Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Adversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.
Get nicely formatted output of the last review comments on a PR. Used internally by other skills.
Hunting skill for business-logic vulnerabilities (CWE-840 Business Logic Errors, CWE-841 Improper Enforcement of Behavioral Workflow, CWE-639 Authorization Bypass via User-Controlled Key in business contexts, CWE-362 race conditions on financial flows). Built from 44 corpus reports plus 8.8K shared-platform reports across HackerOne, Bugcrowd, Huntr, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Lilishop coupon overpurchasing (CVE-2024-50654 CVSS 7.5), WWBN AVideo wallet double-spend TOCTOU (CVE-2026-34368, GHSA-h54m-c522-h6qr), Keycloak 2FA bypass (CVE-2025-3910, GHSA-5jfq-x6xp-7rw2), AlegroCart 1.2.9 negative-quantity price manipulation (Andrey Stoykov SecLists Apr 2025), Bagisto cart price manipulation (Rudransh Singh Rajpurohit Sep 2025), Doppler free-trial reset (Aditya Sunny Dec 2024), Stripe hasEverTrialed bypass (better-auth
Hunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants. Built from public bug bounty reports across HackerOne, Intigriti, Bugcrowd, Huntr, and GitHub Security Advisories, plus 2024-2026 meta verified against NVD — DOMPurify nesting mXSS (CVE-2024-47875, GHSA-gx9m-whjm-85jf), DOMPurify depth-bypass family (CVE-2024-45801, GHSA-mmhx-hmjr-r674), DOMPurify mXSS via Re-Contextualization (GHSA-h8r8-wccr-v5f2), Auth0 nextjs-auth0 returnTo (CVE-2025-67716, GHSA-mr6f-h57v-rpj5), React Server Components DoS family (CVE-2025-67779/55184, GHSA-5j59-xgg2-r9c4), markdown-to-jsx iframe XSS (CVE-2024-21535), listmonk stored XSS → Admin ATO (GHSA-jmr4-p576-v565, CVSS 8.0). Use when hunting DOM XSS, stored XSS, reflected XSS, postMessage XSS, mXSS, sanitizer bypass (DOMPurify / sanitize-html / bleach), OAuth redirect_uri XSS, prototype pollution → XSS gadgets, markdown renderer XSS, Server Components content injection, agentic LLM output injection.
OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT specialist. Dispatcher passes subtype — 'oauth', 'oidc', 'saml', or 'jwt' — in the task; falls back to inference. Use for redirect_uri / returnTo flaws, state/nonce/PKCE bypass, alg confusion (none/HS-with-RS-key/kid/jku), SAML XSW + comment injection + assertion replay, OIDC ID token validation gaps, code/token leak channels, cross-tenant impersonation, PKCE downgrade, and any flow involving a code, access_token, id_token, assertion, client_id, client_secret, code_verifier, code_challenge, kid, or jku parameter.
Open Redirect specialist (H1 #38). Use for testing URL redirect parameters, login/logout flows, OAuth callbacks, and any endpoint that redirects based on user input.
Bug bounty PoC and report builder. Use after confirming a vulnerability to create minimal reproduction steps, self-contained HTML demonstration pages, curl-based reproduction scripts, and platform-ready report drafts for HackerOne/Bugcrowd/Intigriti.
Report quality scorer. Use BEFORE submitting any report to validate completeness, clarity, title strength, CVSS accuracy, PoC quality, and overall report grade. Provide the draft report path or content.
Race Condition specialist (H1 #29). Use for testing TOCTOU flaws, double-spend, parallel request abuse on balance operations, coupon redemption, and any non-idempotent state changes.
Maps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command.