Agent Skills by Q16G
Showing 51 vetted skills indexed across 1 GitHub repositories.
Q16Gvuln-reproduction
Normalize vulnerability findings into standardized reproduction tasks with traceable evidence chains.
Q16Gdataflow-analysis
Analyze cross-function taint propagation with SyntaxFlow MCP and deterministic fallback.
Q16Gsecurity-header-audit
Detect missing or misconfigured HTTP security headers and cookie attributes.
Q16Gproject-framework-analysis
Map technology stacks, architecture layers, and entry points into a project-framework diagram.
Q16Gdependency-decompile
Recover readable source code for critical-path dependencies lacking source.
Q16Gsast-scan
Scan multi-language codebases with local Semgrep rules for security weaknesses.
Q16Gsession-security
Audit session management for weak IDs, fixation risks, and cookie misconfigurations.
Q16Gdependency-audit
Scan project manifests and lockfiles to identify known CVEs.
Q16Gstored-xss-detection
Trace storage XSS risk chains from source to render sinks.
Q16Gbusiness-logic-auth-review
Audit authentication and authorization weaknesses across Java, PHP, Python, and Go codebases.
Q16Gclient-js-audit
Audit client-side JavaScript for DOM XSS and token handling risks.
Q16Gsecret-detection
Detect hard-coded secrets in code repositories and generate remediation guidance.
Q16Gclient-side-sec
Audit CSP configurations and DOM data flow risks in web projects.
Q16Gconfig-sec
Audit YAML, JSON, INI, and environment variable configurations for secrets and insecure settings.
Q16Gsecurity-code-analysis
Audit code, configurations, and dependencies for security gaps.
Q16Gauth-authz
Audit authentication and authorization flows for login, session, and ownership controls.
Q16Gcsp-audit
Analyze Content-Security-Policy configurations for unsafe directives and bypass patterns.
Q16Gweb-ctf
Perform black-box reconnaissance on a target URL to identify attack surfaces and extract a flag.
Q16Grecon-methodology
Enumerate attack surfaces and fingerprint technologies for penetration testing.
Q16Gregistration-abuse
Detect batch registration abuse in registration endpoints.
Q16Gcsrf-testing
Identify and validate CSRF vulnerabilities in cookie-authenticated web endpoints.
Q16Gweb-security-testing
Coordinate web security testing workflows for reconnaissance and vulnerability discovery.
Q16Gxss-testing
Inject payloads to detect reflected, stored, and DOM XSS vulnerabilities.
Q16Gnotification-abuse
Detect and triage notification abuse across email and SMS endpoints.