Browse Skills

Kiro Spec Status reads a specification's files and reports its current phase, completion percentage, task breakdown, boundary context, and next actions. Use it to see where a spec-driven development effort stands and what blockers or revalidation needs are next.

Kiro Spec Tasks reads specification documents and generates an implementation task plan, mapping every requirement to executable 1–3 hour tasks with dependencies and parallel markers. Use it in spec-driven development to turn approved requirements and design into a reviewable tasks.md.

Kiro Steering Management maintains {{KIRO_DIR}}/steering/ as persistent project knowledge, bootstrapping core steering files from the codebase and syncing them as the project evolves. Use it to keep AI agents' shared context aligned with codebase patterns and principles.

Kiro Validate Design reviews technical design documents against requirements and project context, identifying critical issues and giving a GO/NO-GO decision before implementation.

Spec Batch creates complete specification files (spec.json, requirements.md, design.md, tasks.md) for all features in a roadmap by dispatching sub-agents in dependency-ordered waves. Use it when you need to generate specs for a whole project roadmap and verify cross-spec consistency.

Spec Requirements generates a comprehensive requirements document aligned with steering context, using EARS-formatted acceptance criteria to capture user-observable behavior and explicit scope boundaries for spec-driven development. Use it after discovery to turn a project brief into testable, unambiguous requirements before design.

Verify Completion checks completion and success claims against fresh command evidence before a task, fix, test, or feature is reported as done. Use it before closing tasks, trusting subagent success, or giving feature GO.

API Misconfig Hunter finds mass assignment, prototype pollution, HTTP verb tampering, and server-side parameter pollution in APIs. Use it when auditing API endpoints for security misconfigurations in bug bounty or penetration testing.

APK Red Team Pipeline automates Android APK reconnaissance, acquisition, decompilation, secret scanning, and Frida instrumentation for authorized red-team assessments. Use when a target has a mobile app catalogue, hosts APK files, or when 'mobile app' is in scope.

Auth Bypass Hunting guides reconnaissance of authentication entry points and exploitation of SSO, SAML, JWT, XMLRPC, and legacy protocol weaknesses to find login bypasses and privilege escalation. Use when assessing web apps, WordPress, SharePoint, Atlassian, and partner portals for auth flaws.

Bug Bounty guides security researchers through the full bug bounty workflow: reconnaissance, hunting vulnerabilities (IDOR, SSRF, XSS, auth bypass, AI/LLM security issues), validating findings, and writing impactful reports.

Bug Bounty Local Toolkit provides the complete bug-bounty workflow (recon, learning, hunting, validation, reporting) and resolves local install paths for tools, wordlists, and clones. Use it when hunting from a local machine and you need to know where jhaddix, SecLists, trufflehog, ffuf, dalfox, or ghauri are installed, or as the full-workflow variant of the local toolkit.