Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Security Posture & Third-Party Tech-Stack — measured AI agent skill | DecimalAI

transilienceai/techstack-security

NewSkillScoreMaintained

Security-posture and third-party SaaS identification — security headers, CSP, HSTS, email auth, security.txt, plus payments/analytics/auth/CRM/support integrations.

Securityby transilienceai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/transilienceai-techstack-security/SKILL.md

decimalai skills pull transilienceai-techstack-security --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/transilienceai-techstack-security/SKILL.md https://app.decimal.ai/s/transilienceai-techstack-security/SKILL.md

Raw file: /s/transilienceai-techstack-security/SKILL.md ↗ · machine-readable summary at /s/transilienceai-techstack-security.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 9h ago

Yes — +9% lift+12% tokens0% turns95% of whole cases pass with skill (21/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	193%	0%
case-03	✗→✓	▲ Improved	5%	0%
case-18	✗→✓	▲ Improved	64%	0%
case-01	✓→✗	▼ Worse	-42%	0%
case-04	✓→✓	＝ Same ✓	8%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

transilienceai / communitytools

skills/techstack-identification/security/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

Security Posture & Third-Party Tech-Stack

Scope

Two related lenses on a target:

Security posture — HTTP security headers, Content Security Policy, HSTS, email auth (SPF/DKIM/DMARC/MTA-STS), security.txt, certificate practices.
Third-party / SaaS detection — payment processors, analytics, customer support, identity providers, CRM/marketing, error monitoring, A/B testing, social/communication SDKs, media CDNs.

The two are coupled: CSP script-src and DNS TXT verifications reveal third-party services, while third-party domains contribute to the overall security surface.

Signals (input)

HTTP response headers — security headers, CSP directives, HSTS
DNS TXT records — SPF, DKIM, DMARC, SaaS verification tokens
HTML — meta-tag security policies, embedded widgets/iframes
Loaded JS / script-src URLs and globals
/.well-known/security.txt, /security.txt, /.well-known/change-password

Inferences (output)

Security score (header coverage, CSP strength, email-auth strength, security.txt presence)
CSP analysis (unsafe-inline/eval issues, allowed third-party domains)
Email-auth grade (DMARC policy strength)
Third-party SaaS catalogue by category, with integration mode (client SDK vs CSP-only vs DNS-only)

Techniques

See reference/patterns.md.

When to use

Pre-engagement security baseline
Mapping supply-chain / SaaS exposure
Identifying integrations that grant pivot opportunities (Auth0, Stripe webhook surface, Sentry DSN leakage, etc.)
Phase 3 of tech-stack OSINT

Want to see if transilienceai/techstack-security would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.