Loading...
Loading...
Found 3,244 Skills
Reviews a change by running the mission, architecture, implementation, craft, security, and performance passes, then weighing them into a verdict.
Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
Used for authorized OT/ICS security assessments, covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
Infrastructure-as-Code: Terraform, Kubernetes, Docker. Generate, review, cost-compare, security-scan. Use for IaC work. NOT for CI/CD (devops-engineer), application code, or actual pricing.
Catalyst Authentication — user login/signup, ZAID, Web SDK auth flows, and OAuth token management via Connections. Trigger on 'authentication', 'login', 'signup', 'getCurrentUser', 'ZAID', 'isUserAuthenticated', 'signOut', 'Connections', or 'getAccessToken'. You MUST load this skill whenever implementing user login or protecting data — ZAID differs between Development and Production and is the #1 cause of auth failures after environment promotion. For Security Rules (function invocation control), route to catalyst-functions.
Use when implementing Google authentication in a Node.js or Python web application — Google login, OAuth 2.0 flows, verifying Google ID tokens, service account authentication, Application Default Credentials, Google Identity Services, Workload Identity Federation, API keys, or working with google-auth-library (Node.js) or google-auth (Python). Covers ID token verification and security best practices. Triggers - "google auth", "google login", "google sign in", "OAuth 2.0 Google", "google-auth-library", "Sign In with Google", "Google Identity Services", "GIS", "ADC", "Application Default Credentials", "service account", "Google ID token", "verifyIdToken", "GOOGLE_APPLICATION_CREDENTIALS", "Google SSO", "вход через Google", "авторизация Google", "сервисный аккаунт", "проверить ID-токен", "гугл-логин". For end-user web sign-in only, use the google-signin skill instead.
Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout. Use when upgrading deps, configuring security policies, or preventing supply chain attacks.
Resolve security signals, IoC matches, or Smartscape nodes to runtime Dynatrace entities and connect findings on different entity levels through a shared runtime entity. Covers identity-to-Smartscape mapping (incl. container-image digest/ID to workload), cross-level topology (K8s pod detection vs. node CVE via pod-to-node), per-entity risk summarization, and coverage match recipes shared by dt-sec-insights. Trigger: "map these findings to workloads/hosts", "which workload does this container image run as", "do these findings relate through the same runtime entity", "enrich this IoC match with entity context", "which threat report mentions this IoC". Queries security.events ONLY for THREAT_REPORT IoC enrichment (matched IoC to attributing reports); Do NOT use for broad security.events posture/overview (use dt-sec-insights), general DQL (use dt-dql-essentials), IoC hunting in logs/spans (use dt-sec-ioc-hunting), or K8s observability outside the security cross-level context (use dt-obs-kubernetes).
Set up Claude Code hooks to intercept dangerous Git commands (push, reset --hard, clean, branch -D, etc.) before execution. Use this when users want to prevent destructive Git operations, add Git security hooks, or block git push/reset in Claude Code.
Judge a change before it lands: a branch, a pull request, a diff against a base point, or uncommitted work. Says what was not inspected rather than calling it clean. Covers what was actually asked for, security and abuse paths, whether the tests prove what they claim, broken contracts and callers outside this repository, and stale docs. Every finding at file:line, and it never edits. Use when the user says "review this", "check this before I commit", "does this hold up", or hands over a branch before opening it. Not for explaining code, formatting-only passes, running the linter or tests, or responding to a review of your own work.
Scan dependencies for known vulnerabilities using OSV. Use when checking for CVEs, reviewing security posture, or investigating who introduced a vulnerable dependency.
Focused Signals scout for PostHog projects collecting Content Security Policy (CSP) violation reports. Watches `$csp_violation` events for fresh blocked-URL clusters, per-directive bursts, page-scoped regressions after deploys, and suspicious third-party domains that may indicate a compromised script. Emits aggregated findings only when a cluster clears the confidence bar; otherwise writes durable memory and closes out empty. Self-contained peer in the signals-scout-* fleet — no dependencies on other skills.