Security & Auditing Skills

Brain workbench — the model routing classifier and savings analyzer. Invoke ANY time the user says "brain scan", "brain score", "brain audit", "brain audit-skills", "brain pin", "brain apply-env", "brain test", or "/brain [subcommand]". Classifies tasks by severity (S0-S5) to route between Haiku/Sonnet/Opus while preserving Opus quality via hard guardrails. Reads from telemetry to project routing savings.

Perform comprehensive codebase analysis and generate reports (usage: /analyze…

Service health monitoring, alerting patterns, and incident response. Check if services are up, diagnose issues, set up alerting rules. Use when: checking service health, something is down, setting up monitoring, investigating slow performance, or responding to an alert. Trigger words: is it up, healthcheck, monitoring, alert, downtime, slow, service down, 500 error, high latency, incident, on-call. NOT for: deploying code (use ops/deploy), code review (use code/review), or debugging application logic (use code/debug).

Run quality checks, fix code quality issues, check code style, format code, or perform lint…

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

Finds an album by name and shows detailed status with next steps. Use when the user mentions an album name or wants to continue previous work.

Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit.

Traces data flow from entry points to dangerous operations. Cross-file reasoning to determine which entries can reach which dangers, and what validation exists in between. MUST run on Opus for reasoning depth. Use via /sast command.

SSRF vulnerability hunting specialist. Use for testing URL-accepting parameters, webhook endpoints, file import features, and any server-side request functionality. Provide target endpoints with URL parameters.

Draft and submit a vulnerability report to the bug bounty platform. Reads scope.yaml for platform/program, uses brain + findings for content. Always drafts first for review.

Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.

XSS specialist covering reflected (H1 60), stored (H1 61), and DOM (H1 62). Dispatcher passes subtype — 'reflected', 'stored', or 'dom' — in the task; falls back to inference from target. Use for parameter reflection, persisted inputs (comments/profiles/uploads/filenames), or client-side source→sink analysis.

XXE specialist (H1 63). Use for testing XML parsing endpoints, file upload processors, SOAP services, SVG handlers, and any feature accepting XML input.