superagent-a
4 skills with substantive source documentation and an official publisher or observed installation demand. Read each skill’s original documentation through its card.
superagent-aici-cd-security
Scan GitHub Actions workflow files for security vulnerabilities by reading the YAML and reporting findings directly — no external tools, no installation, no shell execution. Use this skill whenever the user shares a .github/workflows/ file, pastes workflow YAML, asks for a CI/CD security review, mentions pullrequesttarget, workflowrun, action pinning, GITHUBTOKEN permissions, pwn requests, template injection, cache poisoning, secret exfiltration, supply chain risk, or any GitHub Actions hardenin
- 導入数
- 3
- GitHub Stars
- 79
- 更新日
- 8月15日
superagent-aiskill-security
Audit an AI agent skill for security risks before installing or trusting it. Runs a deterministic scanner (regex patterns, Python AST analysis, source-to-sink taint tracking, and YARA signatures) and then reasons about intent — catching prompt injection, credential exfiltration, persistence, memory poisoning, malicious code, supply-chain risks, and description-vs-behavior mismatch. Make sure to use this skill whenever the user wants to scan, audit, vet, review, or check the safety of a skill, pl
- 導入数
- 3
- GitHub Stars
- 79
- 更新日
- 8月15日
superagent-aiauthz-security
Review application source code for broken authorization — IDOR / Broken Object Level Authorization (OWASP API1), Broken Function Level Authorization (API5), mass assignment (API3), multi-tenant isolation gaps, and privilege escalation. Reads routes, controllers, resolvers, and data models offline and reports the missing ownership/role check at file:line with a framework-correct fix. No running app, no credentials, no tools. Trigger when reviewing endpoints/handlers, auditing a PR diff that adds
- 導入数
- 1
- GitHub Stars
- 77
- 更新日
- 8月15日
superagent-aicrypto-secrets
- Audit application source code and configuration for cryptography and secrets hygiene issues: hardcoded API keys, committed .env files, private keys, weak hashes, insecure encryption modes, unsafe randomness, bad KDF/password hashing, JWT signing mistakes, disabled TLS verification, and dangerous serialization. Runs a dependency-free offline scanner for high-recall findings, then the model confirms impact and writes concrete fixes with redacted evidence. Use when reviewing app code that handles
- 導入数
- 1
- GitHub Stars
- 77
- 更新日
- 8月15日