Agent skill · security · secondsky
cybersecurity
OSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with OSS.
Why this skill is useful
Adds executable workflows for vulnerability testing and threat modeling using open-source tools that aren't covered in standard documentation.
What it needs
Requires dalfox, ffuf, interactsh, mitmproxy, nuclei, owasp-zap, semgrep installed locally. About 9k tokens when loaded. Last updated 2026-08-06. 204 stars on the source repository.
What this skill does
Cybersecurity Overview OSS-only unified cybersecurity skill: analyze, test, and harden software security using exclusively open-source tooling. Covers threat modeling, web-vulnerability testing (XSS, business logic, Host header, open redirect, forced browsing), SAST / code audit, AI/LLM-app security, and detection engineering (Sigma + MITRE ATT&CK). Paid tools (Burp Suite, Nessus, Splunk, CrowdStrike, SonarQube, DOM Invader, Hackvertor) appear only as "if you already have it" notes — never as the primary path. For the full paid→OSS swap table, SEE: references/oss-tool-map.md. This skill fills a gap in this repo: the 5 existing defensive plugins (csrf-protection, xss-prevention, vulnerability-scanning, security-headers-configuration, defense-in-depth-validation) tell you how to fix — this skill tells you how to find, analyze, and threat-model. When to use Use this skill whenever the user's task touches software security. Triggers include: Web/API vulnerability testing (XSS, business logic, Host header, open redirect, forced browsing, SSRF, CSRF). Code audit / SAST / secure-code review (any language). Threat modeling (STRIDE / PASTA / VAST), MITRE ATT&CK mapping, attack-surface analysis. Incident analysis and response reasoning (ransomware, breach, anomaly triage). Detection engineering: Sigma rules, MITRE ATT&CK coverage / gap analysis, ATT&CK Navigator layers. AI / LLM application security (prompt injection, OWASP LLM Top 10, agent safety, "vibe-coded" app audits). Compliance work (OWASP, CVE, GDPR / SOC2 / ISO27001). Replacing a paid security tool with an OSS alternative. Mapping a finding to a remediation pattern (cross-references the 5 defensive plugins). When NOT to use: IT/infrastructure-only security operations (patching servers, firewall rules — see ORCHESTRATION exclusions). Malware analysis / reverse engineering of binaries (out of scope). Smart-contract / blockchain security beyond agent-safety review (Solana-specific skills excluded). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills secondsky/cybersecurity