stack-overflow-and-rop
Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu,…
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu,…
Interpret splunk-inspector findings and translate Splunk retention, RBAC, audit, search ACL, and auth posture into compliance evidence and remediation.
StateRAMP expert for state and local government cloud services. Deep knowledge of State Risk and Authorization Management Program including Low/Moderate impact…
Interpret Tenable vulnerability-management findings for scan coverage, credentialed scans, vulnerability age, and scan access visibility.
Trigger STABLESWAP_FORK flag (fork-ancestry detects Curve/StableSwap parent via get_d/get_y/ramp_a/StableSwap patterns) - Agent Type general-purpose…
Type Thought-template (instantiate before use) - Research basis Donation attacks via unsolicited token transfers
L1 trigger - audits state sync, snapshot integrity, checkpoint trust, pruning race conditions, and state growth attacks.
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous
Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains
Manage the vulnerability remediation lifecycle: assign owners and SLAs, track fix/verify/close states, handle risk acceptances and exceptions, and report…
Gap-assess an AI system or program against a responsible-AI / governance framework — NIST AI RMF, ISO/IEC 42001, EU AI Act, OECD principles — covering…
Test whether content planted in a RAG corpus (or otherwise retrieved) can steer the model's answers or trigger actions — i.e. indirect prompt injection and…
Auditing Microsoft Entra ID (Azure Active Directory) configuration to
Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting…
Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and…
Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots,…
Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired…
Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis…
Interpret testssl-inspector normalized findings, recommend remediations, and tie evidence back to SCF anchor controls plus SOC 2 / NIST 800-53 r5 / PCI DSS…
Calculates vendor risk scores using inherent and residual risk factors. Generates risk ratings, comparisons, and treatment recommendations.
Build and deploy a production-ready Trust Center for any company. Use this skill whenever someone asks to create a trust center, compliance portal, security…
Type Thought-template (instantiate before use) - Trigger Pattern STORAGE_LAYOUT flag detected
Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth agents
Trigger Pattern TEMPORAL flag (required) - Inject Into Breadth agents, depth-state-trace
Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using
Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS
Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library
Run a structured security risk assessment and maintain a risk register — identify, analyze, evaluate, and treat risks (ISO 27005 / NIST SP 800-30) against the…
Rank a set of enumerated threats or findings by risk (likelihood × impact) and map each to a prioritized mitigation. Use after STRIDE/PASTA enumeration or any…
Scan Python or React/JS code for outdated, banned, or vulnerable functions/methods (eval, pickle.loads, subprocess shell=True, dangerouslySetInnerHTML, md5 for…
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and…
Auditing Google Cloud Platform IAM permissions to identify overly permissive
Auditing Kubernetes cluster RBAC configurations to identify overly permissive
Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key…
Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi),…
Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat,…
California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) expert. Deep knowledge of California Civil Code §1798.100 et seq., CPRA-amended…
US Export Controls expert covering ITAR and EAR. Provides comprehensive guidance on defense articles (USML), dual-use commercial items (CCL), jurisdiction…
FINRA Broker-Dealer Cybersecurity Guidance expert. Stub-depth framework plugin that routes to the SCF crosswalk. Level up by adding framework-specific context,…
Trigger Pattern TOKEN_2022 flag detected (token_2022/spl_token_2022/transfer_checked usage) - Inject Into Breadth agents, depth agents
Trigger Pattern BALANCE_DEPENDENT flag (required) - Inject Into Depth-token-flow, breadth agents
Type Reference document (prevents method signature hallucination) - Trigger trident_available true in build_status.md
Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and
Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with
This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security
Assemble a structured assurance / safety case for deploying an AI system — an explicit argument that it is acceptably safe for its context, backed by evidence…
Design and run a safety evaluation suite for an AI model or feature across harm categories — refusals on disallowed content, robustness, over-refusal vs…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic