[{"id": "skill:ComposioHQ/awesome-claude-skills/composio-skills/abuselpdb-automation", "name": "abuselpdb-automation", "kind": "skill", "official": false, "desc": "Automate Abuselpdb tasks via Rube MCP (Composio). Always search tools first for current schemas.", "repo": "https://github.com/ComposioHQ/awesome-claude-skills/tree/HEAD/composio-skills/abuselpdb-automation", "install": ["npx skills add ComposioHQ/awesome-claude-skills --skill abuselpdb-automation"], "stars": 79451, "pushed": "2026-09-18T07:16:11Z", "license": null, "plat": "abuseipdb", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/cloud-penetration-testing", "name": "cloud-penetration-testing", "kind": "skill", "official": false, "desc": "Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/cloud-penetration-testing", "install": ["npx skills add sickn33/agentic-awesome-skills --skill cloud-penetration-testing"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "microsoft azure, amazon web services (aw", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/ethical-hacking-methodology", "name": "ethical-hacking-methodology", "kind": "skill", "official": false, "desc": "Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/ethical-hacking-methodology", "install": ["npx skills add sickn33/agentic-awesome-skills --skill ethical-hacking-methodology"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:sickn33/agentic-awesome-skills/plugins/aasb-aas-security-engineer/skills/linux-privilege-escalation", "name": "linux-privilege-escalation", "kind": "skill", "official": false, "desc": "Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control.", "repo": "https://github.com/sickn33/agentic-awesome-skills/tree/HEAD/plugins/aasb-aas-security-engineer/skills/linux-privilege-escalation", "install": ["npx skills add sickn33/agentic-awesome-skills --skill linux-privilege-escalation"], "stars": 49672, "pushed": "2026-11-13T22:02:29Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/reverse-engineering/skills/anti-reversing-techniques", "name": "anti-reversing-techniques", "kind": "skill", "official": false, "desc": "Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/reverse-engineering/skills/anti-reversing-techniques", "install": ["npx skills add wshobson/agents --skill anti-reversing-techniques"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/reverse-engineering/skills/binary-analysis-patterns", "name": "binary-analysis-patterns", "kind": "skill", "official": false, "desc": "Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/reverse-engineering/skills/binary-analysis-patterns", "install": ["npx skills add wshobson/agents --skill binary-analysis-patterns"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/reverse-engineering/skills/memory-forensics", "name": "memory-forensics", "kind": "skill", "official": false, "desc": "Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/reverse-engineering/skills/memory-forensics", "install": ["npx skills add wshobson/agents --skill memory-forensics"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wshobson/agents/plugins/cloud-infrastructure/skills/mtls-configuration", "name": "mtls-configuration", "kind": "skill", "official": false, "desc": "Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.", "repo": "https://github.com/wshobson/agents/tree/HEAD/plugins/cloud-infrastructure/skills/mtls-configuration", "install": ["npx skills add wshobson/agents --skill mtls-configuration"], "stars": 42495, "pushed": "2026-11-09T01:08:33Z", "license": "MIT", "plat": "mtls", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/abusing-shadow-credentials-for-privesc", "name": "abusing-shadow-credentials-for-privesc", "kind": "skill", "official": false, "desc": "Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/abusing-shadow-credentials-for-privesc", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/acquiring-disk-image-with-dd-and-dcfldd", "name": "acquiring-disk-image-with-dd-and-dcfldd", "kind": "skill", "official": false, "desc": "Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/acquiring-disk-image-with-dd-and-dcfldd", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill acquiring-disk-image-with-dd-and-dcfldd"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "linux", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-active-directory-acl-abuse", "name": "analyzing-active-directory-acl-abuse", "kind": "skill", "official": false, "desc": "Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-active-directory-acl-abuse", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-active-directory-acl-abuse"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-android-malware-with-apktool", "name": "analyzing-android-malware-with-apktool", "kind": "skill", "official": false, "desc": "Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-android-malware-with-apktool", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-android-malware-with-apktool"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-api-gateway-access-logs", "name": "analyzing-api-gateway-access-logs", "kind": "skill", "official": false, "desc": "Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-api-gateway-access-logs", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-api-gateway-access-logs"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "api gateway", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-apt-group-with-mitre-navigator", "name": "analyzing-apt-group-with-mitre-navigator", "kind": "skill", "official": false, "desc": "Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-apt-group-with-mitre-navigator", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-apt-group-with-mitre-navigator"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats", "name": "analyzing-azure-activity-logs-for-threats", "kind": "skill", "official": false, "desc": "Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-azure-activity-logs-for-threats", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-azure-activity-logs-for-threats"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "azure", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-bootkit-and-rootkit-samples", "name": "analyzing-bootkit-and-rootkit-samples", "kind": "skill", "official": false, "desc": "Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise survives OS reinstallation or antivirus/EDR fails to detect malware despite clear infection signs. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-bootkit-and-rootkit-samples", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-bootkit-and-rootkit-samples"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "bootkit/rootkit", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-browser-forensics-with-hindsight", "name": "analyzing-browser-forensics-with-hindsight", "kind": "skill", "official": false, "desc": "Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-browser-forensics-with-hindsight", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-browser-forensics-with-hindsight"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "browser forensics", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-campaign-attribution-evidence", "name": "analyzing-campaign-attribution-evidence", "kind": "skill", "official": false, "desc": "Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-campaign-attribution-evidence", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-campaign-attribution-evidence"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "cyber attribution", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-certificate-transparency-for-phishing", "name": "analyzing-certificate-transparency-for-phishing", "kind": "skill", "official": false, "desc": "Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-certificate-transparency-for-phishing", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-certificate-transparency-for-phishing"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "certificate transparency", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cloud-storage-access-patterns", "name": "analyzing-cloud-storage-access-patterns", "kind": "skill", "official": false, "desc": "Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-cloud-storage-access-patterns", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-cloud-storage-access-patterns"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "cloud storage", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cobalt-strike-beacon-configuration", "name": "analyzing-cobalt-strike-beacon-configuration", "kind": "skill", "official": false, "desc": "Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-cobalt-strike-beacon-configuration", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-cobalt-strike-beacon-configuration"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "cobalt strike", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cobaltstrike-malleable-c2-profiles", "name": "analyzing-cobaltstrike-malleable-c2-profiles", "kind": "skill", "official": false, "desc": "Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-cobaltstrike-malleable-c2-profiles", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-cobaltstrike-malleable-c2-profiles"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "cobalt strike", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-command-and-control-communication", "name": "analyzing-command-and-control-communication", "kind": "skill", "official": false, "desc": "Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after reverse engineering reveals network traffic needing protocol analysis or when building detection signatures for a framework like Cobalt Strike, Metasploit, or Sliver. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-command-and-control-communication", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-command-and-control-communication"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "c2 communication", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cyber-kill-chain", "name": "analyzing-cyber-kill-chain", "kind": "skill", "official": false, "desc": "Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin k", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-cyber-kill-chain", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-cyber-kill-chain"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "cyber kill chain", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-disk-image-with-autopsy", "name": "analyzing-disk-image-with-autopsy", "kind": "skill", "official": false, "desc": "Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-disk-image-with-autopsy", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-disk-image-with-autopsy"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "disk image", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-dns-logs-for-exfiltration", "name": "analyzing-dns-logs-for-exfiltration", "kind": "skill", "official": false, "desc": "Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-dns-logs-for-exfiltration", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-dns-logs-for-exfiltration"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "dns logs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-docker-container-forensics", "name": "analyzing-docker-container-forensics", "kind": "skill", "official": false, "desc": "Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-docker-container-forensics", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-docker-container-forensics"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "docker", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-email-headers-for-phishing-investigation", "name": "analyzing-email-headers-for-phishing-investigation", "kind": "skill", "official": false, "desc": "Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying whether a message's sender domain was spoofed.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-email-headers-for-phishing-investigation", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-email-headers-for-phishing-investigation"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-golang-malware-with-ghidra", "name": "analyzing-golang-malware-with-ghidra", "kind": "skill", "official": false, "desc": "Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and third-party dependencies from a stripped Go executable.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-golang-malware-with-ghidra", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-golang-malware-with-ghidra"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "ghidra", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-heap-spray-exploitation", "name": "analyzing-heap-spray-exploitation", "kind": "skill", "official": false, "desc": "Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-heap-spray-exploitation", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-heap-spray-exploitation"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "volatility", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-indicators-of-compromise", "name": "analyzing-indicators-of-compromise", "kind": "skill", "official": false, "desc": "Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-indicators-of-compromise", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-indicators-of-compromise"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-ios-app-security-with-objection", "name": "analyzing-ios-app-security-with-objection", "kind": "skill", "official": false, "desc": "Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-ios-app-security-with-objection", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-ios-app-security-with-objection"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "objection", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-kubernetes-audit-logs", "name": "analyzing-kubernetes-audit-logs", "kind": "skill", "official": false, "desc": "Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. ", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-kubernetes-audit-logs", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-kubernetes-audit-logs"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "kubernetes", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-audit-logs-for-intrusion", "name": "analyzing-linux-audit-logs-for-intrusion", "kind": "skill", "official": false, "desc": "Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-linux-audit-logs-for-intrusion", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-audit-logs-for-intrusion"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "linux", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-elf-malware", "name": "analyzing-linux-elf-malware", "kind": "skill", "official": false, "desc": "Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-linux-elf-malware", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-kernel-rootkits", "name": "analyzing-linux-kernel-rootkits", "kind": "skill", "official": false, "desc": "Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-linux-kernel-rootkits", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-system-artifacts", "name": "analyzing-linux-system-artifacts", "kind": "skill", "official": false, "desc": "Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence mechanisms, or scoping a Linux-based breach during incident response.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-linux-system-artifacts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-system-artifacts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "linux", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-lnk-file-and-jump-list-artifacts", "name": "analyzing-lnk-file-and-jump-list-artifacts", "kind": "skill", "official": false, "desc": "Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted. Use when investigating Windows user activity, reconstructing file-access or program-execution timelines, or examining recent/frequently-used file evidence in a forensic exam.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-lnk-file-and-jump-list-artifacts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-lnk-file-and-jump-list-artifacts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-macro-malware-in-office-documents", "name": "analyzing-macro-malware-in-office-documents", "kind": "skill", "official": false, "desc": "Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-macro-malware-in-office-documents", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-macro-malware-in-office-documents"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "microsoft office", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malicious-pdf-with-peepdf", "name": "analyzing-malicious-pdf-with-peepdf", "kind": "skill", "official": false, "desc": "Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-malicious-pdf-with-peepdf", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malicious-url-with-urlscan", "name": "analyzing-malicious-url-with-urlscan", "kind": "skill", "official": false, "desc": "URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-malicious-url-with-urlscan", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-url-with-urlscan"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "urlscan.io", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-behavior-with-cuckoo-sandbox", "name": "analyzing-malware-behavior-with-cuckoo-sandbox", "kind": "skill", "official": false, "desc": "Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and API calls — and generate behavioral reports for classification and IOC extraction. Use when a sample has passed static triage and needs dynamic/behavioral analysis, when mapping a full infection chain, or when building YARA/behavioral signatures from observed sandbox activity. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-malware-behavior-with-cuckoo-sandbox", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-behavior-with-cuckoo-sandbox"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "cuckoo sandbox", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-family-relationships-with-malpedia", "name": "analyzing-malware-family-relationships-with-malpedia", "kind": "skill", "official": false, "desc": "Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relationships such as loader-payload chains and shared authorship. Use when researching a malware family's aliases, lineage, or actor attribution, or when sourcing YARA rules for detection.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-malware-family-relationships-with-malpedia", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-family-relationships-with-malpedia"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "malpedia", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-persistence-with-autoruns", "name": "analyzing-malware-persistence-with-autoruns", "kind": "skill", "official": false, "desc": "Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware autostart entries have been fully identified and removed.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-malware-persistence-with-autoruns", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-persistence-with-autoruns"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "autoruns", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-sandbox-evasion-techniques", "name": "analyzing-malware-sandbox-evasion-techniques", "kind": "skill", "official": false, "desc": "Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or minimal activity in a sandbox, when a behavioral report needs review for evasion indicators, or when building detections for anti-analysis techniques.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-malware-sandbox-evasion-techniques", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-sandbox-evasion-techniques"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-memory-dumps-with-volatility", "name": "analyzing-memory-dumps-with-volatility", "kind": "skill", "official": false, "desc": "Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-memory-dumps-with-volatility", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-memory-dumps-with-volatility"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "volatility", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-memory-forensics-with-lime-and-volatility", "name": "analyzing-memory-forensics-with-lime-and-volatility", "kind": "skill", "official": false, "desc": "Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-memory-forensics-with-lime-and-volatility", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-memory-forensics-with-lime-and-volatility"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "lime", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-mft-for-deleted-file-recovery", "name": "analyzing-mft-for-deleted-file-recovery", "kind": "skill", "official": false, "desc": "Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering evidence of deleted files, reconstructing NTFS file-system timelines, or detecting anti-forensic timestomping during a Windows forensic examination.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-mft-for-deleted-file-recovery", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-mft-for-deleted-file-recovery"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "ntfs", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-network-covert-channels-in-malware", "name": "analyzing-network-covert-channels-in-malware", "kind": "skill", "official": false, "desc": "Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or attributing exfiltration traffic to a known tunneling toolset.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-network-covert-channels-in-malware", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-network-covert-channels-in-malware"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-network-flow-data-with-netflow", "name": "analyzing-network-flow-data-with-netflow", "kind": "skill", "official": false, "desc": "Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-network-flow-data-with-netflow", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-network-flow-data-with-netflow"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-typosquatting-domains-with-dnstwist", "name": "analyzing-typosquatting-domains-with-dnstwist", "kind": "skill", "official": false, "desc": "Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-typosquatting-domains-with-dnstwist", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-typosquatting-domains-with-dnstwist"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "dnstwist", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-uefi-bootkit-persistence", "name": "analyzing-uefi-bootkit-persistence", "kind": "skill", "official": false, "desc": "Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detecting known families like BlackLotus, LoJax, and MoonBounce. Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot bypass detection. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-uefi-bootkit-persistence", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-uefi-bootkit-persistence"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "chipsec", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-usb-device-connection-history", "name": "analyzing-usb-device-connection-history", "kind": "skill", "official": false, "desc": "Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-usb-device-connection-history", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-usb-device-connection-history"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-web-server-logs-for-intrusion", "name": "analyzing-web-server-logs-for-intrusion", "kind": "skill", "official": false, "desc": "Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-web-server-logs-for-intrusion", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-web-server-logs-for-intrusion"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "apache/nginx", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-windows-amcache-artifacts", "name": "analyzing-windows-amcache-artifacts", "kind": "skill", "official": false, "desc": "Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with threat intel and timeline reconstruction. Use for Amcache forensics, program execution evidence gathering, or application compatibility cache investigations in DFIR work. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-windows-amcache-artifacts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-amcache-artifacts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-windows-event-logs-in-splunk", "name": "analyzing-windows-event-logs-in-splunk", "kind": "skill", "official": false, "desc": "Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-windows-event-logs-in-splunk", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-event-logs-in-splunk"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "splunk", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-windows-lnk-files-for-artifacts", "name": "analyzing-windows-lnk-files-for-artifacts", "kind": "skill", "official": false, "desc": "Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction. Use when investigating recently-accessed files, tracking removable media or network paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-windows-lnk-files-for-artifacts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-lnk-files-for-artifacts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-windows-prefetch-with-python", "name": "analyzing-windows-prefetch-with-python", "kind": "skill", "official": false, "desc": "Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-windows-prefetch-with-python", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-prefetch-with-python"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-windows-registry-for-artifacts", "name": "analyzing-windows-registry-for-artifacts", "kind": "skill", "official": false, "desc": "Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-windows-registry-for-artifacts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-registry-for-artifacts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-windows-shellbag-artifacts", "name": "analyzing-windows-shellbag-artifacts", "kind": "skill", "official": false, "desc": "Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even after the folders are deleted. Use when reconstructing a user's folder access history or proving access to a since-removed directory in DFIR work.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-windows-shellbag-artifacts", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifacts"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/auditing-uefi-firmware-with-chipsec", "name": "auditing-uefi-firmware-with-chipsec", "kind": "skill", "official": false, "desc": "Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/auditing-uefi-firmware-with-chipsec", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill auditing-uefi-firmware-with-chipsec"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "chipsec", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-full-scope-red-team-engagement", "name": "conducting-full-scope-red-team-engagement", "kind": "skill", "official": false, "desc": "Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-full-scope-red-team-engagement", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-full-scope-red-team-engagement"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-internal-network-penetration-test", "name": "conducting-internal-network-penetration-test", "kind": "skill", "official": false, "desc": "Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-internal-network-penetration-test", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-internal-network-penetration-test"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-internal-reconnaissance-with-bloodhound-ce", "name": "conducting-internal-reconnaissance-with-bloodhound-ce", "kind": "skill", "official": false, "desc": "Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-internal-reconnaissance-with-bloodhound-ce", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-internal-reconnaissance-with-bloodhound-ce"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-malware-incident-response", "name": "conducting-malware-incident-response", "kind": "skill", "official": false, "desc": "Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-malware-incident-response", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-malware-incident-response"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-man-in-the-middle-attack-simulation", "name": "conducting-man-in-the-middle-attack-simulation", "kind": "skill", "official": false, "desc": "Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-man-in-the-middle-attack-simulation", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-man-in-the-middle-attack-simulation"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-memory-forensics-with-volatility", "name": "conducting-memory-forensics-with-volatility", "kind": "skill", "official": false, "desc": "Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-memory-forensics-with-volatility", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-memory-forensics-with-volatility"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-mobile-app-penetration-test", "name": "conducting-mobile-app-penetration-test", "kind": "skill", "official": false, "desc": "Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls. The tester performs static analysis of application binaries, dynamic analysis at runtime, and API security testing to evaluate the complete mobile attack surface. Activates for requests involving mobile app pentest, iOS sec", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-mobile-app-penetration-test", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-mobile-app-penetration-test"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-network-penetration-test", "name": "conducting-network-penetration-test", "kind": "skill", "official": false, "desc": "Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-network-penetration-test", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-network-penetration-test"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-pass-the-ticket-attack", "name": "conducting-pass-the-ticket-attack", "kind": "skill", "official": false, "desc": "Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-pass-the-ticket-attack", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-pass-the-ticket-attack"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-phishing-incident-response", "name": "conducting-phishing-incident-response", "kind": "skill", "official": false, "desc": "Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-phishing-incident-response", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-phishing-incident-response"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-post-incident-lessons-learned", "name": "conducting-post-incident-lessons-learned", "kind": "skill", "official": false, "desc": "Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-post-incident-lessons-learned", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-post-incident-lessons-learned"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-social-engineering-penetration-test", "name": "conducting-social-engineering-penetration-test", "kind": "skill", "official": false, "desc": "Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-social-engineering-penetration-test", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-social-engineering-penetration-test"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-social-engineering-pretext-call", "name": "conducting-social-engineering-pretext-call", "kind": "skill", "official": false, "desc": "Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-social-engineering-pretext-call", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-social-engineering-pretext-call"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-spearphishing-simulation-campaign", "name": "conducting-spearphishing-simulation-campaign", "kind": "skill", "official": false, "desc": "Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results. Use in authorized engagements to gain initial access via personalized phishing against specific individuals, distinct from broad campaigns.", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-spearphishing-simulation-campaign", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-spearphishing-simulation-campaign"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/conducting-wireless-network-penetration-test", "name": "conducting-wireless-network-penetration-test", "kind": "skill", "official": false, "desc": "Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/conducting-wireless-network-penetration-test", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-wireless-network-penetration-test"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/designing-adversary-engagement-with-mitre-engage", "name": "designing-adversary-engagement-with-mitre-engage", "kind": "skill", "official": false, "desc": "Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step Operational Process, mapping engagement Activities to the ATT&CK techniques they expose, and defining measurable Goals and Operational Objectives. Use when a team has honeypots, honeytokens, or canary tokens but no coordinating strategy, when leader", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/designing-adversary-engagement-with-mitre-engage", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill designing-adversary-engagement-with-mitre-engage"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mukul975/Anthropic-Cybersecurity-Skills/skills/evaluating-threat-intelligence-platforms", "name": "evaluating-threat-intelligence-platforms", "kind": "skill", "official": false, "desc": "Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions. '", "repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/evaluating-threat-intelligence-platforms", "install": ["npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill evaluating-threat-intelligence-platforms"], "stars": 36105, "pushed": "2026-08-31T04:32:44Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/incident-response", "name": "incident-response", "kind": "skill", "official": false, "desc": "Handle a suspected security breach: triage, SEV1-SEV4 severity, escalation and forensic evidence, per NIST SP 800-61. Use whenever the user thinks they were hacked, sees suspicious activity or a leaked key. Outages: incident-commander.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/incident-response", "install": ["npx skills add alirezarezvani/claude-skills --skill incident-response"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/red-team", "name": "red-team", "kind": "skill", "official": false, "desc": "Use when planning or running an authorized red team engagement or attack path analysis. Plans the kill chain with engagement_planner.py: MITRE ATT&CK techniques, choke points, OPSEC risk and crown jewels.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/red-team", "install": ["npx skills add alirezarezvani/claude-skills --skill red-team"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:alirezarezvani/claude-skills/engineering-team/skills/threat-detection", "name": "threat-detection", "kind": "skill", "official": false, "desc": "Use when hunting threats, sweeping IOCs or looking for anomalies in logs and telemetry. Ranks ATT&CK-mapped signals and z-score anomalies with threat_signal_analyzer.py.", "repo": "https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering-team/skills/threat-detection", "install": ["npx skills add alirezarezvani/claude-skills --skill threat-detection"], "stars": 29773, "pushed": "2026-11-12T10:35:06Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:openai/skills/skills/.curated/security-threat-model", "name": "security-threat-model", "kind": "skill", "official": false, "desc": "Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.", "repo": "https://github.com/openai/skills/tree/HEAD/skills/.curated/security-threat-model", "install": ["npx skills add openai/skills --skill security-threat-model"], "stars": 28730, "pushed": "2026-10-28T17:31:41Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/detection-engineering-coverage-evaluation", "name": "detection-engineering-coverage-evaluation", "kind": "skill", "official": false, "desc": "Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating Threat Detection Opportunities (TDOs), simulating attacker behavior with synthetic UDM events, evaluating rule coverage, and deploying gap-closing rules. Don't use for standalone YARA-L 2.0 rule authoring/tuning (use secops-detection-engineering), threat hunting, or SOC investigation.", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/detection-engineering-coverage-evaluation", "install": ["npx skills add google/skills --skill detection-engineering-coverage-evaluation"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/secops-cases", "name": "secops-cases", "kind": "skill", "official": false, "desc": "Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR cases; adding investigative comments and notes; updating case priority or description; or linking and grouping security alerts within cases. Supports both remote Google SecOps MCP tools and local fallback tools. Don't use for SIEM UDM searches or detection rule authoring.", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/secops-cases", "install": ["npx skills add google/skills --skill secops-cases"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/secops-detection-engineering", "name": "secops-detection-engineering", "kind": "skill", "official": false, "desc": "Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep foren", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/secops-detection-engineering", "install": ["npx skills add google/skills --skill secops-detection-engineering"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/secops-hunt", "name": "secops-hunt", "kind": "skill", "official": false, "desc": "Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of compromise (IoCs), performing prevalence searches across enterprise events, hunting for MITRE ATT&CK techniques, or detecting behavioral and statistical outliers using UDM queries. Don't use for incoming alert triage (use secops-triage), active incident response and timeline deep-dives on a known breach (use secops-investigate), or detection rule authorin", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/secops-hunt", "install": ["npx skills add google/skills --skill secops-hunt"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/secops-investigate", "name": "secops-investigate", "kind": "skill", "official": false, "desc": "Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triag", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/secops-investigate", "install": ["npx skills add google/skills --skill secops-investigate"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "skill:google/skills/skills/cloud/secops-triage", "name": "secops-triage", "kind": "skill", "official": false, "desc": "Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity risk, adjusting alert severity or priority, and closing or escalating alerts and cases. Don't use for deep multi-hop incident investigations across host timelines (use secops-investigate), proactive threat hunting or retroactive IoC sweeps (use secops-hunt), or authoring new detection rules (use secops-detection-engineer", "repo": "https://github.com/google/skills/tree/HEAD/skills/cloud/secops-triage", "install": ["npx skills add google/skills --skill secops-triage"], "stars": 24146, "pushed": "2026-11-13T17:51:35Z", "license": "Apache-2.0", "plat": "google cloud", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:0x4m4/hexstrike-ai", "name": "hexstrike-ai", "kind": "mcp", "official": null, "desc": "HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capa", "repo": "https://github.com/0x4m4/hexstrike-ai", "install": [], "stars": 13596, "pushed": null, "license": null, "plat": "cybersecurity tools", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/active-directory/offensive-active-directory", "name": "offensive-active-directory", "kind": "skill", "official": false, "desc": "Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust a", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/active-directory/offensive-active-directory", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-active-directory"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/infrastructure/offensive-advanced-redteam", "name": "offensive-advanced-redteam", "kind": "skill", "official": false, "desc": "Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and ", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/infrastructure/offensive-advanced-redteam", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-advanced-redteam"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "shellcode", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/forensics/offensive-anti-forensics", "name": "offensive-anti-forensics", "kind": "skill", "official": false, "desc": "Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal ", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/forensics/offensive-anti-forensics", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-anti-forensics"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "c2", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/api/offensive-api-abuse", "name": "offensive-api-abuse", "kind": "skill", "official": false, "desc": "Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through ", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/api/offensive-api-abuse", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-api-abuse"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/api/offensive-api-security", "name": "offensive-api-security", "kind": "skill", "official": false, "desc": "Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and met", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/api/offensive-api-security", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-api-security"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-bluetooth-ble", "name": "offensive-bluetooth-ble", "kind": "skill", "official": false, "desc": "Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-bluetooth-ble", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-ble"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-bluetooth-classic", "name": "offensive-bluetooth-classic", "kind": "skill", "official": false, "desc": "Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio acces", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-bluetooth-classic", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-classic"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/web/offensive-business-logic", "name": "offensive-business-logic", "kind": "skill", "official": false, "desc": "Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/web/offensive-business-logic", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-business-logic"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/forensics/offensive-c2-frameworks", "name": "offensive-c2-frameworks", "kind": "skill", "official": false, "desc": "Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (agent ecosystem with Apollo/Poseidon/Medusa, C2 profile configuration, translation containers), Havoc", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/forensics/offensive-c2-frameworks", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-c2-frameworks"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "fuzzing", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/cicd/offensive-cicd-pipeline", "name": "offensive-cicd-pipeline", "kind": "skill", "official": false, "desc": "Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI var", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/cicd/offensive-cicd-pipeline", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-cicd-pipeline"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "ci/cd", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/cicd/offensive-cicd-secrets", "name": "offensive-cicd-secrets", "kind": "skill", "official": false, "desc": "Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently expos", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/cicd/offensive-cicd-secrets", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-cicd-secrets"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/cloud/offensive-cloud", "name": "offensive-cloud", "kind": "skill", "official": false, "desc": "Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBri", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/cloud/offensive-cloud", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-cloud"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "container", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/container/offensive-container-escape", "name": "offensive-container-escape", "kind": "skill", "official": false, "desc": "Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN, cgroup v1 notify_on_release escape, runc CVEs such as CVE-2019-5736 and CVE-2024-21626 Leaky Vessels, kernel exploits from within containers, and Dockerfile misconfigurations like --privileged", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/container/offensive-container-escape", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-container-escape"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "kubernetes", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/crypto/offensive-crypto-attacks", "name": "offensive-crypto-attacks", "kind": "skill", "official": false, "desc": "Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block cut-and-paste and byte-at-a-time decryption, hash length extension attacks against SHA1/SHA256/MD5-based MACs using HashPump, RSA vulnerabilities including small public exponent, common modulus, Bleic", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/crypto/offensive-crypto-attacks", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-crypto-attacks"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "tls", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/post-exploitation/offensive-data-exfiltration", "name": "offensive-data-exfiltration", "kind": "skill", "official": false, "desc": "Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/post-exploitation/offensive-data-exfiltration", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-data-exfiltration"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "lateral movement", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-deauth-disassoc", "name": "offensive-deauth-disassoc", "kind": "skill", "official": false, "desc": "Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-deauth-disassoc", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-deauth-disassoc"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/supply-chain/offensive-dependency-confusion", "name": "offensive-dependency-confusion", "kind": "skill", "official": false, "desc": "Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle ", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/supply-chain/offensive-dependency-confusion", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-dependency-confusion"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/web/offensive-deserialization", "name": "offensive-deserialization", "kind": "skill", "official": false, "desc": "Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream and BinaryFormatter sink identification, pickle __reduce__ RCE, phar:// wrapper abuse, Jackson polymorphic typing, Json.NET TypeNameHandling, ViewState tampering, node-serialize IIFE injection, Ruby Marshal.load and YAML.load gadgets, framework-specific chains for Spring/Hibernate/Laravel/Symfony, modern attack surfaces i", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/web/offensive-deserialization", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-deserialization"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-evil-twin", "name": "offensive-evil-twin", "kind": "skill", "official": false, "desc": "Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-evil-twin", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-evil-twin"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/fuzzing/offensive-fuzzing", "name": "offensive-fuzzing", "kind": "skill", "official": false, "desc": "Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/fuzzing/offensive-fuzzing", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "red team", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/web/offensive-graphql", "name": "offensive-graphql", "kind": "skill", "official": false, "desc": "Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscrip", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/web/offensive-graphql", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-graphql"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/iot/offensive-iot", "name": "offensive-iot", "kind": "skill", "official": false, "desc": "IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol ", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/iot/offensive-iot", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-iot"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "mobile", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/auth/offensive-jwt", "name": "offensive-jwt", "kind": "skill", "official": false, "desc": "JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/auth/offensive-jwt", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-jwt"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "jwt", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/container/offensive-k8s-attacks", "name": "offensive-k8s-attacks", "kind": "skill", "official": false, "desc": "Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersonation, RBAC misconfiguration exploitation including wildcard permissions and privilege escalation via role binding, direct etcd access for secret extraction, kubelet API abuse on port 10250 and read-only port 10255, pod escape via hostPID hostNetwork and hostPath volume mounts, Kubernetes secrets enumeration and decoding", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/container/offensive-k8s-attacks", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-k8s-attacks"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "crypto", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-krack-fragattacks", "name": "offensive-krack-fragattacks", "kind": "skill", "official": false, "desc": "KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-krack-fragattacks", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-krack-fragattacks"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/post-exploitation/offensive-lateral-movement", "name": "offensive-lateral-movement", "kind": "skill", "official": false, "desc": "Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmap", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/post-exploitation/offensive-lateral-movement", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-lateral-movement"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "persistence", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/privesc/offensive-linux-privesc", "name": "offensive-linux-privesc", "kind": "skill", "official": false, "desc": "Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to root: SUID/SGID binary abuse via GTFOBins, Linux capabilities exploitation (cap_setuid, cap_dac_override, cap_dac_read_search), sudo misconfigurations including NOPASSWD rules and Baron Samedit (CVE-2021-3156), cron job abuse through writable scripts, PATH hijacking, and wildcard injection with tar/rsync/chown. Includes writable /etc/passwd attacks", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/privesc/offensive-linux-privesc", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-linux-privesc"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-lorawan-sub-ghz", "name": "offensive-lorawan-sub-ghz", "kind": "skill", "official": false, "desc": "LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset track", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-lorawan-sub-ghz", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-lorawan-sub-ghz"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/mobile/offensive-mobile", "name": "offensive-mobile", "kind": "skill", "official": false, "desc": "Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypa", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/mobile/offensive-mobile", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-mobile"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "network", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/active-directory/offensive-netexec", "name": "offensive-netexec", "kind": "skill", "official": false, "desc": "Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS protocol attacks, password spraying, credential dumping (SAM, NTDS, LSASS, DPAPI), Kerberoasting, ASREPRoasting, lateral movement, BloodHound collection, module usage, or any pentest workflow involving Windo", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/active-directory/offensive-netexec", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-netexec"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "netexec", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/network/offensive-network-attacks", "name": "offensive-network-attacks", "kind": "skill", "official": false, "desc": "Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing Layer 2/3 attack surface.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/network/offensive-network-attacks", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-network-attacks"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "data exfiltration", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/recon/offensive-osint", "name": "offensive-osint", "kind": "skill", "official": false, "desc": "Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracin", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/recon/offensive-osint", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-osint"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/post-exploitation/offensive-persistence", "name": "offensive-persistence", "kind": "skill", "official": false, "desc": "Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques inclu", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/post-exploitation/offensive-persistence", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-persistence"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "linux privilege escalation", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/social-engineering/offensive-phishing", "name": "offensive-phishing", "kind": "skill", "official": false, "desc": "Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition and aging, SPF/DKIM/DMARC alignment), payload delivery vectors (Office macro weaponization, HTA droppers, ISO/IMG container abuse, LNK shortcut hijacking, OneNote embedded payloads, HTML smuggling), email authentication bypass techniques (SPF softfail exploitation, DKIM replay attacks, display name sp", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/social-engineering/offensive-phishing", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-phishing"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/utility/offensive-reporting", "name": "offensive-reporting", "kind": "skill", "official": false, "desc": "Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/utility/offensive-reporting", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-reporting"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/infrastructure/offensive-shellcode", "name": "offensive-shellcode", "kind": "skill", "official": false, "desc": "Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode. Covers null byte avoidance, API hashing, encoder/decoder patterns, staged vs stageless payloads, Windows PEB traversal, and cross-platform shellcode techniques.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/infrastructure/offensive-shellcode", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-shellcode"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "iot", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/social-engineering/offensive-social-engineering", "name": "offensive-social-engineering", "kind": "skill", "official": false, "desc": "Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting methodology (persona creation, authority and urgency psychological triggers, rapport building), vishing (voice phishing via caller ID spoofing, IVR system exploitation, VoIP infrastructure setup with Twilio/Asterisk), smishing (SMS-based phishing, carrier gateway abuse, short code impersonation), physical social engineering (tailgating and piggybackin", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/social-engineering/offensive-social-engineering", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-social-engineering"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/web/offensive-sqli", "name": "offensive-sqli", "kind": "skill", "official": false, "desc": "SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQL", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/web/offensive-sqli", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-sqli"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/web/offensive-ssti", "name": "offensive-ssti", "kind": "skill", "official": false, "desc": "Dense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190. Use when testing template rendering endpoints or exploiting template injection for code execution.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/web/offensive-ssti", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-ssti"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/supply-chain/offensive-supply-chain", "name": "offensive-supply-chain", "kind": "skill", "official": false, "desc": "Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Ma", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/supply-chain/offensive-supply-chain", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-supply-chain"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/crypto/offensive-tls-attacks", "name": "offensive-tls-attacks", "kind": "skill", "official": false, "desc": "Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-201", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/crypto/offensive-tls-attacks", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-tls-attacks"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "toctou", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/exploit-dev/offensive-toctou", "name": "offensive-toctou", "kind": "skill", "official": false, "desc": "Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-cla", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/exploit-dev/offensive-toctou", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-toctou"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "anti-forensics", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-wifi", "name": "offensive-wifi", "kind": "skill", "official": false, "desc": "Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons / Mana evil twin attacks, captive-portal phishing, KRACK and FragAttacks, WPS Pixie Dust, deauthentication and disassociation attacks, rogue AP construction (hostapd-mana), 802.1X ", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-wifi", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-wifi"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-wifi-recon", "name": "offensive-wifi-recon", "kind": "skill", "official": false, "desc": "Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 GHz (Wi-", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-wifi-recon", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-wifi-recon"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/privesc/offensive-windows-privesc", "name": "offensive-windows-privesc", "kind": "skill", "official": false, "desc": "Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\\\\SYSTEM: token impersonation via SeImpersonate and SeAssignPrimaryToken privileges using JuicyPotato, PrintSpoofer, GodPotato, SweetPotato, and RoguePotato; service misconfigurations including unquoted service paths, weak service DACLs, writable service binaries, and insecure service creation permissions; AlwaysInstallElevated MSI ex", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/privesc/offensive-windows-privesc", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-windows-privesc"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-wpa-enterprise", "name": "offensive-wpa-enterprise", "kind": "skill", "official": false, "desc": "WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-wpa-enterprise", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-wpa-enterprise"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-wpa2-psk", "name": "offensive-wpa2-psk", "kind": "skill", "official": false, "desc": "WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-wpa2-psk", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-wpa2-psk"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-wpa3-sae", "name": "offensive-wpa3-sae", "kind": "skill", "official": false, "desc": "WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-wpa3-sae", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-wpa3-sae"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-wps", "name": "offensive-wps", "kind": "skill", "official": false, "desc": "WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-wps", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-wps"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-z-wave", "name": "offensive-z-wave", "kind": "skill", "official": false, "desc": "Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting Z-Wave smart home devices (door locks, sensors, garage controllers) — common in mid-2010s smart home deployments still in production.", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-z-wave", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-z-wave"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:SnailSploit/Claude-Red/Skills/wireless/offensive-zigbee-thread-matter", "name": "offensive-zigbee-thread-matter", "kind": "skill", "official": false, "desc": "Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection attacks, Zigbee Cluster Library command abuse for door locks and bulbs, Thread network credential theft, Matter commissioning chain analysis, and 6LoWPAN/IPv6 routing exploitation. Use when targeting smart-home or commercial mesh deployments, Zigbee-based door loc", "repo": "https://github.com/SnailSploit/Claude-Red/tree/HEAD/Skills/wireless/offensive-zigbee-thread-matter", "install": ["npx skills add SnailSploit/Claude-Red --skill offensive-zigbee-thread-matter"], "stars": 10764, "pushed": "2026-11-11T13:48:05Z", "license": "MIT", "plat": "zigbee", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/apk-redteam-pipeline", "name": "apk-redteam-pipeline", "kind": "skill", "official": false, "desc": "End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when ", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/apk-redteam-pipeline", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill apk-redteam-pipeline"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/bb-local-toolkit", "name": "bb-local-toolkit", "kind": "skill", "official": false, "desc": "Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/bb-local-toolkit", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill bb-local-toolkit"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/bb-methodology", "name": "bb-methodology", "kind": "skill", "official": false, "desc": "Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking \"what should I do next\" or \"where am I in the process.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/bb-methodology", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill bb-methodology"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/bug-bounty", "name": "bug-bounty", "kind": "skill", "official": false, "desc": "Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security test", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/bug-bounty", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill bug-bounty"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/bugcrowd-reporting", "name": "bugcrowd-reporting", "kind": "skill", "official": false, "desc": "Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/bugcrowd-reporting", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill bugcrowd-reporting"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "bugcrowd", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/cloud-iam-deep", "name": "cloud-iam-deep", "kind": "skill", "official": false, "desc": "Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/cloud-iam-deep", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill cloud-iam-deep"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "aws, azure, gcp", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/enterprise-vpn-attack", "name": "enterprise-vpn-attack", "kind": "skill", "official": false, "desc": "External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE lan", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/enterprise-vpn-attack", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill enterprise-vpn-attack"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "cisco, fortinet, citrix, palo alto, puls", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/evidence-hygiene", "name": "evidence-hygiene", "kind": "skill", "official": false, "desc": "Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/evidence-hygiene", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill evidence-hygiene"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "bug bounty", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-idor", "name": "hunt-idor", "kind": "skill", "official": false, "desc": "Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-idor", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-idor"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-jwt-crypto", "name": "hunt-jwt-crypto", "kind": "skill", "official": false, "desc": "Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-jwt-crypto", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-jwt-crypto"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-k8s", "name": "hunt-k8s", "kind": "skill", "official": false, "desc": "Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated nodes/proxy RCE, EphemeralContainers node-shell, bound/projected SA-token audience+expiry abuse, admission-controller bypass, Helm/Tiller remnants. Use when target runs containerized infra,", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-k8s", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-k8s"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "kubernetes", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-laravel", "name": "hunt-laravel", "kind": "skill", "official": false, "desc": "Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-laravel", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-laravel"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "laravel", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-ldap", "name": "hunt-ldap", "kind": "skill", "official": false, "desc": "Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \\\\ NUL /), search-filter-context vs DN-injection, parenthesis-balancing, AND/OR filter logic, and {SSHA}/{CRYPT} userPassword exfil on non-AD directories. Use when target uses LDAP/AD authentication, corporate SSO with a directory backend, an address-book/people-search API, or XML-based data sto", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-ldap", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-ldap"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "ldap", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-lfi", "name": "hunt-lfi", "kind": "skill", "official": false, "desc": "Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal read/write/delete. Covers OOB/blind LFI confirmation and false-positive discipline. Use when hunting file-include or path-traversal bugs on any target.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-lfi", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-lfi"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-llm-ai", "name": "hunt-llm-ai", "kind": "skill", "official": false, "desc": "Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling (Unicode Tags block U+E0000-U+E007F, invisible to humans, decoded by the model), tool-use exfiltration (model has fetch/browse tool, attacker injects OOB URL, model exfils chat hi", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-llm-ai", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-llm-ai"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-mfa-bypass", "name": "hunt-mfa-bypass", "kind": "skill", "official": false, "desc": "Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-mfa-bypass", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-mfa-bypass"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-misc", "name": "hunt-misc", "kind": "skill", "official": false, "desc": "Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-misc", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-misc"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-nextjs", "name": "hunt-nextjs", "kind": "skill", "official": false, "desc": "Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-nextjs", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-nextjs"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "next.js", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-nodejs", "name": "hunt-nodejs", "kind": "skill", "official": false, "desc": "Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-nodejs", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-nodejs"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "node.js", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-nosqli", "name": "hunt-nosqli", "kind": "skill", "official": false, "desc": "Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-nosqli", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-nosqli"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-ntlm-info", "name": "hunt-ntlm-info", "kind": "skill", "official": false, "desc": "Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-ntlm-info", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-ntlm-info"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "iis", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-oauth", "name": "hunt-oauth", "kind": "skill", "official": false, "desc": "Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-oauth", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-oauth"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "oauth", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-open-redirect", "name": "hunt-open-redirect", "kind": "skill", "official": false, "desc": "Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-open-redirect", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-open-redirect"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-race-condition", "name": "hunt-race-condition", "kind": "skill", "official": false, "desc": "Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 \"Smashing the State Machine\"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass v", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-race-condition", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-race-condition"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-rag-vector", "name": "hunt-rag-vector", "kind": "skill", "official": false, "desc": "Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survives across sessions and users (distinct from one-shot indirect prompt injection, which is owned by hunt-llm-ai), cross-tenant vector-database IDOR (unauthenticated or unscoped queries against Pinecone/Weaviate/Chroma/Milvus/Qdrant/pgvector), source-text/metadata leakage in similarity-search results, and retrieval-hijack via adversarial embedding pr", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-rag-vector", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-rag-vector"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-rce", "name": "hunt-rce", "kind": "skill", "official": false, "desc": "Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-rce", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-rce"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-saml", "name": "hunt-saml", "kind": "skill", "official": false, "desc": "Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID (admin@target.com<!--evil-->@attacker.com → some parsers see admin@target.com), signature stripping (remove Signature element entirely, server should reject but doesn't), key confusion (signed by attacker's IdP, accepted by SP), audience-restriction not validated, replay attack (same Assertion accepted twice within validity win", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-saml", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-saml"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "saml", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-session", "name": "hunt-session", "kind": "skill", "official": false, "desc": "Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB con", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-session", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-session"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-shadow-api", "name": "hunt-shadow-api", "kind": "skill", "official": false, "desc": "Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation o", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-shadow-api", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-shadow-api"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-sharepoint", "name": "hunt-sharepoint", "kind": "skill", "official": false, "desc": "Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass (Authentication.asmx), ToolShell precondition chain (CVE-2025-53770), SafeControl reflection enumeration via Picker.aspx, NTLM Type-2 AD topology disclosure, custom-branding module discovery, EoL farm permanent-CVE-window exploitation, FormDigest anonymous issuance, file-extension blocklist NOT-an-oracle pattern, custom-zone Forms aut", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-sharepoint", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-sharepoint"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "sharepoint", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-source-leak", "name": "hunt-source-leak", "kind": "skill", "official": false, "desc": "Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info files, asset-manifest.json API route discovery, .DS_Store file listing. Use at the START of every recon session — these findings often unlock the entire attack surface.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-source-leak", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-source-leak"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-spa-api", "name": "hunt-spa-api", "kind": "skill", "official": false, "desc": "Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of \"Criticals\" completely m", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-spa-api", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-spa-api"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/hunt-springboot", "name": "hunt-springboot", "kind": "skill", "official": false, "desc": "Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SPEL (CVE-2022-22963), heap dump credential extraction. Use when target runs Spring Boot — detected via X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/hunt-springboot", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill hunt-springboot"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "spring boot", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/ios-redteam-pipeline", "name": "ios-redteam-pipeline", "kind": "skill", "official": false, "desc": "End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static analysis, Info.plist + entitlements + Keychain secret extraction, App Transport Security (ATS) misconfig + certificate-pinning bypass (frida-ios-dump, objection, SSL Kill Switch 2), URL-scheme / Universal Link hijack, exported-service enumeration, Frida runtime instrumentation. Companion to apk-redteam-pipeline for the iOS side of a mobile app catalog", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/ios-redteam-pipeline", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill ios-redteam-pipeline"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/m365-entra-attack", "name": "m365-entra-attack", "kind": "skill", "official": false, "desc": "Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, C", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/m365-entra-attack", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill m365-entra-attack"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/mid-engagement-ir-detection", "name": "mid-engagement-ir-detection", "kind": "skill", "official": false, "desc": "Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those observations into deliverable findings. Built from authorized red-team work where the client patched a confirmed SQLi within 30 minutes of detection AND an external attacker locked multiple new accounts during a single test session. Use when (a) running ANY active engagement against a monitored target, (b) a previously-confirmed finding stops ", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/mid-engagement-ir-detection", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill mid-engagement-ir-detection"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/offensive-osint", "name": "offensive-osint", "kind": "skill", "official": false, "desc": "Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/O", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/offensive-osint", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill offensive-osint"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/okta-attack", "name": "okta-attack", "kind": "skill", "official": false, "desc": "Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirect_uri tampering), MFA enumeration, post-compromise admin API surface. Many enterprise orgs use Okta instead of (or alongside) Entra ID. Distinct endpoints, distinct rate-limiting, distinct factor flows. Use wh", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/okta-attack", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill okta-attack"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/osint-methodology", "name": "osint-methodology", "kind": "skill", "official": false, "desc": "Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset types, severity rubric (CRITICAL/HIGH/MEDIUM/LOW/INFO), confidence upgrade workflows, time budgeting, asset-level triage rules, scale-based tactics, identity-fabric mapping (Entra/Okta/ADFS/Google/SAML/M365 Teams+SharePoint+OAuth), API and auth", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/osint-methodology", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill osint-methodology"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/recon-scope-triage", "name": "recon-scope-triage", "kind": "skill", "official": false, "desc": "Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the brand name, so for any target whose name is a common/dictionary word, the output is dominated by assets belonging to UNRELATED same-named companies (repos, cloud buckets, mobile apps, breach corpora, typosquats). Built from an authorized engagement where an ASM report's \"Criticals\" were overwhelmingly false positives and the combo/repos/m", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/recon-scope-triage", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill recon-scope-triage"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/redteam-mindset", "name": "redteam-mindset", "kind": "skill", "official": false, "desc": "Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering \"stopping\" on a defended target. The single most important skill to load when scope is \"external red team\" not \"bug bounty / WAPT\".", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/redteam-mindset", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill redteam-mindset"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/redteam-report-template", "name": "redteam-report-template", "kind": "skill", "official": false, "desc": "Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different cadence. Built from an authorized engagement deliverable where 14 findings were packaged into a 52KB MD + 2.2MB DOCX with 16 embedded screenshots. Use when the engagement is \"external red team for an enterprise client\" (not H1/Bugcrowd/Intigrit", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/redteam-report-template", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill redteam-report-template"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/report-writing", "name": "report-writing", "kind": "skill", "official": false, "desc": "Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Validation gates and the submittability/always-rejected decision are owned by triage-validation; this skill owns the written report itself (templates, tone, formulas). Use after validating a finding and before submitting. Never use \"could potential", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/report-writing", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill report-writing"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/supply-chain-attack-recon", "name": "supply-chain-attack-recon", "kind": "skill", "official": false, "desc": "External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the ", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/supply-chain-attack-recon", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill supply-chain-attack-recon"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-BugHunter/skills/triage-validation", "name": "triage-validation", "kind": "skill", "official": false, "desc": "Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.", "repo": "https://github.com/elementalsouls/Claude-BugHunter/tree/HEAD/skills/triage-validation", "install": ["npx skills add elementalsouls/Claude-BugHunter --skill triage-validation"], "stars": 5763, "pushed": "2026-11-13T12:18:16Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/active-directory-attacks", "name": "active-directory-attacks", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"attack Active Directory\", \"exploit AD\", \"Kerberoasting\", \"DCSync\", \"pass-the-hash\", \"BloodHound enumeration\", \"Golden Ticket\", \"Silver Ticket\", \"AS-REP roasting\", \"NTLM relay\", or needs guidance on Windows domain penetration testing.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/active-directory-attacks", "install": ["npx skills add zebbern/claude-code-guide --skill active-directory-attacks"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "active-directory-attacks", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/api-fuzzing-bug-bounty", "name": "api-fuzzing-bug-bounty", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"test API security\", \"fuzz APIs\", \"find IDOR vulnerabilities\", \"test REST API\", \"test GraphQL\", \"API penetration testing\", \"bug bounty API testing\", or needs guidance on API security assessment techniques.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/api-fuzzing-bug-bounty", "install": ["npx skills add zebbern/claude-code-guide --skill api-fuzzing-bug-bounty"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "api-fuzzing-bug-bounty", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/aws-penetration-testing", "name": "aws-penetration-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"pentest AWS\", \"test AWS security\", \"enumerate IAM\", \"exploit cloud infrastructure\", \"AWS privilege escalation\", \"S3 bucket testing\", \"metadata SSRF\", \"Lambda exploitation\", or needs guidance on Amazon Web Services security assessment.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/aws-penetration-testing", "install": ["npx skills add zebbern/claude-code-guide --skill aws-penetration-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "aws-penetration-testing", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/burp-suite-testing", "name": "burp-suite-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"intercept HTTP traffic\", \"modify web requests\", \"use Burp Suite for testing\", \"perform web vulnerability scanning\", \"test with Burp Repeater\", \"analyze HTTP history\", or \"configure proxy for web testing\". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/burp-suite-testing", "install": ["npx skills add zebbern/claude-code-guide --skill burp-suite-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "burp-suite-testing", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/cloud-penetration-testing", "name": "cloud-penetration-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"perform cloud penetration testing\", \"assess Azure or AWS or GCP security\", \"enumerate cloud resources\", \"exploit cloud misconfigurations\", \"test O365 security\", \"extract secrets from cloud environments\", or \"audit cloud infrastructure\". It provides comprehensive techniques for security assessment across major cloud platforms.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/cloud-penetration-testing", "install": ["npx skills add zebbern/claude-code-guide --skill cloud-penetration-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "azure, aws, gcp", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/ethical-hacking-methodology", "name": "ethical-hacking-methodology", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"learn ethical hacking\", \"understand penetration testing lifecycle\", \"perform reconnaissance\", \"conduct security scanning\", \"exploit vulnerabilities\", or \"write penetration test reports\". It provides comprehensive ethical hacking methodology and techniques.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/ethical-hacking-methodology", "install": ["npx skills add zebbern/claude-code-guide --skill ethical-hacking-methodology"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/file-path-traversal", "name": "file-path-traversal", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"test for directory traversal\", \"exploit path traversal vulnerabilities\", \"read arbitrary files through web applications\", \"find LFI vulnerabilities\", or \"access files outside web root\". It provides comprehensive file path traversal attack and testing methodologies.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/file-path-traversal", "install": ["npx skills add zebbern/claude-code-guide --skill file-path-traversal"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/html-injection-testing", "name": "html-injection-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"test for HTML injection\", \"inject HTML into web pages\", \"perform HTML injection attacks\", \"deface web applications\", or \"test content injection vulnerabilities\". It provides comprehensive HTML injection attack techniques and testing methodologies.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/html-injection-testing", "install": ["npx skills add zebbern/claude-code-guide --skill html-injection-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/idor-testing", "name": "idor-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"test for insecure direct object references,\" \"find IDOR vulnerabilities,\" \"exploit broken access control,\" \"enumerate user IDs or object references,\" or \"bypass authorization to access other users' data.\" It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/idor-testing", "install": ["npx skills add zebbern/claude-code-guide --skill idor-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/linux-privilege-escalation", "name": "linux-privilege-escalation", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"escalate privileges on Linux\", \"find privesc vectors on Linux systems\", \"exploit sudo misconfigurations\", \"abuse SUID binaries\", \"exploit cron jobs for root access\", \"enumerate Linux systems for privilege escalation\", or \"gain root access from low-privilege shell\". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/linux-privilege-escalation", "install": ["npx skills add zebbern/claude-code-guide --skill linux-privilege-escalation"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "linux", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/metasploit-framework", "name": "metasploit-framework", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"use Metasploit for penetration testing\", \"exploit vulnerabilities with msfconsole\", \"create payloads with msfvenom\", \"perform post-exploitation\", \"use auxiliary modules for scanning\", or \"develop custom exploits\". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/metasploit-framework", "install": ["npx skills add zebbern/claude-code-guide --skill metasploit-framework"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "metasploit", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/pentest-checklist", "name": "pentest-checklist", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"plan a penetration test\", \"create a security assessment checklist\", \"prepare for penetration testing\", \"define pentest scope\", \"follow security testing best practices\", or needs a structured methodology for penetration testing engagements.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/pentest-checklist", "install": ["npx skills add zebbern/claude-code-guide --skill pentest-checklist"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/pentest-commands", "name": "pentest-commands", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"run pentest commands\", \"scan with nmap\", \"use metasploit exploits\", \"crack passwords with hydra or john\", \"scan web vulnerabilities with nikto\", \"enumerate networks\", or needs essential penetration testing command references.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/pentest-commands", "install": ["npx skills add zebbern/claude-code-guide --skill pentest-commands"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/privilege-escalation-methods", "name": "privilege-escalation-methods", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"escalate privileges\", \"get root access\", \"become administrator\", \"privesc techniques\", \"abuse sudo\", \"exploit SUID binaries\", \"Kerberoasting\", \"pass-the-ticket\", \"token impersonation\", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/privilege-escalation-methods", "install": ["npx skills add zebbern/claude-code-guide --skill privilege-escalation-methods"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/red-team-tools", "name": "red-team-tools", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"follow red team methodology\", \"perform bug bounty hunting\", \"automate reconnaissance\", \"hunt for XSS vulnerabilities\", \"enumerate subdomains\", or needs security researcher techniques and tool configurations from top bug bounty hunters.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/red-team-tools", "install": ["npx skills add zebbern/claude-code-guide --skill red-team-tools"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/shodan-reconnaissance", "name": "shodan-reconnaissance", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"search for exposed devices on the internet,\" \"perform Shodan reconnaissance,\" \"find vulnerable services using Shodan,\" \"scan IP ranges with Shodan,\" or \"discover IoT devices and open ports.\" It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/shodan-reconnaissance", "install": ["npx skills add zebbern/claude-code-guide --skill shodan-reconnaissance"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "shodan", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/smtp-penetration-testing", "name": "smtp-penetration-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"perform SMTP penetration testing\", \"enumerate email users\", \"test for open mail relays\", \"grab SMTP banners\", \"brute force email credentials\", or \"assess mail server security\". It provides comprehensive techniques for testing SMTP server security.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/smtp-penetration-testing", "install": ["npx skills add zebbern/claude-code-guide --skill smtp-penetration-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/sqlmap-database-pentesting", "name": "sqlmap-database-pentesting", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"automate SQL injection testing,\" \"enumerate database structure,\" \"extract database credentials using sqlmap,\" \"dump tables and columns from a vulnerable database,\" or \"perform automated database penetration testing.\" It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/sqlmap-database-pentesting", "install": ["npx skills add zebbern/claude-code-guide --skill sqlmap-database-pentesting"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/ssh-penetration-testing", "name": "ssh-penetration-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"pentest SSH services\", \"enumerate SSH configurations\", \"brute force SSH credentials\", \"exploit SSH vulnerabilities\", \"perform SSH tunneling\", or \"audit SSH security\". It provides comprehensive SSH penetration testing methodologies and techniques.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/ssh-penetration-testing", "install": ["npx skills add zebbern/claude-code-guide --skill ssh-penetration-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/windows-privilege-escalation", "name": "windows-privilege-escalation", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"escalate privileges on Windows,\" \"find Windows privesc vectors,\" \"enumerate Windows for privilege escalation,\" \"exploit Windows misconfigurations,\" or \"perform post-exploitation privilege escalation.\" It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/windows-privilege-escalation", "install": ["npx skills add zebbern/claude-code-guide --skill windows-privilege-escalation"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zebbern/claude-code-guide/skills/wordpress-penetration-testing", "name": "wordpress-penetration-testing", "kind": "skill", "official": false, "desc": "This skill should be used when the user asks to \"pentest WordPress sites\", \"scan WordPress for vulnerabilities\", \"enumerate WordPress users, themes, or plugins\", \"exploit WordPress vulnerabilities\", or \"use WPScan\". It provides comprehensive WordPress security assessment methodologies.", "repo": "https://github.com/zebbern/claude-code-guide/tree/HEAD/skills/wordpress-penetration-testing", "install": ["npx skills add zebbern/claude-code-guide --skill wordpress-penetration-testing"], "stars": 4708, "pushed": "2026-11-14T00:35:12Z", "license": "MIT", "plat": "wordpress", "live": "Not checked (runs locally)"}, {"id": "skill:ljagiello/ctf-skills/ctf-reverse", "name": "ctf-reverse", "kind": "skill", "official": false, "desc": "Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk", "repo": "https://github.com/ljagiello/ctf-skills/tree/HEAD/ctf-reverse", "install": ["npx skills add ljagiello/ctf-skills --skill ctf-reverse"], "stars": 3701, "pushed": "2026-11-13T15:16:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:ljagiello/ctf-skills/ctf-web", "name": "ctf-web", "kind": "skill", "official": false, "desc": "Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalys", "repo": "https://github.com/ljagiello/ctf-skills/tree/HEAD/ctf-web", "install": ["npx skills add ljagiello/ctf-skills --skill ctf-web"], "stars": 3701, "pushed": "2026-11-13T15:16:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:ljagiello/ctf-skills/ctf-writeup", "name": "ctf-writeup", "kind": "skill", "official": false, "desc": "Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to document the solution steps, tools used, and lessons learned in a structured format.", "repo": "https://github.com/ljagiello/ctf-skills/tree/HEAD/ctf-writeup", "install": ["npx skills add ljagiello/ctf-skills --skill ctf-writeup"], "stars": 3701, "pushed": "2026-11-13T15:16:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wesammustafa/Claude-Code-Quest/examples/intermediate/01-first-skill/dot-claude/skills/tdd", "name": "tdd", "kind": "skill", "official": false, "desc": "TODO", "repo": "https://github.com/wesammustafa/Claude-Code-Quest/tree/HEAD/examples/intermediate/01-first-skill/dot-claude/skills/tdd", "install": ["npx skills add wesammustafa/Claude-Code-Quest --skill tdd"], "stars": 3699, "pushed": "2026-11-13T16:08:26Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:aws-agents-for-devsecops", "name": "aws-agents-for-devsecops", "kind": "claude-plugin", "official": null, "desc": "Investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Agent and AWS Security Agent.", "repo": "https://github.com/aws/agent-toolkit-for-aws.git", "install": ["claude plugin install aws-agents-for-devsecops@claude-plugins-official"], "stars": 3480, "pushed": "2026-11-13T08:43:24Z", "license": "Apache-2.0", "plat": "aws", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:samugit83/redamon", "name": "redamon", "kind": "mcp", "official": null, "desc": "Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your o", "repo": "https://github.com/samugit83/redamon", "install": [], "stars": 3400, "pushed": null, "license": null, "plat": "redamon", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-OSINT/skills/offensive-osint", "name": "offensive-osint", "kind": "skill", "official": false, "desc": "Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 SAML paths, cloud bucket permutations, JS guess-paths, vendor product fingerprints for Citrix/F5/Pulse/Fortinet/Cisco/PaloAlto/VMware/Exchange, cloud-native service fingerprints, container/K8s exposure paths, CI/CD platform paths, documentation/wiki leak paths, WHOIS/RDAP, DNS record catalog, Wa", "repo": "https://github.com/elementalsouls/Claude-OSINT/tree/HEAD/skills/offensive-osint", "install": ["npx skills add elementalsouls/Claude-OSINT --skill offensive-osint"], "stars": 3030, "pushed": "2026-10-20T22:20:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-OSINT/skills/org-attack-surface", "name": "org-attack-surface", "kind": "skill", "official": false, "desc": "Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains -> owned netblocks/ASN -> live assets — with attribution discipline, not just DNS breadth. The org-first attribution pyramid (legal entity -> LEI/registration -> corporate family -> owned domains -> owned netblocks/ASN -> live assets). Corporate-identity resolution via the GLEIF LEI API (legal name -> LEI, exact-LEI direct-children expansion, downwa", "repo": "https://github.com/elementalsouls/Claude-OSINT/tree/HEAD/skills/org-attack-surface", "install": ["npx skills add elementalsouls/Claude-OSINT --skill org-attack-surface"], "stars": 3030, "pushed": "2026-10-20T22:20:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-OSINT/skills/osint-autopilot", "name": "osint-autopilot", "kind": "skill", "official": false, "desc": "End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generated findings, and a consolidated multi-tab .xlsx deliverable. Stops ONLY for Stage 6 (active exploitation) arming and out-of-scope sibling assets. Use whenever asked to \"run OSINT / recon / attack-surfa", "repo": "https://github.com/elementalsouls/Claude-OSINT/tree/HEAD/skills/osint-autopilot", "install": ["npx skills add elementalsouls/Claude-OSINT --skill osint-autopilot"], "stars": 3030, "pushed": "2026-10-20T22:20:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:elementalsouls/Claude-OSINT/skills/osint-methodology", "name": "osint-methodology", "kind": "skill", "official": false, "desc": "Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → asset expansion → enrichment → exposure analysis → convergence → operator-armed active validation) with connector-resilience and stage-vs-gating discipline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation with per-person identity dossiers, detectability tagg", "repo": "https://github.com/elementalsouls/Claude-OSINT/tree/HEAD/skills/osint-methodology", "install": ["npx skills add elementalsouls/Claude-OSINT --skill osint-methodology"], "stars": 3030, "pushed": "2026-10-20T22:20:34Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/tool-chaining-abuse/attacker-forwarding", "name": "attacker-forwarding", "kind": "skill", "official": false, "desc": "Forward collected data to an explicitly attacker-controlled destination", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/tool-chaining-abuse/attacker-forwarding", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill attacker-forwarding"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/test_skills/malicious/exfiltrator", "name": "data-exfiltrator", "kind": "skill", "official": false, "desc": "Analyzes data files", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/test_skills/malicious/exfiltrator", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill data-exfiltrator"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/unicode-steganography/encoded-tag", "name": "encoded-tag-marker", "kind": "skill", "official": false, "desc": "Contain an encoded Unicode Tag Block marker used for hidden instructions", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/unicode-steganography/encoded-tag", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill encoded-tag-marker"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/transitive-trust-abuse/external-instructions", "name": "external-instruction-follower", "kind": "skill", "official": false, "desc": "Delegate agent behavior to instructions obtained from an external page", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/transitive-trust-abuse/external-instructions", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill external-instruction-follower"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/behavioral-analysis/multi-file-exfiltration", "name": "external-socket-reporter", "kind": "skill", "official": false, "desc": "Send a diagnostic record over an explicitly external raw socket", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/behavioral-analysis/multi-file-exfiltration", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill external-socket-reporter"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/test_skills/malicious/prompt-injection", "name": "prompt-injection-test", "kind": "skill", "official": false, "desc": "A test skill with prompt injection patterns", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/test_skills/malicious/prompt-injection", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill prompt-injection-test"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/malware/ransomware-chain", "name": "ransomware-chain", "kind": "skill", "official": false, "desc": "Demonstrate a multi-stage file encryption and extortion implementation", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/malware/ransomware-chain", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill ransomware-chain"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/harmful-content/explicit-ransomware-request", "name": "ransomware-request", "kind": "skill", "official": false, "desc": "Issue an explicit imperative request for a prohibited cyber-harm capability", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/harmful-content/explicit-ransomware-request", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill ransomware-request"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/unauthorized-tool-use/remote-package-source", "name": "remote-package-installer", "kind": "skill", "official": false, "desc": "Install a Python package directly from an untrusted remote archive", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/unauthorized-tool-use/remote-package-source", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill remote-package-installer"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:cisco-ai-defense/skill-scanner/evals/skills/path-traversal/file-reader", "name": "unconstrained-file-reader", "kind": "skill", "official": false, "desc": "Read a caller-selected path without confining it to a safe root", "repo": "https://github.com/cisco-ai-defense/skill-scanner/tree/HEAD/evals/skills/path-traversal/file-reader", "install": ["npx skills add cisco-ai-defense/skill-scanner --skill unconstrained-file-reader"], "stars": 2727, "pushed": "2026-11-10T12:31:45Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/401-403-bypass-techniques", "name": "401-403-bypass-techniques", "kind": "skill", "official": false, "desc": "401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/401-403-bypass-techniques", "install": ["npx skills add yaklang/hack-skills --skill 401-403-bypass-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "web security", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/active-directory-acl-abuse", "name": "active-directory-acl-abuse", "kind": "skill", "official": false, "desc": "Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/active-directory-acl-abuse", "install": ["npx skills add yaklang/hack-skills --skill active-directory-acl-abuse"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/active-directory-certificate-services", "name": "active-directory-certificate-services", "kind": "skill", "official": false, "desc": "AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/active-directory-certificate-services", "install": ["npx skills add yaklang/hack-skills --skill active-directory-certificate-services"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/active-directory-kerberos-attacks", "name": "active-directory-kerberos-attacks", "kind": "skill", "official": false, "desc": "Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/active-directory-kerberos-attacks", "install": ["npx skills add yaklang/hack-skills --skill active-directory-kerberos-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/android-pentesting-tricks", "name": "android-pentesting-tricks", "kind": "skill", "official": false, "desc": "Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/android-pentesting-tricks", "install": ["npx skills add yaklang/hack-skills --skill android-pentesting-tricks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/anti-debugging-techniques", "name": "anti-debugging-techniques", "kind": "skill", "official": false, "desc": "Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/anti-debugging-techniques", "install": ["npx skills add yaklang/hack-skills --skill anti-debugging-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "reverse engineering", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/api-auth-and-jwt-abuse", "name": "api-auth-and-jwt-abuse", "kind": "skill", "official": false, "desc": "API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/api-auth-and-jwt-abuse", "install": ["npx skills add yaklang/hack-skills --skill api-auth-and-jwt-abuse"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "api security", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/api-authorization-and-bola", "name": "api-authorization-and-bola", "kind": "skill", "official": false, "desc": "API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/api-authorization-and-bola", "install": ["npx skills add yaklang/hack-skills --skill api-authorization-and-bola"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "api security", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/api-recon-and-docs", "name": "api-recon-and-docs", "kind": "skill", "official": false, "desc": "API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/api-recon-and-docs", "install": ["npx skills add yaklang/hack-skills --skill api-recon-and-docs"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "api security", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/api-sec", "name": "api-sec", "kind": "skill", "official": false, "desc": "Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/api-sec", "install": ["npx skills add yaklang/hack-skills --skill api-sec"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "api security", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/arbitrary-write-to-rce", "name": "arbitrary-write-to-rce", "kind": "skill", "official": false, "desc": "Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/arbitrary-write-to-rce", "install": ["npx skills add yaklang/hack-skills --skill arbitrary-write-to-rce"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "exploitation", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/attack-surface-mapping", "name": "attack-surface-mapping", "kind": "skill", "official": false, "desc": "Draw a testable attack surface from one authorized target URL or one application. Use when the user says 攻击面, 供给面, 画攻击面, map the surface, application recon, find the business host, JS inventory, or when the only visible page is login. Derive hosts, APIs, keys, and the object graph from what the app already exposes. Do not open with directory brute or payload spray. Use when the user runs /attack-surface-mapping.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/attack-surface-mapping", "install": ["npx skills add yaklang/hack-skills --skill attack-surface-mapping"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "penetration testing", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/auth-sec", "name": "auth-sec", "kind": "skill", "official": false, "desc": "Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterprise SSO weaknesses before any deeper auth topic skill.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/auth-sec", "install": ["npx skills add yaklang/hack-skills --skill auth-sec"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "authentication", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/authbypass-authentication-flaws", "name": "authbypass-authentication-flaws", "kind": "skill", "official": false, "desc": "Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/authbypass-authentication-flaws", "install": ["npx skills add yaklang/hack-skills --skill authbypass-authentication-flaws"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "authentication", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/binary-protection-bypass", "name": "binary-protection-bypass", "kind": "skill", "official": false, "desc": "Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/binary-protection-bypass", "install": ["npx skills add yaklang/hack-skills --skill binary-protection-bypass"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "reverse engineering", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/browser-exploitation-v8", "name": "browser-exploitation-v8", "kind": "skill", "official": false, "desc": "Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass to achieve renderer RCE and sandbox escape in Chrome/Chromium.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/browser-exploitation-v8", "install": ["npx skills add yaklang/hack-skills --skill browser-exploitation-v8"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "web exploitation", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/business-logic-vuln", "name": "business-logic-vuln", "kind": "skill", "official": false, "desc": "Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/business-logic-vuln", "install": ["npx skills add yaklang/hack-skills --skill business-logic-vuln"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "application security", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/business-logic-vulnerabilities", "name": "business-logic-vulnerabilities", "kind": "skill", "official": false, "desc": "Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/business-logic-vulnerabilities", "install": ["npx skills add yaklang/hack-skills --skill business-logic-vulnerabilities"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "application security", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/classical-cipher-analysis", "name": "classical-cipher-analysis", "kind": "skill", "official": false, "desc": "Classical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires frequency analysis, Kasiski examination, or known-plaintext cryptanalysis.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/classical-cipher-analysis", "install": ["npx skills add yaklang/hack-skills --skill classical-cipher-analysis"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/hack", "name": "hack", "kind": "skill", "official": false, "desc": "Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, authorized pentest, code audit, source-leak mining, middleware audit, SOC triage, detection engineering, incident response, or choosing the right next category skill before any deep topic skill. Also use when the user mentions 安全工程师, 渗透测试, 红队, 蓝队, 代码审计, 源码泄露, SRC. Enforce impact-first testing, finish the cu", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/hack", "install": ["npx skills add yaklang/hack-skills --skill hack"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/prototype-pollution", "name": "prototype-pollution", "kind": "skill", "official": false, "desc": "Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/prototype-pollution", "install": ["npx skills add yaklang/hack-skills --skill prototype-pollution"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/prototype-pollution-advanced", "name": "prototype-pollution-advanced", "kind": "skill", "official": false, "desc": "Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/prototype-pollution-advanced", "install": ["npx skills add yaklang/hack-skills --skill prototype-pollution-advanced"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/race-condition", "name": "race-condition", "kind": "skill", "official": false, "desc": "Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/race-condition", "install": ["npx skills add yaklang/hack-skills --skill race-condition"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/recon-and-methodology", "name": "recon-and-methodology", "kind": "skill", "official": false, "desc": "Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/recon-and-methodology", "install": ["npx skills add yaklang/hack-skills --skill recon-and-methodology"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/recon-for-sec", "name": "recon-for-sec", "kind": "skill", "official": false, "desc": "Entry P1 category router for reconnaissance and methodology. Use when mapping scope, drawing an attack surface from one application, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/recon-for-sec", "install": ["npx skills add yaklang/hack-skills --skill recon-for-sec"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/request-smuggling", "name": "request-smuggling", "kind": "skill", "official": false, "desc": "HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/request-smuggling", "install": ["npx skills add yaklang/hack-skills --skill request-smuggling"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/reverse-shell-techniques", "name": "reverse-shell-techniques", "kind": "skill", "official": false, "desc": "Reverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shells, PTY upgrades, file transfer methods, PowerShell shells, and Windows payload generation.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/reverse-shell-techniques", "install": ["npx skills add yaklang/hack-skills --skill reverse-shell-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/rsa-attack-techniques", "name": "rsa-attack-techniques", "kind": "skill", "official": false, "desc": "RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding oracles.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/rsa-attack-techniques", "install": ["npx skills add yaklang/hack-skills --skill rsa-attack-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/saml-sso-assertion-attacks", "name": "saml-sso-assertion-attacks", "kind": "skill", "official": false, "desc": "SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/saml-sso-assertion-attacks", "install": ["npx skills add yaklang/hack-skills --skill saml-sso-assertion-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/sandbox-escape-techniques", "name": "sandbox-escape-techniques", "kind": "skill", "official": false, "desc": "Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/sandbox-escape-techniques", "install": ["npx skills add yaklang/hack-skills --skill sandbox-escape-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/smart-contract-vulnerabilities", "name": "smart-contract-vulnerabilities", "kind": "skill", "official": false, "desc": "Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/smart-contract-vulnerabilities", "install": ["npx skills add yaklang/hack-skills --skill smart-contract-vulnerabilities"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/sqli-sql-injection", "name": "sqli-sql-injection", "kind": "skill", "official": false, "desc": "SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/sqli-sql-injection", "install": ["npx skills add yaklang/hack-skills --skill sqli-sql-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/ssrf-server-side-request-forgery", "name": "ssrf-server-side-request-forgery", "kind": "skill", "official": false, "desc": "SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/ssrf-server-side-request-forgery", "install": ["npx skills add yaklang/hack-skills --skill ssrf-server-side-request-forgery"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/ssti-server-side-template-injection", "name": "ssti-server-side-template-injection", "kind": "skill", "official": false, "desc": "SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/ssti-server-side-template-injection", "install": ["npx skills add yaklang/hack-skills --skill ssti-server-side-template-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/stack-overflow-and-rop", "name": "stack-overflow-and-rop", "kind": "skill", "official": false, "desc": "Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dlresolve, or SROP on Linux userland binaries.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/stack-overflow-and-rop", "install": ["npx skills add yaklang/hack-skills --skill stack-overflow-and-rop"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/steganography-techniques", "name": "steganography-techniques", "kind": "skill", "official": false, "desc": "Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appended data, ADS), and text (whitespace, zero-width, homoglyphs) for hidden data.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/steganography-techniques", "install": ["npx skills add yaklang/hack-skills --skill steganography-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/subdomain-takeover", "name": "subdomain-takeover", "kind": "skill", "official": false, "desc": "Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/subdomain-takeover", "install": ["npx skills add yaklang/hack-skills --skill subdomain-takeover"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/symbolic-execution-tools", "name": "symbolic-execution-tools", "kind": "skill", "official": false, "desc": "Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis with angr, Z3, or Unicorn Engine.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/symbolic-execution-tools", "install": ["npx skills add yaklang/hack-skills --skill symbolic-execution-tools"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/symmetric-cipher-attacks", "name": "symmetric-cipher-attacks", "kind": "skill", "official": false, "desc": "Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key reuse, or meet-in-the-middle attacks.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/symmetric-cipher-attacks", "install": ["npx skills add yaklang/hack-skills --skill symmetric-cipher-attacks"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/traffic-analysis-pcap", "name": "traffic-analysis-pcap", "kind": "skill", "official": false, "desc": "Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), data extraction, covert channel detection, PCAP repair, TLS decryption, and tshark command-line analysis.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/traffic-analysis-pcap", "install": ["npx skills add yaklang/hack-skills --skill traffic-analysis-pcap"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/tunneling-and-pivoting", "name": "tunneling-and-pivoting", "kind": "skill", "official": false, "desc": "Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTTP tunneling, ProxyChains, and multi-layer pivoting strategies.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/tunneling-and-pivoting", "install": ["npx skills add yaklang/hack-skills --skill tunneling-and-pivoting"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/type-juggling", "name": "type-juggling", "kind": "skill", "official": false, "desc": "PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types — common in legacy PHP and CTF-style code paths.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/type-juggling", "install": ["npx skills add yaklang/hack-skills --skill type-juggling"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/unauthorized-access-common-services", "name": "unauthorized-access-common-services", "kind": "skill", "official": false, "desc": "Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interfaces are exposed without authentication.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/unauthorized-access-common-services", "install": ["npx skills add yaklang/hack-skills --skill unauthorized-access-common-services"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/upload-insecure-files", "name": "upload-insecure-files", "kind": "skill", "official": false, "desc": "Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE chains.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/upload-insecure-files", "install": ["npx skills add yaklang/hack-skills --skill upload-insecure-files"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/vm-and-bytecode-reverse", "name": "vm-and-bytecode-reverse", "kind": "skill", "official": false, "desc": "Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode, dispatcher loops, or maze-style challenges.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/vm-and-bytecode-reverse", "install": ["npx skills add yaklang/hack-skills --skill vm-and-bytecode-reverse"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/waf-bypass-techniques", "name": "waf-bypass-techniques", "kind": "skill", "official": false, "desc": "WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/waf-bypass-techniques", "install": ["npx skills add yaklang/hack-skills --skill waf-bypass-techniques"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/web-cache-deception", "name": "web-cache-deception", "kind": "skill", "official": false, "desc": "Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to path confusion or cache key manipulation.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/web-cache-deception", "install": ["npx skills add yaklang/hack-skills --skill web-cache-deception"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/websocket-security", "name": "websocket-security", "kind": "skill", "official": false, "desc": "WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/websocket-security", "install": ["npx skills add yaklang/hack-skills --skill websocket-security"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/windows-av-evasion", "name": "windows-av-evasion", "kind": "skill", "official": false, "desc": "AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/windows-av-evasion", "install": ["npx skills add yaklang/hack-skills --skill windows-av-evasion"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/windows-lateral-movement", "name": "windows-lateral-movement", "kind": "skill", "official": false, "desc": "Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/windows-lateral-movement", "install": ["npx skills add yaklang/hack-skills --skill windows-lateral-movement"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/windows-privilege-escalation", "name": "windows-privilege-escalation", "kind": "skill", "official": false, "desc": "Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/windows-privilege-escalation", "install": ["npx skills add yaklang/hack-skills --skill windows-privilege-escalation"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "windows", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/xslt-injection", "name": "xslt-injection", "kind": "skill", "official": false, "desc": "XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/xslt-injection", "install": ["npx skills add yaklang/hack-skills --skill xslt-injection"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/xss-cross-site-scripting", "name": "xss-cross-site-scripting", "kind": "skill", "official": false, "desc": "XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/xss-cross-site-scripting", "install": ["npx skills add yaklang/hack-skills --skill xss-cross-site-scripting"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:yaklang/hack-skills/skills/xxe-xml-external-entity", "name": "xxe-xml-external-entity", "kind": "skill", "official": false, "desc": "XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.", "repo": "https://github.com/yaklang/hack-skills/tree/HEAD/skills/xxe-xml-external-entity", "install": ["npx skills add yaklang/hack-skills --skill xxe-xml-external-entity"], "stars": 2656, "pushed": "2026-09-13T13:47:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:LeoYeAI/agent-master-skills/skills/agent-bom/analyze", "name": "agent-bom-analyze", "kind": "skill", "official": false, "desc": "Analyze blast radius, attack paths, and threat landscape across your AI infrastructure. Use when: \"blast radius\", \"threat intel\", \"risk score\", \"attack path\", \"lateral movement\", \"context graph\", \"who can reach what\".", "repo": "https://github.com/LeoYeAI/agent-master-skills/tree/HEAD/skills/agent-bom/analyze", "install": ["npx skills add LeoYeAI/agent-master-skills --skill agent-bom-analyze"], "stars": 2192, "pushed": "2026-11-13T02:01:09Z", "license": "MIT", "plat": "ai infrastructure", "live": "Not checked (runs locally)"}, {"id": "skill:Leanmcp/gateway-skills/skills/security-repro", "name": "security-repro", "kind": "skill", "official": false, "desc": "Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like \"reproduce this CVE\", \"build a repro for\", \"demonstrate the EchoLeak/Cursor/postmark-mcp issue\", \"show how this exploit worked\", \"add a reproducibility guide\", or", "repo": "https://github.com/Leanmcp/gateway-skills/tree/HEAD/skills/security-repro", "install": ["npx skills add Leanmcp/gateway-skills --skill security-repro"], "stars": 2125, "pushed": "2026-10-07T16:04:10Z", "license": "MIT", "plat": "security vulnerabilities", "live": "Not checked (runs locally)"}, {"id": "skill:rmyndharis/antigravity-skills/skills/malware-analyst", "name": "malware-analyst", "kind": "skill", "official": false, "desc": "Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use for malware triage, threat hunting, incident response, or security research.", "repo": "https://github.com/rmyndharis/antigravity-skills/tree/HEAD/skills/malware-analyst", "install": ["npx skills add rmyndharis/antigravity-skills --skill malware-analyst"], "stars": 2009, "pushed": "2026-11-07T15:24:20Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:0xSteph/pentest-ai", "name": "pentest-ai", "kind": "mcp", "official": null, "desc": "Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.", "repo": "https://github.com/0xSteph/pentest-ai", "install": [], "stars": 1827, "pushed": null, "license": null, "plat": "pentest-ai", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:jm33-m0/emp3r0r", "name": "emp3r0r", "kind": "mcp", "official": null, "desc": "Stealthy, Linux-first multi-operator C2 with a self-healing mesh, in-memory execution, and an AI-driven MCP assistant.", "repo": "https://github.com/jm33-m0/emp3r0r", "install": [], "stars": 1825, "pushed": null, "license": null, "plat": "c2", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:BlackSnufkin/LitterBox", "name": "LitterBox", "kind": "mcp", "official": null, "desc": "A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.", "repo": "https://github.com/BlackSnufkin/LitterBox", "install": [], "stars": 1571, "pushed": null, "license": null, "plat": "litterbox", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:LING71671/open-reverselab", "name": "open-reverselab", "kind": "mcp", "official": null, "desc": "Open-source AI reverse-engineering workspace with a desktop app, red / blue / both analysis, parallel Goals, a security knowledge base, and MCP tools for Ghidra, Frida, x64dbg and Rizin.", "repo": "https://github.com/LING71671/open-reverselab", "install": [], "stars": 1372, "pushed": null, "license": null, "plat": "ghidra", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:ASCIT31/Dark-Moon", "name": "Dark-Moon", "kind": "mcp", "official": null, "desc": "Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.", "repo": "https://github.com/ASCIT31/Dark-Moon", "install": [], "stars": 1234, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:mrwadams/stride-gpt", "name": "stride-gpt", "kind": "mcp", "official": null, "desc": "An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.", "repo": "https://github.com/mrwadams/stride-gpt", "install": [], "stars": 1156, "pushed": null, "license": null, "plat": "openai", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:FrancescoStabile/numasec", "name": "numasec", "kind": "mcp", "official": null, "desc": "The AI Agent for Cyber Security.", "repo": "https://github.com/FrancescoStabile/numasec", "install": [], "stars": 839, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/01-recon-osint", "name": "01-recon-osint", "kind": "skill", "official": false, "desc": "Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/01-recon-osint", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 01-recon-osint"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "osint", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/03-exploit-development", "name": "03-exploit-development", "kind": "skill", "official": false, "desc": "Proof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/03-exploit-development", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 03-exploit-development"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "exploit", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/04-reverse-engineering", "name": "04-reverse-engineering", "kind": "skill", "official": false, "desc": "Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/04-reverse-engineering", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 04-reverse-engineering"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "reverse engineering", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/05-malware-analysis", "name": "05-malware-analysis", "kind": "skill", "official": false, "desc": "Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/05-malware-analysis", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 05-malware-analysis"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "malware", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/06-threat-hunting", "name": "06-threat-hunting", "kind": "skill", "official": false, "desc": "IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/06-threat-hunting", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 06-threat-hunting"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "threat hunting", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/07-incident-response", "name": "07-incident-response", "kind": "skill", "official": false, "desc": "IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/07-incident-response", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 07-incident-response"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "incident response", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/08-network-security", "name": "08-network-security", "kind": "skill", "official": false, "desc": "Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/08-network-security", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 08-network-security"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "network security", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/09-web-security", "name": "09-web-security", "kind": "skill", "official": false, "desc": "OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authorized assessments", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/09-web-security", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 09-web-security"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "web security", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/10-cloud-security", "name": "10-cloud-security", "kind": "skill", "official": false, "desc": "AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/10-cloud-security", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 10-cloud-security"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "cloud security", "live": "Not checked (runs locally)"}, {"id": "skill:Masriyan/Claude-Code-CyberSecurity-Skill/skills/14-red-team-ops", "name": "14-red-team-ops", "kind": "skill", "official": false, "desc": "Authorized red team engagement planning, C2 architecture design, attack methodology, lateral movement strategy, OPSEC, and professional reporting", "repo": "https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/HEAD/skills/14-red-team-ops", "install": ["npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 14-red-team-ops"], "stars": 573, "pushed": "2026-10-20T02:54:51Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:ARCANGEL0/Mitsu", "name": "Mitsu", "kind": "mcp", "official": null, "desc": "Meet Mitsu, your chibi red-team operator. Connect your AI provider, set the scope, and she can take an authorized pentest from recon and attack-surface mapping through vulnerability discovery, > exploitation, and post-exploitation, armored with 165+ MCP-connected tools and live session intel. Guide ", "repo": "https://github.com/ARCANGEL0/Mitsu", "install": [], "stars": 539, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Vasco0x4/AIDA", "name": "AIDA", "kind": "mcp", "official": null, "desc": "Turn any LLM into an autonomous pentester. You define the scope, the agent does the work, you review the findings.", "repo": "https://github.com/Vasco0x4/AIDA", "install": [], "stars": 512, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-diagnostic-method", "name": "windbg-diagnostic-method", "kind": "skill", "official": false, "desc": "Use with every WinDbg plugin investigation to apply evidence-first reasoning, confidence calibration, contrarian review, structured reporting, and deterministic validation. Not a bug-family-specific triage skill.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-diagnostic-method", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-diagnostic-method"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-kernel-bugcheck-triage", "name": "windbg-kernel-bugcheck-triage", "kind": "skill", "official": false, "desc": "Use when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for user-mode process crashes or blaming a module from its name alone.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-kernel-bugcheck-triage", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-kernel-irp-lifecycle-triage", "name": "windbg-kernel-irp-lifecycle-triage", "kind": "skill", "official": false, "desc": "Use when kernel evidence shows stalled I/O, a power IRP, or completion/cancellation misuse; inspect request state and driver ownership. Not for interpreting an empty IRP search in a limited dump as proof of healthy I/O.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-kernel-irp-lifecycle-triage", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-kernel-irp-lifecycle-triage"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-kernel-lock-deadlock-triage", "name": "windbg-kernel-lock-deadlock-triage", "kind": "skill", "official": false, "desc": "Use when kernel threads block on driver synchronization or Verifier reports a lock-order violation; build an owner/waiter graph. Not for treating every watchdog stop as a deadlock or listing every lock type with !locks.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-kernel-lock-deadlock-triage", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-kernel-lock-deadlock-triage"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-kernel-verifier-triage", "name": "windbg-kernel-verifier-triage", "kind": "skill", "official": false, "desc": "Use when a kernel dump contains Driver Verifier violations; inspect flags, bugcheck subcodes, and available I/O shadow state. Not for Application Verifier user-mode stops or inferring a violation from enabled flags alone.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-kernel-verifier-triage", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-kernel-verifier-triage"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-user-exception-triage", "name": "windbg-user-exception-triage", "kind": "skill", "official": false, "desc": "Use when a native C/C++ app, service, or user-mode driver host (including UMDF) crashes with a structured exception in a dump or WinDbg session, including native faults inside managed processes. Not for managed .NET exceptions, WinUI/XAML app errors, or kernel bugchecks.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-user-exception-triage", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-user-exception-triage"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-user-heap-corruption-investigation", "name": "windbg-user-heap-corruption-investigation", "kind": "skill", "official": false, "desc": "Use when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds. Not for kernel pool corruption or ordinary OOM.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-user-heap-corruption-investigation", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-user-heap-corruption-investigation"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-user-mutex-held-across-co-await", "name": "windbg-user-mutex-held-across-co-await", "kind": "skill", "official": false, "desc": "Use when app, service, or user-mode driver C++ coroutine code holds a thread-affine lock across suspension and later hangs or fails. Not for all coroutine crashes or choosing lock performance.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-user-mutex-held-across-co-await", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-user-mutex-held-across-co-await"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-user-ttd-reverse-debugging-triage", "name": "windbg-user-ttd-reverse-debugging-triage", "kind": "skill", "official": false, "desc": "Use when an app, service, or user-mode driver host TTD recording is available and earlier calls, writes, or lifetimes matter. Not for kernel replay or history from a normal dump.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-user-ttd-reverse-debugging-triage", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-user-ttd-reverse-debugging-triage"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-user-virtual-memory-exhaustion", "name": "windbg-user-virtual-memory-exhaustion", "kind": "skill", "official": false, "desc": "Use when a native app, service, or user-mode driver host allocation fails; distinguish VA exhaustion, fragmentation, and commit pressure. Not for managed .NET heap growth, proving a leak from one snapshot, or corruption.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-user-virtual-memory-exhaustion", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-user-virtual-memory-exhaustion"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:microsoft/win-dev-skills/plugins/windbg/skills/windbg-user-wait-chain-analysis", "name": "windbg-user-wait-chain-analysis", "kind": "skill", "official": false, "desc": "Use when an app, service, or user-mode driver host is unresponsive on locks, COM/RPC, I/O, or another process; follow the blocker chain. Not for a crash solely from an exception stack.", "repo": "https://github.com/microsoft/win-dev-skills/tree/HEAD/plugins/windbg/skills/windbg-user-wait-chain-analysis", "install": ["npx skills add microsoft/win-dev-skills --skill windbg-user-wait-chain-analysis"], "stars": 511, "pushed": "2026-11-08T22:27:16Z", "license": "MIT", "plat": "windbg", "live": "Not checked (runs locally)"}, {"id": "skill:Eyadkelleh/awesome-skills-security/skills/security-fuzzing", "name": "security-fuzzing", "kind": "skill", "official": false, "desc": "Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.", "repo": "https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-fuzzing", "install": ["npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing"], "stars": 401, "pushed": "2026-06-08T08:31:04Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Eyadkelleh/awesome-skills-security/skills/security-payloads", "name": "security-payloads", "kind": "skill", "official": false, "desc": "Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.", "repo": "https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-payloads", "install": ["npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads"], "stars": 401, "pushed": "2026-06-08T08:31:04Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:Eyadkelleh/awesome-skills-security/skills/security-usernames", "name": "security-usernames", "kind": "skill", "official": false, "desc": "Top username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing.", "repo": "https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-usernames", "install": ["npx skills add Eyadkelleh/awesome-skills-security --skill security-usernames"], "stars": 401, "pushed": "2026-06-08T08:31:04Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:BugTraceAI/BugTraceAI", "name": "BugTraceAI", "kind": "mcp", "official": null, "desc": "Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations.", "repo": "https://github.com/BugTraceAI/BugTraceAI", "install": [], "stars": 385, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/exploit-file-download", "name": "exploit-file-download", "kind": "skill", "official": false, "desc": "任意文件下载与本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf、wget 等工具测试文件下载漏洞，支持路径遍历、伪协议利用、敏感文件读取。当用户需要测试文件下载功能、检测 LFI 漏洞、读取服务器敏感文件时使用此技能。", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/exploit-file-download", "install": ["npx skills add crazyMarky/pentest-skills --skill exploit-file-download"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/exploit-file-download/scripts", "name": "exploit-file-download", "kind": "skill", "official": false, "desc": "Arbitrary file download vulnerability detection and exploitation using path traversal techniques, bypass methods, and sensitive file discovery. Use this skill when user needs to test for file download vulnerabilities, path traversal, or read sensitive files on target systems.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/exploit-file-download/scripts", "install": ["npx skills add crazyMarky/pentest-skills --skill exploit-file-download"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/exploit-lfi", "name": "exploit-lfi", "kind": "skill", "official": false, "desc": "本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf 等工具测试 LFI 漏洞，支持路径遍历、PHP 伪协议利用、日志投毒 RCE、敏感文件读取。当用户需要检测 LFI 漏洞、利用文件包含漏洞读取服务器文件时使用此技能。", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/exploit-lfi", "install": ["npx skills add crazyMarky/pentest-skills --skill exploit-lfi"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/exploit-sqli", "name": "exploit-sqli", "kind": "skill", "official": false, "desc": "SQL injection detection and exploitation using sqlmap, manual techniques, and custom payloads. Use this skill when user needs to test for SQL injection vulnerabilities, extract database information, or exploit SQLi in parameters, headers, or cookies.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/exploit-sqli", "install": ["npx skills add crazyMarky/pentest-skills --skill exploit-sqli"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/exploit-xss", "name": "exploit-xss", "kind": "skill", "official": false, "desc": "Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use this skill when user mentions XSS, cross-site scripting, script injection, or needs to test JavaScript injection in parameters, forms, headers, or DOM sources.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/exploit-xss", "install": ["npx skills add crazyMarky/pentest-skills --skill exploit-xss"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/pentest-report", "name": "pentest-report", "kind": "skill", "official": false, "desc": "按照标准格式生成渗透测试报告，包含项目信息表、漏洞发现清单、漏洞详情（含属性表、描述、复现步骤、证据截图、修复建议）、附录（风险等级定义、CVSS说明、词汇表）。当用户要求生成渗透测试报告、安全测试报告、漏洞报告时使用此技能。严格遵循项目模板目录中的标准格式。", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/pentest-report", "install": ["npx skills add crazyMarky/pentest-skills --skill pentest-report"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "penetration testing", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/recon-dir-scan", "name": "recon-dir-scan", "kind": "skill", "official": false, "desc": "Directory and file enumeration using ffuf, gobuster, dirsearch, and feroxbuster. Use this skill when user needs to discover hidden directories, enumerate files, find backup files, or map application structure through path fuzzing.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/recon-dir-scan", "install": ["npx skills add crazyMarky/pentest-skills --skill recon-dir-scan"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/recon-fingerprint", "name": "recon-fingerprint", "kind": "skill", "official": false, "desc": "Web fingerprinting and WAF detection using wafw00f, whatweb, nuclei, and httpx. Use this skill when user needs to identify web technologies, detect WAF/CDN, analyze server headers, or fingerprint web applications and frameworks.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/recon-fingerprint", "install": ["npx skills add crazyMarky/pentest-skills --skill recon-fingerprint"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/recon-port-scan", "name": "recon-port-scan", "kind": "skill", "official": false, "desc": "Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running services, detect service versions, or fingerprint operating systems on target hosts.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/recon-port-scan", "install": ["npx skills add crazyMarky/pentest-skills --skill recon-port-scan"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "network", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/recon-subdomain", "name": "recon-subdomain", "kind": "skill", "official": false, "desc": "Subdomain enumeration and DNS reconnaissance using subfinder, amass, dnsx, and other tools. Use this skill when user needs to discover subdomains, perform DNS enumeration, gather DNS records, or find hidden subdomains of a target domain.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/recon-subdomain", "install": ["npx skills add crazyMarky/pentest-skills --skill recon-subdomain"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "dns", "live": "Not checked (runs locally)"}, {"id": "skill:crazyMarky/pentest-skills/results-storage", "name": "results-storage", "kind": "skill", "official": false, "desc": "SQLite-based persistent storage and reporting system for penetration testing results. Use this skill when user needs to store scan results, query vulnerabilities, generate reports, or manage pentest data across sessions.", "repo": "https://github.com/crazyMarky/pentest-skills/tree/HEAD/results-storage", "install": ["npx skills add crazyMarky/pentest-skills --skill results-storage"], "stars": 364, "pushed": "2026-06-04T07:18:15Z", "license": "Apache-2.0", "plat": "penetration testing", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.THORCollective/hearth", "name": "HEARTH", "kind": "mcp", "official": null, "desc": "Search community threat hunting hypotheses by keyword, threat actor, or the log sources you have.", "repo": "https://github.com/THORCollective/HEARTH", "install": ["npm:@thorcollective/hearth-mcp"], "stars": 362, "pushed": "2026-11-13T02:05:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:PatrikFehrenbach/h1-brain", "name": "h1-brain", "kind": "mcp", "official": null, "desc": "MCP server that connects AI assistants to HackerOne for bug bounty hunting", "repo": "https://github.com/PatrikFehrenbach/h1-brain", "install": [], "stars": 360, "pushed": null, "license": null, "plat": "hackerone", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/bounty-deep-hunt", "name": "bounty-deep-hunt", "kind": "skill", "official": false, "desc": "Use when bug bounty hunting on a live target, or whenever web-pentest / zero-day-hunting / red-team-web-methodology finishes and the AI is about to stop with \"nothing found\". Burmese triggers \"bounty\", \"ဆက်ရှာ\", \"လက်မလျော့နဲ့\", \"ထပ်တူး\", \"မတွေ့သေးဘူး\", \"bug ရှာမယ်\". Forces DIVERGENT thinking (not a checklist) via Cliché Purge, Artifact-Pointer Mining, Inversion Operators, Seam/Confused-Deputy mapping, and the Uniqueness Law — grounded in real 2026 Meta/Google payouts. A session ends only as FOUN", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/bounty-deep-hunt", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill bounty-deep-hunt"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "bug bounty", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/cloud-exploitation", "name": "cloud-exploitation", "kind": "skill", "official": false, "desc": "Use when \"cloud\", \"aws\", \"azure\", \"gcp\", \"iam\", \"s3\", \"bucket\", \"lambda\", \"cloudfront\", \"metadata\", \"serverless\", \"kubernetes\", \"terraform\", \"cloudshell\". Cloud infrastructure exploitation, IAM privilege escalation, storage enumeration, and serverless persistence.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/cloud-exploitation", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill cloud-exploitation"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/cve-threat-intel", "name": "cve-threat-intel", "kind": "skill", "official": false, "desc": "Use when user says \"latest CVE\", \"recent vulnerability\", \"new PoC\", \"CVE today\", \"threat intel\", \"exploit for\". Real-time CVE monitoring and PoC discovery.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/cve-threat-intel", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill cve-threat-intel"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "cve", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/opsec", "name": "opsec", "kind": "skill", "official": false, "desc": "Use as pre-validation layer BEFORE any other skill. Activates when user says any security/attack/scan command. Ensures VPN is connected, user agents rotate, fingerprint is clean, and operational environment is isolated from personal identity. This runs FIRST before any other skill executes.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/opsec", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill opsec"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "opsec", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/osint-recon", "name": "osint-recon", "kind": "skill", "official": false, "desc": "Use when user says \"ရှာ\", \"osint\", \"recon\", \"investigate\", \"research\", \"target\", \"ခြေရာခံ\", \"information gathering\", \"passive recon\", \"footprint\". Performs nation-level OSINT including passive recon, WHOIS history, DNS archaeology, employee enumeration, technology profiling, and social media mapping WITHOUT touching the target.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/osint-recon", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill osint-recon"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "osint", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/real-registration", "name": "real-registration", "kind": "skill", "official": false, "desc": "Use when user says \"register\", \"sign up\", \"create account\", \"အကောင့်ဖွင့်\", \"ဖွင့်လိုက်\", \"အကောင့်လုပ်\", \"ဖောက်\". Creates accounts with perfect attribution cover - matching cover country names, locale-aware behavior, human-like typing/mouse patterns, and consistent backstory across all created profiles.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/real-registration", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill real-registration"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "real registration", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/red-team-web-methodology", "name": "red-team-web-methodology", "kind": "skill", "official": false, "desc": "Use when user says \"red team\", \"full pentest\", \"web pentest\", \"find vulnerabilities\", \"security assessment\", \"attack chain\". Professional web app red team methodology combining recon, manual testing, and business logic exploitation.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/red-team-web-methodology", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill red-team-web-methodology"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "red team", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/web-pentest", "name": "web-pentest", "kind": "skill", "official": false, "desc": "Use when user says \"စစ်လိုက်\", \"စစ်ဆေး\", \"pentest\", \"security check\", \"vuln scan\", \"vulnerability test\", \"hack\", \"break into\", \"ရှာ\", \"ဖောက်\". Activates elite-level web penetration testing with exploit chaining, business logic auditing, and PoC verification. NEVER say \"bug found\" without verified PoC.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/web-pentest", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill web-pentest"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/web-pentest-setup", "name": "web-pentest-setup", "kind": "skill", "official": false, "desc": "Environment-aware Web Security & Pentest setup skill. Detects OS (Windows/WSL/Kali), checks installed pentest tools in PATH and ~/go/bin, skips existing ones, and avoids re-running setup if all tools are verified.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/web-pentest-setup", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill web-pentest-setup"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/web3-security", "name": "web3-security", "kind": "skill", "official": false, "desc": "Use when user says \"web3 စစ်\", \"contract စစ်\", \"defi ဖောက်\", \"solidity စစ်\", \"web3 hack\", \"smart contract vulnerability\". Hunts million-dollar bugs in smart contracts - reentrancy, oracle manipulation, access control bypass, flashloan exploits. Writes working PoCs, chains exploits, maximizes impact. Zero theory - pure attack.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/web3-security", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill web3-security"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:mrhlaingbwardev/agentic-hacking-skills/skills/zero-day-hunting", "name": "zero-day-hunting", "kind": "skill", "official": false, "desc": "Use when user says \"zero-day\", \"0day\", \"find vulnerability\", \"vuln research\", \"bug hunting\", \"CVE research\". Deep manual vulnerability research and unknown-flaw discovery methodology.", "repo": "https://github.com/mrhlaingbwardev/agentic-hacking-skills/tree/HEAD/skills/zero-day-hunting", "install": ["npx skills add mrhlaingbwardev/agentic-hacking-skills --skill zero-day-hunting"], "stars": 330, "pushed": "2026-11-01T06:16:19Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:tsale/awesome-dfir-skills/skills/analysis/admiralty-system-tr", "name": "admiralty-system", "kind": "skill", "official": false, "desc": "Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. Use this skill whenever you need to evaluate a CTI report, breach claim, dark web forum post, threat actor advertisement, vendor blog, social media intel claim, leaked database listing, or any source plus information pair where trust matters. Trigger phrases include \"assess this source\", \"rate this report\", \"is this breach real\", \"evaluate c", "repo": "https://github.com/tsale/awesome-dfir-skills/tree/HEAD/skills/analysis/admiralty-system-tr", "install": ["npx skills add tsale/awesome-dfir-skills --skill admiralty-system"], "stars": 325, "pushed": "2026-05-14T03:17:58Z", "license": "Apache-2.0", "plat": "威胁情报分析", "live": "Not checked (runs locally)"}, {"id": "skill:tsale/awesome-dfir-skills/skills/analysis/analysing-attack-skill", "name": "analysing-attack", "kind": "skill", "official": false, "desc": "Analyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of threat detections, threat models, security risks or cyber threat intelligence", "repo": "https://github.com/tsale/awesome-dfir-skills/tree/HEAD/skills/analysis/analysing-attack-skill", "install": ["npx skills add tsale/awesome-dfir-skills --skill analysing-attack"], "stars": 325, "pushed": "2026-05-14T03:17:58Z", "license": "Apache-2.0", "plat": "攻击技术分析", "live": "Not checked (runs locally)"}, {"id": "skill:tsale/awesome-dfir-skills/skills/analysis/malware-analysis-tr", "name": "malware-analysis", "kind": "skill", "official": false, "desc": "Professional malware analysis workflow for PE executables and suspicious files. Triggers on file uploads with requests like \"analyze this malware\", \"analyze this sample\", \"what does this executable do\", \"check this file for malware\", or any request to examine suspicious files. Performs static analysis, threat intelligence triage, behavioral inference, and produces analyst-grade reports with reasoned conclusions.", "repo": "https://github.com/tsale/awesome-dfir-skills/tree/HEAD/skills/analysis/malware-analysis-tr", "install": ["npx skills add tsale/awesome-dfir-skills --skill malware-analysis"], "stars": 325, "pushed": "2026-05-14T03:17:58Z", "license": "Apache-2.0", "plat": "恶意软件分析", "live": "Not checked (runs locally)"}, {"id": "skill:tsale/awesome-dfir-skills/skills/analysis/threat-actor-profiling", "name": "threat-actor-profiling", "kind": "skill", "official": false, "desc": "Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map TTPs to MITRE ATT&CK for a specific group, or produce any intelligence deliverable about a threat actor. Also trigger when the user mentions threat actor names (e.g. APT29, Lazarus, FIN7), asks about victimology, modus operandi, or wants to ", "repo": "https://github.com/tsale/awesome-dfir-skills/tree/HEAD/skills/analysis/threat-actor-profiling", "install": ["npx skills add tsale/awesome-dfir-skills --skill threat-actor-profiling"], "stars": 325, "pushed": "2026-05-14T03:17:58Z", "license": "Apache-2.0", "plat": "威胁行为者分析", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:ethiack/ai4eh", "name": "ai4eh", "kind": "mcp", "official": null, "desc": "AI for Ethical Hacking - Workshop", "repo": "https://github.com/ethiack/ai4eh", "install": [], "stars": 303, "pushed": null, "license": null, "plat": "ethical hacking", "live": "Not checked (runs locally)"}, {"id": "skill:Arenbai/SecSkills", "name": "secskills", "kind": "skill", "official": false, "desc": "渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。 已剔除无危害噪音项（明文传输/CORS/响应头缺失等），只报告有实际危害证据的漏洞。 当用户给出具体目标 (IP/域名/URL) 且意图是攻击/利用/拿权限时触发。 不触发: 概念讨论、蓝队防御、代码审计、CVE文档查询。", "repo": "https://github.com/Arenbai/SecSkills", "install": ["npx skills add Arenbai/SecSkills --skill secskills"], "stars": 265, "pushed": "2026-09-29T07:26:52Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:securityfortech/secops-mcp", "name": "secops-mcp", "kind": "mcp", "official": null, "desc": "All-in-one security testing toolbox that brings together popular open source tools through a single MCP interface. Connected to an AI agent, it enables tasks like pentesting, bug bounty hunting, threat hunting, and more.", "repo": "https://github.com/securityfortech/secops-mcp", "install": [], "stars": 219, "pushed": null, "license": null, "plat": "ai agent", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/acl-abuse", "name": "acl-abuse", "kind": "skill", "official": false, "desc": "Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, and replication rights via DS-Replication-Get-Changes-All). Use when BloodHound CE shows an outbound control edge from a principal you own toward a higher-value object, and you want the exact bloodyAD/impacket command to weaponize that ACE, plus detection and remediation. DCSync is covered here strictly as a post-com", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/acl-abuse", "install": ["npx skills add ADScanPro/Claude-AD --skill acl-abuse"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/ad-environment-constraints", "name": "ad-environment-constraints", "kind": "skill", "official": false, "desc": "Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object paging, and VPN latency. Use this whenever a bind, TGT request, LDAP query, or SMB ", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/ad-environment-constraints", "install": ["npx skills add ADScanPro/Claude-AD --skill ad-environment-constraints"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/ad-methodology", "name": "ad-methodology", "kind": "skill", "official": false, "desc": "The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning or driving an AD assessment and need to know what to run before what and why (map before you exploit; harvest easy credentials before spraying to avoid lockouts; collect the graph before you reason about paths). Covers phase sequencing with standard tooling: netexec/nxc, impacket, certipy, bloodyAD, kerbrute, BloodHound CE. Invoke it at the start ", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/ad-methodology", "install": ["npx skills add ADScanPro/Claude-AD --skill ad-methodology"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/ad-opsec-telemetry", "name": "ad-opsec-telemetry", "kind": "skill", "official": false, "desc": "The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and an MDI alert, DCSync produces Event 4662 with the DS-Replication-Get-Changes GUID, AS-REP roasting produces Event 4768 with no pre-auth, LSASS dumping is blocked by EDR, plus a lateral-movement telemetry table by protocol (SMB/WMI/WinRM/RDP/DCOM). Use this whenever you run or plan an offensive AD technique and need to know what noise it makes, when ", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/ad-opsec-telemetry", "install": ["npx skills add ADScanPro/Claude-AD --skill ad-opsec-telemetry"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/adcs-attacks", "name": "adcs-attacks", "kind": "skill", "official": false, "desc": "Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a Certificate Authority and you want to find vulnerable certificate templates or CA misconfigurations, request a certificate that impersonates a privileged user, and know the exact certipy command, what each ESC actually checks, the Windows Event IDs that fire, and the remediation. ESC1 and ESC8 are the two you hit most in the field.", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/adcs-attacks", "install": ["npx skills add ADScanPro/Claude-AD --skill adcs-attacks"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/coercion-ntlm-relay", "name": "coercion-ntlm-relay", "kind": "skill", "official": false, "desc": "Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/coercion-ntlm-relay", "install": ["npx skills add ADScanPro/Claude-AD --skill coercion-ntlm-relay"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/compliance-mapping", "name": "compliance-mapping", "kind": "skill", "official": false, "desc": "A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication and logging, so it brushes ENS op.acc.5 / op.exp.8, NIS2 Art.21(2)(h), DORA RTS Art.9 / Art.21. Use this when a reader wants to understand which regulatory control an AD finding relates to, or to add an orientation note to a technical finding. This is a conceptual, orientative mapping only; it is NOT an auditor-defensible, curated, ID-by-ID contro", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/compliance-mapping", "install": ["npx skills add ADScanPro/Claude-AD --skill compliance-mapping"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:ADScanPro/Claude-AD/skills/kerberos-attacks", "name": "kerberos-attacks", "kind": "skill", "official": false, "desc": "Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstrained, constrained/S4U, RBCD). Use when the target has SPN-bearing service accounts, accounts without pre-authentication, or delegation configured on computer/user objects, and you want the exact impacket/Rubeus/bloodyAD command, the hash format and hashcat mode, the Windows Event IDs that fire, and the remediation to write up.", "repo": "https://github.com/ADScanPro/Claude-AD/tree/HEAD/skills/kerberos-attacks", "install": ["npx skills add ADScanPro/Claude-AD --skill kerberos-attacks"], "stars": 216, "pushed": "2026-08-24T18:14:38Z", "license": "MIT", "plat": "active directory", "live": "Not checked (runs locally)"}, {"id": "skill:bluechips-zhao/av-evasion-skills", "name": "ai-av-evasion-optimized", "kind": "skill", "official": false, "desc": "使用AI生成免杀Loader和处理Shellcode，结合Indirect Syscall、ETW补丁、Module Stomping、字符串加密、IPv4混淆等免杀技术绕过主流杀软和EDR检测", "repo": "https://github.com/bluechips-zhao/av-evasion-skills", "install": ["npx skills add bluechips-zhao/av-evasion-skills --skill ai-av-evasion-optimized"], "stars": 211, "pushed": "2026-09-27T14:23:24Z", "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.w0h1v/shodan", "name": "io.github.w0h1v/shodan", "kind": "mcp", "official": null, "desc": "MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries.", "repo": "https://github.com/w0h1v/mcp-shodan", "install": ["npm:@burtthecoder/mcp-shodan"], "stars": 191, "pushed": "2026-11-12T23:58:56Z", "license": "MIT", "plat": "shodan", "live": "Not checked (runs locally)"}, {"id": "skill:wiz-sec-public/SITF/.claude/skills/attack-flow", "name": "attack-flow", "kind": "skill", "official": false, "desc": "Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports. Use when analyzing supply chain attacks, breaches, or security incidents.", "repo": "https://github.com/wiz-sec-public/SITF/tree/HEAD/.claude/skills/attack-flow", "install": ["npx skills add wiz-sec-public/SITF --skill attack-flow"], "stars": 185, "pushed": "2026-11-02T15:12:44Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wiz-sec-public/SITF/.claude/skills/red-team-flow", "name": "red-team-flow", "kind": "skill", "official": false, "desc": "Generate SITF-compliant attack flow JSON from red team or pentest reports. Accepts report files, URLs, or pasted findings. Use when documenting offensive security engagements.", "repo": "https://github.com/wiz-sec-public/SITF/tree/HEAD/.claude/skills/red-team-flow", "install": ["npx skills add wiz-sec-public/SITF --skill red-team-flow"], "stars": 185, "pushed": "2026-11-02T15:12:44Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:wiz-sec-public/SITF/.claude/skills/technique-proposal", "name": "technique-proposal", "kind": "skill", "official": false, "desc": "Generate a PR-ready technique proposal when an attack step doesn't map to existing SITF techniques. Use after /attack-flow identifies technique gaps.", "repo": "https://github.com/wiz-sec-public/SITF/tree/HEAD/.claude/skills/technique-proposal", "install": ["npx skills add wiz-sec-public/SITF --skill technique-proposal"], "stars": 185, "pushed": "2026-11-02T15:12:44Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-ai-tools", "name": "web3-ai-tools", "kind": "skill", "official": false, "desc": "AI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discovery.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-ai-tools", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-ai-tools"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-bug-classes", "name": "web3-bug-classes", "kind": "skill", "official": false, "desc": "Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrade bugs.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-bug-classes", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-bug-classes"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-case-study-role-misconfig", "name": "web3-case-study-role-misconfig", "kind": "skill", "official": false, "desc": "Case study - role misconfiguration bug class applied to a yield aggregator protocol. Use as a template for applying all 10 bug classes to a single target.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-case-study-role-misconfig", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-case-study-role-misconfig"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-grep-arsenal", "name": "web3-grep-arsenal", "kind": "skill", "official": false, "desc": "Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability classes.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-grep-arsenal", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-grep-arsenal"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation", "name": "web3-hunt-foundation", "kind": "skill", "official": false, "desc": "Hunter mindset, recon setup, and target scoring for Web3 bug bounty. Use at the START of any new protocol hunt - scoring targets, setting up environment, understanding architecture.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-hunt-foundation", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-hunt-foundation"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-zksync-era", "name": "web3-hunt-zksync-era", "kind": "skill", "official": false, "desc": "ZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, which patterns block all 10 bug classes, and when to abandon a target. Contains architecture breakdown, 25 tested attack vectors, and pre-dive scoring refinements for large L1 bridge protocols.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-hunt-zksync-era", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-hunt-zksync-era"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-methodology-research", "name": "web3-methodology-research", "kind": "skill", "official": false, "desc": "External research synthesis from Trail of Bits, SlowMist, ConsenSys, Immunefi, and Cyfrin. Use this for advanced audit methodology, Echidna/Medusa fuzzing setup, Slither custom detector writing, attack pattern deep dives, or the 4-phase learning roadmap.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-methodology-research", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-methodology-research"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-poc-foundry", "name": "web3-poc-foundry", "kind": "skill", "official": false, "desc": "Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting up a fork test, using Foundry cheatcodes, or reproducing a known DeFi hack for learning.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-poc-foundry", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-poc-foundry"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-start-here", "name": "web3-start-here", "kind": "skill", "official": false, "desc": "Master index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-start-here", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-start-here"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "skill:awarexone/web3-bug-bounty-hunting-ai-skills/web3-triage-report", "name": "web3-triage-report", "kind": "skill", "official": false, "desc": "Bug triage validation system, Immunefi report format, and 20 real paid bounty examples dissected. Use this when validating a finding before submitting, writing an Immunefi report, checking if a bug is actually valid, or studying real examples of paid vulnerabilities.", "repo": "https://github.com/awarexone/web3-bug-bounty-hunting-ai-skills/tree/HEAD/web3-triage-report", "install": ["npx skills add awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-triage-report"], "stars": 185, "pushed": "2026-09-21T12:14:57Z", "license": "MIT", "plat": "web3", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Tcotl/AgentCapture", "name": "AgentCapture", "kind": "mcp", "official": null, "desc": "Deception-layer honeypot that captures & reverse-controls AI pentest agents — embedded decoys, prompt-injection counter-offense, MCP honeypot, conversational C2. ", "repo": "https://github.com/Tcotl/AgentCapture", "install": [], "stars": 177, "pushed": null, "license": null, "plat": "agentcapture", "live": "Not checked (runs locally)"}, {"id": "skill:Fausto-404/ai-mobile-reverse-skills/ai-mobile-reverse-skills", "name": "ai-mobile-reverse-skills", "kind": "skill", "official": false, "desc": "面向授权移动安全分析的 6 阶段总控 Skill，负责 Android 静态侦察、流量与代码对齐、JNI/SO 分析、风险筛查、最小验证设计和报告交付。用户提供反编译目录、Jadx/Burp/Yakit/IDA/Ghidra 材料，或前序阶段产物时使用。", "repo": "https://github.com/Fausto-404/ai-mobile-reverse-skills/tree/HEAD/ai-mobile-reverse-skills", "install": ["npx skills add Fausto-404/ai-mobile-reverse-skills --skill ai-mobile-reverse-skills"], "stars": 177, "pushed": "2026-08-14T15:43:12Z", "license": "MIT", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:CommonHuman-Lab/nyxstrike", "name": "nyxstrike", "kind": "mcp", "official": null, "desc": "AI Powered penetration testing Platform for offensive security research", "repo": "https://github.com/CommonHuman-Lab/nyxstrike", "install": [], "stars": 158, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/ai-agent", "name": "ai-agent", "kind": "skill", "official": false, "desc": "AI/LLM/Agent 安全专项。当目标是 Chatbot/RAG/AI 助手、AI 应用平台、在线代码执行沙箱、云端 Agent 沙箱/工具执行/网关时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/ai-agent", "install": ["npx skills add zhaji2333/CkSKILLS --skill ai-agent"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/binary-re", "name": "binary-re", "kind": "skill", "official": false, "desc": "二进制/固件/ELF/PE/内存破坏逆向专项。当目标是 PE/ELF/SO/固件可执行文件、Windows 服务、TCP 二进制服务、需要逆向协议或挖内存破坏漏洞时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/binary-re", "install": ["npx skills add zhaji2333/CkSKILLS --skill binary-re"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/ck-router", "name": "ck-router", "kind": "skill", "official": false, "desc": "安全测试/漏洞挖掘总入口与路由技能。凡涉及授权渗透测试、SRC、红队评估、漏洞挖掘、代码审计、二进制/移动/云/AI 安全评估任务，或需要战法索引、首枪选择、失败换层、线索板、报告规范时先调用本技能。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/ck-router", "install": ["npx skills add zhaji2333/CkSKILLS --skill ck-router"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "skill:zhaji2333/CkSKILLS/.agents/skills/mobile-app", "name": "mobile-app", "kind": "skill", "official": false, "desc": "Android/APK/小程序/移动端逆向与组件安全专项。当目标是 APK/预装应用/厂商应用/小程序，需要脱壳、逆向、组件漏洞、密钥追踪或未授权接口时调用。", "repo": "https://github.com/zhaji2333/CkSKILLS/tree/HEAD/.agents/skills/mobile-app", "install": ["npx skills add zhaji2333/CkSKILLS --skill mobile-app"], "stars": 154, "pushed": "2026-11-05T01:55:53Z", "license": "MIT", "plat": "android", "live": "Not checked (runs locally)"}, {"id": "skill:Sequester-AG/bug-bounty-triage", "name": "bug-bounty-triage", "kind": "skill", "official": false, "desc": "Bug bounty report triage, validation, and severity escalation. Use when the user provides a bug bounty report to validate, wants to check if a finding is submittable, needs to escalate severity for maximum payout, or says 'triage this', 'validate this report', 'escalate this', 'is this submittable', 'check this bounty report', 'max bounty', or 'will this get accepted'.", "repo": "https://github.com/Sequester-AG/bug-bounty-triage", "install": ["npx skills add Sequester-AG/bug-bounty-triage --skill bug-bounty-triage"], "stars": 151, "pushed": "2026-10-09T19:35:13Z", "license": "MIT", "plat": "bug-bounty-triage", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:DMontgomery40/pentest-mcp", "name": "pentest-mcp", "kind": "mcp", "official": null, "desc": "NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.", "repo": "https://github.com/DMontgomery40/pentest-mcp", "install": [], "stars": 151, "pushed": null, "license": null, "plat": "nmap", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:AppliedIR/Valhuntir", "name": "Valhuntir", "kind": "mcp", "official": null, "desc": "Valhuntir CLI — AI-augmented incident response platform", "repo": "https://github.com/AppliedIR/Valhuntir", "install": [], "stars": 150, "pushed": null, "license": null, "plat": "incident response", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:REMnux/remnux-mcp-server", "name": "remnux-mcp-server", "kind": "mcp", "official": null, "desc": "MCP server for using the REMnux malware analysis toolkit via AI assistants", "repo": "https://github.com/REMnux/remnux-mcp-server", "install": [], "stars": 142, "pushed": null, "license": null, "plat": "remnux", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:hahwul/gori", "name": "gori", "kind": "mcp", "official": null, "desc": "A fast, keyboard-driven HTTP intercepting proxy and pentesting toolkit for the terminal built for humans and AI agents alike.", "repo": "https://github.com/hahwul/gori", "install": [], "stars": 137, "pushed": null, "license": null, "plat": "terminal", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:an7ln/wmpf-mcp-bridge", "name": "wmpf-mcp-bridge", "kind": "mcp", "official": null, "desc": "ai渗透测试小程序", "repo": "https://github.com/an7ln/wmpf-mcp-bridge", "install": [], "stars": 128, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:RamKansal/pentestMCP", "name": "pentestMCP", "kind": "mcp", "official": null, "desc": "pentestMCP: AI-Powered Penetration Testing via MCP, an MCP designed for penetration testers.", "repo": "https://github.com/RamKansal/pentestMCP", "install": [], "stars": 116, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:1SHA1024/darknet-mcp-server", "name": "darknet-mcp-server", "kind": "mcp", "official": null, "desc": "66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit search, stealer logs", "repo": "https://github.com/1SHA1024/darknet-mcp-server", "install": [], "stars": 115, "pushed": null, "license": null, "plat": "dark web", "live": "Not checked (runs locally)"}, {"id": "skill:DarkNavySecurity/web3-skills/exploit-investigator", "name": "exploit-investigator", "kind": "skill", "official": false, "desc": "Use when the user provides a transaction hash (0x...) with a chain name, asks to investigate an on-chain incident or exploit, or points to an incident brief file.", "repo": "https://github.com/DarkNavySecurity/web3-skills/tree/HEAD/exploit-investigator", "install": ["npx skills add DarkNavySecurity/web3-skills --skill exploit-investigator"], "stars": 115, "pushed": "2026-07-21T11:47:17Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:7anX/AgentScan", "name": "AgentScan", "kind": "mcp", "official": null, "desc": "AI protocol scanner — discover exposed MCP servers, A2A Agent Cards, and open LLM APIs in one command. 一条命令盘点 MCP、A2A Agent Card 和 LLM 开放接口暴露面。", "repo": "https://github.com/7anX/AgentScan", "install": [], "stars": 110, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:akari-sora/synology-nas-cli", "name": "synology-nas-cli", "kind": "mcp", "official": null, "desc": "nas: a zero-dependency Python CLI + MCP server for Synology DSM 7. One-command audit and fix for the C3RB3R / .L0CK3D ransomware campaign; hand it to your AI agent. Mirror; canonical repo and issues: gitlab.com/aa22396584/synology-nas-cli", "repo": "https://github.com/akari-sora/synology-nas-cli", "install": [], "stars": 104, "pushed": null, "license": null, "plat": "synology dsm", "live": "Not checked (runs locally)"}, {"id": "mcp:gh:Chieko-Seren/ARIES", "name": "ARIES", "kind": "mcp", "official": null, "desc": "顺便一提，我们支持 RWKV | 「Intel 2025 人工智能创新大赛」🚀AutoOPS: Provide the chaos brought by language models to the operation and maintenance industry! 🏆使用 LLM 提供的动力实现全自动运维，支持 Windows Server/Linux/macOS/Cisco IOS，可进行全网自动管理，让我们颠覆运维行业【带外管理/自动运维/IoT设备管理/WebHook监控/任意平台/全模态Workflow】", "repo": "https://github.com/Chieko-Seren/ARIES", "install": [], "stars": 102, "pushed": null, "license": null, "plat": "windows server", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.w0h1v/dnstwist", "name": "io.github.w0h1v/dnstwist", "kind": "mcp", "official": null, "desc": "MCP server for dnstwist: detect typosquatting, phishing and brand impersonation domains.", "repo": "https://github.com/w0h1v/mcp-dnstwist", "install": ["npm:@burtthecoder/mcp-dnstwist"], "stars": 51, "pushed": "2026-11-04T21:14:34Z", "license": "MIT", "plat": "dnstwist", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:crowdstrike-falcon-foundry", "name": "crowdstrike-falcon-foundry", "kind": "claude-plugin", "official": null, "desc": "CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.", "repo": "https://github.com/CrowdStrike/foundry-skills.git", "install": ["claude plugin install crowdstrike-falcon-foundry@claude-plugins-official"], "stars": 38, "pushed": "2026-11-10T16:41:53Z", "license": "MIT", "plat": "crowdstrike falcon foundry", "live": "Not checked (runs locally)"}, {"id": "plugin:anthropics/claude-plugins-official:crowdstrike-falcon-fusion", "name": "crowdstrike-falcon-fusion", "kind": "claude-plugin", "official": null, "desc": "CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema validation, workflow import and release, execution monitoring, and Falcon Next-Gen SIEM lookup files.", "repo": "https://github.com/CrowdStrike/fusion-skills.git", "install": ["claude plugin install crowdstrike-falcon-fusion@claude-plugins-official"], "stars": 30, "pushed": "2026-11-10T20:47:07Z", "license": "MIT", "plat": "crowdstrike falcon fusion", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.operantlabs/operant-mcp", "name": "io.github.operantlabs/operant-mcp", "kind": "mcp", "official": null, "desc": "Security testing MCP server for penetration testing, forensics, and vulnerability assessment", "repo": "https://github.com/operantlabs/operant-mcp", "install": ["npm:operant-mcp"], "stars": 27, "pushed": "2026-04-01T03:09:17Z", "license": "MIT", "plat": "operantlabs", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.lupingQAQ/ntobjmanager-mcp", "name": "io.github.lupingQAQ/ntobjmanager-mcp", "kind": "mcp", "official": null, "desc": "Stateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager.", "repo": "https://github.com/lupingQAQ/ntobjmanager-mcp", "install": [], "stars": 16, "pushed": "2026-09-30T05:34:43Z", "license": "MIT", "plat": "ntobjectmanager", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.luongnv89/mitre-mcp", "name": "MITRE ATT&CK", "kind": "mcp", "official": null, "desc": "MCP server exposing the MITRE ATT&CK framework via the official MCP Python SDK.", "repo": "https://github.com/Montimage/mitre-mcp", "install": ["pypi:mitre-mcp"], "stars": 15, "pushed": "2026-10-30T18:45:04Z", "license": "MIT", "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.aplaceforallmystuff/mcp-threatintel", "name": "io.github.aplaceforallmystuff/mcp-threatintel", "kind": "mcp", "official": null, "desc": "Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker", "repo": "https://github.com/aplaceforallmystuff/mcp-threatintel", "install": ["npm:mcp-threatintel-server"], "stars": 11, "pushed": "2026-11-05T08:26:15Z", "license": "MIT", "plat": "threat intel", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.apxlabs-ai/niro", "name": "Niro", "kind": "mcp", "official": null, "desc": "AI pentester for PRs — finds exploitable bugs and hands your developer agent the fix.", "repo": "https://github.com/apxlabs-ai/niro", "install": ["mcpb:https://github.com/apxlabs-ai/niro/releases/download/v0.1.61/niro.mcpb"], "stars": 10, "pushed": "2026-08-25T21:54:14Z", "license": "NOASSERTION", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.AIops-tools/ot-aiops", "name": "OT AIops", "kind": "mcp", "official": null, "desc": "Governed OT tap (57 tools): OPC-UA/Modbus/S7/MC/MTConnect/MQTT/EtherNet-IP/EtherCAT.", "repo": "https://github.com/AIops-tools/OT-AIops", "install": ["pypi:ot-aiops"], "stars": 10, "pushed": "2026-11-13T03:16:38Z", "license": "MIT", "plat": "ot", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.aplaceforallmystuff/mcp-pihole", "name": "io.github.aplaceforallmystuff/mcp-pihole", "kind": "mcp", "official": null, "desc": "Pi-hole v6 MCP server - manage DNS blocking, stats, whitelists/blacklists", "repo": "https://github.com/aplaceforallmystuff/mcp-pihole", "install": ["npm:mcp-pihole-server"], "stars": 8, "pushed": "2026-08-12T20:21:09Z", "license": "MIT", "plat": "pi-hole v6", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.WYRE-AI/proofpoint-mcp", "name": "Proofpoint", "kind": "mcp", "official": null, "desc": "MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.", "repo": "https://github.com/WYRE-AI/proofpoint-mcp", "install": ["oci:ghcr.io/wyre-ai/proofpoint-mcp:v1.1.6"], "stars": 6, "pushed": "2026-11-12T16:54:37Z", "license": "Apache-2.0", "plat": "proofpoint", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.imouiche/mitre-attack-mcp-server", "name": "io.github.imouiche/mitre-attack-mcp-server", "kind": "mcp", "official": null, "desc": "MCP server providing 50+ tools for MITRE ATT&CK techniques, groups, and mitigations", "repo": "https://github.com/imouiche/complete-mitre-attack-mcp-server", "install": ["npm:@imouiche/mitre-attack-mcp-server"], "stars": 5, "pushed": "2026-10-23T20:32:51Z", "license": null, "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.John0n1/chainrpc-mcp", "name": "ChainRPC MCP", "kind": "mcp", "official": null, "desc": "Safety-first EVM and Bitcoin RPC tools for balances, contracts, blocks, and transactions", "repo": "https://github.com/John0n1/chainrpc-mcp", "install": ["npm:chainrpc-mcp", "https://chainrpc-mcp.mitander.io/mcp"], "stars": 4, "pushed": "2026-11-12T22:27:38Z", "license": "MIT", "plat": "evm and bitcoin", "live": "Not checked (runs locally)"}, {"id": "mcp:com.pentest-tools/mcp-server", "name": "com.pentest-tools/mcp-server", "kind": "mcp", "official": null, "desc": "MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.", "repo": "https://github.com/pentesttoolscom/pentesttools-pypi", "install": ["https://mcp.pentest-tools.com/mcp"], "stars": 4, "pushed": "2026-08-03T08:55:42Z", "license": "GPL-3.0", "plat": "pentest-tools.com", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:ai.smithery/alex-llm-attack-mcp-server", "name": "ai.smithery/alex-llm-attack-mcp-server", "kind": "mcp", "official": null, "desc": "Query and retrieve information about various adversarial tactics and techniques used in cyber atta…", "repo": "https://github.com/alex-llm/attAck-mcp-server", "install": ["https://server.smithery.ai/@alex-llm/attack-mcp-server/mcp"], "stars": 3, "pushed": "2025-10-01T00:50:51Z", "license": null, "plat": "", "live": "Down · HTTP 404 (checked 2026-11-13)"}, {"id": "mcp:eu.ansvar/threat-intel", "name": "Ansvar: Threat Intelligence", "kind": "mcp", "official": null, "desc": "CVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid.", "repo": "https://github.com/Ansvar-Systems/ansvar-gateway", "install": ["https://gateway.ansvar.eu/threat-intel/mcp"], "stars": 3, "pushed": "2026-07-20T11:56:18Z", "license": null, "plat": "ansvar", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.cyanheads/attack-surface-mcp-server", "name": "io.github.cyanheads/attack-surface-mcp-server", "kind": "mcp", "official": null, "desc": "Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.", "repo": "https://github.com/cyanheads/attack-surface-mcp-server", "install": ["npm:@cyanheads/attack-surface-mcp-server", "npm:@cyanheads/attack-surface-mcp-server"], "stars": 3, "pushed": "2026-11-11T12:31:15Z", "license": "Apache-2.0", "plat": "ct subdomains, dns, tls, http posture", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Jam0k/threatcluster", "name": "io.github.Jam0k/threatcluster", "kind": "mcp", "official": null, "desc": "Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.", "repo": "https://github.com/Jam0k/Threat-Intelligence-MCP", "install": ["npm:threatcluster-mcp", "https://threatcluster.io/mcp"], "stars": 3, "pushed": "2026-10-15T14:54:32Z", "license": "GPL-3.0", "plat": "threatcluster", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.1N3/sn1per-mcp", "name": "Sn1per MCP Server: pentest, recon and attack surface scanning", "kind": "mcp", "official": null, "desc": "Run scoped, authorized Sn1per pentest, recon and attack surface scans from AI agents; read findings.", "repo": "https://github.com/1N3/sn1per-mcp", "install": ["pypi:sn1per-mcp"], "stars": 3, "pushed": "2026-11-07T13:58:17Z", "license": "Apache-2.0", "plat": "sn1per", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.santhosh-005/bevigil", "name": "BeVigil OSINT", "kind": "mcp", "official": null, "desc": "Discover mobile app attack surfaces via BeVigil OSINT — hosts, subdomains, URLs, and more.", "repo": "https://github.com/santhosh-005/bevigil-mcp-server", "install": ["npm:bevigil-mcp-server"], "stars": 2, "pushed": "2026-08-24T05:09:38Z", "license": "MIT", "plat": "bevigil", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pduggusa/dugganusa-cli", "name": "DugganUSA CLI — Local STDIO MCP", "kind": "mcp", "official": null, "desc": "Local STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli.", "repo": "https://github.com/pduggusa/dugganusa-cli", "install": ["npm:dugganusa-cli"], "stars": 2, "pushed": "2026-11-09T18:39:21Z", "license": "MIT", "plat": "dugganusa", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/dns-intelligence", "name": "io.github.4hmetuyar/dns-intelligence", "kind": "mcp", "official": null, "desc": "DNS record enumeration, misconfiguration and dangling-subdomain detection", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-dns-intelligence"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.4hmetuyar/llm-redteam", "name": "io.github.4hmetuyar/llm-redteam", "kind": "mcp", "official": null, "desc": "Active jailbreak/extraction/obfuscation red-teaming for live LLM endpoints", "repo": "https://github.com/GuardBee/guardbee-mcp", "install": ["npm:@guardbee/mcp-llm-redteam"], "stars": 2, "pushed": "2026-11-12T10:18:15Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Braynexservices/nigeria-nigsac-sanctions", "name": "io.github.Braynexservices/nigeria-nigsac-sanctions", "kind": "mcp", "official": null, "desc": "Screen a name vs Nigeria's NIGSAC sanctions register. Best-effort signal, not compliance-grade.", "repo": "https://github.com/Braynexservices/nigeria-mcp", "install": ["npm:@braynexservices/nigeria-mcp-nigsac-sanctions"], "stars": 2, "pushed": "2026-10-21T19:40:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.daedalus/mcp-pwntools", "name": "io.github.daedalus/mcp-pwntools", "kind": "mcp", "official": null, "desc": "MCP server exposing pwntools 4.15.0 functionality for binary exploitation", "repo": "https://github.com/daedalus/mcp-pwntools", "install": ["pypi:mcp-pwntools"], "stars": 2, "pushed": "2026-05-03T03:21:13Z", "license": "MIT", "plat": "pwntools", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.nagameTW/mcp-server-malcolm", "name": "io.github.nagameTW/mcp-server-malcolm", "kind": "mcp", "official": null, "desc": "MCP server for Malcolm (Zeek/Suricata/Arkime/OpenSearch): threat-hunting access for AI agents", "repo": "https://github.com/nagameTW/mcp-server-malcolm", "install": ["pypi:mcp-server-malcolm"], "stars": 2, "pushed": "2026-11-01T10:58:20Z", "license": "MIT", "plat": "zeek", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.tidynest/raven-nest-mcp", "name": "io.github.tidynest/raven-nest-mcp", "kind": "mcp", "official": null, "desc": "AI-driven penetration testing - 22 security tools behind safety-hardened MCP endpoints", "repo": "https://github.com/tidynest/raven-nest-mcp", "install": ["oci:ghcr.io/tidynest/raven-nest-mcp:0.4.1"], "stars": 2, "pushed": "2026-11-03T20:54:20Z", "license": "Apache-2.0", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.w0h1v/otx", "name": "io.github.w0h1v/otx", "kind": "mcp", "official": null, "desc": "MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.", "repo": "https://github.com/w0h1v/mcp-otx", "install": ["pypi:otx-mcp"], "stars": 2, "pushed": "2026-11-09T18:07:51Z", "license": "MIT", "plat": "alienvault otx", "live": "Not checked (runs locally)"}, {"id": "mcp:io.jikida/mcp", "name": "io.jikida/mcp", "kind": "mcp", "official": null, "desc": "Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.", "repo": "https://github.com/unesLam/jikida", "install": ["npm:@jikida/mcp"], "stars": 2, "pushed": "2026-10-20T21:58:13Z", "license": "Apache-2.0", "plat": "ai security tools", "live": "Not checked (runs locally)"}, {"id": "mcp:sh.mlab/mcp", "name": "mlab.sh", "kind": "mcp", "official": null, "desc": "Threat intel and DFIR: IOCs, CVEs, actors, SBOMs, domain scans, cases, memory, Kubernetes, Proxmox.", "repo": "https://github.com/mlab-sh/mcp", "install": ["https://mlab.sh/mcp", "https://mlab.sh/mcp"], "stars": 2, "pushed": "2026-11-05T21:42:00Z", "license": "MIT", "plat": "mlab.sh", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.blackdome-ai/blackdome", "name": "BlackDome Threat Intel", "kind": "mcp", "official": null, "desc": "Live honeypot threat intel: attacker IPs, IOCs, credentials, payloads, actors.", "repo": "https://github.com/blackdome-ai/blackdome-mcp", "install": ["pypi:blackdome-mcp"], "stars": 1, "pushed": "2026-11-07T07:08:04Z", "license": "MIT", "plat": "honeypot threat intel", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.blackdome-ai/blackdome-mcp", "name": "BlackDome Threat Intel", "kind": "mcp", "official": null, "desc": "Honeypot threat intel: IOCs, sample comparisons, evidence clusters and ThreatDrop case status.", "repo": "https://github.com/blackdome-ai/blackdome-mcp", "install": ["pypi:blackdome-mcp"], "stars": 1, "pushed": "2026-11-07T07:08:04Z", "license": "MIT", "plat": "honeypot threat intel", "live": "Not checked (runs locally)"}, {"id": "mcp:com.dechonet/mcp", "name": "com.dechonet/mcp", "kind": "mcp", "official": null, "desc": "34 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.", "repo": "https://github.com/node-man/dechonet-mcp", "install": ["npm:dechonet-mcp", "https://dechonet.com/mcp"], "stars": 1, "pushed": "2026-11-06T03:54:10Z", "license": null, "plat": "dechonet", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wyre-technology/huntress-mcp", "name": "Huntress", "kind": "mcp", "official": null, "desc": "MCP server for Huntress — accounts, organizations, agents, incidents, and reports.", "repo": "https://github.com/wyre-technology/huntress-mcp", "install": ["oci:ghcr.io/wyre-technology/huntress-mcp:v1.2.19"], "stars": 1, "pushed": "2026-11-12T16:55:13Z", "license": "NOASSERTION", "plat": "huntress", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.cyanheads/pentest-mcp-server", "name": "io.github.cyanheads/pentest-mcp-server", "kind": "mcp", "official": null, "desc": "Offline methodology engine for authorized penetration testing, CTF, and security research.", "repo": "https://github.com/cyanheads/pentest-mcp-server", "install": ["npm:@cyanheads/pentest-mcp-server", "npm:@cyanheads/pentest-mcp-server", "https://pentest.caseyjhand.com/mcp"], "stars": 1, "pushed": "2026-10-30T09:22:51Z", "license": "Apache-2.0", "plat": "pentest", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.daedalus/mcp-pcapy-ng", "name": "io.github.daedalus/mcp-pcapy-ng", "kind": "mcp", "official": null, "desc": "MCP server exposing pcapy-ng packet capture functionality", "repo": "https://github.com/daedalus/mcp-pcapy-ng", "install": ["pypi:mcp-pcapy-ng"], "stars": 1, "pushed": "2026-04-21T19:27:31Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.daedalus/mcp-pymetasploit3", "name": "io.github.daedalus/mcp-pymetasploit3", "kind": "mcp", "official": null, "desc": "MCP server for Metasploit Framework via pymetasploit3", "repo": "https://github.com/daedalus/mcp-pymetasploit3", "install": ["pypi:mcp-pymetasploit3"], "stars": 1, "pushed": "2026-06-23T20:35:08Z", "license": "MIT", "plat": "metasploit", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.daedalus/mcp-recon-ng", "name": "io.github.daedalus/mcp-recon-ng", "kind": "mcp", "official": null, "desc": "MCP server exposing full recon-ng OSINT framework functionality", "repo": "https://github.com/daedalus/mcp-recon-ng", "install": ["pypi:mcp-recon-ng"], "stars": 1, "pushed": "2026-04-21T19:28:02Z", "license": "MIT", "plat": "recon-ng", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.daedalus/mcp_reverse_engineering", "name": "io.github.daedalus/mcp_reverse_engineering", "kind": "mcp", "official": null, "desc": "A sandboxed MCP tool for reverse engineering with multiple tool integrations", "repo": "https://github.com/daedalus/mcp_reverse_engineering", "install": ["pypi:mcp_reverse_engineering"], "stars": 1, "pushed": "2026-05-03T03:46:39Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.rascal-3/chainanalyzer-mcp", "name": "io.github.rascal-3/chainanalyzer-mcp", "kind": "mcp", "official": null, "desc": "Blockchain AML for AI agents: risk scoring, sanctions, tx & bridge tracing across 12 chains.", "repo": "https://github.com/rascal-3/chainanalyzer-mcp", "install": ["npm:chainanalyzer-mcp"], "stars": 1, "pushed": "2026-11-12T14:31:08Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Toraastrta/sphior-ai-governance-mcp", "name": "io.github.Toraastrta/sphior-ai-governance-mcp", "kind": "mcp", "official": null, "desc": "Record what your AI did as tamper-evident evidence for ISO 42001, EU AI Act and SOC 2. Hash-only.", "repo": "https://github.com/Toraastrta/sphior-code", "install": ["npm:sphior-ai-governance-mcp"], "stars": 1, "pushed": "2026-11-12T00:26:34Z", "license": "MIT", "plat": "iso 42001", "live": "Not checked (runs locally)"}, {"id": "mcp:com.ismalicious/mcp-server", "name": "isMalicious threat intelligence for AI agents", "kind": "mcp", "official": null, "desc": "Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans", "repo": "https://github.com/hexablob/ismalicious-mcp-server", "install": ["npm:@ismalicious/mcp-server", "https://api.ismalicious.com/mcp"], "stars": 1, "pushed": "2026-10-23T15:22:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:ca.ohey/ohey", "name": "Ohey", "kind": "mcp", "official": null, "desc": "Look up hosts in the Ohey web malware feed, read CVEs and scan URLs with Ohey's scanner.", "repo": "https://github.com/Oheyresearch/ohey-mcp", "install": ["https://ohey.ca/mcp"], "stars": 1, "pushed": "2026-11-04T18:47:26Z", "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:ca.ohey/research", "name": "Ohey research", "kind": "mcp", "official": null, "desc": "Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.", "repo": "https://github.com/Oheyresearch/ohey-mcp", "install": ["https://ohey.ca/mcp/research"], "stars": 1, "pushed": "2026-11-04T18:47:26Z", "license": null, "plat": "", "live": "Live · 1228 ms · 8 tools · free to try: `list_threats` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.0xDanielLopez/phishunt", "name": "Phishunt", "kind": "mcp", "official": null, "desc": "Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.", "repo": "https://github.com/0xDanielLopez/phishunt-mcp", "install": ["https://mcp.phishunt.io/"], "stars": 1, "pushed": "2026-11-06T13:17:08Z", "license": "MIT", "plat": "", "live": "Live · 2780 ms · 11 tools · free to try: `get_cert_metadata` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/alienvault-otx", "name": "Alienvault Otx", "kind": "mcp", "official": null, "desc": "AlienVault OTX MCP — Open Threat Exchange (free with key)", "repo": "https://github.com/pipeworx-io/mcp-alienvault-otx", "install": ["npm:@pipeworx/mcp-alienvault-otx", "https://gateway.pipeworx.io/alienvault-otx/mcp"], "stars": 0, "pushed": "2026-11-09T13:25:46Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.SSJCorpSec/apex-disclosure-test-968cf160", "name": "APEX disclosure test (temporary, will be deleted)", "kind": "mcp", "official": null, "desc": "Temporary authorized security research probe. Safe to ignore. Will be removed shortly.", "repo": "https://github.com/MrW0r57/apex-mcp-disclosure-canary-968cf160", "install": ["https://example.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issue (checked 2026-11-13)"}, {"id": "mcp:app.bewary/bewary", "name": "Bewary: scam, phishing and fraud detection", "kind": "mcp", "official": null, "desc": "Threat intelligence for AI agents: checks URLs, domains, phones, emails, wallets and IBANs for scams", "repo": "https://github.com/bewary-app/bewary", "install": ["https://api.bewary.app/mcp"], "stars": 0, "pushed": "2026-11-05T16:10:22Z", "license": "MIT", "plat": "threat intelligence", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.blueteamjobs/jobs", "name": "BlueTeamJobs", "kind": "mcp", "official": null, "desc": "Search open defensive cybersecurity (blue team) jobs and salary data. Read-only, no sign-in.", "repo": null, "install": ["https://mcp.blueteamjobs.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cybersecurity", "live": "Live · 1552 ms · 6 tools · free to try: `search_jobs` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.AnshumanAtrey/bug-bounty-finder", "name": "Bug Bounty Finder - HackerOne + Bugcrowd + security.txt", "kind": "mcp", "official": null, "desc": "Bug Bounty Programs - HackerOne + Bugcrowd Lookup | Bulk", "repo": "https://github.com/AnshumanAtrey/bug-bounty-finder", "install": ["https://mcp.apify.com/?tools=anshumanatrey/bug-bounty-finder"], "stars": 0, "pushed": "2026-11-12T04:52:26Z", "license": "MIT", "plat": "hackerone", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/bug-bounty-programs", "name": "Bug Bounty Programs", "kind": "mcp", "official": null, "desc": "bug-bounty-programs", "repo": "https://github.com/pipeworx-io/mcp-bug-bounty-programs", "install": ["npm:@pipeworx/mcp-bug-bounty-programs", "https://gateway.pipeworx.io/bug-bounty-programs/mcp"], "stars": 0, "pushed": "2026-11-09T13:37:29Z", "license": "MIT", "plat": "bug bounty programs", "live": "Not checked (runs locally)"}, {"id": "mcp:com.threadlinqs/intelthreadlinqs-mcp", "name": "com.threadlinqs/intelthreadlinqs-mcp", "kind": "mcp", "official": null, "desc": "Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs", "repo": "https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp", "install": ["npm:intelthreadlinqs-mcp"], "stars": 0, "pushed": "2026-08-23T21:21:55Z", "license": "MIT", "plat": "com.threadlinqs/intelthreadlinqs-mcp", "live": "Not checked (runs locally)"}, {"id": "mcp:com.controldrill/mcp", "name": "ControlDrill", "kind": "mcp", "official": null, "desc": "List, schedule, and retrieve evidence for ControlDrill incident-response tabletop exercises.", "repo": null, "install": ["https://mcp.controldrill.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.cyberlibrary/library", "name": "Cyber Library", "kind": "mcp", "official": null, "desc": "Search and read Cyber Library, a free structured cybersecurity knowledge base. Read-only, no auth.", "repo": null, "install": ["https://www.cyberlibrary.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1257 ms · 6 tools · free to try: `search_library` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.ASCIT31/darkmoon-mcp-server", "name": "Darkmoon", "kind": "mcp", "official": null, "desc": "Drive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings.", "repo": "https://github.com/ASCIT31/darkmoon-mcp-server", "install": ["npm:@darkmoon_ai/mcp-server"], "stars": 0, "pushed": "2026-11-02T09:59:20Z", "license": "GPL-3.0", "plat": "darkmoon pro", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Reztek-creator/data-agent-foundry", "name": "DATA/AGENT FOUNDRY", "kind": "mcp", "official": null, "desc": "Free catalogue; paid historical software/security evidence. No current-risk assessment.", "repo": null, "install": ["https://foundry-api-production-95ae.up.railway.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 610 ms · 4 tools (checked 2026-11-13)"}, {"id": "mcp:ai.deltabridge/deltabridge", "name": "Deltabridge Threat Intelligence", "kind": "mcp", "official": null, "desc": "Cyber threat intelligence: threat actors, malware, CVEs, IOCs, ATT&CK and analyst briefs.", "repo": null, "install": ["https://mcp.deltabridge.ai"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.kwb-commits/diopter-ai", "name": "Diopter AI", "kind": "mcp", "official": null, "desc": "Real-time detection of deepfakes, voice cloning and AI social engineering on live calls.", "repo": null, "install": ["https://diopter.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:com.ransomware-tracker.api/dragonseye", "name": "Dragons Eye Ransomware Claims", "kind": "mcp", "official": null, "desc": "Ransomware claim lookups, IOC and CVE intel, group intel, bulk checks and watch alerts (x402 USDC).", "repo": null, "install": ["https://api.ransomware-tracker.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2247 ms · 16 tools · free to try: `indicator_check` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/redteam", "name": "Eclipse Redteam MCP", "kind": "mcp", "official": null, "desc": "Adversarial simulation for AI agents — sandboxed twins only.", "repo": null, "install": [], "stars": null, "pushed": null, "license": null, "plat": "ai agents", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/epss", "name": "Epss", "kind": "mcp", "official": null, "desc": "FIRST.org EPSS (Exploit Prediction Scoring System) MCP.", "repo": "https://github.com/pipeworx-io/mcp-epss", "install": ["npm:@pipeworx/mcp-epss", "https://gateway.pipeworx.io/epss/mcp"], "stars": 0, "pushed": "2026-11-09T13:56:59Z", "license": "MIT", "plat": "first.org epss", "live": "Not checked (runs locally)"}, {"id": "mcp:org.evebrief.oracle/risk-check", "name": "EveBrief Risk Oracle (ERO)", "kind": "mcp", "official": null, "desc": "EVM token and wallet risk check: rug pulls, rug factories, fake tokens, contract flags. Via x402.", "repo": null, "install": ["https://oracle.evebrief.org/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1571 ms · 3 tools · free to try: `get_methodology` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.EyalSec/eyalsec-mcp", "name": "EyalSec", "kind": "mcp", "official": null, "desc": "Read your EyalSec security events, machines, runs and rules from an AI assistant.", "repo": "https://github.com/EyalSec/eyalsec-mcp", "install": ["pypi:eyalsec-mcp"], "stars": 0, "pushed": "2026-11-12T08:08:26Z", "license": "MIT", "plat": "eyalsec", "live": "Not checked (runs locally)"}, {"id": "mcp:com.fet112/fet112", "name": "FET112", "kind": "mcp", "official": null, "desc": "Security intelligence for AI agents monitoring Ethereum before actions.", "repo": null, "install": ["https://www.fet112.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ethereum", "live": "Down · HTTP 502 (checked 2026-11-13)"}, {"id": "mcp:com.flockward/flockward", "name": "Flockward", "kind": "mcp", "official": null, "desc": "Free safety checks for AI agents: links, sites, MCP servers, and pages read with traps removed.", "repo": null, "install": ["https://flockward.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2468 ms · 10 tools · free to try: `check_site` answered without a key (checked 2026-11-14)"}, {"id": "mcp:io.github.dalisecurity/fray", "name": "Fray — WAF Security Testing MCP Server", "kind": "mcp", "official": null, "desc": "WAF security testing: 5,500+ payloads, 25 WAF fingerprints, 21 recon checks, bypass AI", "repo": "https://github.com/dalisecurity/fray", "install": ["pypi:fray"], "stars": null, "pushed": null, "license": null, "plat": "waf", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Evozim/fuzz-breaker", "name": "Fuzz-Breaker", "kind": "mcp", "official": null, "desc": "Automated API pentesting and structural fuzzing proxy.", "repo": null, "install": ["https://fuzz-breaker-mcp.vercel.app/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 500 ms · 1 tools (checked 2026-11-13)"}, {"id": "mcp:ai.kwekuanansi/scam-check", "name": "Ghana Scam Check", "kind": "mcp", "official": null, "desc": "Compares a message with fraud patterns reported in Ghana and says where to report.", "repo": null, "install": ["https://kwekuanansi.ai/mcp/scam-check"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 4449 ms · 3 tools · free to try: `scams.list_patterns` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/hackertarget", "name": "Hackertarget", "kind": "mcp", "official": null, "desc": "HackerTarget MCP.", "repo": "https://github.com/pipeworx-io/mcp-hackertarget", "install": ["npm:@pipeworx/mcp-hackertarget", "https://gateway.pipeworx.io/hackertarget/mcp"], "stars": 0, "pushed": "2026-11-09T14:06:39Z", "license": "MIT", "plat": "hackertarget", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/hibp", "name": "Hibp", "kind": "mcp", "official": null, "desc": "Have I Been Pwned MCP", "repo": "https://github.com/pipeworx-io/mcp-hibp", "install": ["npm:@pipeworx/mcp-hibp", "https://gateway.pipeworx.io/hibp/mcp"], "stars": 0, "pushed": "2026-11-09T14:07:46Z", "license": "MIT", "plat": "have i been pwned", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.bernik-bot/ichi-mcp", "name": "ICHI — Internet Cyber Health Index", "kind": "mcp", "official": null, "desc": "Daily internet-wide cyber threat band (NORMAL-CRITICAL), numeric score, advisories, source health.", "repo": "https://github.com/bernik-bot/ichi-mcp", "install": [], "stars": 0, "pushed": "2026-11-11T16:52:15Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CloudCorpRecords/threatcheck", "name": "io.github.CloudCorpRecords/threatcheck", "kind": "mcp", "official": null, "desc": "Check URLs, indicators and CVEs against threat intelligence before you act on them.", "repo": "https://github.com/CloudCorpRecords/threatcheck", "install": ["npm:@reneturcios/threatcheck", "oci:ghcr.io/cloudcorprecords/threatcheck:0.1.0"], "stars": 0, "pushed": "2026-11-10T11:05:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.CSOAI-ORG/scam-detector-mcp", "name": "io.github.CSOAI-ORG/scam-detector-mcp", "kind": "mcp", "official": null, "desc": "Scam Detector MCP Server by MEOK AI Labs", "repo": "https://github.com/CSOAI-ORG/scam-detector-mcp", "install": ["pypi:scam-detector-mcp"], "stars": 0, "pushed": "2026-10-08T04:19:51Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.daedalus/mcp-smbmap", "name": "io.github.daedalus/mcp-smbmap", "kind": "mcp", "official": null, "desc": "MCP server exposing smbmap SMB enumeration functionality", "repo": "https://github.com/daedalus/mcp-smbmap", "install": ["pypi:mcp-smbmap"], "stars": 0, "pushed": "2026-04-21T19:28:54Z", "license": "MIT", "plat": "smbmap", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.forgemeshlabs/anomaly-mcp", "name": "io.github.forgemeshlabs/anomaly-mcp", "kind": "mcp", "official": null, "desc": "Real-time anomaly detection for blockchain, aviation, GitHub, mempool, and depeg signals.", "repo": "https://github.com/forgemeshlabs/anomaly-mcp", "install": ["npm:@forgemeshlabs/anomaly-mcp"], "stars": 0, "pushed": "2026-11-13T13:53:28Z", "license": "MIT", "plat": "github", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.integsec/turbopentest", "name": "io.github.integsec/turbopentest", "kind": "mcp", "official": null, "desc": "AI-powered penetration testing. Launch scans, review findings, download reports.", "repo": "https://github.com/integsec/turbopentest-mcp", "install": ["npm:@turbopentest/mcp-server"], "stars": 0, "pushed": "2026-10-21T15:34:58Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.kayembahamid/cybersim-pro", "name": "io.github.kayembahamid/cybersim-pro", "kind": "mcp", "official": null, "desc": "Cybersecurity training, simulation, and incident response MCP server", "repo": "https://github.com/kayembahamid/cybersim-pro", "install": ["oci:docker.io/hamcodes/cybersim-pro-mcp:v1.0.1"], "stars": 0, "pushed": "2025-10-01T08:39:11Z", "license": null, "plat": "cybersecurity", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.megabrainee/sectora", "name": "io.github.megabrainee/sectora", "kind": "mcp", "official": null, "desc": "Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.", "repo": "https://github.com/BraineeTech/sectora", "install": ["https://mcp.sectora.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 3854 ms · 14 tools · `list_my_scans` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.mintmas/oracle42-intelligence", "name": "io.github.mintmas/oracle42-intelligence", "kind": "mcp", "official": null, "desc": "AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.", "repo": "https://github.com/mintmas/oracle42-intelligence.git", "install": ["https://app.eno.cx.ua/mcp/"], "stars": 0, "pushed": "2026-03-19T22:25:30Z", "license": null, "plat": "oracle42-intelligence", "live": "Down · HTTP 526 (checked 2026-11-13)"}, {"id": "mcp:io.github.mrfentmen/hudsonrock-mcp", "name": "io.github.mrfentmen/hudsonrock-mcp", "kind": "mcp", "official": null, "desc": "Infostealer breach intelligence from Hudson Rock. No key required.", "repo": "https://github.com/mrfentmen/hudsonrock-mcp", "install": ["npm:hudsonrock-mcp"], "stars": null, "pushed": null, "license": null, "plat": "hudson rock", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/mitre-attack-mcp", "name": "io.github.mrfentmen/mitre-attack-mcp", "kind": "mcp", "official": null, "desc": "Search the MITRE ATT&CK enterprise knowledge base for adversary techniques and tactics.", "repo": "https://github.com/mrfentmen/mitre-attack-mcp", "install": ["npm:@mrfentmen/mitre-attack-mcp"], "stars": null, "pushed": null, "license": null, "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/openioc-mcp", "name": "io.github.mrfentmen/openioc-mcp", "kind": "mcp", "official": null, "desc": "OpenIOC MCP: parse IOC bundles, validate indicators, conditions and content.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/openioc-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "openioc", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/openvas-mcp", "name": "io.github.mrfentmen/openvas-mcp", "kind": "mcp", "official": null, "desc": "OpenVAS MCP: parse reports, validate findings, hosts, ports and severities.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/openvas-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "openvas", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/otx-mcp", "name": "io.github.mrfentmen/otx-mcp", "kind": "mcp", "official": null, "desc": "MCP server for AlienVault OTX: pulses, indicators. Free key.", "repo": "https://github.com/mrfentmen/awesome-mcps", "install": ["npm:otx-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "alienvault otx", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/port-scanner-mcp", "name": "io.github.mrfentmen/port-scanner-mcp", "kind": "mcp", "official": null, "desc": "Scan local or remote hosts for open TCP ports. Runs locally.", "repo": "https://github.com/mrfentmen/port-scanner-mcp", "install": ["npm:port-scanner-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.mrfentmen/sigma-rules-mcp", "name": "io.github.mrfentmen/sigma-rules-mcp", "kind": "mcp", "official": null, "desc": "Sigma MCP: parse detection rules, validate ids, levels, statuses and detection blocks.", "repo": "https://github.com/mrfentmen/awesome-servers", "install": ["npm:@mrfentmen/sigma-rules-mcp"], "stars": 0, "pushed": "2026-11-10T07:18:37Z", "license": null, "plat": "sigma", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.robertoyanguas-ops/domain-osint-mcp", "name": "io.github.robertoyanguas-ops/domain-osint-mcp", "kind": "mcp", "official": null, "desc": "Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.", "repo": null, "install": ["https://domain-osint-72343955726.us-central1.run.app/mcp/domain-osint"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 638 ms · 2 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.RudrenduPaul/truesignal", "name": "io.github.RudrenduPaul/truesignal", "kind": "mcp", "official": null, "desc": "Wraps the truesignal CLI as a single generic MCP tool for threat/connector status checks.", "repo": "https://github.com/RudrenduPaul/truesignal", "install": ["pypi:truesignal-cli"], "stars": 0, "pushed": "2026-10-21T08:07:46Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.threadlinqs-cmd/intelthreadlinqs-mcp", "name": "io.github.threadlinqs-cmd/intelthreadlinqs-mcp", "kind": "mcp", "official": null, "desc": "Threadlinqs threat-intelligence MCP — 49 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs", "repo": "https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp", "install": ["npm:intelthreadlinqs-mcp"], "stars": 0, "pushed": "2026-08-23T21:21:55Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.vibefix-tech/vibefix", "name": "io.github.vibefix-tech/vibefix", "kind": "mcp", "official": null, "desc": "Bug bounty platform for vibe coders. Post bugs, find fixes, run diagnostics.", "repo": "https://github.com/vibefix-tech/vibefix", "install": ["npm:@vibefix/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:it.elsas/security-intel", "name": "it.elsas/security-intel", "kind": "mcp", "official": null, "desc": "Daily Ed25519-signed security intelligence for AI-agent stacks; CVEs & advisories, paid via x402.", "repo": "https://github.com/romans-repos/elsas-verify", "install": ["https://elsas.it/mcp"], "stars": 0, "pushed": "2026-06-29T04:34:01Z", "license": "MIT", "plat": "", "live": "Down · URLError: <urlopen error timed out> (checked 2026-11-13)"}, {"id": "mcp:com.dugganusa/threat-intel", "name": "Jeevesus — DugganUSA threat-intel MCP", "kind": "mcp", "official": null, "desc": "Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.", "repo": "https://github.com/pduggusa/enterprise-extraction-platform", "install": ["https://analytics.dugganusa.com/api/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "dugganusa", "live": "Live · 3094 ms · 10 tools · free to try: `check-workflow` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.pduggusa/dugganusa-threat-intel", "name": "Jeevesus — DugganUSA threat-intel MCP", "kind": "mcp", "official": null, "desc": "Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.", "repo": "https://github.com/pduggusa/enterprise-extraction-platform", "install": ["https://analytics.dugganusa.com/api/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "dugganusa", "live": "Live · 3094 ms · 10 tools · free to try: `check-workflow` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.kevwire/kevwire", "name": "KEVWire", "kind": "mcp", "official": null, "desc": "Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources.", "repo": null, "install": ["https://kevwire.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "kevwire", "live": "Live · 7989 ms · 5 tools · free to try: `list_recent_exploited` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.kit-rx.api/kitrx", "name": "Kit Rx", "kind": "mcp", "official": null, "desc": "Pay-per-call web markdown, security headers, WHOIS/DNS, SEC, onchain safety, sanctions (x402 USDC)", "repo": null, "install": ["https://api.kit-rx.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "kit rx", "live": "Live · 626 ms · 36 tools · `web_check` asked for payment (checked 2026-11-15)"}, {"id": "mcp:dev.rohnelt.kortex/kortex", "name": "Kortex", "kind": "mcp", "official": null, "desc": "Which x402 service actually works: uptime, valid 402, and settlements proven on-chain.", "repo": null, "install": ["https://kortex.rohnelt.dev/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 502 (checked 2026-11-13)"}, {"id": "mcp:io.github.jhashantanu987-beep/kryptheon", "name": "Kryptheon", "kind": "mcp", "official": null, "desc": "Record a flow through your app, check it after every change, and attack a copy of your database.", "repo": null, "install": ["npm:kryptheon-mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.thechristianaicompany/leaks-and-confessions", "name": "leaks.md and confession.md", "kind": "mcp", "official": null, "desc": "Anonymous, encrypted disclosure of AI alignment and safety failures, with signed receipts.", "repo": "https://github.com/thechristianaicompany/leaks-and-confessions-skills", "install": ["https://leaks.md/mcp", "https://confession.md/mcp"], "stars": 0, "pushed": "2026-10-07T12:07:16Z", "license": "MIT", "plat": "", "live": "Live · 2201 ms · 11 tools · free to try: `read_guidance` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.lightbringer/connector", "name": "Lightbringer", "kind": "mcp", "official": null, "desc": "Register innovations, request patent preparation, and collaborate with Lightbringer’s patent team.", "repo": "https://github.com/lightbringer-patents/mcp-connector", "install": ["https://mcp.lightbringer.com/mcp"], "stars": 0, "pushed": "2026-11-09T16:43:33Z", "license": "MIT", "plat": "patent team", "live": "Live · 1355 ms · 44 tools · `search` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.malwagon/malwagon", "name": "Malwagon", "kind": "mcp", "official": null, "desc": "Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.", "repo": null, "install": ["https://malwagon.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "malwagon", "live": "Down · URLError: <urlopen error [Errno 11001] getaddrinfo failed> (checked 2026-11-13)"}, {"id": "mcp:io.github.AndreC10002/mcp-server-threat-intelligence", "name": "Malware Patrol Threat Intelligence MCP server", "kind": "mcp", "official": null, "desc": "Our MCP Server connects AI workflows to current, curated cyber threat intelligence", "repo": null, "install": ["https://mcp.malwarepatrol.net/v1?api_key={api_key}"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Down · HTTP 307 (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/malwarebazaar", "name": "Malwarebazaar", "kind": "mcp", "official": null, "desc": "MalwareBazaar MCP — abuse.ch malware sample database (free, key required)", "repo": "https://github.com/pipeworx-io/mcp-malwarebazaar", "install": ["npm:@pipeworx/mcp-malwarebazaar", "https://gateway.pipeworx.io/malwarebazaar/mcp"], "stars": 0, "pushed": "2026-11-09T14:17:11Z", "license": "MIT", "plat": "malwarebazaar", "live": "Not checked (runs locally)"}, {"id": "mcp:com.midkernel/threat-intel", "name": "Midkernel Threat Intel", "kind": "mcp", "official": null, "desc": "Free, read-only public-source threat intel over MCP. No account or API key.", "repo": null, "install": ["https://www.midkernel.com/security/app/mcp/threat-intel"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1757 ms · 6 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.mitigant/mitigant-mcp", "name": "Mitigant", "kind": "mcp", "official": null, "desc": "Run real, auto-recovered cloud attacks on AWS, Azure and GCP to test your defenses.", "repo": "https://github.com/mitigant/mitigant-external-api", "install": ["https://mcp.mitigant.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "aws", "live": "Live · 1729 ms · 14 tools (checked 2026-11-13)"}, {"id": "mcp:io.github.imouiche/mitre-atlas-mcp-server", "name": "MITRE ATLAS MCP Server", "kind": "mcp", "official": null, "desc": "Threat-model AI and agentic systems against MITRE ATLAS: surfaces, techniques, controls", "repo": "https://github.com/imouiche/mitre-atlas-mcp-server", "install": ["npm:@imouiche/mitre-atlas-mcp-server"], "stars": null, "pushed": null, "license": null, "plat": "mitre atlas", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.pipeworx-io/mitre-attck", "name": "Mitre Attck", "kind": "mcp", "official": null, "desc": "MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.", "repo": "https://github.com/pipeworx-io/mcp-mitre-attck", "install": ["npm:@pipeworx/mcp-mitre-attck", "https://gateway.pipeworx.io/mitre-attck/mcp"], "stars": 0, "pushed": "2026-11-09T14:20:19Z", "license": "MIT", "plat": "mitre att&ck", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.maco144/nullcone", "name": "Nullcone Threat Intelligence", "kind": "mcp", "official": null, "desc": "Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats", "repo": "https://github.com/maco144/nullcone-mcp", "install": ["https://nullcone.ai/mcp"], "stars": 0, "pushed": "2026-07-08T13:36:17Z", "license": "NOASSERTION", "plat": "threat intel", "live": "Live · 1389 ms · 30 tools · free to try: `check_prompt` answered without a key (checked 2026-11-13)"}, {"id": "mcp:org.onionlens/tor-tools", "name": "OnionLens Tor Tools", "kind": "mcp", "official": null, "desc": "Tor address validation and retrieval fixtures, with disclosed research logging.", "repo": "https://github.com/NellInc/OnionLens-public", "install": ["https://onionlens.org/mcp"], "stars": 0, "pushed": "2026-10-23T23:42:59Z", "license": "MIT", "plat": "", "live": "Live · 1052 ms · 3 tools · free to try: `list_resources` answered without a key (checked 2026-11-13)"}, {"id": "mcp:foundation.osint/osint", "name": "osint.foundation", "kind": "mcp", "official": null, "desc": "OSINT lookups: usernames, social profiles, phones, domains, IPs, crypto wallets and companies.", "repo": null, "install": ["https://osint.foundation/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "osint.foundation", "live": "Live · 1859 ms · 51 tools · `http_get` asked for payment (checked 2026-11-13)"}, {"id": "mcp:io.github.No3men60/ot-intel-api", "name": "OT Intel API", "kind": "mcp", "official": null, "desc": "OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.", "repo": null, "install": ["https://ot-intel-api.onrender.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 969 ms · 40 tools · `getXThread` asked for payment (checked 2026-11-13)"}, {"id": "mcp:com.penetrationtestservices/site", "name": "Pentest requests, security headers checker, guides", "kind": "mcp", "official": null, "desc": "Request a penetration test, grade a website's HTTP security headers, and search pentest guides.", "repo": "https://github.com/Excession-Labs/mcp-servers", "install": ["https://penetrationtestservices.com/mcp"], "stars": 0, "pushed": "2026-11-12T15:12:23Z", "license": "MIT", "plat": "", "live": "Live · 1735 ms · 5 tools · free to try: `check_security_headers` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.pentestcompare/site", "name": "PentestCompare: pentest provider data", "kind": "mcp", "official": null, "desc": "Sourced data on 66 penetration testing providers: scope, delivery, published prices, retests.", "repo": "https://github.com/Excession-Labs/mcp-servers", "install": ["https://pentestcompare.com/mcp"], "stars": 0, "pushed": "2026-11-12T15:12:23Z", "license": "MIT", "plat": "pentest providers", "live": "Live · 1316 ms · 5 tools · free to try: `list_providers` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.WYRE-AI/petra-mcp", "name": "Petra Security", "kind": "mcp", "official": null, "desc": "Read-only Petra Security MCP: M365 compromise incidents, failed attacks, posture, tenants, usage.", "repo": "https://github.com/WYRE-AI/petra-mcp", "install": ["oci:ghcr.io/wyre-ai/petra-mcp:v1.0.1"], "stars": 0, "pushed": "2026-11-12T16:43:44Z", "license": "NOASSERTION", "plat": "petra security", "live": "Not checked (runs locally)"}, {"id": "mcp:nl.phishnoo.api/sandbox", "name": "Phishnoo Sandbox", "kind": "mcp", "official": null, "desc": "Explore synthetic security awareness metrics and file example threat reports.", "repo": null, "install": ["https://api.phishnoo.nl/mcp"], "stars": null, "pushed": null, "license": null, "plat": "phishnoo sandbox", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/phishtank", "name": "Phishtank", "kind": "mcp", "official": null, "desc": "PhishTank MCP — wraps PhishTank API (checkurl.phishtank.com)", "repo": "https://github.com/pipeworx-io/mcp-phishtank", "install": ["npm:@pipeworx/mcp-phishtank", "https://gateway.pipeworx.io/phishtank/mcp"], "stars": 0, "pushed": "2026-11-09T14:32:30Z", "license": "MIT", "plat": "phishtank", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.radar989/polarity-mcp", "name": "Polarity", "kind": "mcp", "official": null, "desc": "Real-time threat intelligence lookups and IOC parsing from your self-hosted Polarity instance.", "repo": null, "install": ["npm:@polarityio/mcp-connector"], "stars": null, "pushed": null, "license": null, "plat": "polarity", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Br0ski777/port-scanner", "name": "Port Scanner API", "kind": "mcp", "official": null, "desc": "TCP port scanning — check open ports on any host. x402 micropayment.", "repo": "https://github.com/Br0ski777/port-scanner-x402", "install": ["https://port-scanner.api.klymax402.com/mcp"], "stars": 0, "pushed": "2026-09-02T19:57:03Z", "license": "MIT", "plat": "", "live": "Down · URLError: <urlopen error [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:1082)> (checked 2026-11-13)"}, {"id": "mcp:io.github.pipeworx-io/pulsedive", "name": "Pulsedive", "kind": "mcp", "official": null, "desc": "Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com)", "repo": "https://github.com/pipeworx-io/mcp-pulsedive", "install": ["npm:@pipeworx/mcp-pulsedive", "https://gateway.pipeworx.io/pulsedive/mcp"], "stars": 0, "pushed": "2026-11-09T14:35:23Z", "license": "MIT", "plat": "pulsedive", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.alemaiorano/research-vault", "name": "Research Vault (research decoy)", "kind": "mcp", "official": null, "desc": "Owned MCP research honeypot: synthetic decoy data with canary markers; digest-only logging.", "repo": null, "install": ["https://34.134.225.250.sslip.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2108 ms · 6 tools · free to try: `agent_memory_search` answered without a key (checked 2026-11-14)"}, {"id": "mcp:com.riskcovery/mcp", "name": "Riskcovery", "kind": "mcp", "official": null, "desc": "Agents that white-hack your app for a full day and report what attackers could exploit.", "repo": null, "install": ["https://www.riskcovery.com/api/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 5717 ms · 33 tools · `readCve` asked for an API key (checked 2026-11-15)"}, {"id": "mcp:io.github.WYRE-AI/rocketcyber-mcp", "name": "RocketCyber", "kind": "mcp", "official": null, "desc": "MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.", "repo": "https://github.com/WYRE-AI/rocketcyber-mcp", "install": ["oci:ghcr.io/wyre-ai/rocketcyber-mcp:v1.6.3"], "stars": 0, "pushed": "2026-11-09T08:45:28Z", "license": "Apache-2.0", "plat": "rocketcyber", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.wyre-technology/rocketcyber-mcp", "name": "RocketCyber", "kind": "mcp", "official": null, "desc": "MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.", "repo": "https://github.com/wyre-technology/rocketcyber-mcp", "install": ["oci:ghcr.io/wyre-technology/rocketcyber-mcp:v1.5.4"], "stars": 0, "pushed": "2026-11-09T08:45:28Z", "license": "Apache-2.0", "plat": "rocketcyber", "live": "Not checked (runs locally)"}, {"id": "mcp:io.github.Nicoiakl/rosetta-quantum-pqc", "name": "Rosetta Quantum — PQC exposure", "kind": "mcp", "official": null, "desc": "Live post-quantum (PQC) exposure of any domain, with a QEX score and sealed quantum evidence.", "repo": null, "install": ["https://rosettaquantum.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 843 ms · 12 tools · free to try: `listar_fuentes_cuanticas` answered without a key (checked 2026-11-14)"}, {"id": "mcp:lat.rta/rta", "name": "rta — zero-knowledge proof of a threshold", "kind": "mcp", "official": null, "desc": "Prove a hidden value reached a threshold without revealing the value.", "repo": "https://github.com/mrpkk/rta", "install": ["https://rta.lat/mcp"], "stars": 0, "pushed": "2026-11-12T14:19:09Z", "license": "Apache-2.0", "plat": "rta", "live": "Live · 3809 ms · 2 tools · free to try: `list_predicates` answered without a key (checked 2026-11-13)"}, {"id": "mcp:io.github.chomkaevan/sanctions-check", "name": "Sanctions Check", "kind": "mcp", "official": null, "desc": "Screen crypto wallets and names against US Treasury OFAC sanctions lists. Pay per call via x402.", "repo": "https://github.com/chomkaevan/public-domain-check-mcp", "install": ["https://public-domain-check-production.up.railway.app/sanctions/mcp"], "stars": 0, "pushed": "2026-11-14T01:49:44Z", "license": "MIT", "plat": "", "live": "Live · 484 ms · 3 tools · free to try: `sanctions_list_status` answered without a key (checked 2026-11-14)"}, {"id": "mcp:com.0xpi.sdsentry/sds-lookup", "name": "SDSentry: Safety Data Sheet Lookup, GHS Pictograms & HazCom", "kind": "mcp", "official": null, "desc": "SDS lookup, GHS pictograms, HazCom dates; customers: list my chemicals, sheets due, PPE, hazards.", "repo": null, "install": ["https://sdsentry.0xpi.com/mcp-sds"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 11595 ms · 10 tools · `list_my_chemicals` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:io.github.getlarkwright/secops-field-notes-mcp", "name": "SecOps Field Notes", "kind": "mcp", "official": null, "desc": "CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.", "repo": "https://github.com/getlarkwright/secops-field-notes-mcp", "install": ["oci:ghcr.io/getlarkwright/secops-field-notes-mcp:0.1.1"], "stars": 0, "pushed": "2026-11-07T15:25:08Z", "license": "MIT", "plat": "", "live": "Not checked (runs locally)"}, {"id": "mcp:ai.strix/strix", "name": "Strix", "kind": "mcp", "official": null, "desc": "AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.", "repo": null, "install": ["https://app.strix.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ai pentesting", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.AIops-tools/symantec-edr-aiops", "name": "Symantec Endpoint Detection and Response (on-premises) AIops", "kind": "mcp", "official": null, "desc": "Governed Symantec on-prem EDR — 20 MCP tools, read-only with audit.", "repo": "https://github.com/AIops-tools/Symantec-EDR-AIops", "install": ["pypi:symantec-edr-aiops"], "stars": 0, "pushed": "2026-11-06T09:42:40Z", "license": "MIT", "plat": "symantec edr", "live": "Not checked (runs locally)"}, {"id": "mcp:ai.theleaf.observatory/threat-observatory", "name": "TheLeaf Threat Observatory", "kind": "mcp", "official": null, "desc": "Read-only honeypot observations and evidence. Invite-only API key; request access on our website.", "repo": null, "install": ["https://observatory.theleaf.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.chico10117/tron-usdt-mcp", "name": "TRON USDT Risk Checker", "kind": "mcp", "official": null, "desc": "TRON USDT risk: free Tether blacklist check, paid sanctions screen and AML report.", "repo": "https://github.com/chico10117/tron-usdt-mcp", "install": ["npm:tron-usdt-mcp", "https://usdt.chikocorp.com/mcp"], "stars": 0, "pushed": "2026-11-12T16:50:25Z", "license": "MIT", "plat": "usdt", "live": "Not checked (runs locally)"}, {"id": "mcp:com.truss-security/truss-mcp", "name": "Truss Threat Intelligence", "kind": "mcp", "official": null, "desc": "Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.", "repo": "https://github.com/truss-security/truss-agent-mcp", "install": ["https://api.truss-security.com/mcp"], "stars": 0, "pushed": "2026-11-10T20:10:07Z", "license": "MIT", "plat": "truss threat intelligence", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.trustonion/scam-check", "name": "Trust Onion Scam Check", "kind": "mcp", "official": null, "desc": "Verified AI voice-clone scam incidents, loss stats, and a family verification protocol. Keyless.", "repo": null, "install": ["https://trustonion.io/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 1796 ms · 7 tools · free to try: `list_scam_types` answered without a key (checked 2026-11-13)"}, {"id": "mcp:uk.co.penetrationtestingcost/site", "name": "uk.co.penetrationtestingcost/site", "kind": "mcp", "official": null, "desc": "Penetration Testing Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...", "repo": null, "install": ["https://penetrationtestingcost.co.uk/mcp"], "stars": null, "pushed": null, "license": null, "plat": "", "live": "Live · 2204 ms · 3 tools · free to try: `enquiry_describe` answered without a key (checked 2026-11-13)"}, {"id": "mcp:com.a2awire/data-threat-research-unit42-malware-analysis", "name": "Unit 42 Threat Research & Malware Analysis — buy per-query in-session (unit42watch)", "kind": "mcp", "official": null, "desc": "Unit 42 malware analysis & threat research. $0.01/query. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/unit42watch-unit-42-threat-research-malware-analysis-ed410c/http"], "stars": null, "pushed": null, "license": null, "plat": "unit 42", "live": "Live · 1625 ms · 21 tools · `check_earnings` asked for an API key (checked 2026-11-13)"}, {"id": "mcp:com.vulntel/mcp", "name": "vulntel", "kind": "mcp", "official": null, "desc": "Free hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports", "repo": "https://github.com/rozetyp/vulntel-mcp", "install": ["https://mcp.vulntel.com/mcp"], "stars": 0, "pushed": "2026-11-10T17:38:46Z", "license": "NOASSERTION", "plat": "", "live": "Live · 1977 ms · 13 tools · free to try: `find_continuations` answered without a key (checked 2026-11-13)"}, {"id": "mcp:ai.vysion/vysion", "name": "Vysion", "kind": "mcp", "official": null, "desc": "Darknet threat intelligence for AI assistants: leaks, documents, chat, ransomware.", "repo": null, "install": ["https://mcp.vysion.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "vysion", "live": "Responds, sign-in needed (checked 2026-11-13)"}, {"id": "mcp:io.github.ZKStamp/proof100", "name": "ZKStamp Proof-100", "kind": "mcp", "official": null, "desc": "Shielded proof-of-existence timestamps on BitcoinZ (zk-SNARKs). Free trial: 3 proofs.", "repo": "https://github.com/ZKStamp/Proof100", "install": ["https://proof.zketernity.app/mcp"], "stars": 0, "pushed": "2026-10-29T17:28:03Z", "license": "MIT", "plat": "bitcoinz", "live": "Live · 1846 ms · 3 tools (checked 2026-11-13)"}]