Skill UI

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

A comprehensive, top-level routing skill for authorized web security assessment, bug bounty hunting, and API penetration testing. It guides the agent through a structured methodology, covering the entire attack lifecycle from reconnaissance and vulnerability triage (XSS, SQLi, IDOR, etc.) to advanced business logic flaw identification. Use this skill to ensure thorough, systematic security analysis.

This skill acts as a central orchestrator for all comprehensive Go development tasks. It analyzes the task context—whether designing an API, debugging a panic, or auditing security—and automatically loads a comprehensive set of required, specialized Go skills simultaneously. Designed for advanced AI coding agents, it ensures that complex tasks are never handled by a single, isolated skill, greatly improving coverage and accuracy.

This skill provides comprehensive management for Opencode's permission system. It allows users to review currently always-allowed commands, suggest safe read-only commands, and configure granular access controls using allow/deny/ask patterns. It is essential for optimizing security, performing system audits, and managing the operational scope of the agent.

Mason is the dedicated builder agent responsible for writing clean, functional, and production-ready code. He strictly adheres to architectural blueprints and defined checklists, ensuring every feature is implemented with high code quality standards, including comprehensive error handling, security best practices, and testability. Ideal for the core development phase of complex projects.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

Automate security regression testing for Large Language Model (LLM) applications by integrating Promptfoo and DeepTeam into CI/CD pipelines. This skill enforces a critical security gate, automatically testing endpoints against OWASP LLM Top 10, OWASP Agentic threats, and common jailbreaks/prompt injections. It ensures that security patches do not regress over time due to prompt or model changes, providing continuous risk monitoring.

A comprehensive security tool designed to detect and defend against subtle prompt injection attacks hidden within untrusted multi-modal content, such as web pages, PDFs, and images. It scans for obfuscated payloads (e.g., hidden CSS, metadata, zero-width characters) by combining content normalization, heuristic analysis, and dedicated ML detectors, ensuring that LLM agents only consume sanitized, trustworthy input.

This skill guides the deployment and operation of the Havoc C2 framework, enabling advanced adversary emulation. It utilizes Yaotl profiles to generate highly evasive agents (Demon) that employ sophisticated techniques like indirect syscalls and sleep obfuscation. The scope covers the full red-teaming lifecycle, including C2 setup, payload generation, post-exploitation, and lateral movement, making it ideal for authorized security testing and validating EDR detection capabilities.

This skill performs a comprehensive, read-only, multi-agent review of a git diff or file scope. It launches four specialized sub-agents—covering Regression, Security, Performance, and Contracts—in parallel. The main agent then aggregates, filters, and summarizes critical findings, ensuring the code change is robust, secure, and maintainable. Ideal for pre-commit or Pull Request review workflows.

This comprehensive guide outlines a rigorous, human-in-the-loop engineering workflow for leveraging advanced AI agents to complete complex implementation tasks. It mandates defining clear completion criteria, decomposing work into manageable units, and strategically routing models (Haiku, Sonnet, Opus) based on task complexity. The workflow emphasizes continuous evaluation, regression testing, security review of invariants and edge cases, and strict cost discipline to ensure robust and reliable software development using AI assistance.

This comprehensive tool guides developers through the entire plugin ecosystem, helping them find and recommend the optimal plugins for any given workflow or task. It covers core coordination, multi-agent collaboration, advanced memory management (Vector DB, RAG), architectural design (ADR/DDD), security auditing, and modern development methodologies. Use it when starting a new project or optimizing existing development pipelines.