2,707 agent tools in 3 subcategories. See them all in one list ↓
1,651 tools
528 tools
528 tools
| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| ponytail-audit Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first. SkillInstall · skills CLI | 190,451 | MIT | ||
| ponytail-debt Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report. SkillInstall · skills CLI | 190,451 | MIT | ||
| security-and-hardening Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, SkillInstall · skills CLI | 117,221 | MIT | ||
| deal-with-security-advisory Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, SkillInstall · skills CLI | 113,505 | MIT | ||
| html-ppt-knowledge-arch-blueprint OpenDesign's incident retro: the daemon-restart data bug, the root cause, the fix, and the systemic follow-ups. Built as a decision-grade product mana SkillInstall · skills CLI | 107,550 | Apache-2.0 | ||
| html-ppt-testing-safety-alert A hospital data-governance briefing: patient-data risk, the control framework, accountability, and the approval the board must give. Built as a decisi SkillInstall · skills CLI | 107,550 | Apache-2.0 | ||
| abuselpdb-automation Automate Abuselpdb tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,451 | — | ||
| bitwarden-automation Automate Bitwarden tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,451 | — | ||
| borneo-automation Automate Borneo tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,451 | — | ||
| control-d-automation Automate Control D tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,451 | — | ||
| digicert-automation Automate Digicert tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,451 | — | ||
| doppler-secretops-automation Automate Doppler Secretops tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,451 | — | ||
| security-research Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, cla SkillInstall · skills CLI | 70,897 | — | ||
| accesslint-audit Find and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or page, produce a prioritized written report, no edits) and fix (aud SkillInstall · skills CLI | 49,672 | MIT | ||
| accesslint-diff Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [name] to dif SkillInstall · skills CLI | 49,672 | MIT | ||
| accesslint-scan Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing. SkillInstall · skills CLI | 49,672 | MIT | ||
| api-security-testing API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best pra SkillInstall · skills CLI | 49,672 | MIT | ||
| auth-implementation-patterns Implement or review authentication and authorization with explicit token, session and resource-access boundaries. SkillInstall · skills CLI | 49,672 | MIT | ||
| azure-identity-py Azure Identity SDK for Python authentication. Use for DefaultAzureCredential, managed identity, service principals, and token caching. SkillInstall · skills CLI | 49,672 | MIT | ||
| backend-security-coder Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security imp SkillInstall · skills CLI | 49,672 | MIT | ||
| burp-suite-testing Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, re SkillInstall · skills CLI | 49,672 | MIT | ||
| cc-skill-security-review This skill guides review of security practices and potential vulnerabilities; no checklist ensures all code is secure. Use when implementing authentic SkillInstall · skills CLI | 49,672 | MIT | ||
| cloud-penetration-testing Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). SkillInstall · skills CLI | 49,672 | MIT | ||
| data-privacy-controls Data privacy control register: data category, lawful basis, retention period, access roles, encryption and consent requirement per module. Use for GDP SkillInstall · skills CLI | 49,672 | MIT | ||
| dependency-management-deps-audit You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependenci SkillInstall · skills CLI | 49,672 | MIT | ||
| django-access-review Use when reviewing Django or DRF access control: trace authorization flows, IDOR risks, object permissions, query scoping and tenant isolation before SkillInstall · skills CLI | 49,672 | MIT | ||
| ethical-hacking-methodology Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodol SkillInstall · skills CLI | 49,672 | MIT | ||
| fixing-accessibility Audit and fix HTML accessibility issues including ARIA labels, keyboard navigation, focus management, color contrast, and form errors. Use when adding SkillInstall · skills CLI | 49,672 | MIT | ||
| frontend-security-coder Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. SkillInstall · skills CLI | 49,672 | MIT | ||
| fsi-compliance-checker Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0.1 and MAS TRM (Singapore financial regulator), producing a SkillInstall · skills CLI | 49,672 | MIT | ||
| gdpr-data-handling Practical implementation guide for GDPR-oriented data-processing design, consent management, and privacy controls. SkillInstall · skills CLI | 49,672 | MIT | ||
| linux-privilege-escalation Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weak SkillInstall · skills CLI | 49,672 | MIT | ||
| pci-compliance Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification. SkillInstall · skills CLI | 49,672 | MIT | ||
| privacy-by-design Use when building apps that collect user data. Ensures privacy protections are built in from the start—data minimization, consent, encryption. SkillInstall · skills CLI | 49,672 | MIT | ||
| sast-configuration Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple pro SkillInstall · skills CLI | 49,672 | MIT | ||
| screen-reader-testing Practical guide to testing web applications with screen readers for comprehensive accessibility validation. SkillInstall · skills CLI | 49,672 | MIT | ||
| secrets-management Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools. SkillInstall · skills CLI | 49,672 | MIT | ||
| security-auditor Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. SkillInstall · skills CLI | 49,672 | MIT | ||
| security-requirement-extraction Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security use SkillInstall · skills CLI | 49,672 | MIT | ||
| skill-security-audit Audit an Agent Skill, MCP server, connector, or desktop extension before installation by tracing code, dependencies, permissions, credentials, data fl SkillInstall · skills CLI | 49,672 | MIT | ||
| threat-modeling-expert Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirem SkillInstall · skills CLI | 49,672 | MIT | ||
| top-web-vulnerabilities Provide an illustrative, overlapping reference for common web application vulnerability patterns organized by category. This skill enables systematic SkillInstall · skills CLI | 49,672 | MIT | ||
| ui-a11y Audit a component or page for accessibility issues and fix them SkillInstall · skills CLI | 49,672 | MIT | ||
| vulnerability-scanner Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization. SkillInstall · skills CLI | 49,672 | MIT | ||
| wcag-audit-patterns Comprehensive guide to auditing web content against WCAG 2.2 guidelines with actionable remediation strategies. SkillInstall · skills CLI | 49,672 | MIT | ||
| web-security-testing Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues. SkillInstall · skills CLI | 49,672 | MIT | ||
| claude-security Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged befo PluginAnthropic marketplace | 47,064 | Apache-2.0 | ||
| anti-reversing-techniques Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion SkillInstall · skills CLI | 42,495 | MIT | ||
| attack-tree-construction Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security ris SkillInstall · skills CLI | 42,495 | MIT | ||
| auth-implementation-patterns Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. SkillInstall · skills CLI | 42,495 | MIT | ||
| binary-analysis-patterns Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executab SkillInstall · skills CLI | 42,495 | MIT | ||
| gdpr-data-handling Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU SkillInstall · skills CLI | 42,495 | MIT | ||
| incident-runbook-templates Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a serv SkillInstall · skills CLI | 42,495 | MIT | ||
| memory-forensics Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use whe SkillInstall · skills CLI | 42,495 | MIT | ||
| mtls-configuration Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or s SkillInstall · skills CLI | 42,495 | MIT | ||
| postmortem-writing Write effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem SkillInstall · skills CLI | 42,495 | MIT | ||
| protocol-reverse-engineering Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing netw SkillInstall · skills CLI | 42,495 | MIT | ||
| sast-configuration Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security sca SkillInstall · skills CLI | 42,495 | MIT | ||
| secrets-management Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive cr SkillInstall · skills CLI | 42,495 | MIT | ||
| solidity-security Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contrac SkillInstall · skills CLI | 42,495 | MIT | ||
| stride-analysis-patterns Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating secu SkillInstall · skills CLI | 42,495 | MIT | ||
| threat-mitigation-mapping Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or va SkillInstall · skills CLI | 42,495 | MIT | ||
| audit-integrity Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, o SkillInstall · skills CLI | 41,140 | MIT | ||
| data-breach-blast-radius Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a re SkillInstall · skills CLI | 41,140 | MIT | ||
| gdpr-compliant Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authent SkillInstall · skills CLI | 41,140 | MIT | ||
| abusing-dpapi-for-credential-access Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline us SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| achieving-cmmc-level-2-compliance Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requireme SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verifi SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-active-directory-acl-abuse Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-android-malware-with-apktool Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest in SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-api-gateway-access-logs Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attem SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-apt-group-with-mitre-navigator Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-azure-activity-logs-for-threats Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privil SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-bootkit-and-rootkit-samples Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persiste SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-browser-forensics-with-hindsight Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, sa SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-campaign-attribution-evidence Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypothe SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-certificate-transparency-for-phishing Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate iss SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cloud-storage-access-patterns Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for aft SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cobalt-strike-beacon-configuration Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cobaltstrike-malleable-c2-profiles Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-command-and-control-communication Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cyber-kill-chain Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-disk-image-with-autopsy Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining meta SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-dns-logs-for-exfiltration Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-docker-container-forensics Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidenc SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-email-headers-for-phishing-investigation Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMA SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-ethereum-smart-contract-vulnerabilities Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-golang-malware-with-ghidra Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-heap-spray-exploitation Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-indicators-of-compromise Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-ios-app-security-with-objection Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass c SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-kubernetes-audit-logs Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymou SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-audit-logs-for-intrusion Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-elf-malware Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-kernel-rootkits Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, a SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-system-artifacts Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of comprom SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-lnk-file-and-jump-list-artifacts Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of fi SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-macro-malware-in-office-documents Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persis SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malicious-pdf-with-peepdf Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objec SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malicious-url-with-urlscan URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-behavior-with-cuckoo-sandbox Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, a SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-family-relationships-with-malpedia Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-persistence-with-autoruns Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, se SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-sandbox-evasion-techniques Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and s SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-memory-dumps-with-volatility Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-memory-forensics-with-lime-and-volatility Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-mft-for-deleted-file-recovery Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-network-covert-channels-in-malware Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-network-flow-data-with-netflow Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflo SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-typosquatting-domains-with-dnstwist Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains regis SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-uefi-bootkit-persistence Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware i SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-usb-device-connection-history Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-p SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-web-server-logs-for-intrusion Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-fo SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-amcache-artifacts Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s AmcacheParser and Timeline Explorer to extract evidence of program execution, appl SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-event-logs-in-splunk Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-lnk-files-for-artifacts Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconst SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-prefetch-with-python Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-registry-for-artifacts Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/per SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-shellbag-artifacts Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interac SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| auditing-uefi-firmware-with-chipsec Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-identity-federation-with-saml-azure-ad Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federati SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-identity-governance-lifecycle-process Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JM SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-soc-metrics-and-kpi-tracking Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, an SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-soc-playbook-for-ransomware Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with speci SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-threat-actor-profile-from-osint Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicator SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-threat-feed-aggregation-with-misp Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intell SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-threat-hunt-hypothesis-framework Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates t SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-threat-intelligence-enrichment-in-splunk Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them agains SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-threat-intelligence-feed-integration Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms int SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-threat-intelligence-platform Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system wit SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-vulnerability-aging-and-sla-tracking Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days cri SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-vulnerability-dashboard-with-defectdojo Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-vulnerability-exception-tracking-system Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic ex SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| building-vulnerability-scanning-workflow Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of sec SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| bypassing-authentication-with-forced-browsing Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during auth SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| coercing-authentication-with-coercer-petitpotam Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz mod SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| collecting-indicators-of-compromise Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blockin SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| collecting-open-source-intelligence Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| collecting-threat-intelligence-with-misp Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events a SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| collecting-volatile-evidence-from-compromised-host Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running proce SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-api-security-testing Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validatio SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-cloud-incident-response Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP A SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-cloud-penetration-testing This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understandin SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-cyber-risk-assessment-with-nist-800-30 Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-domain-persistence-with-dcsync Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-external-reconnaissance-with-osint Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-full-scope-red-team-engagement Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploita SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-internal-network-penetration-test Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escala SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-internal-reconnaissance-with-bloodhound-ce Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-malware-incident-response Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and exec SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-man-in-the-middle-attack-simulation Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traf SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-memory-forensics-with-volatility Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-mobile-app-penetration-test Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-network-penetration-test Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumerati SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-pass-the-ticket-attack Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-phishing-incident-response Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quara SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-post-incident-lessons-learned Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improv SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-social-engineering-penetration-test Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretex SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-social-engineering-pretext-call Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security aware SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-spearphishing-simulation-campaign Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LN SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-wireless-network-penetration-test Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-active-directory-tiered-model Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, pri SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-aws-verified-access-for-ztna Configure AWS Verified Access to provide VPN-less zero trust network access to internal apps, combining identity trust providers (IAM Identity Center, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-certificate-authority-with-openssl Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-host-based-intrusion-detection Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security viol SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-hsm-for-key-storage Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-identity-aware-proxy-with-google-iap Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, a SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-ldap-security-hardening Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, chann SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-microsegmentation-for-zero-trust Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, prev SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-multi-factor-authentication-with-duo Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-network-segmentation-with-vlans Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-oauth2-authorization-flow Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-pfsense-firewall-rules Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic betwee SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-snort-ids-for-intrusion-detection Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and aler SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-suricata-for-network-monitoring Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-tls-1-3-for-secure-communications Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with opens SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-windows-defender-advanced-settings Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, netw SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-windows-event-logging-for-detection Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigatio SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| configuring-zscaler-private-access-for-ztna Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application se SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| containing-active-breach Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short- SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| continuous-llm-red-teaming-with-promptfoo Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS pre SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| correlating-security-events-in-qradar Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi- SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| correlating-threat-campaigns Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute t SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| defending-llms-with-guardrails Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementar SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deobfuscating-javascript-malware Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipul SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deobfuscating-powershell-obfuscated-malware Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidd SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-active-directory-honeytokens Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (h SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-cloud-deception-with-decoy-resources Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the ins SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-cloudflare-access-for-zero-trust Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-decoy-files-for-ransomware-detection Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy document SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-edr-agent-with-crowdstrike Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automa SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-honeytokens-and-canarytokens Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-osquery-for-endpoint-monitoring Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-palo-alto-prisma-access-zero-trust Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| deploying-ransomware-canary-files Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, cre SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| designing-adversary-engagement-with-mitre-engage Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-ai-model-prompt-injection-attacks Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, fla SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-anomalies-in-industrial-control-systems Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-anomalous-authentication-patterns Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, cred SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-api-enumeration-attacks Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, paramet SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-arp-poisoning-in-network-traffic Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scr SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-attacks-on-historian-servers Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized quer SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-attacks-on-scada-systems This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on in SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-aws-cloudtrail-anomalies Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-aws-credential-exposure-with-trufflehog Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native dete SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-aws-guardduty-findings-automation Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-aws-iam-privilege-escalation Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-azure-lateral-movement Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomal SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-azure-service-principal-abuse Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel/Splunk) against Azure AD Audit and Sign-in Logs, cove SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-azure-storage-account-misconfigurations Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-beaconing-patterns-with-zeek Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Panda SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-bluetooth-low-energy-attacks Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle int SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-broken-object-property-level-authorization Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass ass SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-business-email-compromise Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclos SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-business-email-compromise-with-ai Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and context SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-cloud-threats-with-guardduty Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-command-and-control-over-dns Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entrop SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-compromised-cloud-credentials Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffi SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-credential-dumping-techniques Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Wind SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-dcsync-attack-in-active-directory Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-dependency-confusion Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal packag SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-dll-sideloading-attacks Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-dnp3-protocol-anomalies Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol viol SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-dns-exfiltration-with-dns-query-analysis Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-entra-offensive-tools-in-graph-logs Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration t SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-evasion-techniques-in-endpoint-logs Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool di SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-exfiltration-over-dns-with-zeek Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or pa SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-fileless-attacks-on-endpoints Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. U SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-fileless-malware-techniques Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living- SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-golden-ticket-attacks-in-kerberos-logs Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-golden-ticket-forgery Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-insider-data-exfiltration-via-dlp Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoin SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-insider-threat-behaviors Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-c SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-insider-threat-with-ueba Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform pe SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-kerberoasting-attacks Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers r SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-lateral-movement-in-network Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zee SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-lateral-movement-with-splunk Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/P SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-lateral-movement-with-zeek Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerbe SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-living-off-the-land-attacks Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and par SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-living-off-the-land-with-lolbas Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and p SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-malicious-npm-packages Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-malicious-scheduled-tasks-with-sysmon Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), a SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-mimikatz-execution-patterns Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detectio SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-misconfigured-azure-storage Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violat SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-mobile-malware-behavior Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, an SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-modbus-command-injection-attacks Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frame SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-modbus-protocol-anomalies Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep pa SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-model-extraction-attacks Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-network-anomalies-with-zeek Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-network-scanning-with-ids-signatures Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-ntlm-relay-with-event-correlation Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoni SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-oauth-token-theft Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refres SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-pass-the-hash-attacks Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-pass-the-ticket-attacks Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-port-scanning-with-fail2ban Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatica SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-privilege-escalation-attempts Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel ex SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-privilege-escalation-in-kubernetes-pods Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-process-hollowing-technique Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR tele SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-process-injection-techniques Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-qr-code-phishing-with-email-security Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using imag SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-ransomware-encryption-behavior Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scor SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-ransomware-precursors-in-network Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control b SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-rdp-brute-force-attacks Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Ty SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-rootkit-activity Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network c SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-s3-data-exfiltration-attempts Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alert SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-secure-boot-bypass Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and h SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-serverless-function-injection Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-service-account-abuse Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR/SIEM telemetry (Cro SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-shadow-api-endpoints Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysis against API gateways (Kong, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-shadow-it-cloud-usage Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python panda SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-spearphishing-with-email-gateway Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway ( SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-sql-injection-via-waf-logs Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to i SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-stuxnet-style-attacks Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipul SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-supply-chain-attacks-in-ci-cd Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expr SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-suspicious-oauth-application-consent Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to ident SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-suspicious-powershell-execution Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion us SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-t1003-credential-dumping-with-edr Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sy SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-t1055-process-injection-with-sysmon Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 1 SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-t1548-abuse-elevation-control-mechanism Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setui SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-typosquatting-packages Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proxim SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-typosquatting-packages-in-npm-pypi Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metr SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-wmi-persistence Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| emulating-cloud-attacks-with-stratus-red-team Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-deto SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| eradicating-malware-from-infected-systems Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| evaluating-threat-intelligence-platforms Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAX SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| executing-active-directory-attack-simulation Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege path SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| owasp-security Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 1 SkillInstall · skills CLI | 33,495 | MIT | ||
| ai-security Use when assessing an AI/ML system or LLM agent for prompt injection, jailbreaks, model inversion, data poisoning or tool abuse. Maps findings to MITR SkillInstall · skills CLI | 29,773 | MIT | ||
| ciso-advisor Use for security leadership decisions: a security program, budget justification in dollars, SOC 2 vs ISO 27001 vs HIPAA roadmap, or board security rep SkillInstall · skills CLI | 29,773 | MIT | ||
| cloud-security Use when checking AWS, Azure or GCP for security misconfigurations: IAM privilege escalation, public buckets, open security groups, IaC gaps. Runs clo SkillInstall · skills CLI | 29,773 | MIT | ||
| env-secrets-manager Use when auditing .env files, planning credential rotation, chasing a missing env var in production or hardening a repo against leaked secrets. Scans SkillInstall · skills CLI | 29,773 | MIT | ||
| incident-response Handle a suspected security breach: triage, SEV1-SEV4 severity, escalation and forensic evidence, per NIST SP 800-61. Use whenever the user thinks the SkillInstall · skills CLI | 29,773 | MIT | ||
| red-team Use when planning or running an authorized red team engagement or attack path analysis. Plans the kill chain with engagement_planner.py: MITRE ATT&CK SkillInstall · skills CLI | 29,773 | MIT | ||
| security-guidance Use when installing or tuning the PreToolUse security hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserializati SkillInstall · skills CLI | 29,773 | MIT | ||
| security-pen-testing Authorized penetration testing of an app or API: vulnerability scans, OWASP Top 10 checks, dependency audits and a pentest report. Use whenever the us SkillInstall · skills CLI | 29,773 | MIT | ||
| senior-secops Find and fix application security problems: security reviews, CVE remediation, hardening, secrets and auth, SOC 2, PCI-DSS, HIPAA and GDPR checks. Use SkillInstall · skills CLI | 29,773 | MIT | ||
| senior-security Check if a design or code is secure: STRIDE threat model, DREAD risk scores, leaked secret scan. Use whenever the user asks what could be attacked, ho SkillInstall · skills CLI | 29,773 | MIT | ||
| threat-detection Use when hunting threats, sweeping IOCs or looking for anomalies in logs and telemetry. Ranks ATT&CK-mapped signals and z-score anomalies with threat_ SkillInstall · skills CLI | 29,773 | MIT | ||
| security-best-practices Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests securi SkillInstall · skills CLI | 28,730 | — | ||
| security-ownership-map Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON SkillInstall · skills CLI | 28,730 | — | ||
| security-threat-model Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concis SkillInstall · skills CLI | 28,730 | — | ||
| nocobase-app-plugin-api-keys Register the API Keys plugin in a NocoBase App, let scripts and integrations call the App's API with an x-api-key header, or work out why a key is rej SkillInstall · skills CLI | 24,921 | — | ||
| nocobase-app-plugin-authentication Build authentication requirements in a NocoBase 3 application: protect API routes and pages with the session, read and refresh the session in the brow SkillInstall · skills CLI | 24,921 | — | ||
| nocobase-app-plugin-authorization Design and implement NocoBase 3 business permissions: job responsibilities, pages, business actions, fields, record scopes, relations, team inheritanc SkillInstall · skills CLI | 24,921 | — | ||
| nocobase-app-plugin-authz-default-access Design, implement and verify default access for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,921 | — | ||
| nocobase-app-plugin-authz-restriction-rules Design, implement and verify restriction rules for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,921 | — | ||
| nocobase-app-plugin-authz-sharing-rules Design, implement and verify sharing rules for NocoBase 3 business operations, including named data scopes and production administration. SkillInstall · skills CLI | 24,921 | — | ||
| assuredworkloads-environment-assessor Discover Google Cloud resource telemetry and effective Org Policies, evaluate brownfield workloads against sovereign data boundary and compliance stan SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| assuredworkloads-frameworks-navigator Acts as a Data Boundary Compliance Analyst that maps user compliance queries against Data Boundary Frameworks and cloud controls, validates matched re SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| cloud-armor-crs-rule-upgrader Upgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates e SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| detection-engineering-coverage-evaluation Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| gke-platform-security Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBA SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| gke-workload-security Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running securi SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| google-cloud-filestore-auditing Audits Filestore instances on Google Cloud across projects for disaster recovery readiness (missing or stale backups), security access governance (ove SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| google-cloud-recipe-auth Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| google-cloud-scc-query Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Securi SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| google-cloud-scc-remediation Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| google-cloud-solution-multi-agent-security Designs, deploys, and secures Google Cloud Agent Gateway solutions. Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGEN SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| google-cloud-storage-diagnostic Troubleshoots and diagnoses Cloud Storage on Google Cloud (also known colloquially as GCS) access and permission denials (403 Permission Denied or Ins SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| google-cloud-waf-security Evaluates Google Cloud workloads and provides actionable recommendations for identity management, access control, permissions and roles, network and p SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-cases Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR ca SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-detection-engineering Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new d SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-hunt Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of comprom SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-investigate Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, d SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-triage Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| hydra Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAut MCP server | 17,664 | — | ||
| skill-security-auditor Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection SkillInstall · skills CLI | 15,816 | Apache-2.0 | ||
| casdoor An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, MCP server | 14,858 | — | ||
| hexstrike-ai HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for autom MCP server | 13,596 | — | ||
| secure-code-guardian Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implem SkillInstall · skills CLI | 12,355 | MIT | ||
| security-reviewer Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when SkillInstall · skills CLI | 12,355 | MIT | ||
| offensive-active-directory Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential a SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-advanced-redteam Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rul SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-anti-forensics Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-api-abuse Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Cov SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-api-security Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 i SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-bluetooth-ble Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Se SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-bluetooth-classic Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-business-logic Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-c2-frameworks Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profi SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-cicd-pipeline Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-cicd-secrets Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from buil SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-cloud Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance ro SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-container-escape Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem m SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-crypto-attacks Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attack SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-data-exfiltration Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICM SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-deauth-disassoc Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (w SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-dependency-confusion Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploit SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-deserialization Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoser SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-evil-twin Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-fuzzing Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness wr SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-graphql Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint disco SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-iot IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-jwt JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter inject SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-k8s-attacks Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service acco SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-krack-fragattacks KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against W SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-lateral-movement Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, over SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-linux-privesc Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-lorawan-sub-ghz LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-mobile Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-netexec Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Trigg SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-network-attacks Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-osint Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, ema SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-persistence Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Ru SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-phishing Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhis SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-reporting Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technic SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-shellcode Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-social-engineering Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting met SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-sqli SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out- SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-ssti Dense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-supply-chain Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-tls-attacks Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. C SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-toctou Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symb SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wifi Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake cap SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wifi-recon Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-windows-privesc Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell t SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wpa-enterprise WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wpa2-psk WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapn SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wpa3-sae WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wps WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), onli SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-z-wave Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-zigbee-thread-matter Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolk SkillInstall · skills CLI | 10,764 | MIT | ||
| android-intent-security Audits, detects, and remediates Android Intent and component security vulnerabilities. Use this skill when auditing component configurations in Androi SkillInstall · skills CLI | 10,503 | Apache-2.0 | ||
| android-permissions-security Audits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing AndroidManifest.xml, defining SkillInstall · skills CLI | 10,503 | Apache-2.0 | ||
| play-policy-insights Automated auditor designed to verify Android applications against Google Play Policy domains. It cross-references static code analysis with Play Store SkillInstall · skills CLI | 10,503 | Apache-2.0 | ||
| restore-credentials Provides knowledge and workflows to implement Android's Restore Credentials feature using the androidx.credentials library. Use this skill to create, SkillInstall · skills CLI | 10,503 | Apache-2.0 | ||
| verified-email Provides a complete workflow for implementing verified email retrieval on Android Credential Manager API. Use this skill to integrate a secure, OTP-le SkillInstall · skills CLI | 10,503 | Apache-2.0 | ||
| antinet-security-scan 信息安全分析师与软件开发工程师在搭建文档处理流水线时，当需要拦截违规文件或外部URL，请挂载此技能作为强制前置安检，自动输出 pass/reject 判定与详细合规扫描报告，一键守住零信任安全底线。 SkillInstall · skills CLI | 9,543 | — | ||
| security-scan 对进入系统的文件或 URL 执行安全与合规扫描，输出 pass/reject 判定与扫描报告，作为所有文档处理的强制前置关卡。 SkillInstall · skills CLI | 9,543 | — | ||
| CyberStrikeAI The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation imp MCP server | 8,642 | — | ||
| audit-augmentation Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| crypto-protocol-diagram Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and gen SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| cvss-scoring Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerabili SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| dwarf-expert Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| firebase-apk-scanner Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functio SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| fp-check Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evid SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| genotoxic Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| graph-evolution Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detec SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| mermaid-to-proverif Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a Pro SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| slicing-code-context Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use whe SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| taint-trace Improves taint-analysis coverage and precision by using Trailmark graphs to repair native source, sink, sanitizer, propagation, and type models, then SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| trailmark Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagatio SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| trailmark-finding-triage Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| trailmark-review-gate Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| trailmark-structural Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundarie SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| trailmark-summary Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvani SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| trailmark-variant-neighborhood Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared caller SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| variant-analysis Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| vector-forge Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped muta SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| vulnerability-triage-brocards This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a find SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| wycheproof Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, E SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| yara-rule-authoring Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers nami SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| zeroize-audit Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysi SkillInstall · skills CLI | 8,179 | CC-BY-SA-4.0 | ||
| health Audits or prunes agent config, instruction drift, hooks or MCP, and AI maintainability. Use when Claude, Codex, or Pi setup looks wrong or guidance ne SkillInstall · skills CLI | 7,585 | MIT | ||
| Contractor Licence Changes Did this contractor's licence change? Observed lapses and reinstatements, not a snapshot. MCP serverVerified domain · ottobot.agencyRemote● Live | 7,467 | — | ||
| Licensed House Painters Find licensed house painters in 11 US states, with dated license status from state boards. MCP serverVerified domain · ottobot.agencyRemote● Live | 7,467 | — | ||
| agent-wallet Give the AI agent its own EVM wallet with admin-controlled policies the agent CANNOT bypass even under prompt injection. Encrypted keystore (AES-256-G SkillInstall · skills CLI | 7,120 | — | ||
| provider-oracles Run hash-bound Google, OpenAI, Microsoft, or Meta watermark-oracle checks for this repository. Use for provider verification, multi-account Gemini che SkillInstall · skills CLI | 6,366 | Apache-2.0 | ||
| remove-ai-watermarks Removes and identifies AI watermarks and provenance marks in images, video, and text the user generated or edited. Covers Gemini sparkles, SynthID, Mi SkillInstall · skills CLI | 6,366 | Apache-2.0 | ||
| signal-discovery Discover missing AI provenance and watermark coverage in the remove-ai-watermarks library from fresh or historical corpora, then validate detection an SkillInstall · skills CLI | 6,366 | Apache-2.0 | ||
| apk-redteam-pipeline End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/F SkillInstall · skills CLI | 5,763 | MIT | ||
| bb-local-toolkit Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need SkillInstall · skills CLI | 5,763 | MIT | ||
| bb-methodology Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combi SkillInstall · skills CLI | 5,763 | MIT | ||
| bug-bounty Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning ( SkillInstall · skills CLI | 5,763 | MIT | ||
| bugcrowd-reporting Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severit SkillInstall · skills CLI | 5,763 | MIT | ||
| cloud-iam-deep Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Cove SkillInstall · skills CLI | 5,763 | MIT | ||
| enterprise-vpn-attack External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalPro SkillInstall · skills CLI | 5,763 | MIT | ||
| evidence-hygiene Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp p SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-api-misconfig Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, veri SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-aspnet Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, reques SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-ato Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predict SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-auth-bypass Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-20 SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-brute-force Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/em SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-business-logic Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), ne SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-cache-poison Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-captcha-bypass Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replay SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-cicd Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poiso SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-clickjacking Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-cloud-misconfig Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write) SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-cors Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-csrf Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Arg SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-deserialization Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.l SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-dispatch Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Us SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-dom Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-exceptional-conditions Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and mak SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-file-upload Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double e SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-fintech-graphql Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-forgot-password Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs inva SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-graphql Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM featur SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-grpc Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoi SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-host-header Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks ups SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-html-injection Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-http-smuggling Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next b SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-idor Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-jwt-crypto Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-k8s Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-laravel Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard u SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-ldap Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-lfi Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upl SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-llm-ai Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agent SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-mfa-bypass Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-misc Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-nextjs Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisonin SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-nodejs Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/ev SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-nosqli Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-ntlm-info Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-oauth Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-open-redirect Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redir SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-race-condition Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Ke SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-rag-vector Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survi SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-rce Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-saml Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-session Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-c SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-shadow-api Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-sharepoint Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-source-leak Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint dis SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-spa-api Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-springboot Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injecti SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-sqli Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $ SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-ssrf Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exc SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-ssti Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thyme SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-subdomain Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-poo SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-tls-network Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/D SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-websocket Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentica SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-xss Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflect SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-xxe Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML As SkillInstall · skills CLI | 5,763 | MIT | ||
| ios-redteam-pipeline End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static ana SkillInstall · skills CLI | 5,763 | MIT | ||
| m365-entra-attack Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart SkillInstall · skills CLI | 5,763 | MIT | ||
| meme-coin-audit Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze a SkillInstall · skills CLI | 5,763 | MIT | ||
| mid-engagement-ir-detection Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting t SkillInstall · skills CLI | 5,763 | MIT | ||
| offensive-osint Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain SkillInstall · skills CLI | 5,763 | MIT | ||
| okta-attack Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-not SkillInstall · skills CLI | 5,763 | MIT | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed di SkillInstall · skills CLI | 5,763 | MIT | ||
| recon-scope-triage Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-match SkillInstall · skills CLI | 5,763 | MIT | ||
| redteam-mindset Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where SkillInstall · skills CLI | 5,763 | MIT | ||
| redteam-report-template Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for exter SkillInstall · skills CLI | 5,763 | MIT | ||
| report-writing Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title SkillInstall · skills CLI | 5,763 | MIT | ||
| security-arsenal Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need s SkillInstall · skills CLI | 5,763 | MIT | ||
| supply-chain-attack-recon External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions SkillInstall · skills CLI | 5,763 | MIT | ||
| triage-validation Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid wi SkillInstall · skills CLI | 5,763 | MIT | ||
| vmware-vcenter-attack VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload SkillInstall · skills CLI | 5,763 | MIT | ||
| web2-recon Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, SkillInstall · skills CLI | 5,763 | MIT | ||
| web3-audit Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flas SkillInstall · skills CLI | 5,763 | MIT | ||
| active-directory-attacks This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enume SkillInstall · skills CLI | 4,708 | MIT | ||
| api-fuzzing-bug-bounty This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API p SkillInstall · skills CLI | 4,708 | MIT | ||
| audit-flow Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, comp SkillInstall · skills CLI | 4,708 | MIT | ||
| authentication-patterns Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mista SkillInstall · skills CLI | 4,708 | MIT | ||
| aws-penetration-testing This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege es SkillInstall · skills CLI | 4,708 | MIT | ||
| broken-authentication This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform crede SkillInstall · skills CLI | 4,708 | MIT | ||
| burp-suite-testing This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerabil SkillInstall · skills CLI | 4,708 | MIT | ||
| cloud-penetration-testing This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources SkillInstall · skills CLI | 4,708 | MIT | ||
| code-vuln-audit Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL SkillInstall · skills CLI | 4,708 | MIT | ||
| ethical-hacking-methodology This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduc SkillInstall · skills CLI | 4,708 | MIT | ||
| file-path-traversal This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files throug SkillInstall · skills CLI | 4,708 | MIT | ||
| html-injection-testing This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web SkillInstall · skills CLI | 4,708 | MIT | ||
| idor-testing This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access cont SkillInstall · skills CLI | 4,708 | MIT | ||
| linux-privilege-escalation This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfiguratio SkillInstall · skills CLI | 4,708 | MIT | ||
| metasploit-framework This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads SkillInstall · skills CLI | 4,708 | MIT | ||
| pentest-checklist This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing" SkillInstall · skills CLI | 4,708 | MIT | ||
| pentest-commands This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or jo SkillInstall · skills CLI | 4,708 | MIT | ||
| privilege-escalation-methods This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", SkillInstall · skills CLI | 4,708 | MIT | ||
| red-team-tools This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS SkillInstall · skills CLI | 4,708 | MIT | ||
| scanning-tools This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", " SkillInstall · skills CLI | 4,708 | MIT | ||
| secure-code-review Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities SkillInstall · skills CLI | 4,708 | MIT | ||
| shodan-reconnaissance This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable servic SkillInstall · skills CLI | 4,708 | MIT | ||
| smtp-penetration-testing This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP b SkillInstall · skills CLI | 4,708 | MIT | ||
| sql-injection-testing This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL inj SkillInstall · skills CLI | 4,708 | MIT | ||
| sqlmap-database-pentesting This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using SkillInstall · skills CLI | 4,708 | MIT | ||
| ssh-penetration-testing This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vu SkillInstall · skills CLI | 4,708 | MIT | ||
| top-web-vulnerabilities This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability SkillInstall · skills CLI | 4,708 | MIT | ||
| windows-privilege-escalation This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege esc SkillInstall · skills CLI | 4,708 | MIT | ||
| wordpress-penetration-testing This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, o SkillInstall · skills CLI | 4,708 | MIT | ||
| xss-html-injection This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws SkillInstall · skills CLI | 4,708 | MIT | ||
| create-formal-verification-skill Generate a project-local skill that formally verifies the code where a bug costs the most and tests reach the least, in any language, with whichever v SkillInstall · skills CLI | 4,298 | MIT | ||
| security Security audit workflow - vulnerability scan → verification SkillInstall · skills CLI | 3,949 | MIT | ||
| security-reviewer Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposur SkillInstall · skills CLI | 3,816 | Apache-2.0 | ||
| launch-check Passive pre-launch report card for a live URL of an app or site built with AI (Lovable, Bolt, Replit, Cursor, v0, Claude). Scores security (secret key SkillInstall · skills CLI | 3,743 | MIT | ||
| ops-settings Post-setup credential manager. Shows current integration status (configured/missing/expired) and lets you update individual credentials without re-run SkillInstall · skills CLI | 3,743 | MIT | ||
| security-audit Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates SkillInstall · skills CLI | 3,743 | MIT | ||
| verify-watermark-removal Verify that a watermark-removal or "humanizer" step actually removed a statistical text watermark, by measuring a sample whose key the user holds. Use SkillInstall · skills CLI | 3,743 | MIT | ||
| ctf-reverse Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized SkillInstall · skills CLI | 3,701 | MIT | ||
| ctf-web Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, i SkillInstall · skills CLI | 3,701 | MIT | ||
| ctf-writeup Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to docume SkillInstall · skills CLI | 3,701 | MIT | ||
| tdd TODO SkillInstall · skills CLI | 3,699 | — | ||
| aws-agents-for-devsecops Investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Age PluginAnthropic marketplace | 3,480 | Apache-2.0 | ||
| credentials Instructions for handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing using a safe protoc SkillInstall · skills CLI | 3,472 | Apache-2.0 | ||
| redamon Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with hu MCP server | 3,400 | — | ||
| agent-scan Security scanner for AI agents, MCP servers and agent skills. MCP server | 3,241 | — | ||
| azure-compliance Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/complian SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-identity-py Azure Identity SDK for Python authentication with Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and token SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-identity-rust Azure Identity library for Rust. Microsoft Entra ID authentication for all Azure SDK clients. Triggers: "azure identity rust", "DeveloperToolsCredenti SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-keyvault-certificates-rust Azure Key Vault Certificates library for Rust. Create, manage, and use X.509 certificates including self-signed and CA-issued. Triggers: "keyvault cer SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-keyvault-keys-rust Azure Key Vault Keys library for Rust. Create, manage, and use cryptographic keys including RSA, EC, and HSM-protected keys. Triggers: "keyvault keys SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-keyvault-keys-ts Manage cryptographic keys using Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys). Use when creating, encrypting/decrypting, signing, or SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-keyvault-py Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage. Triggers: "key vault", "SecretClient", "KeyCli SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-keyvault-secrets-rust Azure Key Vault Secrets library for Rust. Store and retrieve secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-keyvault-secrets-ts Manage secrets using Azure Key Vault Secrets SDK for JavaScript (@azure/keyvault-secrets). Use when storing and retrieving application secrets or conf SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-security-keyvault-keys-dotnet Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-security-keyvault-keys-java Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/ver SkillInstall · skills CLI | 3,203 | MIT | ||
| azure-security-keyvault-secrets-java Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other se SkillInstall · skills CLI | 3,203 | MIT | ||
| entra-agent-id Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2 SkillInstall · skills CLI | 3,203 | MIT | ||
| entra-app-registration Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, c SkillInstall · skills CLI | 3,203 | MIT | ||
| microsoft-azure-webjobs-extensions-authentication-events-dotnet Microsoft Entra Authentication Events SDK for .NET. Azure Functions triggers for custom authentication extensions. Use for token enrichment, custom cl SkillInstall · skills CLI | 3,203 | MIT | ||
| exposure-risk-quantification FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownershi SkillInstall · skills CLI | 3,030 | MIT | ||
| identity-provider-recon Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fi SkillInstall · skills CLI | 3,030 | MIT | ||
| offensive-osint Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 SkillInstall · skills CLI | 3,030 | MIT | ||
| org-attack-surface Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains - SkillInstall · skills CLI | 3,030 | MIT | ||
| osint-autopilot End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement SkillInstall · skills CLI | 3,030 | MIT | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → SkillInstall · skills CLI | 3,030 | MIT | ||
| warden Security engineer — IAM, secrets, threat modeling, hardening, auth, and supply chain security. SkillInstall · skills CLI | 2,919 | MIT | ||
| warden-audit Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for "security audit", "ch SkillInstall · skills CLI | 2,919 | MIT | ||
| warden-harden Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. SkillInstall · skills CLI | 2,919 | MIT | ||
| warden-iam Build IAM from scratch — roles, policies, service accounts with least privilege. Use when asked to "set up IAM", "create roles", "service accounts", o SkillInstall · skills CLI | 2,919 | MIT | ||
| warden-recon Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps. Use when aske SkillInstall · skills CLI | 2,919 | MIT | ||
| warden-scan Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured J SkillInstall · skills CLI | 2,919 | MIT | ||
| warden-threat Produce a threat model — assets, ranked threats, mitigations, accepted risks. Use when asked to "threat model this", "what could go wrong security-wis SkillInstall · skills CLI | 2,919 | MIT | ||
| security-hardening Application security covering input validation, auth, headers, secrets management, and dependency auditing SkillInstall · skills CLI | 2,838 | Apache-2.0 | ||
| attacker-forwarding Forward collected data to an explicitly attacker-controlled destination SkillInstall · skills CLI | 2,727 | — | ||
| data-exfiltrator Analyzes data files SkillInstall · skills CLI | 2,727 | — | ||
| eicar-test Test skill containing EICAR test file for malware detection SkillInstall · skills CLI | 2,727 | — | ||
| encoded-tag-marker Contain an encoded Unicode Tag Block marker used for hidden instructions SkillInstall · skills CLI | 2,727 | — | ||
| external-instruction-follower Delegate agent behavior to instructions obtained from an external page SkillInstall · skills CLI | 2,727 | — | ||
| external-socket-reporter Send a diagnostic record over an explicitly external raw socket SkillInstall · skills CLI | 2,727 | — | ||
| prompt-injection-test A test skill with prompt injection patterns SkillInstall · skills CLI | 2,727 | — | ||
| ransomware-chain Demonstrate a multi-stage file encryption and extortion implementation SkillInstall · skills CLI | 2,727 | — | ||
| ransomware-request Issue an explicit imperative request for a prohibited cyber-harm capability SkillInstall · skills CLI | 2,727 | — | ||
| remote-package-installer Install a Python package directly from an untrusted remote archive SkillInstall · skills CLI | 2,727 | — | ||
| sensitive-file-reader Read a sensitive operating-system credential file for diagnostics SkillInstall · skills CLI | 2,727 | — | ||
| unconstrained-file-reader Read a caller-selected path without confining it to a safe root SkillInstall · skills CLI | 2,727 | — | ||
| 401-403-bypass-techniques 401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-acl-abuse Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentia SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-certificate-services AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-kerberos-attacks Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, SkillInstall · skills CLI | 2,656 | MIT | ||
| ai-ml-security AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model st SkillInstall · skills CLI | 2,656 | MIT | ||
| android-pentesting-tricks Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent r SkillInstall · skills CLI | 2,656 | MIT | ||
| anti-debugging-techniques Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or sig SkillInstall · skills CLI | 2,656 | MIT | ||
| api-auth-and-jwt-abuse API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary SkillInstall · skills CLI | 2,656 | MIT | ||
| api-authorization-and-bola API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level SkillInstall · skills CLI | 2,656 | MIT | ||
| api-recon-and-docs API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area SkillInstall · skills CLI | 2,656 | MIT |
Filters apply to the top 600 of 2,707 tools by stars.