Security & Testing Agent Skills for HTTP / API

Secure Fathom API keys and handle meeting data privacy.

Comprehensive QA of a feature on the staging server — bugs, UX concerns, and questionable design decisions reported with 15-yr QA-engineer…

Expert guidance for ffuf web fuzzing during penetration testing, including authenticated fuzzing with raw requests, auto-calibration, and…

Answer questions about FIASSE v1.1 and SSEM from the bundled framework reference — definitions, principles (Securable Paradigm, Boundary…

PreToolUse protection blocking sensitive file access across 195+ patterns in 12 categories with bash pipeline analysis and multi-tool…

This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary…

Skills for securing file handling, upload pipelines, and authoring defensive payloads.

End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation…

Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed…

Hunt for a hidden threat on a system the user owns — malware/rootkit/backdoor on the running machine, OR a dev-inserted kill switch /…

This skill enables Claude to identify potential security misconfigurations in various systems and configurations.

Secure Finta fundraising data and investor information.

Configure Firecrawl team access control with per-key credit limits and

Executes end-to-end IoT and embedded firmware penetration testing workflows following the OWASP FSTM methodology.

Apply when debugging. Trace each symptom to its root cause and fix it there; reproduce first, ask why until you reach it, resist nil-check…

Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause…

Implement data handling for Flexport supply chain data including PII

Automate Fluxguard tasks via Rube MCP (Composio).

Apply Fly.io security best practices for secrets management, private

Tests web application URL parameters for Server-Side Request Forgery by probing cloud metadata endpoints (AWS/GCP/Azure at…

Microsoft 365 / Entra ID red-team attack chain — current 2026 reality.