Security & Testing Agent Skills for Windsurf (legacy)

Orchestrate a full, authorized security assessment of an application — web, API, cloud-native, CI/CD, mobile, network service, or…

USAP agent skill for Attack Surface Management.

Build comprehensive attack trees to visualize threat paths.

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security…

Secure Attio API integrations -- token scoping, secret management,

Secondary Authoritative Time Source

Audit an existing Coval evaluation setup for coverage, misleading scores, missing evidence, judge validation and execution risk.

Find and triage known vulnerabilities in authorized project dependencies, lockfiles, vendored packages, and container manifests.

Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through…

Run a tenant-neutral, read-only Windows prerequisite audit before repairing Microsoft Intune enrollment or Hybrid Entra Join.

Audit a website or digital experience against its supplied source references for originality and plagiarism risk.

This skill should be used when the user asks to "check the implementation against the documents", "audit the platform", "does the code do…

This skill enables Claude to audit access control implementations in various systems.

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police…

Use when checking this repository's skills for security or quality issues before sharing them, or remediating findings across skills.

Sonnet Amplified fullstack engine. 34 modes, SEC-01~15 OWASP security, 13 runtime hooks, 75% token reduction.

Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature…

When to activate: JWT, OAuth2, OIDC, authentication, refresh token, session, MFA, passkeys, authorization

This skill should be used when the user asks about "authentication in Next.js", "NextAuth", "Auth.js", "middleware auth", "protected…

Agent-native admin CLI for authentik identity provider with offline SQLite cache and an MCP server for Claude Desktop.

Help with ABAP authorization and IAM (Identity and Access Management) including authorization objects, authorization checks, IAM apps…