grc-control-map-diagra…
Use when creating a draw.io diagram for controls mapped across frameworks, systems, owners, risks, and evidence sources in a GRC, security, audit, compliance,…
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
Use when creating a draw.io diagram for controls mapped across frameworks, systems, owners, risks, and evidence sources in a GRC, security, audit, compliance,…
Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (meta_buffer.md enrichment)
L1 trigger - audits fork-choice rule implementation (LMD-GHOST, Tendermint locking, Nakamoto longest-chain) for equivocation handling, slot-vs-block reasoning,…
Trigger FA_STANDARD flag detected (protocol uses FungibleAsset standard) - Used by Breadth agents, depth-token-flow
Guide NoSQL injection exploitation during authorized penetration testing.
Exploit OAuth 2.0 and OpenID Connect vulnerabilities during authorized penetration testing.
Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash,…
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record
Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration,
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing
Detect Solady SafeTransferLib calls that assume the token has code. SafeTransferLib.safeTransfer/safeTransferFrom/safeApprove deliberately skip the EXTCODESIZE…
Detect bug classes specific to Solana / Anchor (Rust) programs — missing signer checks, missing account owner checks, account-confusion / type-cosplay without…
Detect storage-layout issues in upgradeable contracts — slot collisions, slot reuse, packing changes, missing gap. Activate when reviewing UUPS/Transparent…
Review a host/OS (Linux or Windows) or its baseline image against CIS Benchmark hardening — accounts, services, network, logging, file permissions, and…
Review Infrastructure-as-Code (Terraform, CloudFormation, ARM/Bicep, Pulumi, Ansible, Helm) for security misconfigurations before deployment — public exposure,…
Drive a security incident through the response lifecycle (NIST SP 800-61 / SANS PICERL): triage and scope, contain, eradicate, recover, and capture lessons…
Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,
Detect and analyze covert communication channels used by malware, including
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port
Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif…
Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces…
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image…
Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval…
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when…
Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging…
HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control…
HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application…
Use when creating a draw.io diagram for regulated data flows, data classifications, storage, processing, transfer, access, retention, and logging in a GRC,…
Use when creating a draw.io diagram for evidence collection, evidence lifecycle, audit evidence pipelines, and systems of record in a GRC, security, audit,…
Use when creating a draw.io diagram for mapping controls and obligations across frameworks to show overlap, gaps, and conflicts in a GRC, security, audit,…
L1 supplement - audits Go-specific concurrency hazards in node client code: map iteration non-determinism, goroutine leaks, mutex ordering, panic boundaries,…
L1 trigger - audits message and seen caches for write-after-validate ordering, eviction safety, and duplicate handling.
Protocol Type Trigger governance (detected when Governor, Timelock, voting, proposal, quorum, delegate patterns found) - Inject Into Breadth agents,…
Exploit password reset vulnerabilities during authorized penetration testing.
Performs password spraying against authentication services with lockout-safe techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA, and…
Exploit PHP code evaluation injection via eval(), assert(), preg_replace /e, create_function(), call_user_func(), usort() callbacks, and runtime function…
Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including
Analyzes network traffic generated by malware during sandbox execution or live incident response to identify
Detect bug classes specific to Arbitrum Stylus (Rust→WASM) contracts — storage aliasing & EVM state-cache coherence, msg::value / #[payable] handling,…
Detect ERC-20 token compatibility issues — fee-on-transfer, rebasing, non-standard return values, missing decimals(), low-decimal tokens, blacklistable tokens…
Detect misuse of tx.origin, block.timestamp, block.number — phishing via tx.origin, timestamp dependence, L2-block-number assumptions. Activate on `tx.origin`,…
Create a shareable single-page infographic / one-pager summarizing a security posture, assessment result, metric set, or program update for a non-technical or…
Test a web app for injection flaws — SQL/NoSQL, OS command, LDAP, template injection, and cross-site scripting (XSS). Use to validate OWASP A03 on an…
Extract and operationalize indicators (IOCs) and behaviors (IOAs) from an incident or sample — atomic, computed, and behavioral — and prepare them for…
Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented…
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic