Use when deciding whether a parameter, object field, stored value, claim, file name, URL, path, expression, selector, or object id remains attacker-controlled at a sensitive operation, especially when the result may be written into a report and must be bounded by the official security model, scope, and expected behavior.
EnglishUse when planning, coordinating, or reviewing evidence-first security code audits, vulnerability hunting, scanner triage, exploitability review, or report verification across a repository before selecting language-specific or vulnerability-specific skills.
EnglishUse when an audit needs to prove whether user-controlled, stored, framework-bound, message-derived, file-derived, header-derived, claim-derived, or configuration-derived data can reach a security-sensitive sink with exploitable control, and when that trace must survive identifier-acquisition, account-matrix, and official-security-model review before it can be reported.
EnglishUse when reviewing vulnerability reports, reproduction notes, scanner tickets, submission drafts, audit findings, or claimed technicalconfirmed vulnerabilities for evidence quality, claim boundaries, impact proof, downgrade decisions, retest needs, remediation readiness, or 对外提交资格 status.
English
AGENT SKILLS ATLASIncludes Parameter Controllability Analysis, Security Audit Methodology, Source to Sink Taint Tracing, and other workflows.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLISupported by the Atlas install prompt. Skill-specific requirements vary.
Pack stats
What’s included
Parameter Controllability Analysis
Use when deciding whether a parameter, object field, stored value, claim, file name, URL, path, expression, selector, or object id remains attacker-controlled at a sensitive operation, especially when the result may be written into a report and must be bounded by the official security model, scope, and expected behavior.
Security Audit Methodology
Use when planning, coordinating, or reviewing evidence-first security code audits, vulnerability hunting, scanner triage, exploitability review, or report verification across a repository before selecting language-specific or vulnerability-specific skills.
Source to Sink Taint Tracing
Use when an audit needs to prove whether user-controlled, stored, framework-bound, message-derived, file-derived, header-derived, claim-derived, or configuration-derived data can reach a security-sensitive sink with exploitable control, and when that trace must survive identifier-acquisition, account-matrix, and official-security-model review before it can be reported.
Vulnerability Report Evidence Review
Use when reviewing vulnerability reports, reproduction notes, scanner tickets, submission drafts, audit findings, or claimed technicalconfirmed vulnerabilities for evidence quality, claim boundaries, impact proof, downgrade decisions, retest needs, remediation readiness, or 对外提交资格 status.
Quick start
- Choose your skills. Select individual skills above, or choose the entire pack.
- Copy the install prompt. Use Copy install prompt above the list.
- Send it to your agent. Paste into your coding agent’s chat. Your agent reviews the source and guides the setup.
Try it with your agent
After installation, start with a request like:
Use the Parameter Controllability Analysis skill to help with my task.
Ask me for the context you need before getting started.Requirements & license
- A coding agent that can access your project files and install skills.
- Your agent checks each skill’s instructions, dependencies, and permissions during setup.
- Reported license for the skills shown: MIT. The author’s terms apply.