security-audit

CTF-style security and correctness audit. Use when the user asks for a security review, before deploying user-facing services, or when reviewing auth, payments, or anything that touches secrets.

Ir para a instalação

Repositório: Kevin-Liu-01/Agent-Machines
Última atividade na origem: 12 de maio de 2026 às 08:51
Idioma detectado do SKILL.md: inglês
Estrelas: 17
Forks: 3

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/Kevin-Liu-01/Agent-Machines --skill security-audit

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

dedalus-machines

How Agent Machines work -- providers (Dedalus, E2B, Sprites), agent runtimes (Hermes, OpenClaw, Claude Code, Codex), MCP catalog, bootstrap, and closed-loop verification. Use when asked about the runtime, scaling, sleep/wake, destroy, or inspecting this environment.

2026-05-21

reticle-aesthetic

Build landing page sections, hero blocks, and marketing surfaces in the Reticle/Sigil engineering-instrument-grid aesthetic. Use when creating new landing sections, hero components, marketing pages, or when the user says "reticle", "hero", "landing page", "new section", "instrument panel", "grid cell", or wants to match the existing Agent Machines visual language.

2026-05-19

aframe-webxr

Declarative web framework for building browser-based 3D, VR, and AR experiences using HTML and entity-component architecture. Use this skill when creating WebXR applications, VR experiences, AR experiences, 360-degree media viewers, or immersive web content with minimal JavaScript. Triggers on tasks involving A-Frame, WebXR, VR development, AR development, entity-component-system, declarative 3D, or HTML-based 3D scenes. Built on Three.js with accessible HTML-first approach.

2026-05-17

Ver todas deste repositório

Class	Smell	Bug
Auth	role/permission check after the operation	TOCTOU privilege escalation
Auth	`if user.is_admin or req.is_admin`	request body forging the role
Path	`path.join(root, user_input)`	path traversal via `../` or absolute paths
SQL	string-formatted query	SQL injection
Shell	`subprocess(..., shell=True)` with user input	command injection
Deserialize	`pickle.loads`, `yaml.load`, `eval` on untrusted	RCE
Crypto	`==` on hashes/HMACs	timing attack
Crypto	random tokens via `Math.random` / non-CSPRNG	predictable secret
Webhook	no signature verification	replay/forgery
Webhook	timestamp not checked	replay even if signed
API	error responses leak stack traces or DB schema	recon assist
API	rate-limit per IP only	trivial bypass via headers
CORS	`Access-Control-Allow-Origin: *` with `credentials: true`	session theft
JWT	`alg: none` accepted, or HMAC verified with public RSA key	forge tokens
Race	concurrent updates without optimistic locking	lost updates, double-spend
SSRF	server-side fetch with user URL	metadata service exfil

Severity:    crit | high | med | low
Location:    file:line
Trust path:  [source] → [sink]
Repro:       <exact request / input / payload that triggers it>
Fix:         <minimal code change>

name	security-audit
description	CTF-style security and correctness audit. Use when the user asks for a security review, before deploying user-facing services, or when reviewing auth, payments, or anything that touches secrets.
version	1.0.0
author	Kevin Liu
license	MIT
metadata	{"agent-machines":{"tags":["security","audit","ctf","code-review"],"related_skills":["empirical-verification","plan-mode-review"]}}

name	security-audit
description	CTF-style security and correctness audit. Use when the user asks for a security review, before deploying user-facing services, or when reviewing auth, payments, or anything that touches secrets.
version	1.0.0
author	Kevin Liu
license	MIT
metadata	{"agent-machines":{"tags":["security","audit","ctf","code-review"],"related_skills":["empirical-verification","plan-mode-review"]}}

security-audit

Opções de instalação

Revise os arquivos de origem

Security Audit

Trust boundaries

Security Audit

Trust boundaries

Top patterns to hunt

Hermes-specific: prompt injection

Required output

False-positive avoidance

Recurring patterns from real Dedalus incidents

security-audit

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Security Audit

Trust boundaries

Mais deste repositório

Security Audit

Trust boundaries

Top patterns to hunt

Hermes-specific: prompt injection

Required output

False-positive avoidance

Recurring patterns from real Dedalus incidents