#security

A checked, item-by-item list of accounts, with old accounts deleted or set to private, and occupied brand names reclaimed through platform appeals.

Developer advanced tutorial: to build a trustworthy agent, manage its system prompt well and recognize six common threats: tampered instructions, unauthorized access, resource abuse, knowledge base poisoning, cascading failures, and how to defend against them.

Advanced developer tutorial: Agent logs can be altered, so what can you use to prove integrity during an audit? Use signed receipts to record each tool call, hash chains to prevent deletion and tampering, and clarify what they can and cannot prove.

Someone has put together 10 reverse-engineering Skills and integration solutions for Agents: comprehensive analysis, scenario routing, Android interfaces, product analysis, lightweight command line, CTF, IDA assistance, JS signatures, and an all-in-one lab. We have added all of them to our site's Skill pages, with selection advice, license differences, and authorization reminders.

Use when working on CTF competitions or practice challenges (Web, binary exploitation, cryptography, reverse engineering, forensics, OSINT, etc.). Based on the open-source ctf-skills (MIT): a set of Skills split by challenge type, with tool installation scripts. For competitions, practice ranges, and authorized testing only. Use case: Lets the agent pull the matching solving approach and tools for each challenge type, so CTF work goes faster.

Use when a user wants a security audit of their own codebase, vulnerability hunting, penetration-style review, or analysis of security issues in a specific piece of code. Based on Cloudflare's open-source security-audit-skill (MIT): reconnaissance, parallel vulnerability hunting, one-by-one attempts to refute each finding, independent review, and report generation. Reads source code only, does not touch production, does not run target code without a sandbox, and speculation does not count as a vulnerability. Use case: Have an Agent run a structured security audit of your own codebase, where every suspicion is verified by another Agent, producing a report with evidence.

Use this when you need to design or review free quotas, sign-up bonuses, trials and rate limits for a product, so the platform can afford to give things away without being farmed to death. Covers identity and device identification, sign-up and login protection, human verification, and isolating quotas and model costs. Use case: Used to stop the platform from being mass-registered and farmed for free credits.

Before an Agent touches your inbox or calendar, learn the three questions to ask about any connection, what "read-only" really means, and how to revoke access in two minutes.