superagent-ai/skills

superagent

Set up Superagent Context Guardrails at coding-agent tool boundaries, configure and safely use the remote MCP server, and manage signed webhooks for findings, security reports, Contributor Trust, and Runtime Guardrails. Use when the user asks to enable…

لغة النص الأصلي: الإنجليزية

repo-security-posture

Audit a GitHub repository's security posture and hardening gaps across branch protection, CODEOWNERS, GitHub Actions, publish/release integrity, collaborator access, security features, and dependency review. Use when reviewing or hardening a repo, assessing…

لغة النص الأصلي: الإنجليزية

security-disclosure-triage

Verify whether an incoming security advisory is a real, disclosable vulnerability in a target repository checkout, and assign an honest severity. Use when triaging an advisory, GHSA, scanner finding, or draft report from the researcher/reporter side to decide…

لغة النص الأصلي: الإنجليزية

redteam-autoresearch

Run a bounded red-teaming autoresearch loop to generate LLM guardrail training data. You (the agent running the skill) are the attacker and the judge: you craft attacks and label every response. The only model the harness calls is the target under test, over…

لغة النص الأصلي: الإنجليزية

hacker

Cursor-native offensive security engagement and exploitability autoresearch orchestrator inspired by offensive-claude. Use for an authorized offensive engagement, red-team or pentest workflow, Kill Chain style assessment, scoped…

لغة النص الأصلي: الإنجليزية

supply-chain-security

Review new or changed dependencies for supply-chain compromise before they enter a project — malicious install scripts (preinstall/postinstall), binding.gyp/node-gyp install-time execution (June 2026 worm), self-propagating worms (Shai-Hulud, binding.gyp),…

لغة النص الأصلي: الإنجليزية

pr-github-ops

Post Superagent PR security scan findings as inline GitHub pull request review comments using the authenticated gh CLI. Use whenever you need to comment on a PR scan finding, manage Superagent PR labels, complete a GitHub check run, or avoid posting findings…

لغة النص الأصلي: الإنجليزية

vulnerability-triage

Triage inbound vulnerability reports - GitHub Advisories (GHSA/CVE), bug bounty submissions, HackerOne/Bugcrowd/Intigriti exports, or a researcher's issue - to decide whether a finding is real, by-design, or noise. Reads the report offline, cross-references…

لغة النص الأصلي: الإنجليزية

crypto-secrets

Audit application source code and configuration for cryptography and secrets hygiene issues: hardcoded API keys, committed .env files, private keys, weak hashes, insecure encryption modes, unsafe randomness, bad KDF/password hashing, JWT signing mistakes,…

لغة النص الأصلي: الإنجليزية

infra-security

Audit Infrastructure-as-Code for security misconfigurations before it ships — Terraform (.tf/.tfvars/.hcl), CloudFormation/SAM (YAML/JSON), Kubernetes & Helm manifests, and Docker / Docker Compose. Reads the IaC offline and reports each misconfiguration at…

لغة النص الأصلي: الإنجليزية

recon-security

Guide authorized external penetration testing from recon through validation and scoped exploitation using free and open-source tools. Use for domain/IP attack surface mapping, subdomain discovery, nmap/httpx/nuclei/ffuf workflows, web app testing, SIP/NAS…

لغة النص الأصلي: الإنجليزية

authz-security

Review application source code for broken authorization — IDOR / Broken Object Level Authorization (OWASP API1), Broken Function Level Authorization (API5), mass assignment (API3), multi-tenant isolation gaps, and privilege escalation. Reads routes,…

لغة النص الأصلي: الإنجليزية

skill-security

Audit an AI agent skill for security risks before installing or trusting it. Runs a deterministic scanner (regex patterns, Python AST analysis, source-to-sink taint tracking, and YARA signatures) and then reasons about intent — catching prompt injection,…

لغة النص الأصلي: الإنجليزية

ci-cd-security

Scan GitHub Actions workflow files for security vulnerabilities by reading the YAML and reporting findings directly — no external tools, no installation, no shell execution. Use this skill whenever the user shares a `.github/workflows/` file, pastes workflow…

لغة النص الأصلي: الإنجليزية