BOLA and missing authorization\n```\n\n \n\n\nrecon-security: external pentest workflow with free/open-source tools
\n\nUse it when you're running an authorized external pentest: recon, validation, scoped exploitation, and reporting on domains, IPs, web apps, TLS, SIP/VoIP, or exposed storage — without commercial APIs.\n\nIt guides the agent end to end: scope/RoE, passive recon, normalization, active scanning, web and infrastructure checks, triage, manual validation (Burp/ZAP), scoped exploitation when approved, and final reporting. No bundled scripts — the model proposes commands and checklists; the user runs tools locally. It covers:\n\n- Recon: DNS, WHOIS/RDAP, RIPEstat, CT, `subfinder`, `amass`, `gau`, `waybackurls`, `httpx`, `nmap`, `nuclei`\n- Web: `ffuf`, `arjun`, `sqlmap` detection mode, `dalfox`, misconfiguration checks\n- Infra: SIP/VoIP and NAS/SMB/NFS exposure checks when in scope\n- Validation and PoC bar; exploitation boundaries in `references/exploitation-roe.md`\n- Pairing with `authz-security` for IDOR/BOLA when source or two-account testing is available\n\n```\nPlan a full external pentest for example.com with free tools only\nRun validation on these nuclei findings before we report\nWhat exploitation is allowed under our RoE for this SQLi lead?\nGive me passive recon commands for example.com and where to save evidence\n```\n\n \n\n\nsupply-chain-security: malicious or compromised dependencies before they land
\n\nUse it when you're adding or upgrading a dependency, reviewing a PR that changes `package.json`, `requirements.txt`, `go.mod`, or a lockfile, or deciding whether a package is safe to install — anywhere you need to answer \"is this dependency safe to add?\"\n\nIt reads your manifests, lockfiles, install scripts, and dependency diffs offline — across npm/pnpm/yarn, PyPI, Go, Cargo, RubyGems, Maven/Gradle, NuGet, and Composer — and reports each risk at `file:line` with a concrete fix. No install, no execution, no phoning home. Every finding comes with a severity (P0–P3). It catches:\n\n- Malicious install scripts — `preinstall`/`postinstall` hooks that harvest and exfiltrate secrets (the Shai-Hulud and nx `s1ngularity` worm pattern), and **`binding.gyp`/`node-gyp` execution** that bypasses lifecycle-script scanners (June 2026 worm)\n- Obfuscated payloads, credential harvesting, exfiltration, persistence, and worm self-propagation\n- Typosquatting and slopsquatting (AI-hallucinated package names) of real dependencies\n- Dependency / namespace confusion — unscoped internal names a public registry can hijack\n- Maintainer account takeover, and version hygiene gaps (floating ranges, missing lockfile/integrity, no cooldown or provenance)\n\nRules track the consensus from OpenSSF, OSV, Socket, Datadog, and the 2025 npm worm post-mortems — applied as a pre-install source read, the defensive complement to a continuous SCA scanner.\n\n```\nIs this dependency safe to add?\nReview this PR's package.json and lockfile changes for supply-chain risks\nCheck this package's postinstall script for Shai-Hulud / credential theft\n```\n\n \n\n\nsecurity-disclosure-triage: reporter-side advisory verification before disclosure
\n\nUse it when a researcher-side advisory, GHSA, scanner finding, or draft report needs an honest \"is this worth disclosing?\" decision against a target checkout.\n\nIt optimizes against false confirmations and inflated severity. The skill requires the agent to reproduce the implicated construct, trace the real asset guard, build a usable exploit path, check intended behavior and trust boundaries, ground the finding in shipped state, and run an adversary pass before recommending disclosure. It emits both `TRIAGE_REPORT.md` and `triage-result.json` using the reporter-side disposition taxonomy.\n\n```\nVerify this advisory before disclosure\nTriage this scanner finding against the checked-out repository\nIs this GHSA worth disclosing or by-design/operator responsibility?\n```\n\n \n\n\nvulnerability-triage: is this advisory a real finding, by-design, or noise?
\n\nUse it when a GitHub Advisory (GHSA/CVE) lands against a dependency, a bug bounty or HackerOne/Bugcrowd/Intigriti report hits your inbox, or a researcher files an issue — anywhere you need to answer \"is this real, by-design, or noise?\"\n\nIt reads the report offline, cross-references the project's documented intent — `SECURITY.md`, README, code comments, closed issues, changelog — statically audits any PoC without executing it, and emits a structured markdown triage report. No Docker, no network, no PoC execution. Every verdict comes with a severity (P0–P3 / Informational / By-Design) and a recommended action. It catches:\n\n- By-design behavior dressed up as a vuln — CORS preflight, documented rate limits, intentional public assets, debug verbosity, admin-only features\n- Unreproduced or theoretical claims — gated to Informational until a PoC is confirmed\n- Reporter severity inflation — scored independently from reproduced evidence\n- Verdict-steering and prompt-injection attempts inside the report itself\n- The real-bug twin of each by-design pattern, so genuine findings aren't waved through\n\nReproduction is model-audited and user-run: the model inspects the PoC for dangerous behavior and hands you safe, pinned-version steps to run in your own sandbox.\n\n```\nTriage this vulnerability report: \nIs this advisory a real finding or by-design?\nReproduce and score this GitHub advisory: GHSA-xxxx\n```\n\n \n\n\ncrypto-secrets: hardcoded secrets and broken cryptography in application code
\n\nUse it when you're reviewing source that handles credentials, encryption, JWTs, TLS clients, sessions, or password hashing — anywhere you need to answer \"are we leaking secrets or relying on broken crypto?\"\n\nIt runs in two stages, like `infra-security` and `skill-security`. A deterministic, dependency-free scanner (`scripts/scan.py` — pure stdlib, no network, no `pip install`) finds high-signal candidates with `file:line` anchors; then the model confirms impact, suppresses fixtures/placeholders, redacts secret values, and writes concrete fixes. It catches:\n\n- Exposed credentials — API keys, OAuth/Bearer tokens, Slack/GitHub/Stripe keys, database URLs, PEM private keys, committed `.env` values\n- Weak crypto — MD5/SHA1 password hashing, DES/3DES/RC4, AES-ECB, CBC/CTR without authentication, static IVs/nonces\n- Token and transport bugs — weak token randomness, hardcoded JWT secrets, `alg: none`, missing `exp`, disabled TLS verification, SSL/TLS 1.0/1.1\n- Key-management and serialization risks — hardcoded encryption keys, private keys in source, unsafe `pickle`/`yaml.load`\n\nRules track OWASP, NIST, CWE, and language-specific crypto guidance — applied as an offline source read rather than a live credential validator.\n\n```\nAudit this repo for hardcoded secrets and weak crypto\nScan for exposed API keys in this codebase\nReview JWT handling for algorithm confusion or weak secrets\nFind verify=False / InsecureSkipVerify / rejectUnauthorized false\n```\n\n \n\n\ninfra-security: misconfigurations in your Terraform, Kubernetes, CloudFormation, and Docker
\n\nUse it when you're about to apply a Terraform plan, reviewing a PR that changes K8s/Helm manifests or a Dockerfile, checking CloudFormation before deploy, or prepping for a SOC-2 / PCI-DSS / ISO-27001 audit — anywhere you need to answer \"what's the blast radius if this infra is wrong?\"\n\nIt runs in two stages, like `skill-security`. A deterministic, dependency-free scanner (`scripts/scan.py` — pure stdlib, no `pip install`, no `hcl2`/`pyyaml`) does the high-recall first pass over every `.tf`/`.yaml`/`Dockerfile` with `file:line` anchors and a CI-friendly exit code; then the model adds the judgment a regex can't — blast radius, cross-resource chains, and false-positive suppression. Every finding comes with a severity (P0–P3) and a corrected snippet. It catches:\n\n- Network — security groups open to `0.0.0.0/0` on SSH/RDP/database ports, all-ports ingress, unrestricted egress\n- IAM — wildcard `Action`/`Resource`, `*` principals on resource and KMS policies, `PassRole` on `*`, over-broad roles on compute\n- Storage — public S3 ACLs, missing public-access-block, encryption-at-rest disabled (S3/EBS/RDS)\n- Containers — privileged/root pods, host namespaces, the Docker socket mounted in, `:latest` images, missing limits\n- Secrets — plaintext credentials in variables/env/ConfigMaps, missing TLS, plaintext-HTTP endpoints\n\nRules track the CIS Benchmarks, AWS Well-Architected, and the Kubernetes Pod Security Standards — applied as a source read rather than another scanner to wire up.\n\n```\nAudit this Terraform for security issues: \nReview these Kubernetes manifests before deploy: \nCheck this CloudFormation for public S3 buckets: \nWhat's the blast radius if this Terraform is wrong?\n```\n\n \n\n## Install\n\n```bash\n# everything\nnpx skills add superagent-ai/skills\n\n# or pick one\nnpx skills add superagent-ai/skills --skill superagent -a cursor -y\nnpx skills add superagent-ai/skills --skill hacker -a cursor -y\nnpx skills add superagent-ai/skills --skill redteam-autoresearch -a cursor -y\nnpx skills add superagent-ai/skills --skill ci-cd-security -a cursor -y\nnpx skills add superagent-ai/skills --skill repo-security-posture -a cursor -y\nnpx skills add superagent-ai/skills --skill skill-security -a cursor -y\nnpx skills add superagent-ai/skills --skill authz-security -a cursor -y\nnpx skills add superagent-ai/skills --skill recon-security -a cursor -y\nnpx skills add superagent-ai/skills --skill supply-chain-security -a cursor -y\nnpx skills add superagent-ai/skills --skill security-disclosure-triage -a cursor -y\nnpx skills add superagent-ai/skills --skill vulnerability-triage -a cursor -y\nnpx skills add superagent-ai/skills --skill crypto-secrets -a cursor -y\nnpx skills add superagent-ai/skills --skill infra-security -a cursor -y\n```\n\nOnce installed, skills load on their own when a task matches — nothing to remember or invoke by hand.\n\n**Migration:** Use `--skill hacker` for the offensive engagement framework.\n\n## Repo layout\n\n```\nskills/\n superagent/ SKILL.md (opt-in Superagent MCP integration)\n hacker/ SKILL.md + references/ (instruction-only engagement framework)\n redteam-autoresearch/ SKILL.md + references/ + scripts/ (red-team autoresearch harness)\n ci-cd-security/ SKILL.md + references/\n repo-security-posture/ SKILL.md + references/ + scripts/ (GitHub repo posture collector)\n skill-security/ SKILL.md + scripts/ (scanner) + rules/ (YARA) + references/\n authz-security/ SKILL.md + references/\n recon-security/ SKILL.md + references/\n supply-chain-security/ SKILL.md + references/\n security-disclosure-triage/ SKILL.md\n vulnerability-triage/ SKILL.md + references/\n crypto-secrets/ SKILL.md + scripts/ (scanner) + references/\n infra-security/ SKILL.md + scripts/ (scanner) + references/\n```\n\nA skill is a `SKILL.md` (the agent's instructions) plus optional `references/`, `scripts/`, and `rules/`.\n\n## Contributing\n\nNew skills and rule improvements are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). The bar is a real security problem the model gets wrong by default, encoded as durable rules that run offline.\n\n## License\n\nReleased under the [MIT License](LICENSE).\n",
"bytes": 20938,
"sha": "c02d2e15dc81683dcfe068765bfbaf062877563d040df4ea4b30989817c8907b",
"repo_slug": "superagent-ai/skills",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/skl_superagent_ai_skills_skill_security_1783351b/readme"
}