Atheris
Trail of BitsOfficial
A coverage-guided fuzzer for Python code and C extensions based on libFuzzer.
Trusted skills for AI agents from official vendors and established maintainers. Every skill is attributed to its author, scanned, and comes with install steps for your AI tool.
172 skills
Trail of BitsOfficial
A coverage-guided fuzzer for Python code and C extensions based on libFuzzer.
Trail of BitsOfficial
Expands a confirmed vulnerability into a list of graph-derived variant candidates for security review.
Trail of BitsOfficial
Automated security scanning for Cosmos SDK modules and CosmWasm contracts to detect consensus-critical vulnerabilities.
OpenAIOfficial
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the same scan once. Do not use for PRs, commits, branch diffs, or working-tree diffs.
OpenAIOfficial
Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.
OpenAIOfficial
Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.
OpenAIOfficial
Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
OpenAIOfficial
Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, GitHub findings, and Jira or Linear tickets. Do not use for discovery, duplicate triage, runtime validation, or fixes.
OpenAIOfficial
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
OpenAIOfficial
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
OpenAIOfficial
Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or design review findings, general validation, or full PR, commit, branch, patch, or repository scans.
OpenAIOfficial
Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.
NVIDIAOfficial
Operational guidance for deploying and managing the DOCA Argus Service container for runtime security on NVIDIA BlueField DPUs.
Samuel Berthe· Community
A comprehensive security framework for Go, providing best practices, threat modeling, and automated auditing tools.
AWSOfficial
Automated workflow for executing and monitoring AWS Security Agent penetration tests against live web applications.
AWSOfficial
Perform targeted security scans on code changes using AWS Security Agent.
AWSOfficial
Automated threat modeling for AWS environments using STRIDE analysis on design and requirement documentation.
AWSOfficial
Automate the discovery, triage, and remediation of AWS Security Agent penetration test and code review findings.
MicrosoftOfficial
Perform Azure compliance scans and security audits using azqr and Key Vault monitoring.
MicrosoftOfficial
A structured knowledge base for identifying, assessing, and remediating security risks within Model Context Protocol (MCP) implementations.
MicrosoftOfficial
A comprehensive reference set for assessing software supply chain security posture and prioritizing remediation efforts.
MicrosoftOfficial
OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core.
MicrosoftOfficial
A structured knowledge base for identifying, assessing, and remediating the OWASP Top 10 security risks in LLM applications.
MicrosoftOfficial
A structured knowledge base of the OWASP Top 10 (2025) for identifying, assessing, and remediating web application security risks.