{"id":"96a92739-f7b1-41d0-9f75-15362e23b518","shortId":"mCCSD5","kind":"skill","title":"find-cybersecurity-firm","tagline":"Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on \"find me a pen-testing firm for our SOC 2 audit\", \"s","description":"# find-cybersecurity-firm\n\nDrive the **ServiceGraph API** (`https://api.servicegraph.co`) to find,\nshortlist, and enrich US cybersecurity firms.\n\n**Always pin `service_provided:cybersecurity`** — that's the only\nrelevant structured tag in the live catalog. Older skill docs and\nthe catalog source mention sub-tags like `pen-testing` and\n`security-audit`, but in the current release **none of those exist\nas separate tags** — `cybersecurity` is the broad catch-all and\nevery sub-type (pen-testing, red-team, vCISO, SOC 2 readiness, IR\nretainer, IAM, cloud security, AppSec) is a keyword substring search\non firm text. Confirm via `/v1/tags?include_values=1` once per\nsession.\n\nThe industry tag also drifts between releases — newer catalogs use\n`industry:cybersecurity`, older ones used `industry:security`.\nConfirm the value via `/v1/tags` and pin both `industry` and\n`service_provided:cybersecurity` for safety.\n\nAny HTTP client works (curl, fetch, requests). Examples below use curl.\n\n## When NOT to use this skill\n\n- **Consumer/personal cybersecurity** (\"my Gmail got hacked\", \"how do\n  I secure my home wifi\") — the catalog is B2B procurement only.\n- In-house security hires (Security Engineer, CISO, SOC analyst).\n- DIY/configuration questions (\"how do I patch CVE-X\", \"configure\n  firewall rules\", \"review this nginx config\").\n- Security-product comparisons (CrowdStrike vs SentinelOne, EDR\n  vendors, SIEM vendors).\n- Generic security knowledge (\"explain zero-trust\", \"what is OWASP\n  Top 10\").\n- Non-US firms.\n- Individual freelance pen-testers / bug-bounty hunters / contract\n  CISOs.\n\nIf the user is a *business* procuring external cybersecurity\nservices (pen test, audit, vCISO, IR retainer, SOC 2 prep), this\nskill applies — defaults to fire on B2B procurement intent.\n\n## MCP server (preferred for authed calls)\n\nIf your agent harness has the **ServiceGraph MCP server** loaded\n(`https://mcp.servicegraph.co`), prefer its tools for the **authed**\ntier (`/search`, `/get`, `/stats`). The MCP server uses OAuth 2.1 +\nPKCE — the host harness handles credentials in its own audited\nsandbox, so there's no `.env.local`, no shell dispatch, and no token\nvalue ever enters the LLM context.\n\nFor the **anonymous** tier (`/tags`, `/check`, `/explore`), MCP is\n**not** preferred — every MCP tool requires OAuth (the server has no\nanonymous tier), so plain curl against the REST URL is the simpler\npath for discovery calls. Use the REST patterns below for those.\n\nThe MCP tools 1:1-map to the public REST endpoints — same backend,\nsame quota, same data:\n\n| MCP tool | REST endpoint | Anon? | Recommended path |\n|---|---|---|---|\n| `list_tags` | `GET /v1/tags` | yes | curl |\n| `check_filter` | `GET /v1/check` | yes | curl |\n| `explore_firms` | `GET /v1/explore` | yes | curl |\n| `search_firms` | `GET /v1/search` | no | MCP if loaded, else curl + OTP |\n| `get_firm` | `GET /v1/get/:id` | no | MCP if loaded, else curl + OTP |\n| `catalog_stats` | `GET /v1/stats` | no | MCP if loaded, else curl + OTP |\n\n**Detection**: if you see any MCP tools with `servicegraph` in the\nname (the harness-specific prefix varies — agents pattern-match the\nsubstring), the ServiceGraph MCP server is loaded. Prefer those\ntools for the authed tier; complete any auth flow the harness\ninitiates if needed. If no `servicegraph` MCP tools are present,\nfall through to the REST + OTP flow below for the authed tier.\n\n## The four-tier funnel\n\n| Tier | Auth | Cost | Use it for |\n|---|---|---|---|\n| `GET /v1/tags` | none | free | **First call of every session.** Discover legal field names, kinds, operators, values. |\n| `GET /v1/check?filter=...` | none | free | Validate a filter before spending an explore/search call. |\n| `GET /v1/explore?filter=...` | none | free, IP-throttled | Scope: count + breakdowns. Use to size the candidate pool before quota-spending. |\n| `GET /v1/search?filter=...` | bearer | 200 unique firms / month free | Brief firm cards. **No url, no contact info.** Use for ranking / shortlisting. |\n| `GET /v1/get/:id` | bearer | 50 unique firms / month free | Full bundle: url, phone, email, social, legal name, address. **Only call for shortlisted firms.** |\n| `POST /v1/research` | paid | not in MVP | Deferred — skip. |\n\n**Quota rule that matters**: `/search` and `/get` charge per *unique\nfirm viewed per calendar month*, not per call. Re-paging the same\nquery is free. Two different filters that overlap charge once for\nthe overlap. Re-fetching a firm you already pulled this month is free.\n\n## Session-start ritual\n\nBefore constructing any filter, call:\n\n```\nGET https://api.servicegraph.co/v1/tags?include_values=1\n```\n\nCache the response for the conversation. Confirm the cybersecurity\nindustry tag value name (`cybersecurity` or older `security`) and\nthat `cybersecurity` is in the `service_provided` value list. The\nlive catalog has only the broad `service_provided:cybersecurity`\ntag — there are no separate `pen-testing` / `security-audit` /\n`appsec` tags despite older docs sometimes mentioning them.\n\nField kinds you'll use most:\n- **categorical**: `industry` (cybersecurity), `state`, `pricing_model`, `company_size_signal`, `geography_served` — op `:`\n- **tag_set_with_evidence**: `service_provided` — Map<tag, evidence∈{low,medium,high}>. Op `:` with optional `@evidence`\n- **numeric**: `rating`, `review_count_total`, `founded_year` — ops `= >= <= > <`\n- **presence**: `has:phone`, `has:clutch`, `has:rating`, `has:linkedin_company`, …\n- **keyword**: free-text substring across firm name / brand / title / meta / legal_name. **Many sub-types (vCISO, SOC 2, IR retainer, IAM, AppSec) are keyword-only.**\n\n## Auth\n\n`/tags`, `/check`, and `/explore` are anonymous. `/search` and `/get`\nrequire a bearer token.\n\n**Security model — keep the token out of the LLM context.**\n\n- **Never** read `.env`, `.env.local`, or any other credential file\n  into your context. The token's literal value should never appear\n  in the conversation.\n- Use shell dispatch for every authed request so the token flows\n  directly from the user's environment / dotenv file into the\n  `Authorization` header without round-tripping through the LLM.\n- **Always ask the user once per session** before using a detected\n  token, even if it's already in their shell or `.env.local`.\n\n**Resolution rule**:\n\n1. **Detect** whether a token is available — without reading its\n   value. Run a shell check that only inspects exit codes:\n\n   ```bash\n   ( [ -n \"${SERVICEGRAPH_TOKEN:-}\" ] \\\n     || grep -qs '^SERVICEGRAPH_TOKEN=' .env.local \\\n     || grep -qs '^SERVICEGRAPH_TOKEN=' .env )\n   ```\n\n   Exit code `0` = token is available somewhere; non-zero = no token.\n\n2. **Confirm with the user** before the first authed call this session:\n\n   > \"I found a `SERVICEGRAPH_TOKEN` in your environment / `.env.local`.\n   > OK to use it for ServiceGraph API requests this session?\"\n\n   If the user says no, stay on the anonymous tiers (`/tags`, `/check`,\n   `/explore`) and skip authed calls. Don't re-ask later unless the\n   user asks for authed work.\n\n3. **Dispatch via shell** — every authed call goes through a shell\n   wrapper so the literal token never enters the conversation:\n\n   ```bash\n   # If exported in the shell environment:\n   curl -H \"Authorization: Bearer $SERVICEGRAPH_TOKEN\" \\\n        'https://api.servicegraph.co/v1/search?filter=...'\n\n   # If in .env.local — source it inside a subshell so it doesn't\n   # leak into the parent shell either:\n   ( set -a; . ./.env.local; set +a;\n     curl -H \"Authorization: Bearer $SERVICEGRAPH_TOKEN\" \\\n          'https://api.servicegraph.co/v1/search?filter=...' )\n   ```\n\n   Capture the response body to a tmp file or jq-process it, but do\n   NOT echo the request command with the token expanded.\n\n4. **OTP flow** if no token is detected — capture the new token\n   directly into `.env.local` without surfacing its value to the LLM:\n\n   ```bash\n   # 1. trigger the email — agent prompts the user for $EMAIL\n   curl -fsS -X POST 'https://api.servicegraph.co/v1/auth/request-otp' \\\n     -H 'Content-Type: application/json' \\\n     -d \"{\\\"email\\\":\\\"$EMAIL\\\"}\"\n\n   # 2. exchange the code — agent prompts the user for $CODE.\n   #    The ?format=env query param returns SERVICEGRAPH_TOKEN=<token>\n   #    as plain text appended to .env.local — no jq needed. The -f\n   #    flag makes curl exit non-zero on 4xx so a wrong code doesn't\n   #    pollute the file (the error mirror is also a `# comment` line,\n   #    safe to ignore even if it lands).\n   curl -fsS -X POST 'https://api.servicegraph.co/v1/auth/verify-otp?format=env' \\\n     -H 'Content-Type: application/json' \\\n     -d \"{\\\"email\\\":\\\"$EMAIL\\\",\\\"code\\\":\\\"$CODE\\\",\\\"name\\\":\\\"claude-cli\\\"}\" \\\n     >> .env.local\n\n   # 3. confirm capture without revealing the value\n   grep -q '^SERVICEGRAPH_TOKEN=' .env.local && echo \"OTP token captured.\"\n   ```\n\n   After a successful capture, the user has implicitly consented\n   (they just completed the flow), so proceed to dispatch (step 3).\n   The token is now persistent in `.env.local` for future sessions.\n\n5. If a `/search` or `/get` returns `401 unauthorized` mid-session,\n   the token expired or was revoked — re-run the OTP flow.\n\n## Filter DSL\n\nOne query parameter, GitHub-search-style.\n\n```\nfilter   := orExpr\norExpr   := andExpr (\"OR\" andExpr)*\nandExpr  := notExpr ((\"AND\")? notExpr)*    # whitespace = implicit AND\nnotExpr  := (\"NOT\" | \"-\") notExpr | atom\natom     := \"(\" filter \")\" | predicate\npredicate:= IDENT op valueOrList | bareword\nop       := \":\" | \"=\" | \">=\" | \"<=\" | \">\" | \"<\"\nvalueOrList := value (\",\" value)*\nvalue    := IDENT | NUMBER | tagAtEvidence\ntagAtEvidence := IDENT \"@\" (\"low\"|\"medium\"|\"high\")\nbareword := IDENT | NUMBER          # → keyword:<bareword>\n```\n\n**Four rules that bite:**\n\n1. **AND binds tighter than OR.** `a OR b c` parses as `a OR (b AND c)`.\n   Use parens.\n2. **Comma list = OR within one predicate.** `state:CA,NY,TX` matches\n   any of the three.\n3. **Negation is `-x` or `NOT x`.** Negative literals inside a comma\n   list are **not** allowed: `state:CA,-NY` is rejected. Use\n   `state:CA -state:NY`.\n4. **Bareword = keyword search.** Any IDENT or NUMBER not followed by\n   an operator becomes a free-text substring across name / brand /\n   title / meta / legal_name. Multiple barewords AND.\n\n**Cybersecurity examples** (validate yours with `/v1/check`; replace\n`cybersecurity` with whatever `/v1/tags` returns as the industry value):\n\n```\nindustry:cybersecurity service_provided:cybersecurity\nservice_provided:cybersecurity pen-testing\nservice_provided:cybersecurity security audit soc 2\nservice_provided:cybersecurity vciso\nservice_provided:cybersecurity incident response retainer\nservice_provided:cybersecurity cloud aws\nservice_provided:cybersecurity application security sast\nservice_provided:cybersecurity rating>=4 has:clutch\nservice_provided:cybersecurity hipaa\n```\n\nWhen in doubt, hit `/v1/check?filter=...` first. (Note: the live\ncatalog has no separate `pen-testing` / `security-audit` /\n`appsec` tags. Pin `service_provided:cybersecurity` and treat all\nsub-types as keywords.)\n\n**Sub-type → keyword mapping** (all sub-types are keyword-only —\nthe live catalog has only the broad `service_provided:cybersecurity`\ntag):\n\n| User asks for | Use |\n|---|---|\n| Pen test / red team / penetration testing | keywords `pen-testing`, `red team` |\n| Security audit / assessment | keywords `audit`, `assessment` |\n| vCISO / fractional CISO | `vciso`, `fractional ciso` |\n| SOC 2 readiness / preparation | `soc 2`, `readiness` |\n| Incident response / forensics | `incident response`, `forensics`, `ir retainer` |\n| Cloud security (AWS/GCP/Azure) | `cloud security`, `aws`, `gcp`, `azure` |\n| Identity / IAM | `iam`, `identity` |\n| Application security / SAST/DAST | `application security`, `appsec`, `sast`, `dast` |\n| Compliance frameworks | `pci`, `hipaa`, `iso 27001`, `nist` |\n\n## firm_id contract\n\n`firm_id` is a stable 12-hex-char handle:\n\n```\nfirm_id = sha256(apex.lower().rstrip(\".\")).hexdigest()[:12]\n```\n\n```python\nimport hashlib\ndef firm_id(apex):\n    return hashlib.sha256(apex.lower().rstrip(\".\").encode()).hexdigest()[:12]\n```\n\n```bash\necho -n \"mandiant.com\" | tr 'A-Z' 'a-z' \\\n  | openssl dgst -sha256 -hex | awk '{print substr($2,1,12)}'\n```\n\n## Recipes\n\n### A. Pen test for SOC 2\n\nUser: *\"Pen-testing firm for our SOC 2 audit.\"*\n\n```\nGET /v1/explore?filter=industry:cybersecurity+service_provided:cybersecurity+pen-testing+soc 2\nGET /v1/search?filter=industry:cybersecurity+service_provided:cybersecurity+pen-testing+soc 2&limit=10\nGET /v1/get/<firm_id>     # ×3\n```\n\n### B. vCISO for a healthcare-tech startup\n\nUser: *\"vCISO services for our healthcare-tech startup.\"*\n\n```\nGET /v1/search?filter=industry:cybersecurity+vciso+(healthcare OR hipaa)\n```\n\n### C. Incident response retainer\n\nUser: *\"Incident response retainer in case we get breached.\"*\n\n```\nGET /v1/search?filter=industry:cybersecurity+incident response+retainer\n```\n\nIf thin, drop `retainer` — most IR firms also offer retainer engagements.\n\n### D. Cloud security + AWS + HIPAA\n\nUser: *\"Cloud security consultancy familiar with AWS and HIPAA.\"*\n\n```\nGET /v1/search?filter=industry:cybersecurity+cloud+aws+hipaa\n```\n\n### E. Indirect intent — \"we got breached\"\n\nUser: *\"We got hit with a ransomware attack last week — we need help fast.\"*\n\nThat's an emergency IR ask:\n\n```\nGET /v1/search?filter=industry:cybersecurity+incident response+ransomware&limit=10&order_by=relevance\n```\n\nSurface as urgent: skip `/v1/explore`, jump to `/v1/search`, present\nbriefs immediately.\n\n### F. AppSec / SAST\n\nUser: *\"Application security firms experienced with code review and SAST.\"*\n\n```\nGET /v1/search?filter=industry:cybersecurity+application security+(sast OR code review)\n```\n\n### G. SOC 2 readiness ahead of enterprise sales\n\nUser: *\"SOC 2 readiness partner ahead of our enterprise sales push.\"*\n\n```\nGET /v1/search?filter=industry:cybersecurity+soc 2+(readiness OR preparation)\n```\n\n### H. BYO apex list — enrich domains\n\nUser pastes 8–20 cybersecurity firm domains. For each:\n\n1. Compute `firm_id` locally.\n2. `GET /v1/get/<firm_id>` — full bundle if in catalog, 404 if not.\n3. Aggregate, present, flag the not-found ones.\n\n## Gotchas\n\n- **Always pin the cybersecurity industry tag.** Without it, `pen-testing` / `vciso` / `appsec` keywords leak into IT-services or other industries that mention security.\n- **Confirm the industry value name via `/v1/tags`** — older catalog releases used `industry:security`, newer ones may use `industry:cybersecurity`. Don't hardcode; check once per session.\n- **Refuse consumer-personal asks.** \"My Gmail got hacked\", \"how do I secure my home wifi\", \"should I use a VPN\" — none of these are B2B procurement. The catalog is for businesses procuring security services.\n- **DIY/configuration questions** (\"patch CVE-X\", \"configure firewall rules\", \"review this Terraform\") are NOT procurement.\n- **Security-product comparisons** (EDR, SIEM, identity providers) are NOT procurement either.\n- **\"Hire a security engineer / CISO\" is recruiting**, not procurement of a firm. Refuse.\n- **Bug-bounty / freelance pen-testers** are out of scope (catalog is firm-level only).\n- **Many sub-types are keyword-only.** Multi-word sub-types split into ANDed barewords (`incident response` → `incident` AND `response`).\n- **`looks_not_pro_services` 404 is not a bug.** A `firm_id` may exist in `/search` but 404 on `/get` if it's been flagged. Skip and continue; not charged.\n- **`/v1/explore` k=20 suppression.** When fewer than 20 firms match, the response is `{\"count\": \"<20\", \"suppressed\": true, \"breakdowns\": {}}`. Drilling further makes the count smaller. Broaden or escalate to `/v1/search`.\n- **Briefs from `/search` do NOT include `apex`, `url`, `phone_primary`, `email_primary`, `legal_name`, or address.** If the user asks for contact info, you must `/get/:id`.\n- **Quota is per-user-per-month, deduped on first view.** Re-views are free; re-pagination is free.\n\n## Errors\n\nAll errors return JSON: `{\"error\": {\"code\": \"...\", \"message\": \"...\"}}`.\n\n| Status | Code | What to do |\n|---|---|---|\n| 400 | `filter_parse_error` | Payload includes `position`. Fix the filter, re-validate with `/v1/check`. |\n| 400 | `filter_required` | Empty filter where one is required. |\n| 400 | `invalid_firm_id` | firm_id must be 12 lowercase hex chars. Re-derive. |\n| 401 | `unauthorized` | Token missing/expired. Re-run OTP. |\n| 404 | `not_found` | Firm not in catalog or flagged. Not charged. Skip and continue. |\n| 429 | `rate_limited` | Honor `Retry-After` header / `retry_after` field. |\n| 429 | `monthly_quota_exhausted` | Switch to `/v1/explore`-only mode for the rest of the month. Tell the user. |\n\n## End-to-end example\n\nUser: *\"Three pen-testing firms for our SOC 2 audit, 4-star ratings,\nideally with HIPAA experience for a healthcare-tech context.\"*\n\n```\nGET /v1/tags?include_values=1\nGET /v1/check?filter=industry:cybersecurity+service_provided:cybersecurity+pen-testing+soc 2+hipaa+rating>=4\nGET /v1/explore?filter=industry:cybersecurity+service_provided:cybersecurity+pen-testing+soc 2+hipaa+rating>=4\nGET /v1/search?filter=...&limit=10\nGET /v1/get/<firm_id>     # ×3\n```\n\nEnd of session: report `X-Quota-Remaining-Month`.","tags":["find","cybersecurity","firm","servicegraph","nostrband","agent-skills","ai-agents","b2b-data","claude-code-marketplace","claude-code-plugins","claude-code-skills","claude-plugins"],"capabilities":["skill","source-nostrband","skill-find-cybersecurity-firm","topic-agent-skills","topic-ai-agents","topic-b2b-data","topic-claude-code-marketplace","topic-claude-code-plugins","topic-claude-code-skills","topic-claude-plugins","topic-claude-skills","topic-mcp-server","topic-openapi","topic-professional-services","topic-vendor-discovery"],"categories":["ServiceGraph"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/nostrband/ServiceGraph/find-cybersecurity-firm","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add nostrband/ServiceGraph","source_repo":"https://github.com/nostrband/ServiceGraph","install_from":"skills.sh"}},"qualityScore":"0.530","qualityRationale":"deterministic score 0.53 from registry signals: · indexed on github topic:agent-skills · 160 github stars · SKILL.md body (17,188 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:56:02.835Z","embedding":null,"createdAt":"2026-05-06T12:58:10.678Z","updatedAt":"2026-05-18T18:56:02.835Z","lastSeenAt":"2026-05-18T18:56:02.835Z","tsv":"'/.env.local':1143 '/check':390,881,1068 '/explore':391,883,1069 '/get':349,688,888,1362,2232,2297 '/red':22 '/search':348,686,886,1360,2228,2274 '/stats':350 '/tags':389,880,1067 '/v1/auth/request-otp''':1218 '/v1/auth/verify-otp?format=env''':1295 '/v1/check':461,597,1531,1596,2347,2458 '/v1/explore':467,610,1793,1946,2243,2411,2474 '/v1/get':484,652,1821,2028,2495 '/v1/research':675 '/v1/search':473,631,1806,1841,1863,1896,1930,1949,1967,1997,2271,2490 '/v1/search?filter=...''':1122,1154 '/v1/stats':496 '/v1/tags':156,184,455,581,1536,2078,2453 '/v1/tags?include_values=1':742 '0':1016 '1':159,431,432,980,1202,1436,1773,2021,2456 '10':279,1819,1938,2493 '12':1728,1739,1753,1774,2365 '2':28,51,138,312,870,1026,1227,1455,1559,1679,1683,1772,1781,1790,1804,1817,1979,1987,2002,2026,2437,2469,2485 '2.1':356 '20':2015,2245,2250,2257 '200':634 '27001':1718 '3':1087,1311,1346,1471,1822,2037,2496 '4':1179,1497,1585,2439,2472,2488 '400':2333,2348,2357 '401':1364,2372 '404':2034,2217,2230,2380 '429':2394,2405 '4xx':1264 '5':1357 '50':655 '8':2014 'a-z':1759,1762 'across':856,1516 'address':668,2287 'agent':332,522,1206,1231 'aggreg':2038 'ahead':1981,1990 'allow':1486 'alreadi':724,972 'also':166,1278,1877 'alway':71,956,2047 'analyst':240 'and':2206 'andexpr':1393,1395,1396 'anon':449 'anonym':387,405,885,1065 'apex':1746,2008,2278 'apex.lower':1736,1749 'api':61,1053 'api.servicegraph.co':62,741,1121,1153,1217,1294 'api.servicegraph.co/v1/auth/request-otp''':1216 'api.servicegraph.co/v1/auth/verify-otp?format=env''':1293 'api.servicegraph.co/v1/search?filter=...''':1120,1152 'api.servicegraph.co/v1/tags?include_values=1':740 'appear':922 'append':1248 'appli':316 'applic':1578,1705,1708,1957,1971 'application/json':1223,1300 'appsec':38,145,791,874,1612,1710,1954,2059 'ask':957,1078,1083,1651,1928,2102,2291 'assess':1668,1671 'atom':1406,1407 'attack':1916 'audit':25,52,105,307,366,790,1557,1611,1667,1670,1791,2438 'auth':328,346,539,543,567,575,879,931,1034,1072,1085,1092 'author':947,1116,1148 'avail':986,1019 'aw':1574,1698,1884,1892,1901 'awk':1769 'aws/gcp/azure':1695 'azur':1700 'b':1444,1450,1823 'b2b':228,321,2123 'backend':440 'bareword':1414,1428,1498,1524,2207 'bash':1000,1107,1201,1754 'bearer':633,654,891,1117,1149 'becom':1510 'bind':1438 'bite':1435 'bodi':1158 'bounti':291,2175 'brand':859,1518 'breach':1861,1908 'breakdown':619,2260 'brief':639,1951,2272 'broad':121,776,1645 'broaden':2267 'bug':290,2174,2221 'bug-bounti':289,2173 'bundl':661,2030 'busi':300,2129 'byo':2007 'c':1445,1452,1849 'ca':1463,1488,1494 'cach':743 'calendar':695 'call':329,420,585,608,670,699,738,1035,1073,1093 'candid':624 'captur':1155,1187,1313,1326,1330 'card':641 'case':1858 'catalog':86,92,171,226,493,772,1602,1641,2033,2080,2126,2184,2386 'catch':123 'catch-al':122 'categor':805 'char':1731,2368 'charg':689,713,2242,2390 'check':458,994,2094 'ciso':238,294,1674,1677,2164 'claud':1308 'claude-c':1307 'cli':1309 'client':197 'cloud':35,143,1573,1693,1696,1882,1887,1900 'clutch':845,1587 'code':999,1015,1230,1236,1268,1304,1305,1962,1975,2326,2329 'comma':1456,1482 'command':1174 'comment':1280 'compani':811,850 'comparison':260,2151 'complet':541,1338 'complianc':1713 'comput':2022 'config':256 'configur':250,2139 'confirm':154,180,749,1027,1312,2072 'consent':1335 'construct':735 'consult':1889 'consum':2100 'consumer-person':2099 'consumer/personal':212 'contact':645,2293 'content':1221,1298 'content-typ':1220,1297 'context':384,902,914,2451 'continu':2240,2393 'contract':293,1722 'convers':748,925,1106 'cost':576 'count':618,836,2256,2265 'credenti':362,910 'crowdstrik':261 'curl':199,205,409,457,463,469,479,491,502,1114,1146,1212,1258,1289 'current':109 'cve':248,2137 'cve-x':247,2136 'cybersecur':3,17,56,69,75,118,174,192,213,303,751,756,762,779,807,1526,1533,1543,1546,1549,1555,1562,1566,1572,1577,1583,1590,1617,1648,1796,1799,1809,1812,1844,1866,1899,1933,1970,2000,2016,2050,2090,2461,2464,2477,2480 'd':1224,1301,1881 'dast':1712 'data':444 'dedup':2306 'def':1743 'default':317 'defer':680 'deriv':2371 'despit':793 'detect':504,966,981,1186 'dgst':1766 'differ':709 'direct':937,1191 'discov':589 'discoveri':419 'dispatch':375,928,1088,1344 'diy/configuration':241,2133 'doc':89,795 'doesn':1133,1269 'domain':2011,2018 'dotenv':943 'doubt':1594 'drift':167 'drill':2261 'drive':58 'drop':1872 'dsl':1382 'e':1903 'echo':1171,1323,1755 'edr':264,2152 'either':1140,2159 'els':478,490,501 'email':664,1205,1211,1225,1226,1302,1303,2282 'emerg':1926 'empti':2351 'encod':1751 'end':2424,2426,2497 'end-to-end':2423 'endpoint':438,448 'engag':1880 'engin':237,2163 'enrich':15,67,2010 'enter':381,1104 'enterpris':1983,1993 'env':905,1013,1239 'env.local':372,906,977,1008,1046,1125,1193,1250,1310,1322,1353 'environ':942,1045,1113 'error':1275,2320,2322,2325,2336 'escal':2269 'even':968,1285 'ever':380 'everi':126,396,587,930,1091 'evid':820,825,832 'exampl':202,1527,2427 'exchang':1228 'exhaust':2408 'exist':114,2226 'exit':998,1014,1259 'expand':1178 'experi':2445 'experienc':1960 'expir':1371 'explain':271 'explor':464 'explore/search':607 'export':1109 'extern':302 'f':1255,1953 'fall':557 'familiar':1890 'fast':1922 'fetch':200,720 'fewer':2248 'field':591,799,2404 'file':911,944,1162,1273 'filter':459,598,603,611,632,710,737,1381,1390,1408,1597,1794,1807,1842,1864,1897,1931,1968,1998,2334,2342,2349,2352,2459,2475,2491 'find':2,11,41,55,64 'find-cybersecurity-firm':1,54 'fire':319 'firewal':251,2140 'firm':4,18,47,57,70,152,283,465,471,482,636,640,657,673,692,722,857,1720,1723,1733,1744,1786,1876,1959,2017,2023,2171,2187,2223,2251,2359,2361,2383,2433 'firm-level':2186 'first':584,1033,1598,2308 'fix':2340 'flag':1256,2040,2237,2388 'flow':544,563,936,1181,1340,1380 'follow':1506 'forens':1687,1690 'format':1238 'found':838,1039,2044,2382 'four':571,1432 'four-tier':570 'fraction':1673,1676 'framework':1714 'free':583,600,613,638,659,707,729,853,1513,2314,2319 'free-text':852,1512 'freelanc':285,2176 'fss':1213,1290 'full':660,2029 'funnel':573 'futur':1355 'g':1977 'gcp':1699 'generic':268 'geographi':814 'get':454,460,466,472,481,483,495,580,596,609,630,651,739,1792,1805,1820,1840,1860,1862,1895,1929,1966,1996,2027,2452,2457,2473,2489,2494 'github':1387 'github-search-styl':1386 'gmail':215,2104 'goe':1094 'got':216,1907,1911,2105 'gotcha':2046 'grep':1004,1009,1318 'h':1115,1147,1219,1296,2006 'hack':217,2106 'handl':361,1732 'har':333,360,518,546 'hardcod':2093 'harness-specif':517 'hashlib':1742 'hashlib.sha256':1748 'header':948,2401 'healthcar':1828,1837,1846,2449 'healthcare-tech':1827,1836,2448 'help':1921 'hex':1730,1768,2367 'hex-char':1729 'hexdigest':1738,1752 'high':828,1427 'hipaa':1591,1716,1848,1885,1894,1902,2444,2470,2486 'hire':235,2160 'hit':1595,1912 'home':223,2112 'honor':2397 'host':359 'hous':233 'http':196 'hunter':292 'iam':34,142,873,1702,1703 'id':485,653,1721,1724,1734,1745,2024,2224,2298,2360,2362 'ideal':2442 'ident':1411,1420,1424,1429,1502,1701,1704,2154 'ignor':1284 'immedi':1952 'implicit':1334,1401 'import':1741 'in-hous':231 'incid':30,1567,1685,1688,1850,1854,1867,1934,2208,2210 'includ':157,2277,2338,2454 'indirect':1904 'individu':284 'industri':164,173,178,188,752,806,1540,1542,1795,1808,1843,1865,1898,1932,1969,1999,2051,2068,2074,2083,2089,2460,2476 'info':646,2294 'initi':547 'insid':1128,1480 'inspect':997 'intent':323,1905 'invalid':2358 'ip':615 'ip-throttl':614 'ir':140,309,871,1691,1875,1927 'iso':1717 'it-servic':2063 'jq':1165,1252 'jq-process':1164 'json':2324 'jump':1947 'k':2244 'keep':895 'keyword':148,851,877,1431,1499,1625,1629,1637,1660,1669,2060,2196 'keyword-on':876,1636,2195 'kind':593,800 'knowledg':270 'land':1288 'last':1917 'later':1079 'leak':1135,2061 'legal':590,666,862,1521,2284 'level':2188 'like':98 'limit':1818,1937,2396,2492 'line':1281 'linkedin':849 'list':452,769,1457,1483,2009 'liter':918,1101,1479 'live':85,771,1601,1640 'll':802 'llm':383,901,955,1200 'load':339,477,489,500,533 'local':2025 'look':2213 'low':826,1425 'lowercas':2366 'make':1257,2263 'manag':32 'mandiant.com':1757 'mani':864,2190 'map':433,823,1630 'match':525,1466,2252 'matter':685 'may':2087,2225 'mcp':324,337,352,392,397,429,445,475,487,498,509,530,553 'mcp.servicegraph.co':340 'medium':827,1426 'mention':94,797,2070 'messag':2327 'meta':861,1520 'mid':1367 'mid-sess':1366 'mirror':1276 'missing/expired':2375 'mode':2413 'model':810,894 'month':637,658,696,727,2305,2406,2419,2505 'multi':2199 'multi-word':2198 'multipl':1523 'must':2296,2363 'mvp':679 'n':1001,1756 'name':515,592,667,755,858,863,1306,1517,1522,2076,2285 'need':549,1253,1920 'negat':1472,1478 'never':903,921,1103 'new':1189 'newer':170,2085 'nginx':255 'nist':1719 'non':281,1022,1261 'non-us':280 'non-zero':1021,1260 'none':111,582,599,612,2119 'not-found':2042 'note':1599 'notexpr':1397,1399,1403,1405 'number':1421,1430,1504 'numer':833 'ny':1464,1489,1496 'oauth':355,400 'offer':1878 'ok':1047 'older':87,175,758,794,2079 'one':176,1383,1460,2045,2086,2354 'op':816,829,840,1412,1415 'openssl':1765 'oper':594,1509 'option':831 'order':1939 'orexpr':1391,1392 'otp':480,492,503,562,1180,1324,1379,2379 'overlap':712,717 'owasp':277 'page':702 'pagin':2317 'paid':676 'param':1241 'paramet':1385 'paren':1454 'parent':1138 'pars':1446,2335 'partner':1989 'past':2013 'patch':246,2135 'path':417,451 'pattern':424,524 'pattern-match':523 'payload':2337 'pci':1715 'pen':20,45,100,131,287,305,786,1551,1607,1654,1662,1777,1784,1801,1814,2056,2178,2431,2466,2482 'pen-test':19,44,99,130,286,785,1550,1606,1661,1783,1800,1813,2055,2177,2430,2465,2481 'penetr':1658 'per':161,690,694,698,961,2096,2302,2304 'per-user-per-month':2301 'persist':1351 'person':2101 'phone':663,843,2280 'pin':72,186,1614,2048 'pkce':357 'plain':408,1246 'pollut':1271 'pool':625 'posit':2339 'post':674,1215,1292 'predic':1409,1410,1461 'prefer':326,341,395,534 'prefix':520 'prep':313 'prepar':1681,2005 'presenc':841 'present':556,1950,2039 'price':809 'primari':2281,2283 'print':1770 'pro':2215 'proceed':1342 'process':1166 'procur':229,301,322,2124,2130,2147,2158,2168 'product':259,2150 'prompt':1207,1232 'provid':74,191,767,778,822,1545,1548,1554,1561,1565,1571,1576,1582,1589,1616,1647,1798,1811,2155,2463,2479 'public':436 'pull':725 'push':1995 'python':1740 'q':1319 'qs':1005,1010 'queri':705,1240,1384 'question':242,2134 'quota':442,628,682,2299,2407,2503 'quota-spend':627 'rank':649 'ransomwar':1915,1936 'rate':834,847,1584,2395,2441,2471,2487 're':701,719,1077,1376,2311,2316,2344,2370,2377 're-ask':1076 're-der':2369 're-fetch':718 're-pag':700 're-pagin':2315 're-run':1375,2376 're-valid':2343 're-view':2310 'read':904,988 'readi':29,139,1680,1684,1980,1988,2003 'recip':1775 'recommend':450 'recruit':2166 'red':134,1656,1664 'red-team':133 'refus':2098,2172 'reject':1491 'releas':110,169,2081 'relev':80,1941 'remain':2504 'replac':1532 'report':2500 'request':201,932,1054,1173 'requir':399,889,2350,2356 'resolut':978 'respons':31,745,1157,1568,1686,1689,1851,1855,1868,1935,2209,2212,2254 'rest':412,423,437,447,561,2416 'retain':141,310,872,1569,1692,1852,1856,1869,1873,1879 'retri':2399,2402 'retry-aft':2398 'return':1242,1363,1537,1747,2323 'reveal':1315 'review':253,835,1963,1976,2142 'revok':1374 'ritual':733 'round':951 'round-trip':950 'rstrip':1737,1750 'rule':252,683,979,1433,2141 'run':991,1377,2378 'safe':1282 'safeti':194 'sale':1984,1994 'sandbox':367 'sast':1580,1711,1955,1965,1973 'sast/dast':1707 'say':1060 'scope':617,2183 'search':150,470,1388,1500 'secur':24,36,104,144,179,221,234,236,258,269,759,789,893,1556,1579,1610,1666,1694,1697,1706,1709,1883,1888,1958,1972,2071,2084,2110,2131,2149,2162 'security-audit':103,788,1609 'security-product':257,2148 'see':507 'sentinelon':263 'separ':116,784,1605 'serv':815 'server':325,338,353,402,531 'servic':73,190,304,766,777,821,1544,1547,1553,1560,1564,1570,1575,1581,1588,1615,1646,1797,1810,1833,2065,2132,2216,2462,2478 'servicegraph':60,336,512,529,552,1002,1006,1011,1041,1052,1118,1150,1243,1320 'session':162,588,731,962,1037,1056,1356,1368,2097,2499 'session-start':730 'set':818,1141,1144 'sha256':1735,1767 'shell':374,927,975,993,1090,1097,1112,1139 'shortlist':12,65,650,672 'siem':266,2153 'signal':813 'simpler':416 'size':622,812 'skill':88,211,315 'skill-find-cybersecurity-firm' 'skip':681,1071,1945,2238,2391 'smaller':2266 'soc':27,33,50,137,239,311,869,1558,1678,1682,1780,1789,1803,1816,1978,1986,2001,2436,2468,2484 'social':665 'sometim':796 'somewher':1020 'sourc':93,1126 'source-nostrband' 'specif':519 'spend':605,629 'split':2204 'stabl':1727 'star':2440 'start':732 'startup':1830,1839 'stat':494 'state':808,1462,1487,1493,1495 'status':2328 'stay':1062 'step':1345 'structur':81 'style':1389 'sub':96,128,866,1622,1627,1633,2192,2202 'sub-tag':95 'sub-typ':127,865,1621,1626,1632,2191,2201 'subshel':1130 'substr':149,527,855,1515,1771 'success':1329 'suppress':2246,2258 'surfac':1195,1942 'switch':2409 'tag':82,97,117,165,453,753,780,792,817,824,1613,1649,2052 'tagatevid':1422,1423 'team':23,135,1657,1665 'tech':1829,1838,2450 'tell':2420 'terraform':2144 'test':21,46,101,132,306,787,1552,1608,1655,1659,1663,1778,1785,1802,1815,2057,2432,2467,2483 'tester':288,2179 'text':153,854,1247,1514 'thin':1871 'three':1470,2429 'throttl':616 'tier':347,388,406,540,568,572,574,1066 'tighter':1439 'titl':860,1519 'tmp':1161 'token':378,892,897,916,935,967,984,1003,1007,1012,1017,1025,1042,1102,1119,1151,1177,1184,1190,1244,1321,1325,1348,1370,2374 'tool':343,398,430,446,510,536,554 'top':278 'topic-agent-skills' 'topic-ai-agents' 'topic-b2b-data' 'topic-claude-code-marketplace' 'topic-claude-code-plugins' 'topic-claude-code-skills' 'topic-claude-plugins' 'topic-claude-skills' 'topic-mcp-server' 'topic-openapi' 'topic-professional-services' 'topic-vendor-discovery' 'total':837 'tr':1758 'treat':1619 'trigger':39,1203 'trip':952 'true':2259 'trust':274 'two':708 'tx':1465 'type':129,867,1222,1299,1623,1628,1634,2193,2203 'unauthor':1365,2373 'uniqu':635,656,691 'unless':1080 'urgent':1944 'url':413,643,662,2279 'us':16,68,282 'use':5,172,177,204,209,354,421,577,620,647,803,926,964,1049,1453,1492,1653,2082,2088,2116 'user':8,297,940,959,1030,1059,1082,1209,1234,1332,1650,1782,1831,1853,1886,1909,1956,1985,2012,2290,2303,2422,2428 'valid':601,1528,2345 'valu':158,182,379,595,754,768,919,990,1197,1317,1417,1418,1419,1541,2075,2455 'valueorlist':1413,1416 'vari':521 'vciso':26,136,308,868,1563,1672,1675,1824,1832,1845,2058 'vendor':265,267 'vet':13 'via':155,183,1089,2077 'view':693,2309,2312 'vpn':2118 'vs':262 'want':9 'week':1918 'whatev':1535 'whenev':6 'whether':982 'whitespac':1400 'wifi':224,2113 'within':1459 'without':949,987,1194,1314,2053 'word':2200 'work':198,1086 'wrapper':1098 'wrong':1267 'x':249,1214,1291,1474,1477,2138,2502 'x-quota-remaining-month':2501 'year':839 'yes':456,462,468 'z':1761,1764 'zero':273,1023,1262 'zero-trust':272","prices":[{"id":"02fb37ea-91b1-42fc-b406-33fcaca12253","listingId":"96a92739-f7b1-41d0-9f75-15362e23b518","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"nostrband","category":"ServiceGraph","install_from":"skills.sh"},"createdAt":"2026-05-06T12:58:10.678Z"}],"sources":[{"listingId":"96a92739-f7b1-41d0-9f75-15362e23b518","source":"github","sourceId":"nostrband/ServiceGraph/find-cybersecurity-firm","sourceUrl":"https://github.com/nostrband/ServiceGraph/tree/main/skills/find-cybersecurity-firm","isPrimary":false,"firstSeenAt":"2026-05-06T12:58:10.678Z","lastSeenAt":"2026-05-18T18:56:02.835Z"}],"details":{"listingId":"96a92739-f7b1-41d0-9f75-15362e23b518","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"nostrband","slug":"find-cybersecurity-firm","github":{"repo":"nostrband/ServiceGraph","stars":160,"topics":["agent-skills","ai-agents","b2b-data","claude-code-marketplace","claude-code-plugins","claude-code-skills","claude-plugins","claude-skills","mcp-server","openapi","professional-services","vendor-discovery"],"license":"mit","html_url":"https://github.com/nostrband/ServiceGraph","pushed_at":"2026-05-07T12:11:52Z","description":"AI Agent skills for a structured catalog of 100k+ US professional-services firms","skill_md_sha":"5ac146f21284f49c3fe4ef369bfdd8bd2d4ca771","skill_md_path":"skills/find-cybersecurity-firm/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/nostrband/ServiceGraph/tree/main/skills/find-cybersecurity-firm"},"layout":"multi","source":"github","category":"ServiceGraph","frontmatter":{"name":"find-cybersecurity-firm","license":"MIT","description":"Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on \"find me a pen-testing firm for our SOC 2 audit\", \"shortlist three vCISO services for our healthcare-tech startup\", \"we need an incident response retainer\", or \"pull contact info for these 8 security firm domains\", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, \"how do I patch CVE-X\" or \"configure firewall Y\" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters."},"skills_sh_url":"https://skills.sh/nostrband/ServiceGraph/find-cybersecurity-firm"},"updatedAt":"2026-05-18T18:56:02.835Z"}}