Browse Source-Indexed Agent Skills
Find SKILL.md workflows by category, repository, and source date, then inspect the original GitHub file before installing.
Inspect the source before you use a Skill
AI Vitamin indexes original GitHub SKILL.md files and source dates. A listing improves discovery; it does not certify compatibility, security, or requested permissions.
Learn how Agent Skills workBrowse by workflow
1000 source-indexed records across 10 categories.
AI Agents & Models
Agent design, models, prompting, context, MCP, and evaluation workflows.
96 source recordsDevelopment & Engineering
Software delivery, codebases, APIs, SDKs, debugging, and developer workflows.
228 source recordsDesign & Frontend
Product design, UX, UI systems, frontend implementation, and visual work.
127 source recordsData, Research & Analysis
Research, data work, analytics, databases, visualisation, and evidence synthesis.
48 source recordsDocuments & Productivity
Documents, presentations, spreadsheets, knowledge work, and personal productivity.
41 source recordsWriting, Content & Marketing
Writing, editing, SEO, communications, content production, and marketing work.
74 source recordsCloud, DevOps & Infrastructure
Deployment, cloud platforms, CI/CD, operations, observability, and infrastructure.
74 source recordsAutomation & Integrations
Workflow automation, browser tasks, connected services, and cross-tool integrations.
45 source recordsSecurity, Quality & Compliance
Security, testing, quality assurance, accessibility, reviews, and compliance work.
207 source recordsBusiness & Operations
Product planning, sales, support, project delivery, and operational workflows.
60 source recordsSource records · Page 18
Only this page of records is included in the HTML response.
analyzing-threat-landscape-with-misp
Query a MISP (Malware Information Sharing Platform) instance via PyMISP
Source checked 2026-09-04analyzing-tls-certificate-transparency-logs
'Queries Certificate Transparency logs via crt.sh and pycrtsh to detect
Source checked 2026-09-04analyzing-typosquatting-domains-with-dnstwist
Generate domain permutations with dnstwist and check DNS resolution
Source checked 2026-09-04analyzing-uefi-bootkit-persistence
'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,
Source checked 2026-09-04analyzing-usb-device-connection-history
Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,
Source checked 2026-09-04analyzing-web-server-logs-for-intrusion
Parse Apache and Nginx access logs to detect SQL injection attempts,
Source checked 2026-09-04analyzing-windows-amcache-artifacts
'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s
Source checked 2026-09-04analyzing-windows-event-logs-in-splunk
'Analyzes Windows Security, System, and Sysmon event logs in Splunk to
Source checked 2026-09-04analyzing-windows-lnk-files-for-artifacts
Parse Windows LNK shortcut files to extract target paths, MAC timestamps,
Source checked 2026-09-04analyzing-windows-prefetch-with-python
Parse Windows Prefetch (.pf) files with the windowsprefetch Python
Source checked 2026-09-04analyzing-windows-registry-for-artifacts
Extract and analyze Windows Registry hives with tools like RegRipper
Source checked 2026-09-04analyzing-windows-shellbag-artifacts
Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and
Source checked 2026-09-04assessing-vector-and-embedding-weaknesses
Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,
Source checked 2026-09-04attacking-entra-id-with-roadtools
Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and
Source checked 2026-09-04attacking-oauth-with-device-code-phishing
Run OAuth 2.0 device-code and illicit-consent phishing attacks against
Source checked 2026-09-04auditing-aws-s3-bucket-permissions
'Systematically audit AWS S3 bucket permissions to identify publicly
Source checked 2026-09-04auditing-azure-active-directory-configuration
'Auditing Microsoft Entra ID (Azure Active Directory) configuration to
Source checked 2026-09-04auditing-cloud-with-cis-benchmarks
Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.
Source checked 2026-09-04auditing-foundry-smart-contract-security
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch reentrancy, access-control, oracle/price manipulation, and arithmetic bugs BEFORE deploying to an EVM chain. Also enforces key hygiene (no plaintext private keys, encrypted cast keystore) and a secure deploy workflow. Use when writing, reviewing, testing, or deploying Solidity/Foundry contracts, building a dApp, or working with forge/cast/anvil, MetaMask, or Web3/DeFi code.
Source checked 2026-09-04auditing-gcp-iam-permissions
'Auditing Google Cloud Platform IAM permissions to identify overly permissive
Source checked 2026-09-04auditing-kubernetes-cluster-rbac
'Auditing Kubernetes cluster RBAC configurations to identify overly permissive
Source checked 2026-09-04auditing-kubernetes-rbac-privilege-escalation
Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.
Source checked 2026-09-04auditing-mcp-servers-for-tool-poisoning
Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior.
Source checked 2026-09-04auditing-terraform-infrastructure-for-security
'Auditing Terraform infrastructure-as-code for security misconfigurations
Source checked 2026-09-04auditing-tls-certificate-transparency-logs
'Monitors Certificate Transparency (CT) logs to detect unauthorized certificate
Source checked 2026-09-04auditing-uefi-firmware-with-chipsec
Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.
Source checked 2026-09-04automating-ioc-enrichment
'Automates the enrichment of raw indicators of compromise with multi-source
Source checked 2026-09-04benchmarking-kubernetes-with-kube-bench
Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.
Source checked 2026-09-04building-adversary-infrastructure-tracking-system
Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.
Source checked 2026-09-04building-attack-pattern-library-from-cti-reports
Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.
Source checked 2026-09-04building-automated-malware-submission-pipeline
'Builds an automated malware submission and analysis pipeline that collects
Source checked 2026-09-04building-c2-infrastructure-with-sliver-framework
Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.
Source checked 2026-09-04building-c2-redirector-infrastructure
Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.
Source checked 2026-09-04building-cloud-siem-with-sentinel
Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.
Source checked 2026-09-04building-detection-rule-with-splunk-spl
Build effective detection rules using Splunk Search Processing Language
Source checked 2026-09-04building-detection-rules-with-sigma
'Builds vendor-agnostic detection rules using the Sigma rule format for
Source checked 2026-09-04