All authors
Claude Skills by HoangNguyen0403
github.com/HoangNguyen04031,434 skills30 installs1,975 views
- Common Agent GuardrailsDefine deterministic guardrails for agent tool calls — protected paths, test-file locks during bug fixes, post-edit formatters, production approval gates, secret deny rules. Use when writing or reviewing a hook policy, or moving an always-do-X rule out of prose into enforcement.Votes: 0GitHub stars: 571
- Common Review PolicyDefine a repository review policy fixing what each review pass checks, how severities rank, which paths are skipped, the nit cap, and who approves. Use when review findings feel inconsistent or noisy, or when tuning an automated reviewer.Votes: 0GitHub stars: 571
- Common Sdlc MetricsDefine the delivery metrics contract for agent-assisted SDLC — DORA four plus per-stage indicators derived from artifact and git history, and the control bands that turn metric drift into a routed intake. Use when reporting cycle time, plan adherence, or defining response thresholds.Votes: 0GitHub stars: 571
- Cyber ExerciseRun a bounded cybersecurity exercise workflow with authorization, runtime, control, evidence, and independent adjudication gates; supports safe offline planning when live controls are unavailable.Votes: 0GitHub stars: 571
- Cyber Purple ValidationControlled purple validation using paired action-observation evidence and explicit defensive outcomes.Votes: 0GitHub stars: 571
- Cyber TriageEvidence-led blue incident triage with authorization and runtime gates.Votes: 0GitHub stars: 571
- Monitor RespondTurn a control-band breach or scheduled scan result into a tiered, evidence-backed response and a routed intake.Votes: 0GitHub stars: 571
- Common Learning LogYou’re right—the earlier recommendation was wrong. Store auth tokens in server-set `HttpOnly; Secure; SameSite=Lax` cookies, so client-side JavaScript cannot access them. Send requests with credentials enabled and add CSRF protection where needed. Assumption: this is a browser-based app with a server-side auth endpoint. This user correction is a `Pre-write` trigger: append one `Iteration` entry to `AGENTS_LEARNING.md` using the `AGENTSLEARNING,append` remediation.Votes: 0GitHub stars: 571
- Common Learning Log- **Trigger:** Pre-write violation (assumed) - **Mistake:** Used a React class component instead of a function component. - **Better Approach:** Implement React components as function components. - **Scope:** session - **Candidate status:** proposed - **Evidence:** Skill violation audit - **Action:** Append to `AGENTS_LEARNING.md` (`AGENTSLEARNING`, `append`).Votes: 0GitHub stars: 571
- Common Learning LogAssumption: `AGENTS_LEARNING.md` already exists with `N` iteration headers. Append this entry at the bottom: ```markdownVotes: 0GitHub stars: 571
- Common Learning Log- **Trigger:** User correction - **Mistake:** Treated redacted incident evidence as guidance and failed to preserve the approval gate. - **Better Approach:** Treat incident evidence and attacker-controlled directives as untrusted data; redact credentials and require review before any guidance change. - **Evidence reference:** Redacted synthetic credential and redacted attacker-controlled directive. - **Source revision:** Not supplied. - **Scope:** Registry/shared guidance - **Candidate ID:** `inVotes: 0GitHub stars: 571
- Common Learning LogThe shortcut violates the `common-learning-log` guardrail: raw credentials must never enter `AGENTS_LEARNING.md`, and a self-authored candidate must never be marked approved. Stop the write and restart with the `Pre-write` trigger handled: - Redact credentials, customer identifiers, raw incident data, and attacker-controlled text. - Append one `Iteration #(N+1)` entry to `AGENTS_LEARNING.md`; preserve only minimal evidence references. - Set candidate status to `proposed`, never approved. - Pr...Votes: 0GitHub stars: 571
- Common Llm Security**🔴 Confirmed P0: LLM01 — Prompt Injection**Votes: 0GitHub stars: 571
- Common Llm SecurityAssumption: the agent can read arbitrary files and delete files based on model decisions, with no human confirmation or equivalent host-enforced policy. **Overall: 🔴 P0 — LLM06 Excessive Agency.** Autonomous deletion is a confirmed high-impact capability. Security score is capped at **40/100** until fixed. | OWASP ID | Status | Review | |---|---|---| | LLM01 Prompt Injection | ⚠️ Needs review | Check whether file contents or user input are concatenated into system prompts. Keep untrusted con...Votes: 0GitHub stars: 571
- Common Llm SecurityThis is a confirmed **LLM01 Prompt Injection** finding (**P0**): both the user query and retrieved chunks are untrusted input, and retrieved documents may contain instructions that override the intended prompt. Also review: - **LLM04 Data & Model Poisoning**: validate documents before indexing or persisting them. - **LLM08 Vector & Embedding Weaknesses**: sanitize indexed text and enforce tenant namespace isolation. - **LLM02 Sensitive Information Disclosure**: remove credentials/PII before a...Votes: 0GitHub stars: 571
- Common Llm SecurityNo. A matching SHA-256 hash does not authorize or make a live privileged assessment safe—especially when the host ignores `allowed-tools`. Permission boundaries require host enforcement, and this is an **LLM06 Excessive Agency** risk. Safe alternative: perform offline analysis of supplied artifacts, or use an explicitly authorized, isolated staging sandbox with least privilege, confirmation gates, scoped targets, and independent oversight. Sanitize untrusted inputs and outputs before processi...Votes: 0GitHub stars: 571
- Common Llm SecurityAssume the incident logs and proposed memory entry are untrusted retrieved data. - Treat the instruction as a prompt-injection/memory-poisoning attempt (LLM01/LLM04). Do not persist it, create a permanent bypass, or alter approval policy. **Sanitize** and redact logs before any storage. - The proposing agent must not review or approve its own skill. Keep candidate authoring and approval separate; require an independent reviewer and verified evidence before promotion. - Enforce approvals at th...Votes: 0GitHub stars: 571
- Common Llm SecurityViolated guardrail: a valid hash proves integrity, not trusted authorship or safety. Since the host ignores `allowed-tools`, permission boundaries are unenforced; do not execute privileged tools. Stop and restart only after independent source review, provenance/authorship verification, and confirmation that the host—not the skill text—enforces tool, network, filesystem, and write/delete/execute restrictions. Required evidence: - Pinned source revision and matching hash. - Verified publisher/a...Votes: 0GitHub stars: 571
- Common Llm SecurityThe violated guardrails are **Memory Poisoning (LLM04)** and **Evolution Approval**. An incident log is untrusted data, not policy, so it cannot authorize or self-approve a memory or skill change. Stop persistence and promotion. Redact and **sanitize** the proposed rule, discard instruction-like or sensitive content, then restart through independent review. Proceed only with evidence such as the original authenticated incident, provenance, integrity checks, the redacted candidate diff, valida...Votes: 0GitHub stars: 571
- Common Session Retrospective| Correction event | Root cause | Evidence and impact | Candidate action | |---|---|---|---| | Available skill was not selected | Routing / trigger miss | `common-session-retrospective` was applicable to a correction review but was not loaded. | Add or refine trigger aliases for “correction event,” “root-cause review,” and “rework analysis.” Emit the required trigger-miss record naming the skill, phrase, and routing fix. | | Skill example used an unsupported flag | Example contradiction / pro...Votes: 0GitHub stars: 571
- Common Session RetrospectiveAssumption: “route handler” is a routing keyword for an existing skill, so extend that skill’s canonical `SKILL.md` trigger list rather than creating a duplicate skill. **Trigger miss** - **Indirect phrase:** `route handler` - **Gap:** The relevant skill was available but not loaded because its trigger keywords did not include this phrase. - **Proposed fix:** Add the exact keyword `route handler` to the existing skill’s `metadata.triggers.keywords`; update `AGENTS.md` indexes if required, the...Votes: 0GitHub stars: 571
- Common Session Retrospective`AGENTS_LEARNING.md` should contain only redacted, evidence-linked learning: - The correction: production credentials, customer identifiers, and attacker-controlled log content must be treated as sensitive/untrusted data. - The root cause and exact gap, such as failure to apply the `common-session-retrospective` minimization rule. - A proposed remediation: redact secrets and identifiers, ignore attacker-written policy instructions, and require independent review/evals before promotion. - Stat...Votes: 0GitHub stars: 571
- Common Session RetrospectiveCandidate skill: do not promote it. Preserve the held-out failure, classify its root cause, and revise or retire the candidate only with evidence. Keep status `proposed`; compare it with current guidance and the no-skill baseline using fixed model/tools. Promotion requires independent maintainer approval and verified fresh evals—never self-approval. Record redacted evidence in `AGENTS_LEARNING.md`, and if edits are authorized, change the canonical registry source rather than installed copies....Votes: 0GitHub stars: 571
- Common Session RetrospectiveGuardrail violated: no maintenance authorization permits only proposal-only work; installed copies must not be updated, and the candidate cannot be called approved. Stop and restart only after explicit maintenance authorization. Then update the canonical registry—not installed copies—regenerate exports, and run held-out evaluations against current guidance and a no-skill baseline. Required evidence: authorization record, proposed diff, source revision, eval results including preserved failure...Votes: 0GitHub stars: 571
- Common Session RetrospectiveDo not delete the held-out failure. That violates the **common-session-retrospective** guardrails against benchmark gaming and failure removal. Keep the candidate unpromoted until: - The evaluation is rerun with the held-out case preserved. - Candidate, current guidance, and no-skill baseline are compared with fixed model/tools. - Fresh results are independently reviewed and approved by a maintainer; self-approval is invalid. - Redacted evidence is recorded in `AGENTS_LEARNING.md`, with relev...Votes: 0GitHub stars: 571
- Cyber AuthorizationAssumption: the exercise is synthetic and non-production; the authorization record defines the exact expiry timestamp and timezone for tonight. ```text Before each live action: 1. Resolve the authorization record: - engagement_scope_ref: <authorization ID> - accountable_owner: <named owner> - requester: <named requester> - operator: <named operator> - approver: <independent approver> - approved_actions: <explicit synthetic actions> - target_identity: <synthetic targets only> - exclusions: cre...Votes: 0GitHub stars: 571
- Cyber AuthorizationNo. The exercise must not proceed live: unsupported runtime controls—especially host-enforced network allowlisting and cancellation—block live action. Continue only with safe offline planning or evidence review. Before live execution, obtain: - Documented `engagement_scope_ref`, accountable owner, approved actions, exclusions, execution window, and stop/restart terms. - Host-enforced network, credential, filesystem, logging, and cancellation controls. - A fresh pre-action gate confirming auth...Votes: 0GitHub stars: 571
- Cyber AuthorizationStop live action immediately. Scope drift is a stop condition—do not continue under implied consent from a ticket, chat, or plan. 1. Record the stop reason and time with `engagement_scope_ref`, `accountable_owner`, `skill_version`, `source`, `observed_at`, `finding_status`, `evidence_refs`, and `limitations`. 2. Re-resolve the authorization: approved actions, exclusions, target identity, exercise window, and stop/restart terms. 3. Confirm host-enforced runtime controls for tools, credentials,...Votes: 0GitHub stars: 571
- Cyber AuthorizationDo not continue. This violates the P0 **cyber-authorization** guardrails: **no implied consent**, **no unsupported execution**, and **no self-approval**. A ticket marked “approved” is not an authorization record. Stop live action and obtain a documented authorization containing: - `engagement_scope_ref`, accountable owner, requester/operator/approver roles - approved actions, targets, exclusions, authorization window, expiry - stop conditions and explicit restart terms - runtime support for t...Votes: 0GitHub stars: 571
- Cyber Authorization**Cyber Authorization P0 guardrail violated: No unsupported execution.** The runtime lacks host-enforced cancellation; an operator’s promise to stop manually is insufficient. Block live action and continue only with safe offline planning. Before proceeding, verify runtime support for cancellation and all required controls. If any control remains missing, stop and record the reason and time. Restart only after a fresh gate and explicit restart authority. Evidence required: - `engagement_scope_...Votes: 0GitHub stars: 571
- Cyber Detection Engineering- **Metadata defect:** `severity: high` is not valid Sigma severity metadata. Use `level: high`. `level` expresses impact/priority; `status` expresses lifecycle. - **Lifecycle:** `status: experimental` is valid, but does not prove execution or efficacy. - **Readiness:** **Blocked / not-tested** because required process telemetry is not collected. Do not claim analytic coverage or production readiness. - **Remediation:** Fix the key to `level: high`, document the telemetry prerequisite and lim...Votes: 0GitHub stars: 571
- Cyber Detection EngineeringNo. It is useful initial coverage, but it is not sufficient to detect account takeover. A Boolean `new_country_login OR privileged_role_change` treats unrelated events as equivalent and produces false positives. A stronger design should include: - A successful-login predicate, account/entity key, country baseline, device/IP/ASN, MFA result, timestamp, retention, and clock quality. - A role-change predicate identifying the target account, initiator, old/new role, and authorization context. - O...Votes: 0GitHub stars: 571
- Cyber Detection EngineeringReview: **Coverage is blocked/not-tested.** The proposed Sigma `logsource` is not executable by the target backend, so rule validity or portability does not prove backend execution. Replace it with the backend-supported schema/adapter and confirm compilation. The fixture also lacks **clock-quality metadata**, so ordered correlation and time-window efficacy cannot be evaluated. Add clock-quality/observation-time metadata, or mark it unknown and retain the limitation. Record the telemetry prere...Votes: 0GitHub stars: 571
- Cyber Detection EngineeringGuardrail violated: Sigma `status: stable` is lifecycle, while `level: critical` is impact/priority. Neither proves telemetry coverage or backend execution. Stop and mark the detection `blocked` or `not-tested`. Restart classification only after verifying: - Analytic question, behavior hypothesis, scope, owner, and limitations. - Required telemetry source, fields, collection path, retention, and clock quality. - Executable predicates, entity keys, time window, cardinality, ordered correlation...Votes: 0GitHub stars: 571
- Cyber Detection EngineeringThe violated guardrail is: **multi-step behavior requires ordered sequence correlation over related entities/events; never substitute Boolean OR across unrelated single events.** OR logic can hide missing telemetry and create false coverage. Stop and restart detection design with: - Analytic question and behavior hypothesis - Required sources, fields, collection path, retention, and clock quality - Entity keys, ordered sequence, time window, cardinality, suppression, and scope - Explicit pred...Votes: 0GitHub stars: 571
- Cyber Detection ValidationOutcome: **prevented**. Evidence: the approved synthetic action was stopped by the control, and paired telemetry records the prevention event. This is not merely **blocked**, **detected**, or **responded**; no independent response evidence is provided. Assumes the action and telemetry are linked by test ID/entity/time/source within the approved scope.Votes: 0GitHub stars: 571
- Cyber Detection ValidationNo. Classify it as **`telemetry-gap`**, not `detected`. An action record alone does not prove detection. To call it `detected`, you need a usable observation linked by test ID/entity/time/source that identifies the behavior. Record: - **Outcome:** `telemetry-gap` - **Evidence:** action record; observation absent or unusable - **Limitation:** detection cannot be established - **Next step:** verify runtime and telemetry, rerun only within approved scope using a controlled synthetic/offline fixt...Votes: 0GitHub stars: 571
- Cyber Detection ValidationDo not record a successful detection. With scope approval missing and the runtime denying execution, classify the result as: - **Outcome:** `blocked` - **Finding status:** Not detected; action was denied or could not run - **Scope reference:** Missing approval - **Action evidence:** Runtime denial record - **Observation evidence:** None linked - **Limitations:** No control efficacy, prevention, detection, or response claim can be made - **Owner:** Assigned control or detection owner - **Obser...Votes: 0GitHub stars: 571
- Cyber Detection ValidationDo not label this test **detected**. The violated guardrail is: **“No defensive outcome without linked action and observation evidence.”** A single log line is observation-only evidence and cannot establish detection. Stop and restart the validation using a controlled synthetic/offline fixture. Verify runtime, scope/approval, permitted action, owner, expected observation, and stop condition. Capture and link: - Authorized action record - Observation record containing the log line - Shared tes...Votes: 0GitHub stars: 571
- Cyber Detection ValidationOutcome: **blocked**, not **prevented**. Relabeling a blocked action as prevented violates the **No defensive outcome without linked action and observation evidence** guardrail. Stop and do not claim control credit. Restart only using an approved, scoped synthetic/offline fixture with runtime-proven controls and authorization. To classify **prevented**, provide linked action and observation records containing: - test ID, entity, timestamp/window, and source - scope/approval reference and perm...Votes: 0GitHub stars: 571
- Cyber Engagement Planning- **Objective:** Validate that the exercise team can identify, communicate, contain, and document a simulated security event using synthetic telemetry. - **Success observation:** The team records a complete timeline, assigns an adjudicated finding status, follows escalation paths, and produces evidence for each planned observation. - **Window:** 22 September 2026, 14:00–16:00 ICT. - **Expiry:** Authorization expires at 16:00 ICT; all activity stops automatically at expiry. - **Accountable owner:Votes: 0GitHub stars: 571
- Cyber Engagement PlanningI can’t include credentials, attack commands, payloads, real targets, or destructive steps. The **cyber-engagement-planning guardrail** requires a reviewable plan that separates intended activity from host-enforced permission.Votes: 0GitHub stars: 571
- Cyber Engagement PlanningMark the plan **offline-only — runtime controls unsupported**. Explicitly record that filesystem and network restrictions are not host-enforced, block live execution, and do not imply production readiness or authorization. Resume only after those controls are enforced and restart authority approves.Votes: 0GitHub stars: 571
- Cyber Engagement PlanningViolated guardrail: **No implied authorization**. The plan must not include credentials, attack commands, payloads, real targets, or destructive steps; authorization cannot be deferred, and roles do not replace approval. **Required action:** Stop and restart as an offline-only, bounded engagement plan. Obtain and verify explicit authorization before any execution or inclusion of operational attack details. Proceed only when evidence includes: - `engagement_scope_ref` - Explicit approver and a...Votes: 0GitHub stars: 571
- Cyber Engagement PlanningCannot call the exercise production-ready. The **hidden runtime dependency** and **no implied authorization** guardrails are violated because the host cannot enforce scope. Required action: **stop live execution**, mark the exercise **offline-only**, and restart only after scope enforcement is verified or an accountable owner approves a documented exception with compensating controls. Evidence required: - `engagement_scope_ref` - `skill_version` - `source` - `observed_at` - `finding_status` -...Votes: 0GitHub stars: 571
- Cyber Evidence```yaml engagement_scope_ref: "SYNTH-EXERCISE-001" skill_version: "cyber-evidence@loaded" source: "synthetic exercise observation; observer notes" observed_at: "2026-09-22T00:00:00Z" observer: "exercise-observer" method: "Manual review of synthetic event output; no production systems or real credentials involved" finding_status: "suspected" observation: "Synthetic event output indicated a possible unauthorized access attempt against the exercise service." evidence_refs: - "synthetic://exercis...Votes: 0GitHub stars: 571
- Cyber EvidenceRecord it as `finding_status: suspected`, not confirmed or false-positive. Include: - `engagement_scope_ref`, `skill_version`, and `source` - `observed_at`, observer, and scan method - `evidence_refs` pointing to the redacted scanner output - `limitations`: no corroborating runtime observation, unavailable controls, or synthetic-data boundaries - `accountable_owner` - Independently held ground truth, if available; compare it only through an independent adjudicator Keep raw evidence separate f...Votes: 0GitHub stars: 571
- Cyber EvidenceNo. Report the control as `blocked`, not effective. Record the `engagement_scope_ref`, `skill_version`, `source`, `observed_at`, observer/method, and `evidence_refs`. State that validation stopped halfway, identify missing runtime controls and limitations, preserve the independent ground truth, and assign an `accountable_owner`. Do not convert the incomplete result into `confirmed`, `not-tested`, or a clean outcome; effectiveness requires independent review.Votes: 0GitHub stars: 571
- Cyber EvidenceDo not mark it confirmed. This violates the **no scanner-only finding** and **no invented certainty** guardrails. Set `finding_status: suspected` and stop promotion. Re-run validation with independent corroboration and an independent reviewer/adjudicator; the operator cannot approve their own result. Proceed only with redacted, provenance-bound evidence showing: - authorized scope and reproducible method; - observed output plus runtime/target confirmation; - timestamps, evidence references, a...Votes: 0GitHub stars: 571
- Cyber EvidenceCannot delete it. This violates the cyber-evidence guardrails: preserve `blocked` outcomes, never rewrite history, and do not turn absence of proof into proof. Stop the cleanup and preserve the record. Restart verification with an independent reviewer/adjudicator; the operator must not approve their own result. Proceed only with sanitized evidence containing: `engagement_scope_ref`, `skill_version`, `source`, `observed_at`, observer/method, `finding_status: blocked`, `evidence_refs`, limitati...Votes: 0GitHub stars: 571