mitre-attack
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing
**AUDIT SKILL** — Comprehensive on-chain Solana program auditor and full-stack security review for ANY programming language. USE FOR: auditing Solana/Anchor…
In-session, token-efficient LLM security scan of a repo (SAST triage). A lightweight, native Claude Code pipeline — survey → threat-model → deep-dive →…
Mine GitHub Security Advisories and CVE databases for incomplete fixes, finding variant vulnerabilities in patched code or similar patterns in related packages.
Detect authentication and authorization bypass vulnerabilities including missing auth middleware, JWT algorithm confusion, IDOR, and session fixation.
Detect code injection vulnerabilities in packages that dynamically generate or evaluate code via new Function(), eval(), vm.run*, or template literal…
Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv, elf, so, macho, apk) to assess if they are malicious, perform decompilation, extract…
Query the Android/AOSP kernel CVE database to look up a specific CVE, find CVEs affecting a kernel version or build date, find unpatched CVEs in a branch, or…
Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point…
Structured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation
ACTIVATE THIS SKILL FOR ANY SHELL COMMAND OR FILE READ. Check curl, wget, rm, sudo, apt, dpkg, chmod, dd, format, powershell, bash, sh. Check pipe patterns…
Diagnose, install, and verify Agent Guard's plugin-local binary, jq and gitleaks dependencies, the active host integration, and live hook protection. Use when…
Install or refresh Agent Guard's plugin-local shell integration. Use when the user explicitly asks to enable or update shell command masking, or when a…
This skill should be used when the user asks about "AI security", "ML pipeline attacks", "prompt injection", "model deserialization", "unsafe model loading",…
This skill should be used when the user asks about "business logic", "workflow vulnerability", "trust boundary", "state machine", "authorization bypass",…
This skill should be used when the user asks about "cache poisoning", "web cache deception", "CDN cache", "proxy cache", "nginx cache", "varnish", "cache key…
Safe flow state for Claude Code. Auto-approves routine actions, activates when the agent is about to: write files, run shell commands, send messages, access…
This skill should be used when the user mentions "log cleaning", "clear logs", "wipe logs", "timestomp", "timestamp manipulation", "metadata stripping",…
Activate this skill whenever the user mentions API endpoint, REST API, RESTful, GraphQL, GraphQL introspection, GraphQL mutation, gRPC, gRPC reflection,…
This skill activates when the user mentions "patch analysis", "binary diff", "binary diffing", "bindiff", "BinDiff", "Diaphora", "diaphora", "radiff2",…
Endpoint interest scoring, mobile app ownership confidence, attack-path hint patterns, a severity decision matrix, sector severity overrides, and sidecar…
Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure…
Concrete endpoints, probes, and enumeration techniques for identity provider fingerprinting and auth surface mapping. Covers Microsoft Entra (Azure AD), Okta,…
Launch the AKA web dashboard in your browser (reads your local store)
Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source
Audit a site's Cross-Origin Resource Sharing (CORS) configuration for misconfigurations — wildcard origin with credentials, reflected arbitrary Origin, the…
Audit project dependencies for known-vulnerable versions and risky pinning. Parses requirements.txt and package.json, matches a bundled offline advisory DB,…
Scan a Dockerfile for insecure build patterns — running as root, unpinned or :latest base images, ADD from remote URLs, piping curl/wget into a shell,…
Detect missing or incorrect access control — missing modifiers, wrong role checks, privileged function exposure, public initializers, and role-escalation…
Detect ERC-20 approval pitfalls — approve race (front-run), missing safeApprove, infinite approvals, approval-without-revoke, Permit2 misuse, max-approval to…
Always-on meta-skill — cache audit results per file by content hash so unchanged files aren't re-analyzed on subsequent runs. Activate on every /audit,…
**Skill for AI agents (Claude Code, OpenClaw, Cursor, etc.)**
Review agent-to-agent (A2A) / multi-agent-system trust: peer identity and authentication, message integrity, capability-negotiation trust, and delegation-chain…
Test a web app's authorization: IDOR/BOLA, missing function-level access control, privilege escalation (horizontal and vertical), and forced browsing. Use to…
Plan and run an objectives-based adversary-emulation engagement: select a relevant threat actor, build an ATT&CK-mapped emulation plan across the attack…
Use SaferSkills to find, evaluate, and safely install AI agent capabilities (skills, MCP servers, hooks, plugins, rules) and to assess a whole agent. Run this…
Clearfront OSINT is a free, open-source tool that scans a digital footprint. Use it when someone wants to know what is public about an email, username, phone…
對使用者自己的程式碼做防禦性安全審查,檢測資安漏洞、資料外洩風險、壓力/效能風險與程式品質,並產出「依嚴重度排序的風險報告 + 修正後程式碼」。涵蓋 Google Apps Script(Workspace 自動化)、前端 HTML/CSS/JS、後端 API(Node/Python/PHP…
Adversarial, attacker-minded security review of ANY untrusted code before you trust it — a GitHub repo, a Claude/agent skill, an MCP server, a plugin, an npm…
Coleta o máximo de informação (recon/OSINT) sobre um ou mais domínios usando a ferramenta local SimpleReconSubdomain, entregando a saída em JSON por domínio.…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic