528 agent tools in this category, ranked by GitHub stars for now. Hands-on test results will replace this ranking as they finish.
The three most-starred tools here. Not tested together yet.
Automate Abuselpdb tasks via Rube MCP (Composio). Always search tools first for current schemas.
npx skills add ComposioHQ/awesome-claude-skills --skill abuselpdb-automationConduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
npx skills add sickn33/agentic-awesome-skills --skill cloud-penetration-testingMaster the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essen
npx skills add sickn33/agentic-awesome-skills --skill ethical-hacking-methodology| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| abuselpdb-automation Automate Abuselpdb tasks via Rube MCP (Composio). Always search tools first for current schemas. SkillInstall · skills CLI | 79,451 | — | ||
| cloud-penetration-testing Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). SkillInstall · skills CLI | 49,672 | MIT | ||
| ethical-hacking-methodology Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodol SkillInstall · skills CLI | 49,672 | MIT | ||
| linux-privilege-escalation Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weak SkillInstall · skills CLI | 49,672 | MIT | ||
| anti-reversing-techniques Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion SkillInstall · skills CLI | 42,495 | MIT | ||
| binary-analysis-patterns Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executab SkillInstall · skills CLI | 42,495 | MIT | ||
| memory-forensics Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use whe SkillInstall · skills CLI | 42,495 | MIT | ||
| mtls-configuration Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or s SkillInstall · skills CLI | 42,495 | MIT | ||
| abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verifi SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-active-directory-acl-abuse Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-android-malware-with-apktool Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest in SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-api-gateway-access-logs Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attem SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-apt-group-with-mitre-navigator Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-azure-activity-logs-for-threats Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privil SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-bootkit-and-rootkit-samples Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persiste SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-browser-forensics-with-hindsight Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, sa SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-campaign-attribution-evidence Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypothe SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-certificate-transparency-for-phishing Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate iss SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cloud-storage-access-patterns Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for aft SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cobalt-strike-beacon-configuration Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cobaltstrike-malleable-c2-profiles Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-command-and-control-communication Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-cyber-kill-chain Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-disk-image-with-autopsy Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining meta SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-dns-logs-for-exfiltration Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-docker-container-forensics Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidenc SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-email-headers-for-phishing-investigation Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMA SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-golang-malware-with-ghidra Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-heap-spray-exploitation Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-indicators-of-compromise Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-ios-app-security-with-objection Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass c SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-kubernetes-audit-logs Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymou SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-audit-logs-for-intrusion Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-elf-malware Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-kernel-rootkits Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, a SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-linux-system-artifacts Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of comprom SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-lnk-file-and-jump-list-artifacts Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of fi SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-macro-malware-in-office-documents Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persis SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malicious-pdf-with-peepdf Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objec SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malicious-url-with-urlscan URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-behavior-with-cuckoo-sandbox Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, a SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-family-relationships-with-malpedia Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-persistence-with-autoruns Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, se SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-malware-sandbox-evasion-techniques Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and s SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-memory-dumps-with-volatility Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-memory-forensics-with-lime-and-volatility Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-mft-for-deleted-file-recovery Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-network-covert-channels-in-malware Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-network-flow-data-with-netflow Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflo SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-typosquatting-domains-with-dnstwist Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains regis SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-uefi-bootkit-persistence Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware i SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-usb-device-connection-history Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-p SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-web-server-logs-for-intrusion Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-fo SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-amcache-artifacts Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s AmcacheParser and Timeline Explorer to extract evidence of program execution, appl SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-event-logs-in-splunk Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-lnk-files-for-artifacts Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconst SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-prefetch-with-python Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-registry-for-artifacts Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/per SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| analyzing-windows-shellbag-artifacts Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interac SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| auditing-uefi-firmware-with-chipsec Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-full-scope-red-team-engagement Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploita SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-internal-network-penetration-test Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escala SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-internal-reconnaissance-with-bloodhound-ce Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-malware-incident-response Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and exec SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-man-in-the-middle-attack-simulation Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traf SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-memory-forensics-with-volatility Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-mobile-app-penetration-test Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-network-penetration-test Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumerati SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-pass-the-ticket-attack Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-phishing-incident-response Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quara SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-post-incident-lessons-learned Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improv SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-social-engineering-penetration-test Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretex SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-social-engineering-pretext-call Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security aware SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-spearphishing-simulation-campaign Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LN SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| conducting-wireless-network-penetration-test Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| designing-adversary-engagement-with-mitre-engage Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| evaluating-threat-intelligence-platforms Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAX SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| incident-response Handle a suspected security breach: triage, SEV1-SEV4 severity, escalation and forensic evidence, per NIST SP 800-61. Use whenever the user thinks the SkillInstall · skills CLI | 29,773 | MIT | ||
| red-team Use when planning or running an authorized red team engagement or attack path analysis. Plans the kill chain with engagement_planner.py: MITRE ATT&CK SkillInstall · skills CLI | 29,773 | MIT | ||
| threat-detection Use when hunting threats, sweeping IOCs or looking for anomalies in logs and telemetry. Ranks ATT&CK-mapped signals and z-score anomalies with threat_ SkillInstall · skills CLI | 29,773 | MIT | ||
| security-threat-model Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concis SkillInstall · skills CLI | 28,730 | — | ||
| detection-engineering-coverage-evaluation Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-cases Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR ca SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-detection-engineering Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new d SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-hunt Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of comprom SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-investigate Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, d SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| secops-triage Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true SkillInstall · skills CLI | 24,146 | Apache-2.0 | ||
| hexstrike-ai HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for autom MCP server | 13,596 | — | ||
| offensive-active-directory Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential a SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-advanced-redteam Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rul SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-anti-forensics Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-api-abuse Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Cov SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-api-security Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 i SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-bluetooth-ble Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Se SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-bluetooth-classic Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-business-logic Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-c2-frameworks Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profi SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-cicd-pipeline Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-cicd-secrets Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from buil SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-cloud Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance ro SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-container-escape Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem m SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-crypto-attacks Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attack SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-data-exfiltration Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICM SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-deauth-disassoc Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (w SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-dependency-confusion Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploit SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-deserialization Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoser SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-evil-twin Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-fuzzing Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness wr SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-graphql Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint disco SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-iot IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-jwt JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter inject SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-k8s-attacks Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service acco SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-krack-fragattacks KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against W SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-lateral-movement Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, over SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-linux-privesc Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-lorawan-sub-ghz LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-mobile Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-netexec Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Trigg SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-network-attacks Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-osint Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, ema SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-persistence Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Ru SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-phishing Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhis SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-reporting Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technic SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-shellcode Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-social-engineering Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting met SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-sqli SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out- SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-ssti Dense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-supply-chain Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-tls-attacks Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. C SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-toctou Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symb SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wifi Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake cap SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wifi-recon Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-windows-privesc Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell t SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wpa-enterprise WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wpa2-psk WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapn SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wpa3-sae WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-wps WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), onli SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-z-wave Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern SkillInstall · skills CLI | 10,764 | MIT | ||
| offensive-zigbee-thread-matter Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolk SkillInstall · skills CLI | 10,764 | MIT | ||
| apk-redteam-pipeline End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/F SkillInstall · skills CLI | 5,763 | MIT | ||
| bb-local-toolkit Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need SkillInstall · skills CLI | 5,763 | MIT | ||
| bb-methodology Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combi SkillInstall · skills CLI | 5,763 | MIT | ||
| bug-bounty Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning ( SkillInstall · skills CLI | 5,763 | MIT | ||
| bugcrowd-reporting Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severit SkillInstall · skills CLI | 5,763 | MIT | ||
| cloud-iam-deep Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Cove SkillInstall · skills CLI | 5,763 | MIT | ||
| enterprise-vpn-attack External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalPro SkillInstall · skills CLI | 5,763 | MIT | ||
| evidence-hygiene Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp p SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-idor Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-jwt-crypto Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-k8s Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-laravel Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard u SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-ldap Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-lfi Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upl SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-llm-ai Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agent SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-mfa-bypass Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-misc Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-nextjs Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisonin SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-nodejs Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/ev SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-nosqli Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-ntlm-info Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-oauth Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-open-redirect Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redir SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-race-condition Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Ke SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-rag-vector Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survi SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-rce Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target. SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-saml Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-session Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-c SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-shadow-api Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-sharepoint Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-source-leak Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint dis SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-spa-api Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One SkillInstall · skills CLI | 5,763 | MIT | ||
| hunt-springboot Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injecti SkillInstall · skills CLI | 5,763 | MIT | ||
| ios-redteam-pipeline End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static ana SkillInstall · skills CLI | 5,763 | MIT | ||
| m365-entra-attack Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart SkillInstall · skills CLI | 5,763 | MIT | ||
| mid-engagement-ir-detection Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting t SkillInstall · skills CLI | 5,763 | MIT | ||
| offensive-osint Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain SkillInstall · skills CLI | 5,763 | MIT | ||
| okta-attack Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-not SkillInstall · skills CLI | 5,763 | MIT | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed di SkillInstall · skills CLI | 5,763 | MIT | ||
| recon-scope-triage Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-match SkillInstall · skills CLI | 5,763 | MIT | ||
| redteam-mindset Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where SkillInstall · skills CLI | 5,763 | MIT | ||
| redteam-report-template Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for exter SkillInstall · skills CLI | 5,763 | MIT | ||
| report-writing Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title SkillInstall · skills CLI | 5,763 | MIT | ||
| supply-chain-attack-recon External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions SkillInstall · skills CLI | 5,763 | MIT | ||
| triage-validation Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid wi SkillInstall · skills CLI | 5,763 | MIT | ||
| active-directory-attacks This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enume SkillInstall · skills CLI | 4,708 | MIT | ||
| api-fuzzing-bug-bounty This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API p SkillInstall · skills CLI | 4,708 | MIT | ||
| aws-penetration-testing This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege es SkillInstall · skills CLI | 4,708 | MIT | ||
| burp-suite-testing This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerabil SkillInstall · skills CLI | 4,708 | MIT | ||
| cloud-penetration-testing This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources SkillInstall · skills CLI | 4,708 | MIT | ||
| ethical-hacking-methodology This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduc SkillInstall · skills CLI | 4,708 | MIT | ||
| file-path-traversal This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files throug SkillInstall · skills CLI | 4,708 | MIT | ||
| html-injection-testing This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web SkillInstall · skills CLI | 4,708 | MIT | ||
| idor-testing This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access cont SkillInstall · skills CLI | 4,708 | MIT | ||
| linux-privilege-escalation This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfiguratio SkillInstall · skills CLI | 4,708 | MIT | ||
| metasploit-framework This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads SkillInstall · skills CLI | 4,708 | MIT | ||
| pentest-checklist This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing" SkillInstall · skills CLI | 4,708 | MIT | ||
| pentest-commands This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or jo SkillInstall · skills CLI | 4,708 | MIT | ||
| privilege-escalation-methods This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", SkillInstall · skills CLI | 4,708 | MIT | ||
| red-team-tools This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS SkillInstall · skills CLI | 4,708 | MIT | ||
| shodan-reconnaissance This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable servic SkillInstall · skills CLI | 4,708 | MIT | ||
| smtp-penetration-testing This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP b SkillInstall · skills CLI | 4,708 | MIT | ||
| sqlmap-database-pentesting This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using SkillInstall · skills CLI | 4,708 | MIT | ||
| ssh-penetration-testing This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vu SkillInstall · skills CLI | 4,708 | MIT | ||
| windows-privilege-escalation This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege esc SkillInstall · skills CLI | 4,708 | MIT | ||
| wordpress-penetration-testing This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, o SkillInstall · skills CLI | 4,708 | MIT | ||
| ctf-reverse Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized SkillInstall · skills CLI | 3,701 | MIT | ||
| ctf-web Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, i SkillInstall · skills CLI | 3,701 | MIT | ||
| ctf-writeup Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to docume SkillInstall · skills CLI | 3,701 | MIT | ||
| tdd TODO SkillInstall · skills CLI | 3,699 | — | ||
| aws-agents-for-devsecops Investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Age PluginAnthropic marketplace | 3,480 | Apache-2.0 | ||
| redamon Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with hu MCP server | 3,400 | — | ||
| offensive-osint Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 SkillInstall · skills CLI | 3,030 | MIT | ||
| org-attack-surface Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains - SkillInstall · skills CLI | 3,030 | MIT | ||
| osint-autopilot End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement SkillInstall · skills CLI | 3,030 | MIT | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → SkillInstall · skills CLI | 3,030 | MIT | ||
| attacker-forwarding Forward collected data to an explicitly attacker-controlled destination SkillInstall · skills CLI | 2,727 | — | ||
| data-exfiltrator Analyzes data files SkillInstall · skills CLI | 2,727 | — | ||
| encoded-tag-marker Contain an encoded Unicode Tag Block marker used for hidden instructions SkillInstall · skills CLI | 2,727 | — | ||
| external-instruction-follower Delegate agent behavior to instructions obtained from an external page SkillInstall · skills CLI | 2,727 | — | ||
| external-socket-reporter Send a diagnostic record over an explicitly external raw socket SkillInstall · skills CLI | 2,727 | — | ||
| prompt-injection-test A test skill with prompt injection patterns SkillInstall · skills CLI | 2,727 | — | ||
| ransomware-chain Demonstrate a multi-stage file encryption and extortion implementation SkillInstall · skills CLI | 2,727 | — | ||
| ransomware-request Issue an explicit imperative request for a prohibited cyber-harm capability SkillInstall · skills CLI | 2,727 | — | ||
| remote-package-installer Install a Python package directly from an untrusted remote archive SkillInstall · skills CLI | 2,727 | — | ||
| unconstrained-file-reader Read a caller-selected path without confining it to a safe root SkillInstall · skills CLI | 2,727 | — | ||
| 401-403-bypass-techniques 401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-acl-abuse Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentia SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-certificate-services AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to SkillInstall · skills CLI | 2,656 | MIT | ||
| active-directory-kerberos-attacks Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, SkillInstall · skills CLI | 2,656 | MIT | ||
| android-pentesting-tricks Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent r SkillInstall · skills CLI | 2,656 | MIT | ||
| anti-debugging-techniques Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or sig SkillInstall · skills CLI | 2,656 | MIT | ||
| api-auth-and-jwt-abuse API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary SkillInstall · skills CLI | 2,656 | MIT | ||
| api-authorization-and-bola API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level SkillInstall · skills CLI | 2,656 | MIT | ||
| api-recon-and-docs API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area SkillInstall · skills CLI | 2,656 | MIT | ||
| api-sec Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any SkillInstall · skills CLI | 2,656 | MIT | ||
| arbitrary-write-to-rce Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to conv SkillInstall · skills CLI | 2,656 | MIT | ||
| attack-surface-mapping Draw a testable attack surface from one authorized target URL or one application. Use when the user says 攻击面, 供给面, 画攻击面, map the surface, application SkillInstall · skills CLI | 2,656 | MIT | ||
| auth-sec Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, a SkillInstall · skills CLI | 2,656 | MIT | ||
| authbypass-authentication-flaws Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brut SkillInstall · skills CLI | 2,656 | MIT | ||
| binary-protection-bypass Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections SkillInstall · skills CLI | 2,656 | MIT | ||
| browser-exploitation-v8 Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination SkillInstall · skills CLI | 2,656 | MIT | ||
| business-logic-vuln Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more SkillInstall · skills CLI | 2,656 | MIT | ||
| business-logic-vulnerabilities Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and mult SkillInstall · skills CLI | 2,656 | MIT | ||
| classical-cipher-analysis Classical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that r SkillInstall · skills CLI | 2,656 | MIT | ||
| hack Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vul SkillInstall · skills CLI | 2,656 | MIT | ||
| prototype-pollution Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configur SkillInstall · skills CLI | 2,656 | MIT | ||
| prototype-pollution-advanced Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pol SkillInstall · skills CLI | 2,656 | MIT | ||
| race-condition Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, SkillInstall · skills CLI | 2,656 | MIT | ||
| recon-and-methodology Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing SkillInstall · skills CLI | 2,656 | MIT | ||
| recon-for-sec Entry P1 category router for reconnaissance and methodology. Use when mapping scope, drawing an attack surface from one application, discovering asset SkillInstall · skills CLI | 2,656 | MIT | ||
| request-smuggling HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Con SkillInstall · skills CLI | 2,656 | MIT | ||
| reverse-shell-techniques Reverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shell SkillInstall · skills CLI | 2,656 | MIT | ||
| rsa-attack-techniques RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak key SkillInstall · skills CLI | 2,656 | MIT | ||
| saml-sso-assertion-attacks SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundari SkillInstall · skills CLI | 2,656 | MIT | ||
| sandbox-escape-techniques Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or name SkillInstall · skills CLI | 2,656 | MIT | ||
| smart-contract-vulnerabilities Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash SkillInstall · skills CLI | 2,656 | MIT | ||
| sqli-sql-injection SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band SkillInstall · skills CLI | 2,656 | MIT | ||
| ssrf-server-side-request-forgery SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata SkillInstall · skills CLI | 2,656 | MIT | ||
| ssti-server-side-template-injection SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content. SkillInstall · skills CLI | 2,656 | MIT | ||
| stack-overflow-and-rop Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2c SkillInstall · skills CLI | 2,656 | MIT | ||
| steganography-techniques Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polygl SkillInstall · skills CLI | 2,656 | MIT | ||
| subdomain-takeover Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, SkillInstall · skills CLI | 2,656 | MIT | ||
| symbolic-execution-tools Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary SkillInstall · skills CLI | 2,656 | MIT | ||
| symmetric-cipher-attacks Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream ciphe SkillInstall · skills CLI | 2,656 | MIT | ||
| traffic-analysis-pcap Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/US SkillInstall · skills CLI | 2,656 | MIT | ||
| tunneling-and-pivoting Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DN SkillInstall · skills CLI | 2,656 | MIT | ||
| type-juggling PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric SkillInstall · skills CLI | 2,656 | MIT | ||
| unauthorized-access-common-services Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management SkillInstall · skills CLI | 2,656 | MIT | ||
| upload-insecure-files Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload- SkillInstall · skills CLI | 2,656 | MIT | ||
| vm-and-bytecode-reverse Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary SkillInstall · skills CLI | 2,656 | MIT | ||
| waf-bypass-techniques WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to SkillInstall · skills CLI | 2,656 | MIT | ||
| web-cache-deception Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other use SkillInstall · skills CLI | 2,656 | MIT | ||
| websocket-security WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-bac SkillInstall · skills CLI | 2,656 | MIT | ||
| windows-av-evasion AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and s SkillInstall · skills CLI | 2,656 | MIT | ||
| windows-lateral-movement Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pas SkillInstall · skills CLI | 2,656 | MIT | ||
| windows-privilege-escalation Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato expl SkillInstall · skills CLI | 2,656 | MIT | ||
| xslt-injection XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user SkillInstall · skills CLI | 2,656 | MIT | ||
| xss-cross-site-scripting XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths. SkillInstall · skills CLI | 2,656 | MIT | ||
| xxe-xml-external-entity XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources. SkillInstall · skills CLI | 2,656 | MIT | ||
| agent-bom-analyze Analyze blast radius, attack paths, and threat landscape across your AI infrastructure. Use when: "blast radius", "threat intel", "risk score", "attac SkillInstall · skills CLI | 2,192 | MIT | ||
| security-repro Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incident SkillInstall · skills CLI | 2,125 | MIT | ||
| malware-analyst Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral an SkillInstall · skills CLI | 2,009 | MIT | ||
| pentest-ai Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself. MCP server | 1,827 | — | ||
| emp3r0r Stealthy, Linux-first multi-operator C2 with a self-healing mesh, in-memory execution, and an AI-driven MCP assistant. MCP server | 1,825 | — | ||
| LitterBox A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end MCP server | 1,571 | — | ||
| open-reverselab Open-source AI reverse-engineering workspace with a desktop app, red / blue / both analysis, parallel Goals, a security knowledge base, and MCP tools MCP server | 1,372 | — | ||
| Dark-Moon Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM MCP server | 1,234 | — | ||
| stride-gpt An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodolog MCP server | 1,156 | — | ||
| numasec The AI Agent for Cyber Security. MCP server | 839 | — | ||
| 01-recon-osint Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security SkillInstall · skills CLI | 573 | — | ||
| 03-exploit-development Proof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing SkillInstall · skills CLI | 573 | — | ||
| 04-reverse-engineering Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering SkillInstall · skills CLI | 573 | — | ||
| 05-malware-analysis Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification SkillInstall · skills CLI | 573 | — | ||
| 06-threat-hunting IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation SkillInstall · skills CLI | 573 | — | ||
| 07-incident-response IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SAN SkillInstall · skills CLI | 573 | — | ||
| 08-network-security Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection SkillInstall · skills CLI | 573 | — | ||
| 09-web-security OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authoriz SkillInstall · skills CLI | 573 | — | ||
| 10-cloud-security AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment SkillInstall · skills CLI | 573 | — | ||
| 14-red-team-ops Authorized red team engagement planning, C2 architecture design, attack methodology, lateral movement strategy, OPSEC, and professional reporting SkillInstall · skills CLI | 573 | — | ||
| Mitsu Meet Mitsu, your chibi red-team operator. Connect your AI provider, set the scope, and she can take an authorized pentest from recon and attack-surfac MCP server | 539 | — | ||
| AIDA Turn any LLM into an autonomous pentester. You define the scope, the agent does the work, you review the findings. MCP server | 512 | — | ||
| windbg-diagnostic-method Use with every WinDbg plugin investigation to apply evidence-first reasoning, confidence calibration, contrarian review, structured reporting, and det SkillInstall · skills CLI | 511 | MIT | ||
| windbg-kernel-bugcheck-triage Use when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for u SkillInstall · skills CLI | 511 | MIT | ||
| windbg-kernel-irp-lifecycle-triage Use when kernel evidence shows stalled I/O, a power IRP, or completion/cancellation misuse; inspect request state and driver ownership. Not for interp SkillInstall · skills CLI | 511 | MIT | ||
| windbg-kernel-lock-deadlock-triage Use when kernel threads block on driver synchronization or Verifier reports a lock-order violation; build an owner/waiter graph. Not for treating ever SkillInstall · skills CLI | 511 | MIT | ||
| windbg-kernel-verifier-triage Use when a kernel dump contains Driver Verifier violations; inspect flags, bugcheck subcodes, and available I/O shadow state. Not for Application Veri SkillInstall · skills CLI | 511 | MIT | ||
| windbg-user-exception-triage Use when a native C/C++ app, service, or user-mode driver host (including UMDF) crashes with a structured exception in a dump or WinDbg session, inclu SkillInstall · skills CLI | 511 | MIT | ||
| windbg-user-heap-corruption-investigation Use when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds. Not for kernel p SkillInstall · skills CLI | 511 | MIT | ||
| windbg-user-mutex-held-across-co-await Use when app, service, or user-mode driver C++ coroutine code holds a thread-affine lock across suspension and later hangs or fails. Not for all corou SkillInstall · skills CLI | 511 | MIT | ||
| windbg-user-ttd-reverse-debugging-triage Use when an app, service, or user-mode driver host TTD recording is available and earlier calls, writes, or lifetimes matter. Not for kernel replay or SkillInstall · skills CLI | 511 | MIT | ||
| windbg-user-virtual-memory-exhaustion Use when a native app, service, or user-mode driver host allocation fails; distinguish VA exhaustion, fragmentation, and commit pressure. Not for mana SkillInstall · skills CLI | 511 | MIT | ||
| windbg-user-wait-chain-analysis Use when an app, service, or user-mode driver host is unresponsive on locks, COM/RPC, I/O, or another process; follow the blocker chain. Not for a cra SkillInstall · skills CLI | 511 | MIT | ||
| security-fuzzing Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing. SkillInstall · skills CLI | 401 | — | ||
| security-payloads Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing. SkillInstall · skills CLI | 401 | — | ||
| security-usernames Top username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing. SkillInstall · skills CLI | 401 | — | ||
| BugTraceAI Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations. MCP server | 385 | — | ||
| exploit-file-download 任意文件下载与本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf、wget 等工具测试文件下载漏洞，支持路径遍历、伪协议利用、敏感文件读取。当用户需要测试文件下载功能、检测 LFI 漏洞、读取服务器敏感文件时使用此技能。 SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| exploit-file-download Arbitrary file download vulnerability detection and exploitation using path traversal techniques, bypass methods, and sensitive file discovery. Use th SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| exploit-lfi 本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf 等工具测试 LFI 漏洞，支持路径遍历、PHP 伪协议利用、日志投毒 RCE、敏感文件读取。当用户需要检测 LFI 漏洞、利用文件包含漏洞读取服务器文件时使用此技能。 SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| exploit-sqli SQL injection detection and exploitation using sqlmap, manual techniques, and custom payloads. Use this skill when user needs to test for SQL injectio SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| exploit-xss Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use thi SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| pentest-report 按照标准格式生成渗透测试报告，包含项目信息表、漏洞发现清单、漏洞详情（含属性表、描述、复现步骤、证据截图、修复建议）、附录（风险等级定义、CVSS说明、词汇表）。当用户要求生成渗透测试报告、安全测试报告、漏洞报告时使用此技能。严格遵循项目模板目录中的标准格式。 SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| recon-dir-scan Directory and file enumeration using ffuf, gobuster, dirsearch, and feroxbuster. Use this skill when user needs to discover hidden directories, enumer SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| recon-fingerprint Web fingerprinting and WAF detection using wafw00f, whatweb, nuclei, and httpx. Use this skill when user needs to identify web technologies, detect WA SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| recon-port-scan Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running se SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| recon-subdomain Subdomain enumeration and DNS reconnaissance using subfinder, amass, dnsx, and other tools. Use this skill when user needs to discover subdomains, per SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| results-storage SQLite-based persistent storage and reporting system for penetration testing results. Use this skill when user needs to store scan results, query vuln SkillInstall · skills CLI | 364 | Apache-2.0 | ||
| HEARTH Search community threat hunting hypotheses by keyword, threat actor, or the log sources you have. MCP serverGitHub-verified authorLocal · npm | 362 | MIT | ||
| h1-brain MCP server that connects AI assistants to HackerOne for bug bounty hunting MCP server | 360 | — | ||
| bounty-deep-hunt Use when bug bounty hunting on a live target, or whenever web-pentest / zero-day-hunting / red-team-web-methodology finishes and the AI is about to st SkillInstall · skills CLI | 330 | — | ||
| cloud-exploitation Use when "cloud", "aws", "azure", "gcp", "iam", "s3", "bucket", "lambda", "cloudfront", "metadata", "serverless", "kubernetes", "terraform", "cloudshe SkillInstall · skills CLI | 330 | — | ||
| cve-threat-intel Use when user says "latest CVE", "recent vulnerability", "new PoC", "CVE today", "threat intel", "exploit for". Real-time CVE monitoring and PoC disco SkillInstall · skills CLI | 330 | — | ||
| opsec Use as pre-validation layer BEFORE any other skill. Activates when user says any security/attack/scan command. Ensures VPN is connected, user agents r SkillInstall · skills CLI | 330 | — | ||
| osint-recon Use when user says "ရှာ", "osint", "recon", "investigate", "research", "target", "ခြေရာခံ", "information gathering", "passive recon", "footprint". Per SkillInstall · skills CLI | 330 | — | ||
| real-registration Use when user says "register", "sign up", "create account", "အကောင့်ဖွင့်", "ဖွင့်လိုက်", "အကောင့်လုပ်", "ဖောက်". Creates accounts with perfect attrib SkillInstall · skills CLI | 330 | — | ||
| red-team-web-methodology Use when user says "red team", "full pentest", "web pentest", "find vulnerabilities", "security assessment", "attack chain". Professional web app red SkillInstall · skills CLI | 330 | — | ||
| web-pentest Use when user says "စစ်လိုက်", "စစ်ဆေး", "pentest", "security check", "vuln scan", "vulnerability test", "hack", "break into", "ရှာ", "ဖောက်". Activat SkillInstall · skills CLI | 330 | — | ||
| web-pentest-setup Environment-aware Web Security & Pentest setup skill. Detects OS (Windows/WSL/Kali), checks installed pentest tools in PATH and ~/go/bin, skips existi SkillInstall · skills CLI | 330 | — | ||
| web3-security Use when user says "web3 စစ်", "contract စစ်", "defi ဖောက်", "solidity စစ်", "web3 hack", "smart contract vulnerability". Hunts million-dollar bugs in SkillInstall · skills CLI | 330 | — | ||
| zero-day-hunting Use when user says "zero-day", "0day", "find vulnerability", "vuln research", "bug hunting", "CVE research". Deep manual vulnerability research and un SkillInstall · skills CLI | 330 | — | ||
| admiralty-system Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach ana SkillInstall · skills CLI | 325 | Apache-2.0 | ||
| analysing-attack Analyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of threat detections, threat models, security risks or cyber SkillInstall · skills CLI | 325 | Apache-2.0 | ||
| malware-analysis Professional malware analysis workflow for PE executables and suspicious files. Triggers on file uploads with requests like "analyze this malware", "a SkillInstall · skills CLI | 325 | Apache-2.0 | ||
| threat-actor-profiling Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat acto SkillInstall · skills CLI | 325 | Apache-2.0 | ||
| ai4eh AI for Ethical Hacking - Workshop MCP server | 303 | — | ||
| secskills 渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。 已剔除无危害噪音项（明文传输/CORS/响应头缺失等），只报告有实际危害证据的漏洞。 当用户给出具体目标 (IP/域名/URL) 且意图 SkillInstall · skills CLI | 265 | MIT | ||
| secops-mcp All-in-one security testing toolbox that brings together popular open source tools through a single MCP interface. Connected to an AI agent, it enable MCP server | 219 | — | ||
| acl-abuse Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, SkillInstall · skills CLI | 216 | MIT | ||
| ad-environment-constraints Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 bl SkillInstall · skills CLI | 216 | MIT | ||
| ad-methodology The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning SkillInstall · skills CLI | 216 | MIT | ||
| ad-opsec-telemetry The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and a SkillInstall · skills CLI | 216 | MIT | ||
| adcs-attacks Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a SkillInstall · skills CLI | 216 | MIT | ||
| coercion-ntlm-relay Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS SkillInstall · skills CLI | 216 | MIT | ||
| compliance-mapping A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication SkillInstall · skills CLI | 216 | MIT | ||
| kerberos-attacks Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstrained, con SkillInstall · skills CLI | 216 | MIT | ||
| ai-av-evasion-optimized 使用AI生成免杀Loader和处理Shellcode，结合Indirect Syscall、ETW补丁、Module Stomping、字符串加密、IPv4混淆等免杀技术绕过主流杀软和EDR检测 SkillInstall · skills CLI | 211 | — | ||
| io.github.w0h1v/shodan MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries. MCP serverGitHub-verified authorLocal · npm | 191 | MIT | ||
| attack-flow Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports. Use when analyzing supply chain attacks, breaches, or sec SkillInstall · skills CLI | 185 | — | ||
| red-team-flow Generate SITF-compliant attack flow JSON from red team or pentest reports. Accepts report files, URLs, or pasted findings. Use when documenting offens SkillInstall · skills CLI | 185 | — | ||
| technique-proposal Generate a PR-ready technique proposal when an attack step doesn't map to existing SITF techniques. Use after /attack-flow identifies technique gaps. SkillInstall · skills CLI | 185 | — | ||
| web3-ai-tools AI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discov SkillInstall · skills CLI | 185 | MIT | ||
| web3-bug-classes Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accoun SkillInstall · skills CLI | 185 | MIT | ||
| web3-case-study-role-misconfig Case study - role misconfiguration bug class applied to a yield aggregator protocol. Use as a template for applying all 10 bug classes to a single tar SkillInstall · skills CLI | 185 | MIT | ||
| web3-grep-arsenal Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific SkillInstall · skills CLI | 185 | MIT | ||
| web3-hunt-foundation Hunter mindset, recon setup, and target scoring for Web3 bug bounty. Use at the START of any new protocol hunt - scoring targets, setting up environme SkillInstall · skills CLI | 185 | MIT | ||
| web3-hunt-zksync-era ZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, w SkillInstall · skills CLI | 185 | MIT | ||
| web3-methodology-research External research synthesis from Trail of Bits, SlowMist, ConsenSys, Immunefi, and Cyfrin. Use this for advanced audit methodology, Echidna/Medusa fuz SkillInstall · skills CLI | 185 | MIT | ||
| web3-poc-foundry Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting u SkillInstall · skills CLI | 185 | MIT | ||
| web3-start-here Master index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT. SkillInstall · skills CLI | 185 | MIT | ||
| web3-triage-report Bug triage validation system, Immunefi report format, and 20 real paid bounty examples dissected. Use this when validating a finding before submitting SkillInstall · skills CLI | 185 | MIT | ||
| AgentCapture Deception-layer honeypot that captures & reverse-controls AI pentest agents — embedded decoys, prompt-injection counter-offense, MCP honeypot, convers MCP server | 177 | — | ||
| ai-mobile-reverse-skills 面向授权移动安全分析的 6 阶段总控 Skill，负责 Android 静态侦察、流量与代码对齐、JNI/SO 分析、风险筛查、最小验证设计和报告交付。用户提供反编译目录、Jadx/Burp/Yakit/IDA/Ghidra 材料，或前序阶段产物时使用。 SkillInstall · skills CLI | 177 | MIT | ||
| nyxstrike AI Powered penetration testing Platform for offensive security research MCP server | 158 | — | ||
| ai-agent AI/LLM/Agent 安全专项。当目标是 Chatbot/RAG/AI 助手、AI 应用平台、在线代码执行沙箱、云端 Agent 沙箱/工具执行/网关时调用。 SkillInstall · skills CLI | 154 | MIT | ||
| binary-re 二进制/固件/ELF/PE/内存破坏逆向专项。当目标是 PE/ELF/SO/固件可执行文件、Windows 服务、TCP 二进制服务、需要逆向协议或挖内存破坏漏洞时调用。 SkillInstall · skills CLI | 154 | MIT | ||
| ck-router 安全测试/漏洞挖掘总入口与路由技能。凡涉及授权渗透测试、SRC、红队评估、漏洞挖掘、代码审计、二进制/移动/云/AI 安全评估任务，或需要战法索引、首枪选择、失败换层、线索板、报告规范时先调用本技能。 SkillInstall · skills CLI | 154 | MIT | ||
| mobile-app Android/APK/小程序/移动端逆向与组件安全专项。当目标是 APK/预装应用/厂商应用/小程序，需要脱壳、逆向、组件漏洞、密钥追踪或未授权接口时调用。 SkillInstall · skills CLI | 154 | MIT | ||
| bug-bounty-triage Bug bounty report triage, validation, and severity escalation. Use when the user provides a bug bounty report to validate, wants to check if a finding SkillInstall · skills CLI | 151 | MIT | ||
| pentest-mcp NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, has MCP server | 151 | — | ||
| Valhuntir Valhuntir CLI — AI-augmented incident response platform MCP server | 150 | — | ||
| remnux-mcp-server MCP server for using the REMnux malware analysis toolkit via AI assistants MCP server | 142 | — | ||
| gori A fast, keyboard-driven HTTP intercepting proxy and pentesting toolkit for the terminal built for humans and AI agents alike. MCP server | 137 | — | ||
| wmpf-mcp-bridge ai渗透测试小程序 MCP server | 128 | — | ||
| pentestMCP pentestMCP: AI-Powered Penetration Testing via MCP, an MCP designed for penetration testers. MCP server | 116 | — | ||
| darknet-mcp-server 66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit search MCP server | 115 | — | ||
| exploit-investigator Use when the user provides a transaction hash (0x...) with a chain name, asks to investigate an on-chain incident or exploit, or points to an incident SkillInstall · skills CLI | 115 | MIT | ||
| AgentScan AI protocol scanner — discover exposed MCP servers, A2A Agent Cards, and open LLM APIs in one command. 一条命令盘点 MCP、A2A Agent Card 和 LLM 开放接口暴露面。 MCP server | 110 | — | ||
| synology-nas-cli nas: a zero-dependency Python CLI + MCP server for Synology DSM 7. One-command audit and fix for the C3RB3R / .L0CK3D ransomware campaign; hand it to MCP server | 104 | — | ||
| ARIES 顺便一提，我们支持 RWKV | 「Intel 2025 人工智能创新大赛」🚀AutoOPS: Provide the chaos brought by language models to the operation and maintenance industry! 🏆使用 LLM 提供的动力实 MCP server | 102 | — | ||
| io.github.w0h1v/dnstwist MCP server for dnstwist: detect typosquatting, phishing and brand impersonation domains. MCP serverGitHub-verified authorLocal · npm | 51 | MIT | ||
| crowdstrike-falcon-foundry CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, fu PluginAnthropic marketplace | 38 | MIT | ||
| crowdstrike-falcon-fusion CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema PluginAnthropic marketplace | 30 | MIT | ||
| io.github.operantlabs/operant-mcp Security testing MCP server for penetration testing, forensics, and vulnerability assessment MCP serverGitHub-verified authorLocal · npm | 27 | MIT | ||
| io.github.lupingQAQ/ntobjmanager-mcp Stateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager. MCP serverGitHub-verified author | 16 | MIT | ||
| MITRE ATT&CK MCP server exposing the MITRE ATT&CK framework via the official MCP Python SDK. MCP serverGitHub-verified authorLocal · PyPI | 15 | MIT | ||
| io.github.aplaceforallmystuff/mcp-threatintel Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker MCP serverGitHub-verified authorLocal · npm | 11 | MIT | ||
| Niro AI pentester for PRs — finds exploitable bugs and hands your developer agent the fix. MCP serverGitHub-verified authorLocal · MCPB | 10 | — | ||
| OT AIops Governed OT tap (57 tools): OPC-UA/Modbus/S7/MC/MTConnect/MQTT/EtherNet-IP/EtherCAT. MCP serverGitHub-verified authorLocal · PyPI | 10 | MIT | ||
| io.github.aplaceforallmystuff/mcp-pihole Pi-hole v6 MCP server - manage DNS blocking, stats, whitelists/blacklists MCP serverGitHub-verified authorLocal · npm | 8 | MIT |
Filters apply to the top 400 of 528 tools by stars. Full list for agents: sec-offense.json