Mmcp.market

007 skill

by sickn33·sickn33/agentic-awesome-skills·47k stars·MIT

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

F0/100content scan

Is the 007 skill safe?

A critical finding: do not install it without reading the flagged line. We read 16 files in the folder on 2026-09-28.

  • highreferences/ai-agent-security.md:12

    Tells the agent to set aside its instructions, hide what it does from the user, or switch off safety checks.

    The user directly provides malicious instructions to override the system prompt.
  • highreferences/owasp-checklists.md:46

    Tells the agent to set aside its instructions, hide what it does from the user, or switch off safety checks.

    | **LLM01** | **Prompt Injection** | Attacker manipulates LLM via crafted input (direct) or poisoned context (indirect). | User input contains "ignore previous instructions"; external documents wit...
  • highreferences/stride-pasta-guide.md:152

    Reads credential files (SSH keys, cloud or package-manager tokens) that a skill has no normal reason to touch.

    GET /api/files?path=../../etc/passwd
  • highscripts/scanners/dependency_scanner.py:792

    Downloads a script and runs it in one step, so what runs is whatever that server sends that day. Common for installers, and still worth a look at the address.

    description="Pipe-to-shell pattern detected (curl|bash). Remote code execution risk",  # security-allowlist: curl-pipe-bash

Install the 007 skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. Read the findings above first.

git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git /tmp/agentic-awesome-skills
mkdir -p ~/.claude/skills
cp -r /tmp/agentic-awesome-skills/plugins/agentic-awesome-skills-claude/skills/007 ~/.claude/skills/007
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

007 — Licenca para Auditar

Detailed Guide

Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

When to Use This Skill

  • When the user mentions "audite" or related topics
  • When the user mentions "auditoria" or related topics
  • When the user mentions "seguranca" or related topics
  • When the user mentions "security audit" or related topics
  • When the user mentions "threat model" or related topics
  • When the user mentions "STRIDE" or related topics

Do Not Use This Skill When

  • The task is unrelated to 007
  • A simpler, more specific tool can handle the request
  • The user needs general-purpose assistance without domain expertise

Limitations

  • Use this skill only when the task clearly matches the scope described above.
  • Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
  • Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

More skills from sickn33/agentic-awesome-skills

  • A00-andruia-consultantArquitecto de Soluciones Principal y Consultor Tecnológico de Andru.ia. Diagnostica y traza la hoja de ruta óptima para proyectos de IA en español.
  • A10-andruia-skill-smithIngeniero de Sistemas de Andru.ia. Diseña, redacta y despliega nuevas habilidades (skills) dentro del repositorio siguiendo el Estándar de Diamante.
  • A20-andruia-niche-intelligenceEstratega de Inteligencia de Dominio de Andru.ia. Analiza el nicho específico de un proyecto para inyectar conocimientos, regulaciones y estándares únicos del sector. Actívalo tras definir el nicho.
  • A2slides-ppt-generatorAI-powered presentation generation via the 2slides API — create slides from text, match a reference image style, summarize documents into decks, add AI voice narration, and export pages/audio. Use for any \"make slides\", \"create a deck\", or \"slides from this document\" request.
  • A3d-web-experienceExpert in building 3D experiences for the web - Three.js, React
  • Aab-test-setupUse when designing an A/B or split test: define the hypothesis, control and variants, estimate sample size, verify tracking, and predeclare metrics and stopping rules.
  • Aab-testingWhen the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program.
  • Aacceptance-orchestratorUse when a coding task should be driven end-to-end from issue intake through implementation, review, deployment, and acceptance verification with minimal human re-intervention.
  • Aaccess-reviewConduct periodic access reviews and certifications. Implement access
  • Aaccessibility-compliance-accessibility-auditYou are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance.
  • Aaccesslint-auditFind and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or page, produce a prioritized written report, no edits) and fix (audit→edit→verify loop on a target). Prefers direct-CDP live-DOM auditing; falls back to a browser-MCP composition or HTML-string audits.
  • Aaccesslint-diffDiff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [<name>] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing.

All agent skills → · MCP servers