Security & Testing Agent Skills

Minimize the admission of containers with allowPrivilegeEscalation (Manual)

When to activate: HashiCorp Vault, secrets engine, auth method, dynamic secrets, lease, agent sidecar, KV store, PKI, AppRole

Multi-simulator expertise for functional verification of FPGA designs

Health Physics & Radiological Shielding: ALARA principles, linear no-threshold (LNT) models, point-kernel gamma/neutron attenuation ($I =…

Patient safety evaluation harness for healthcare application deployments.

Create and control a disposable named Herdr session from inside an existing Herdr session.

Run Playwright CLI commands via Bash for test execution, code generation, browser management, reporting, and debugging.

Hardware-in-the-loop test development and automation expertise

Check HIPAA compliance for healthcare data security requirements.

When to activate: HIPAA, PHI, protected health information, healthcare data, covered entity, business associate, BAA, health records…

HIPAA compliance validation skill for genomic data handling and audit

LLM & VLM evaluation suite for home security AI applications

Readiness checklist for homelab VLAN segmentation, local DNS filtering, and WireGuard-style remote access before changing router…

Segmenting home networks into VLANs for IoT, guest, trusted, and server traffic using UniFi, pfSense/OPNsense, and MikroTik — including…

Apply Hootsuite security best practices for secrets and access control.

Hunting skill for oauth vulnerabilities.

Implement HubSpot lint rules, secret scanning, and CI policy checks.

Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA…

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted…

Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick…

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs…