Security

Entry P1 category router for API security.

CSRF testing playbook.

WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws.

Create an automation that reads a list of public RSS and Atom feeds on a schedule - daily by default - keeps what is new and matches the configured topics…

CI/CD与开发平台攻击深度专业技能：DevOps供应链攻击链(源码→构建→制品→发布)、代码托管平台攻击(GitHub/GitLab/Gitee)、Git对象深度利用与Secret挖掘、CI系统攻击(Jenkins CVE-2024-23897/GitHub Actions workflow注入/GitLab…

LDAP注入深度测试与域渗透联动高级技能：RFC 4515过滤器语义深度、AND/OR注入、通配符滥用横向接管、认证绕过、RDN/过滤器混淆、盲注高效提取（二分/位运算OID/OAST外带）、非标准属性与AD专属属性利用、LDAPS/StartTLS/通道绑定与NTLM Relay、Spring Data…

XPath/XQuery注入深度攻防专业技能：认证绕过、盲注高效提取（二分/字符集二分/位运算/超时外带/OAST）、任意节点读取完整攻击链、XPath 1.0/2.0/3.1差异、XQuery注入面（BaseX/eXist/MarkLogic）、XML安全联动（XXE/XInclude/XSLT…

Use Langfuse for LLM observability and evaluation and look up Langfuse documentation.

Scan the ClawHunter agent bounty marketplace for opportunities that genuinely match this agent's real capabilities (code, security research, writing) and…

云安全深度攻防与审计专业技能（v3.0）：AWS/Azure/GCP/阿里云全平台配置审计与云上渗透、IAM深度攻击（策略混淆代理/OIDC信任滥用/sts:AssumeRoot/21种提权路径）、云原生完整攻击链（元数据→IAM横向→数据泄露→权限提升）、容器与K8s逃逸、Serverless/Lambda注入、托…

Fastjson/Fastjson2反序列化漏洞深度利用专业技能：版本探测、AutoType全版本绕过、JNDI/BCEL/TemplatesImpl/c3p0利用链、1.2.83 Gadget-free RCE(CVE-2026-16723)、Fastjson2…

Log4Shell（CVE-2021-44228）及 Log4j2 全漏洞家族深度利用专业技能：JNDI Lookup 全链路原理与利用、全变体家族（44228/45046/45105/44832/4104）、现代 JDK 高版本绕过矩阵（8u191/17/21+）、Lookup…

安全自动化顶级专业技能：DevSecOps全流程集成、CI/CD安全管道、SAST/DAST/SCA/容器/IaC自动化扫描编排、安全工具链集成实战、攻防双视角自动化（红队打点/蓝队检测响应）、SOAR深度编排、Agentic AI安全自动化（LLM…

Apache Shiro安全框架深度利用专业技能v3.0：rememberMe Cookie AES-CBC/CBC-GCM双模式深挖、密钥爆破方法论升级(Padding Oracle深度解密原理/工具选型/并行加速)、Gadget链版本兼容矩阵、Shiro-550/721、认证绕过全系列(CVE-2020-1957…

Spring Framework漏洞深度利用专业技能：全年代CVE时间线（2016-2026）、Spring Boot Actuator深度利用与heapdump凭据链、SpEL注入全家族、Spring4Shell数据绑定RCE、Spring…

Use Sokosumi with API-key auth, direct agent hires, coworker tasks, job monitoring, and result retrieval from non-interactive agent environments.

Execution-gap audit - cross-references the startup idea backlog against shipped skills, prototypes, and cross-repo PRs, surfacing the top 3 ideas to build…

One-shot Base-token investigation - runs any subset of six onchain-security checks (rug-scan, contract-audit, deployer-trace, holder-concentration, honeypot…

Recap of everything shipped since the last run - cross-repo PRs, security fixes, star deltas, and X traction, synthesized into a digest article and a…

Live developer experience audit.

Work effectively inside a local Agent Canvas environment, including local agent-server auth, frontend/backend port discovery, safe workspace hygiene, and…

Read Blink camera and video-doorbell state, list motion clips, and prepare guarded home-security control requests without exposing Blink credentials.

Generate images and video through the Higgsfield MCP - text-to-image, text-to-video, and image-to-video with motion control across 100+ models.

Read your Robinhood Agentic brokerage account via the Robinhood Trading MCP - portfolio, buying power, positions, and order history - and place a single…