safety-red-team
Responsibly red-team an AI system to find SAFETY failures — harmful outputs, jailbreaks that defeat safety guardrails, and foreseeable-misuse / dangerous-…
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
Responsibly red-team an AI system to find SAFETY failures — harmful outputs, jailbreaks that defeat safety guardrails, and foreseeable-misuse / dangerous-…
Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and…
Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning…
Auditing Terraform infrastructure-as-code for security misconfigurations
PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion,…
Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management…
Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE…
HIPAA Security Rule expert for US healthcare compliance. Deep knowledge of 45 CFR Part 164 Subpart C, Administrative/Physical/Technical Safeguards, Required vs…
NERC Critical Infrastructure Protection expert. Reference-depth framework plugin with scope determination, evidence checklist, and SCF-backed assessment…
Sarbanes-Oxley Act of 2002 (SOX) expert for ICFR-relevant IT and security work. Deep knowledge of 15 U.S.C. §§ 7201 et seq., §302/§404/§906 certifications,…
Trigger Pattern Always (Aptos Move) - generic type exploitation - Inject Into Breadth agents, depth-state-trace
L1 trigger - audits validator entry/exit transitions, slashing correctness, leader-duplicate handling, and lifecycle state invariants for PoS / DPoS / BFT…
Protocol Type Trigger vault (detected in recon TASK 0 Step 1) - Inject Into Core state agent OR economic design agent (merge via M4 hierarchy)
Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning,
Run or ingest static application security testing (SAST) results on a codebase, triage them to remove false positives, and confirm the real issues with code…
Analyze a project's dependencies (software composition analysis): generate/inspect an SBOM, find known-vulnerable and risky components, and prioritize…
Detect hardcoded secrets, cloud keys (AWS/GCP/Azure), tokens, .env files, and sensitive config before they're committed or pushed, and verify .gitignore covers…
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate
Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash,…
Automates the enrichment of raw indicators of compromise with multi-source
Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode,…
WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft…
Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to…
Conducts comprehensive vendor security assessments. Evaluates vendor security posture, identifies risks, and generates assessment reports with recommendations.
Scaffolds a complete React/Vite website project from site-config.json. Generates components, styles, and configuration based on the site type and plan data.
Sets up GitHub Actions CI/CD workflow for automatic deployment to AWS on push to main. Uses GitHub OIDC for keyless AWS authentication.
How to prove a hypothesis is TRUE or FALSE using Move unit tests.
L1 trigger - audits file/database write paths for metadata commits, cache updates, and success returns that diverge when writes fail.
Trigger Pattern Vault/pool/first-depositor pattern detected - Inject Into Depth-edge-case
Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID)
Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation,
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership
Review how secrets are handled across code, IaC, CI/CD, containers, and config — hardcoding, sprawl, exposure, vaulting, rotation, and access scope. Use to…
Assess an architecture's control completeness against OWASP ASVS and an organization's security-practice maturity against OWASP SAMM. Use when a design review…
Establish or assess an org-wide secure-by-design program — paved roads / golden paths with secure defaults, automated guardrails, and developer enablement — so…
Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and…
Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate…
Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map…
WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.
AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and…
Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or…
Builds the React/Vite site, syncs to S3, and invalidates CloudFront cache. Uses the plugin's bundled deploy.sh script.
Deploys AWS CloudFormation infrastructure stacks for the website (S3, CloudFront, Route 53, ACM, and optionally contact form API).
Validates AWS readiness for website deployment. Checks CLI tools, credentials, SES, Route 53, and ACM. Produces a report with pass/fail and action items.
Designs and documents structured incident response playbooks that define step-by-step procedures for specific
Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic