Loading...
Loading...
Found 136 Skills
Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.
CRITICAL - Detect exposed PostgreSQL database connection strings in client-side code. Direct DB access is a P0 issue.
Audit and refactor code for clarity, maintainability, and correctness. Use when the user asks to refactor, clean up code, reduce complexity, fix code smells, or improve code quality.
Guide for security-related Agent Skills including penetration testing, code auditing, threat hunting, and forensics skills.
This skill should be used when the user asks to "audit this code", "deep analysis before security review", "build architectural context", "line-by-line code review", or needs ultra-granular analysis before vulnerability discovery. Provides structured context-building methodology with First Principles, 5 Whys, 5 Hows micro-analysis patterns.
Review current uncommitted git changes with full file context and produce a structured report with severity levels, actionable fixes, and an approval verdict.
This skill provides systematic bug detection and discovery capabilities for VS Code extensions. Use when searching for hidden bugs, analyzing code for potential issues, investigating suspicious behavior, performing code audits, or proactively finding bugs before they manifest. Covers static analysis patterns, dynamic analysis techniques, code smell detection, and systematic codebase investigation.
Reviews PR changes against issue technical details and acceptance criteria, posts concise outcomes to PR and issue tracker, and routes autonomous next steps.
Use the harem hierarchical code review system to output structured review conclusions based on the division of labor among the Empress, Four Consorts, and Nine Imperial Concubines
Vue2 Frontend Code Review Assistant. Reviews code changes in the src directory of Vue2 projects. Covers 9 major dimensions: component specifications, code style, naming, logic, network requests, computed, security, best practices, and absolute prohibitions. Trigger scenarios: pre-merge review, pre-commit quality check, Code Review for Vue2 code.
Coordinates code modernization: OSS replacement and bundle optimization workers
Augments Trailmark code graphs with external audit findings from SARIF static analysis results and weAudit annotation files. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, cross-referencing Semgrep or CodeQL findings with call graph data, or visualizing audit findings in the context of code structure.