Total 52,534 skills, Security & Compliance has 2066 skills
Showing 12 of 2066 skills
Enumerate a username across hundreds of platforms with sherlock, maigret, and WhatsMyName, then correlate and confirm which accounts belong to the same person. Use for username OSINT, handle enumeration, "find all accounts for this username", cross-platform account correlation, nickname or screen-name pivots, or turning a handle into a real name.
Establish who registered and who operates a domain using WHOIS, RDAP, and DNS. Use when running a whois lookup, querying RDAP, digging A/AAAA/MX/NS/TXT/SOA/CAA records, reading SPF includes, DKIM selectors or DMARC rua addresses, finding the registrar, registrant, or nameservers, doing reverse DNS/PTR or ASN and netblock lookups, or hunting historical WHOIS and passive DNS for a domain.
Deep-dive a subject's social media presence — profile metadata, follower and mutual network, content analysis, and posting-time pattern of life across Instagram, Facebook, X/Twitter, TikTok, LinkedIn, Reddit, Telegram and Discord. Use when profiling a social account, mapping someone's friends and family, inferring a target's timezone, routine, home or workplace from their posts, or archiving a profile before it's deleted.
Enumerate an organization's subdomains and sibling domains from Certificate Transparency logs and passive DNS. Use when looking for hidden, staging, dev, or VPN hosts, querying crt.sh or CT logs, reading certificate SAN fields, running subfinder or amass, doing subdomain enumeration or DNS brute-forcing, checking newly issued TLS certificates, or mapping the full hostname footprint of a domain.
Craft advanced search-engine queries and Google dorks to surface hidden files, documents, and mentions. Use when building a Google dork, using search operators (site:, filetype:, inurl:, intitle:, intext:, before:/after:), forcing verbatim/exact-match search, finding exposed directory listings, config files, backups, or open S3 buckets, searching paste sites and document repositories for a name, email, or leaked selector, or comparing Google against Bing, DuckDuckGo, and Yandex operators.
Investigate an email address — MX and syntactic validation, Gravatar lookup, corporate email-format inference, breach exposure, and full mail-header analysis (Received chain, Message-ID, SPF/DKIM/DMARC). Use for email OSINT, verifying whether an address exists, finding accounts registered to an address, guessing a company's email format, or tracing where a message actually came from.
Mine GitHub, GitLab, and git history for identities, infrastructure, and leaked credentials using commit author emails, GitHub code search, the commit .patch endpoint, trufflehog, gitleaks, git log pickaxe, and full-ref history scans. Use when investigating a developer or organisation on GitHub, finding leaked API keys, AWS access keys or tokens in code, enumerating org members and their personal repos, recovering secrets deleted from HEAD but present in history or forks, or checking exposed .git directories, gists, and CI logs.
Use this skill when the user asks to scan a transaction, check transaction safety, is this transaction safe, pre-execution check, security scan, tx risk check, check if this approve is safe, scan this swap tx, is this token safe, check token security, honeypot check, is this URL a scam, check if this dapp is safe, phishing site check, is this signature safe, check this signing request, check my approvals, show risky approvals, revoke approval, token authorization, ERC20 allowance, Permit2, or mentions transaction security scanning, token risk scanning, DApp/URL phishing detection, message signature safety, pre-execution risk analysis, malicious transaction detection, approval safety checks, or token approval management. Covers token-scan (batch token risk detection), dapp-scan (URL/domain phishing detection), tx-scan (EVM + Solana transaction pre-execution), sig-scan (EIP-712/personal_sign message scanning), and approvals (ERC-20 allowance and Permit2 authorization queries). Chinese: 安全扫描, 代币安全, 蜜罐检测, 貔貅盘, 钓鱼网站, 交易安全, 签名安全, 代币风险, 授权管理, 授权查询, 风险授权, 代币授权. Do NOT use for wallet balance, send, or history — use okx-agentic-wallet. Do NOT use for general programming questions about security.
Use this skill when the user asks to export audit logs, find audit log location, view command history, 导出日志, 查看日志, 日志路径, 操作记录, 调用记录, 命令历史. Do NOT use for wallet balance, token search, swap, or any other on-chain operation — use the corresponding skill instead.
Authorization system with role-based access control. Must-have for all apps that manage personal or access-restricted data.
Deep-dive a social media profile — map the account, its network and content, extract location and pattern-of-life signals, and pivot to other identities.
Investigate a phone number — normalize and classify it, identify carrier and line type, and pivot to owner identity, messaging apps, and linked accounts.