Skills MCP Plugins Subagents

Browse by category

DevOps & CI/CD Skills Productivity & Workflow Skills Other Skills Product & Project Management Skills Documentation & Knowledge Skills Code Review & Refactor Skills Backend & APIs Skills Agent Meta & Communication Skills Research Skills Security Skills UX UI & Design Skills Testing & QA Skills See all →

Every Claude Code skill, MCP server, plugin and subagent in one directory. Searchable, comparable, and one command from installed. Live stats from GitHub, npm and PyPI.

We're on Product HuntYour agent's app storeCheck it out →

Agent Skills MCP Servers Plugins Subagents Coding Agents

Collections Official publishers Glossary FAQ Blog Search Saved Feedback

Privacy Terms llms.txt Sitemap

made with ♥ · © 2026 aaaa.fyi

Independent project · real data from public registries

…/xalgord/xalgorix

home/skills/xalgord/xalgorix

xalgord/xalgorix

59 skills

$npx skills add xalgord/xalgorix

SkillInstalls

analyzing-cloud-storage-access-patternsDetect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS—analyzing-ethereum-smart-contract-vulnerabilitiesPerform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy,—analyzing-office365-audit-logs-for-compromiseParse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation,—auditing-aws-s3-bucket-permissionsSystematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs,—auditing-azure-active-directory-configurationAuditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies,—auditing-cloud-with-cis-benchmarksThis skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS,—auditing-gcp-iam-permissionsAuditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage,—auditing-kubernetes-cluster-rbacAuditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous—auditing-terraform-infrastructure-for-securityAuditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and—building-cloud-siem-with-sentinelThis skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security—bypassing-binary-exploitation-mitigationsMethodology for identifying and defeating common binary hardening mitigations during authorized exploitation ——conducting-cloud-penetration-testingThis skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP—detecting-ai-model-prompt-injection-attacksDetects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex—detecting-api-enumeration-attacksDetect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier—detecting-aws-cloudtrail-anomaliesDetect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis—detecting-broken-object-property-level-authorizationDetect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive—detecting-shadow-api-endpointsDiscover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis,—exploiting-ai-model-file-rceTesting machine-learning model files and model-loading services for remote code execution caused by insecure—exploiting-api-injection-vulnerabilitiesTests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP—exploiting-arbitrary-write-to-executionMethodology for converting an arbitrary-write (write-what-where) or write-anything-anywhere primitive into—exploiting-broken-function-level-authorizationTests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative—exploiting-excessive-data-exposure-in-apiTests APIs for excessive data exposure where endpoints return more data than the client application needs, relying—exploiting-format-string-vulnerabilitiesMethodology for exploiting format string bugs where attacker-controlled data reaches the format argument of—exploiting-glibc-heap-vulnerabilitiesMethodology for exploiting glibc ptmalloc2 heap vulnerabilities during authorized engagements — use-after-free,—exploiting-integer-overflow-vulnerabilitiesMethodology for finding and exploiting integer overflow, underflow, truncation, and signedness bugs in native—exploiting-jwt-algorithm-confusion-attackExploits JWT algorithm confusion vulnerabilities where the server''s token verification library accepts the—exploiting-linux-kernel-vulnerabilitiesMethodology for discovering and exploiting Linux kernel memory-corruption vulnerabilities (UAF, OOB read/write,—exploiting-stack-buffer-overflowsMethodology for discovering and exploiting stack-based buffer overflows in native binaries during authorized—implementing-api-abuse-detection-with-rate-limitingImplement API abuse detection using token bucket, sliding window, and adaptive rate limiting algorithms to prevent—implementing-api-gateway-security-controlsImplements security controls at the API gateway layer including authentication enforcement, rate limiting, request—implementing-api-key-security-controlsImplements secure API key generation, storage, rotation, and revocation controls to protect API authentication—implementing-api-rate-limiting-and-throttlingImplements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms—implementing-api-schema-validation-securityImplement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts—implementing-api-security-posture-managementImplement API Security Posture Management to continuously discover, classify, and score APIs based on risk while—implementing-api-security-testing-with-42crunchImplement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic—implementing-api-threat-protection-with-apigeeImplement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0,—implementing-devsecops-security-scanningIntegrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software—implementing-llm-guardrails-for-securityImplements input and output validation guardrails for LLM-powered applications to prevent prompt injection,—implementing-runtime-application-self-protectionDeploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application—performing-ai-assisted-vulnerability-discoveryUsing LLMs to accelerate vulnerability research and pentest workflows — generating syntax-valid fuzzing—performing-api-fuzzing-with-restlerUses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences—performing-api-inventory-and-discoveryPerforms API inventory and discovery to identify all API endpoints in an organization''s environment including—performing-api-rate-limiting-bypassTests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses,—performing-api-security-testing-with-postmanUses Postman to perform structured API security testing by building collections that test for OWASP API Security—performing-fuzzing-with-aflplusplusPerform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover—performing-graphql-depth-limit-attackExecute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service—performing-graphql-introspection-attackPerforms GraphQL introspection attacks to extract the full API schema including types, queries, mutations, subscriptions,—performing-jwt-none-algorithm-attackExecute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header—performing-return-oriented-programmingMethodology for building Return-Oriented Programming (ROP) chains to bypass NX/DEP by reusing existing code—performing-soap-web-service-security-testingPerform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE,—performing-supply-chain-attack-simulationSimulate and detect software supply chain attacks including typosquatting detection via Levenshtein distance,—performing-windows-binary-exploitationMethodology for exploiting classic 32-bit Windows stack buffer overflows in network services during authorized—testing-api-authentication-weaknessesTests API authentication mechanisms for weaknesses including broken token validation, missing authentication—testing-api-for-broken-object-level-authorizationTests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated—testing-api-for-mass-assignment-vulnerabilityTests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they—testing-llm-prompt-injection-and-jailbreaksTesting LLM-backed applications, chatbots, and AI agents for direct and indirect prompt injection, jailbreaks,—testing-mcp-server-securityTesting Model Context Protocol (MCP) servers and the clients that consume them for tool poisoning, prompt—testing-oauth2-implementation-flawsTests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception,—testing-websocket-api-securityTests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket—