1 645 security skills from 285 authors. They hunt for leaked secrets, vulnerabilities and permissions nobody meant to grant. Half of them fit into 2 028 tokens or less — that is what one costs your context window when the agent loads it. 196 ship runnable scripts rather than instructions alone. We also found 192 copies of these same skills sitting in other people's repositories — counted once here, not 192 times.
1 645 unique 285 authors 884 updated this month 119 from vendors
Complete guide to patching Apache Druid CVE-2021-25646 - JavaScript RCE via Jackson @JacksonInject bypass with empty JSON key
Reliable CSV generation for security audits with automated field mapping.
Robust extraction of vulnerability metadata with CVSS v3 priority and v2 fallback.
Detailed explanation of the Jackson empty key ("") vulnerability and how it bypasses @JacksonInject security.
Security considerations for Jackson JSON deserialization in Java, focusing on @JacksonInject bypass vulnerabilities via empty property names ("").
Ensure vulnerability records are deduplicated and ordered according to ground-truth requirements.
Extract CVSS score from vulnerability data using the correct priority order (NVD → GHSA → RedHat) and handle nested JSON structure properly. Use case-insensitive field access and correct JSON path navigation.
Filter vulnerability records to include only HIGH and CRITICAL severity levels with case-sensitive exact matching.
Properly handle null, missing, and empty values in vulnerability records with appropriate fallback values.
Correctly identify and extract Trivy vulnerability JSON field names and map them to the required CSV output columns in exact order.
Find the CUSIP identifier for a specific security (e.g., Palantir) by searching across all holdings data or a security master file. Use this when you need to locate a specific stock across multiple fund positions.
How to use offline vulnerability scanning tools like grype, trivy, or osv-scanner to detect vulnerabilities in dependency lock files without network access.
How to parse package-lock.json to extract all dependency names and versions for vulnerability lookups, covering both lockfile v1, v2, and v3 formats.
How to generate a properly formatted CSV security audit report from vulnerability scan results, including handling of special characters and proper escaping.
Step-by-step instructions for creating and applying patches to fix the JavaScript RCE vulnerability in Apache Druid 0.20.0. Covers inspecting actual source code patterns, creating correct sed replacements or patch files, and verifying the fix. Use this when you need to patch and build Druid.
Understanding the CVE in Apache Druid 0.20.0 where authenticated attackers can execute arbitrary code via JavaScript payloads. The vulnerability exploits @JacksonInject with empty key "" to override JavaScriptConfig and enable JavaScript execution even when disabled. Use this skill to understand the attack vector and plan the fix.
Use this skill first to locate the trivy binary and its pre-downloaded vulnerability database cache on the system before running any security audit.
Use this skill to run Trivy in offline mode against /root/package-lock.json and produce the security audit CSV at /root/security_audit.csv. Use only after locating the trivy cache directory.
Formatting security audit findings into a standardized CSV format for reporting and compliance.
Extracting specific security metadata (CVE, CVSS, Fix versions) from structured vulnerability reports like npm audit JSON or OSV.
Systematic identification of all Apache Druid components utilizing JavaScript to ensure comprehensive patching of CVE-2021-25646.
Analyze /root/package-lock.json to identify HIGH and CRITICAL vulnerabilities using automated security audit tools and database lookups.
Construct the final CSV output file ensuring strict column compliance with the security audit requirements.
Searches all funds within a specific quarter to rank holdings for a target security by CUSIP.
Scan npm package-lock.json files for vulnerabilities using Trivy in offline mode. Extracts HIGH and CRITICAL severity vulnerabilities with detailed metadata (CVE, CVSS, fix versions). Use this skill whenever you need to audit npm dependencies for security issues, especially when an offline vulnerability database is available.
Generate structured CSV security audit reports from vulnerability data with proper formatting and schema validation. Use this skill whenever you need to export vulnerability records to CSV format with consistent field ordering, proper escaping, and RFC 4180 compliance.
Process vulnerability scan results from Trivy JSON output, extract HIGH/CRITICAL severity vulnerabilities with complete metadata (CVE, CVSS scores, fix versions, references). Use this skill whenever you need to transform raw vulnerability data into structured format with proper field mapping and CVSS score prioritization.
How to patch the Apache Druid 0.20.0 JavaScript sandbox bypass vulnerability. Use this skill when fixing CVE in Druid where authenticated attackers can execute arbitrary code through malicious JavaScript payloads via the sampler endpoint. The vulnerability allows empty key "" in filter specifications to bypass JavaScript security settings.
How to create, apply, and verify security patches for git repositories. Use this skill when creating patches from code changes, applying patches to source code, or validating that patches correctly address vulnerabilities.
Patching Apache Druid JavaScript injection vulnerability (CVE-2021-25646). Use this skill when fixing Druid's JavaScript execution bypass where empty JSON keys override @JacksonInject JavaScriptConfig to enable JavaScript execution despite being disabled server-wide.
Fixing Jackson @JacksonInject bypass vulnerabilities where attackers use empty JSON keys to override injected values. Use this skill whenever reviewing or patching Java code that uses @JacksonInject for security-sensitive configuration injection, especially in Apache projects.
How to patch Apache Druid JavaScript RCE vulnerabilities (CVE-2021-25646 and similar). Use this skill whenever patching Druid JavaScript filter/aggregator security bypass vulnerabilities, when the @JacksonInject config can be overridden via JSON, or when handling arbitrary code execution via JavaScript in Druid sampler/query endpoints.
Security considerations for Jackson @JacksonInject annotation in Java applications. How to prevent JSON input from overriding server-injected values. Use this skill whenever reviewing code that uses @JacksonInject, when an attacker could supply JSON to override configuration objects, or when fixing deserialization vulnerabilities related to injectable values.
Techniques for identifying and patching vulnerabilities in Apache Druid, specifically focusing on Jackson deserialization and JavaScript security. Use this skill when dealing with CVEs related to RCE or security bypasses in Druid.
How to generate security audit reports in CSV format. Use this skill whenever you need to produce a `/root/security_audit.csv` report.
How to perform security audits on package-lock.json. Use this skill whenever you need to identify HIGH or CRITICAL vulnerabilities in project dependencies.
How to fix the Apache Druid JavaScript sampler vulnerability. Use this skill when patching Druid code to block arbitrary JavaScript execution.
Security considerations for Jackson JSON deserialization in Java applications. This skill covers common attack patterns such as the Empty Key ("") attack vector, polymorphic type handling, nested injection, and duplicate keys, along with their root causes and recommended mitigation strategies. It provides essential background knowledge and is highly useful for addressing related security vulnerabilities. It is always recommended to invoke this skill before working on relevant security fixes.
Run any "find all instances of X" sweep — a security audit, a safety audit, a code review, a research question, a compliance check — as an iterative loop that does NOT stop at one pass. Audit → fix → RE-audit → … until a clean pass returns zero NEW discoveries. Use whenever thoroughness matters and a single pass would miss things. Trigger words: audit, sweep, find all, review everything, comprehensive, thorough, exhaustive, security review, safety audit, no stone unturned, did we get everything, convergence.
Use this skill when reverse-engineering Apple platforms with the ipsw CLI — analyzing iOS/macOS Mach-O binaries, disassembling functions inside dyld_shared_cache (DSC), dumping Objective-C/Swift headers from private frameworks, extracting kernelcaches, KEXTs, SEP, iBoot, or DeviceTree from IPSWs/OTAs, decompiling/querying sandbox profiles (SBPL), querying entitlements, symbolicating crashes/panics, diffing two firmware versions, mounting IPSW DMGs, or downloading Apple firmware. Triggers on iOS/macOS internals, kernel research, dyld_shared_cache, KEXT diffing, sandbox/Seatbelt profile analysis (SBPL/SBASM/sandboxd), capability/IOKit queries, entitlement lookup, class-dump, IMG4/AEA handling, or vulnerability research on Apple platforms.
Audit exact npm dependency versions against OSV through Runx native HTTP and emit replay-verified evidence with no unverified findings.
Detect and remove personal data before content crosses a trust boundary, returning usable scrubbed content only when a deterministic residual scan passes. Use for exports, prompts, logs, support material, or outbound handoffs that need a pass, review, or block verdict; it does not move content or handle credentials.
Prepare an evidence-bound vulnerability publication and publish the exact approved advisory through Runx Connect with independent provider readback.
Turn verified exact-version vulnerability evidence into bounded remediation and advisory packets without inventing exposure or claiming publication.
Reviews Elixir code for security vulnerabilities including code injection, atom exhaustion, and secret handling. Use when reviewing code handling user input, external data, or sensitive configuration.
| Professional nmap scanning techniques and optimization for penetration testing. Use this skill when you need to perform network reconnaissance, port scanning, or service enumeration during authorized security assessments.
| Comprehensive system control operations for security testing. Use this skill when you need unified access to file operations, process management, system information, and command execution through a single interface during authorized penetration testing.
| Security-focused command execution techniques for penetration testing. Use this skill when executing system commands during authorized security assessments. Covers Windows and Linux command execution, common security testing commands, and best practices for avoiding detection.