skill
ExploitNinja
147 security/pentest skills for opencode (bug bounty, web3, mobile, cloud, OSINT, AI/LLM security)
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/aloc999/ExploitNinja itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
Skills do not use an MCP config. Follow the steps in the README below.
README
synced Oct 26, 2026ExploitNinja
A curated, collection of security skills for opencode — built for Penetration Testing, Bug Bounty Hunting, CTF, Exploitation, Privilege Escalation, and Post-Exploitation.
Consolidated from 10 source skill packages + 10 author-written gap-filling skills, collapsed to 150 unique skills (10 duplicates removed) plus 10 added: ctf-pwn, ctf-steganography, exploit-development, pivoting-tunneling, lateral-movement, defense-evasion, c2-frameworks, anti-forensics, metasploit-framework, public-exploits. All 179 skills validated: YAML frontmatter + name + description + balanced code fences + zero duplicate names.
Stats: 179 skills · 1199 files
Coverage: Penetration Testing 17/17 · Bug Bounty 34/34 · CTF 12/12 · Exploitation ✅ · Privilege Escalation 5/5 · Post-Exploitation 8/8
Install (one command)
mv ~/.opencode/skills ~/.opencode/skills.bak.$(date +%s)
git clone https://github.com/aloc999/ExploitNinja ~/.opencode/ExploitNinja
ln -s ~/.opencode/ExploitNinja/skills ~/.opencode/skills
# opencode auto-discovers skills/*/SKILL.md recursively.
Update:
cd ~/.opencode/ExploitNinja && git pull· Restore:rm ~/.opencode/skills && mv ~/.opencode/skills.bak.* ~/.opencode/skills
Skill Index
Bug Bounty / OSINT (21)
| Skill | Dir | Files | Description |
|---|---|---|---|
bb-local-toolkit | skills/bb-local-toolkit/ | 1 | Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech sta... |
bb-methodology | skills/bb-methodology/ | 1 | Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear ... |
bug-bounty | skills/bug-bounty/ | 1 | Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech sta... |
bugcrowd-reporting | skills/bugcrowd-reporting/ | 1 | "Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaul... |
evidence-hygiene | skills/evidence-hygiene/ | 1 | "Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools wor... |
hackerone | skills/hackerone/ | 7 | HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports. |
hackthebox | skills/hackthebox/ | 8 | HackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions |
meme-coin-audit | skills/meme-coin-audit/ | 1 | Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, m... |
mid-engagement-ir-detection | skills/mid-engagement-ir-detection/ | 1 | Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those observations into deli... |
offensive-osint | skills/offensive-osint/ | 18 | "Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST... |
osint | skills/osint/ | 2 | Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery. |
osint-methodology | skills/osint-methodology/ | 2 | "Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, ... |
redteam-mindset | skills/redteam-mindset/ | 1 | Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults cause... |
redteam-report-template | skills/redteam-report-template/ | 1 | Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (n... |
report-writing | skills/report-writing/ | 1 | Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement f... |
security-arsenal | skills/security-arsenal/ | 3 | Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SS... |
supply-chain-attack-recon | skills/supply-chain-attack-recon/ | 1 | External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, contai... |
triage-validation | skills/triage-validation/ | 1 | Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 qu... |
web2-recon | skills/web2-recon/ | 1 | Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (f... |
web2-vuln-classes | skills/web2-vuln-classes/ | 1 | Complete reference for 20 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (... |
recon-scope-triage | skills/recon-scope-triage/ | 1 | Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-ma... |
Bug Bounty Hunting (60)
| Skill | Dir | Files | Description |
|---|---|---|---|
hunt-api-misconfig | skills/hunt-api-misconfig/ | 1 | "Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on... |
hunt-aspnet | skills/hunt-aspnet/ | 1 | Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.a... |
hunt-ato | skills/hunt-ato/ | 1 | "Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host header injection redirects token to attacker, predictable token, to... |
hunt-auth-bypass | skills/hunt-auth-bypass/ | 1 | Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signa... |
hunt-brute-force | skills/hunt-brute-force/ | 1 | Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6), credential stuffing, username/email enumeration via error differences or timing, weak password p... |
hunt-business-logic | skills/hunt-business-logic/ | 1 | Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart pri... |
hunt-cache-poison | skills/hunt-cache-poison/ | 1 | Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→store... |
hunt-cicd | skills/hunt-cicd/ | 1 | Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target + untrusted input), Jenkins script console RCE, GitLab CI runner token exposure, Ter... |
hunt-cloud-misconfig | skills/hunt-cloud-misconfig/ | 1 | "Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origi... |
hunt-cors | skills/hunt-cors/ | 1 | Hunt CORS Misconfiguration — wildcard with credentials, null origin, regex with subdomain trust, pre-flight bypass, postMessage origin checks. High when it leads to credentialed... |
hunt-csrf | skills/hunt-csrf/ | 1 | Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), Graph... |
hunt-deserialization | skills/hunt-deserialization/ | 1 | Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE vi... |
hunt-dispatch | skills/hunt-dispatch/ | 1 | Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just recei... |
hunt-dom | skills/hunt-dom/ | 1 | Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept re... |
hunt-file-upload | skills/hunt-file-upload/ | 1 | "Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if... |
hunt-graphql | skills/hunt-graphql/ | 1 | Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF... |
hunt-grpc | skills/hunt-grpc/ | 1 | Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication on internal endpoints, plaintext gRPC over HTTP/2, internal endpoi... |
hunt-host-header | skills/hunt-host-header/ | 1 | Hunt Host Header Injection — password reset poisoning → ATO, cache poisoning via unkeyed host, X-Forwarded-Host injection, SSRF via Host header, routing-based SSRF, OAuth redire... |
hunt-http-smuggling | skills/hunt-http-smuggling/ | 1 | "Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs T... |
hunt-idor | skills/hunt-idor/ | 1 | Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target. |
hunt-k8s | skills/hunt-k8s/ | 1 | Hunt Kubernetes and Docker specific vulnerabilities — Kubernetes API anonymous access, kubelet 10250 unauth exec, etcd 2379 unauth, dashboard exposure, RBAC misconfig, secret le... |
hunt-laravel | skills/hunt-laravel/ | 1 | Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignitio... |
hunt-ldap | skills/hunt-ldap/ | 1 | Hunt LDAP Injection and XPath Injection — authentication bypass, data exfiltration from Active Directory, directory traversal, AD user/group enumeration. Use when target uses LD... |
hunt-lfi | skills/hunt-lfi/ | 1 | Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP wrappers, zip:// and phar:// chains, directory trav... |
hunt-llm-ai | skills/hunt-llm-ai/ | 1 | "Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use, ASCII smuggling, agentic AI security framework (ASI01-ASI10). Patterns: direct promp... |
hunt-mfa-bypass | skills/hunt-mfa-bypass/ | 1 | "Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via dir... |
hunt-misc | skills/hunt-misc/ | 1 | Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target. |
hunt-nextjs | skills/hunt-nextjs/ | 1 | Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF ... |
hunt-nodejs | skills/hunt-nodejs/ | 1 | Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engi... |
hunt-nosqli | skills/hunt-nosqli/ | 1 | Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/M... |
hunt-ntlm-info | skills/hunt-ntlm-info/ | 1 | Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, comp... |
hunt-oauth | skills/hunt-oauth/ | 1 | Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target. |
hunt-open-redirect | skills/hunt-open-redirect/ | 1 | Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header i... |
hunt-race-condition | skills/hunt-race-condition/ | 1 | Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing... |
hunt-rce | skills/hunt-rce/ | 1 | Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target. |
hunt-saml | skills/hunt-saml/ | 1 | "Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW1-XSW8) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID... |
hunt-session | skills/hunt-session/ | 1 | Hunt Session Management vulnerabilities — session fixation, session prediction (low entropy), insufficient invalidation on logout/password change, concurrent session abuse, JWT ... |
hunt-sharepoint | skills/hunt-sharepoint/ | 1 | Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass (Authenticati... |
hunt-source-leak | skills/hunt-source-leak/ | 1 | Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure,... |
hunt-springboot | skills/hunt-springboot/ | 1 | Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, J... |
hunt-sqli | skills/hunt-sqli/ | 1 | Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-202... |
hunt-ssrf | skills/hunt-ssrf/ | 1 | Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106... |
hunt-ssti | skills/hunt-ssti/ | 1 | "Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection pr... |
hunt-subdomain | skills/hunt-subdomain/ | 1 | Hunting skill for subdomain vulnerabilities. Built from 15 public bug bounty reports including modern provider fingerprints — Microsoft Azure DevOps cloudapp.azure.com regiona... |
hunt-tls-network | skills/hunt-tls-network/ | 1 | Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing),... |
hunt-websocket | skills/hunt-websocket/ | 1 | Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing authentication on WS handshake, message tampering, event authorization bypass, WS→HTTP request s... |
hunt-xss | skills/hunt-xss/ | 1 | Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. |
hunt-xxe | skills/hunt-xxe/ | 1 | Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind ... |
hunt-captcha-bypass | skills/hunt-captcha-bypass/ | 1 | Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token rep... |
hunt-clickjacking | skills/hunt-clickjacking/ | 1 | Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims i... |
hunt-exceptional-conditions | skills/hunt-exceptional-conditions/ | 1 | Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and ... |
hunt-fintech-graphql | skills/hunt-fintech-graphql/ | 1 | Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfol... |
hunt-forgot-password | skills/hunt-forgot-password/ | 1 | Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs i... |
hunt-html-injection | skills/hunt-html-injection/ | 1 | Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HT... |
hunt-jwt-crypto | skills/hunt-jwt-crypto/ | 1 | Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e... |
hunt-rag-vector | skills/hunt-rag-vector/ | 1 | Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that su... |
hunt-shadow-api | skills/hunt-shadow-api/ | 1 | Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/leg... |
hunt-spa-api | skills/hunt-spa-api/ | 1 | Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. O... |
graphql-audit | skills/graphql-audit/ | 1 | GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injectio... |
cicd-security | skills/cicd-security/ | 1 | CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC ... |
CTF (1)
| Skill | Dir | Files | Description |
|---|---|---|---|
ctf-steganography | skills/ctf-steganography/ | 1 | Steganography detection and extraction for CTF and forensics. Covers image LSB (PNG/BMP via zsteg, stegsolve, stegoveritas), JPEG/BMP/WAV embedding (steghide), audio spectrogram... |
Exploitation (7)
| Skill | Dir | Files | Description |
|---|---|---|---|
ctf-pwn | skills/ctf-pwn/ | 1 | Binary exploitation / pwn for CTF and live engagement. Covers stack buffer overflow (ret2win, ret2shellcode, ret2libc, ROP chains), format-string vulnerabilities (arbitrary read... |
exploit-development | skills/exploit-development/ | 1 | Real-world exploit development from crash to reliable shell. Covers the crash-to-exploit methodology, shellcode generation (msfvenom linux/windows x86/x64, stageless vs staged, ... |
exploiting-cloud-platforms | skills/exploiting-cloud-platforms/ | 1 | Exploit AWS, Azure, and GCP cloud misconfigurations including S3 buckets, IAM roles, metadata services, serverless functions, and cloud-specific privilege escalation. Use when p... |
exploiting-containers | skills/exploiting-containers/ | 1 | Escape Docker containers and exploit Kubernetes clusters using privileged containers, Docker socket access, misconfigurations, and API abuse. Use when testing container security... |
exploiting-web3-smart-contracts | skills/exploiting-web3-smart-contracts/ | 1 | Audit and exploit smart contracts and Web3 applications including reentrancy, integer overflow, access control flaws, and DeFi-specific vulnerabilities. Use when testing blockch... |
metasploit-framework | skills/metasploit-framework/ | 1 | Metasploit Framework operation for exploitation and post-exploitation. Covers msfconsole workflow (search/use/set/exploit/check), module types (exploit/auxiliary/post/payload/en... |
public-exploits | skills/public-exploits/ | 1 | Finding, evaluating, adapting, and running public exploits (Exploit-DB / searchsploit / GitHub PoCs). Covers the searchsploit workflow (search/mirror/examine/path/update, --nmap... |
Post-Exploitation (5)
| Skill | Dir | Files | Description |
|---|---|---|---|
anti-forensics | skills/anti-forensics/ | 1 | Anti-forensics and covering tracks post-engagement — Windows and Linux. Covers Windows event-log clearing (wevtutil, Clear-EventLog, Phantom DLL/phantom logging, USN journal tru... |
c2-frameworks | skills/c2-frameworks/ | 1 | Command-and-control (C2) frameworks for red-team and post-exploitation. Covers Sliver (Go implants, mTLS/WG/HTTP, sessions, beacons), Havoc (C/C++ implants, Python teamserver, G... |
defense-evasion | skills/defense-evasion/ | 1 | Defense evasion — bypassing AV, EDR, AMSI, and ETW on Windows and Linux. Covers AMSI bypass (AmsiScanBuffer patch, reflection, hardware-ID corruption), ETW patching (EtwEventWri... |
lateral-movement | skills/lateral-movement/ | 1 | Lateral movement across Windows/Linux environments after initial foothold. Covers pass-the-hash (crackmapexec/evil-winrm/wmiexec/psexec), pass-the-ticket & Kerberos ticket reuse... |
pivoting-tunneling | skills/pivoting-tunneling/ | 1 | Network pivoting and tunneling for post-exploitation internal movement. Covers SSH local/remote/dynamic forwarding (-L/-R/-D/-J), chisel reverse SOCKS and port forwards, ligolo-... |
Privilege Escalation (2)
| Skill | Dir | Files | Description |
|---|---|---|---|
escalating-linux-privileges | skills/escalating-linux-privileges/ | 1 | Escalate privileges on Linux systems using SUID/SGID binaries, capabilities, sudo misconfigurations, cron jobs, kernel exploits, and container escapes. Use when performing Linux... |
escalating-windows-privileges | skills/escalating-windows-privileges/ | 1 | Escalate privileges on Windows systems using service misconfigurations, DLL hijacking, token manipulation, UAC bypasses, registry exploits, and credential dumping. Use when perf... |
Web3 / Smart Contracts (12)
| Skill | Dir | Files | Description |
|---|---|---|---|
web3-ai-tools | skills/web3-ai-tools/ | 1 | AI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discovery. |
web3-audit | skills/web3-audit/ | 1 | Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, p... |
web3-bug-classes | skills/web3-bug-classes/ | 1 | Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control... |
web3-case-study-role-misconfig | skills/web3-case-study-role-misconfig/ | 1 | Case study - role misconfiguration bug class applied to a yield aggregator protocol. Use as a template for applying all 10 bug classes to a single target. |
web3-grep-arsenal | skills/web3-grep-arsenal/ | 1 | Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability classes. |
web3-hunt-foundation | skills/web3-hunt-foundation/ | 1 | Hunter mindset, recon setup, and target scoring for Web3 bug bounty. Use at the START of any new protocol hunt - scoring targets, setting up environment, understanding architect... |
web3-hunt-zksync-era | skills/web3-hunt-zksync-era/ | 1 | ZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, which patterns block all 10 ... |
web3-methodology-research | skills/web3-methodology-research/ | 1 | External research synthesis from Trail of Bits, SlowMist, ConsenSys, Immunefi, and Cyfrin. Use this for advanced audit methodology, Echidna/Medusa fuzzing setup, Slither custom ... |
web3-poc-foundry | skills/web3-poc-foundry/ | 1 | Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting up a fork test, using Foundr... |
web3-solidity-audit-mcp | skills/web3-solidity-audit-mcp/ | 1 | MCP server integrating Slither + Aderyn + SWC patterns into Claude Code for smart contract auditing. Use when analyzing Solidity files, running DeFi-specific detectors, or gener... |
web3-start-here | skills/web3-start-here/ | 1 | Master index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT. |
web3-triage-report | skills/web3-triage-report/ | 1 | Bug triage validation system, Immunefi report format, and 20 real paid bounty examples dissected. Use this when validating a finding before submitting, writing an Immunefi repor... |
Mobile (4)
| Skill | Dir | Files | Description |
|---|---|---|---|
apk-redteam-pipeline | skills/apk-redteam-pipeline/ | 1 | End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert e... |
mobile-security | skills/mobile-security/ | 3 | Mobile application security testing — Android (smali, Frida, IL2CPP, Flutter AOT, root detection), iOS (jailbreak, Objection). |
ios-redteam-pipeline | skills/ios-redteam-pipeline/ | 1 | End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static ... |
mobile-pentest | skills/mobile-pentest/ | 1 | Mobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, captur... |
Cloud / Infra (4)
| Skill | Dir | Files | Description |
|---|---|---|---|
cloud-containers | skills/cloud-containers/ | 10 | Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation. |
cloud-iam-deep | skills/cloud-iam-deep/ | 1 | Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam... |
firewall-review | skills/firewall-review/ | 59 | Claude-native firewall ruleset audit playbook — 17 vendor-agnostic detectors across FortiGate / PAN-OS / Cisco ASA·IOS / Azure NSG / AWS SG / iptables, with framework citations ... |
cloud-pentest | skills/cloud-pentest/ | 1 | Post-access cloud exploitation for AWS, GCP, and Azure — what to do AFTER you obtain credentials or reach a metadata endpoint. Covers IAM enumerati... |
Web / General Security (11)
| Skill | Dir | Files | Description |
|---|---|---|---|
api-security | skills/api-security/ | 33 | API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques. |
authentication | skills/authentication/ | 64 | Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. |
client-side | skills/client-side/ | 45 | Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution. |
infrastructure | skills/infrastructure/ | 48 | Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment. |
injection | skills/injection/ | 42 | Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques. |
reconnaissance | skills/reconnaissance/ | 8 | Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis. |
server-side | skills/server-side/ | 44 | Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection. |
social-engineering | skills/social-engineering/ | 13 | Social engineering testing - phishing, pretexting, vishing, and physical security assessment techniques. |
system | skills/system/ | 104 | System exploitation testing - Active Directory attacks, privilege escalation (Linux/Windows), and exploit development. |
web-app-logic | skills/web-app-logic/ | 54 | Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure. |
client-reverse | skills/client-reverse/ | 2 | Client-side request-signing and anti-bot token reversal for bug bounty — when a request carries a sign/sig/hmac/token/nonce/timestamp/X-Sensor head... |
Attack Vectors (2)
| Skill | Dir | Files | Description |
|---|---|---|---|
attacking-active-directory | skills/attacking-active-directory/ | 1 | Attack and enumerate Active Directory environments using Kerberos attacks (Kerberoasting, ASREPRoasting), credential dumping (DCSync, Mimikatz), lateral movement (PtH, PtT), and... |
attacking-wireless-networks | skills/attacking-wireless-networks/ | 1 | Attack WiFi networks using WPA/WPA2 cracking, WPS exploitation, Evil Twin attacks, deauthentication, and wireless reconnaissance. Use when pentesting wireless networks or perfor... |
Enumeration (1)
| Skill | Dir | Files | Description |
|---|---|---|---|
enumerating-network-services | skills/enumerating-network-services/ | 1 | Enumerate and exploit network services including SMB, FTP, SSH, RDP, HTTP, databases (MySQL, MSSQL, PostgreSQL, MongoDB), LDAP, NFS, DNS, and SNMP. Use when testing network serv... |
Credential Attacks (2)
| Skill | Dir | Files | Description |
|---|---|---|---|
cracking-passwords | skills/cracking-passwords/ | 1 | Crack password hashes using hashcat/john, perform password spraying, brute force authentication, and execute pass-the-hash attacks. Use when cracking credentials or performing p... |
credential-attack | skills/credential-attack/ | 1 | Password spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, ... |
Pentest Methodology (3)
| Skill | Dir | Files | Description |
|---|---|---|---|
testing-apis | skills/testing-apis/ | 1 | Test REST and GraphQL APIs for authentication bypasses, authorization flaws, IDOR, mass assignment, injection attacks, and rate limiting issues. Use when pentesting APIs or test... |
testing-mobile-applications | skills/testing-mobile-applications/ | 1 | Pentest Android and iOS mobile applications including APK analysis, dynamic analysis, SSL pinning bypass, root/jailbreak detection bypass, and mobile-specific vulnerabilities. U... |
testing-web-applications | skills/testing-web-applications/ | 1 | Test web applications for security vulnerabilities including SQLi, XSS, command injection, JWT attacks, SSRF, file uploads, XXE, and API flaws. Use when pentesting web apps, ana... |
Operations (2)
| Skill | Dir | Files | Description |
|---|---|---|---|
performing-reconnaissance | skills/performing-reconnaissance/ | 1 | Perform OSINT, subdomain enumeration, port scanning, web reconnaissance, email harvesting, and cloud asset discovery for initial access. Use when gathering intelligence or mappi... |
performing-social-engineering | skills/performing-social-engineering/ | 1 | Conduct phishing campaigns, credential harvesting, pretexting, and social engineering attacks using tools like Gophish, SET, and custom techniques. Use when performing social en... |
Persistence (1)
| Skill | Dir | Files | Description |
|---|---|---|---|
establishing-persistence | skills/establishing-persistence/ | 1 | Establish persistence on Windows and Linux systems using registry keys, scheduled tasks, services, cron jobs, SSH keys, backdoor accounts, and rootkits. Use when performing post... |
File Transfer (1)
| Skill | Dir | Files | Description |
|---|---|---|---|
transferring-files | skills/transferring-files/ | 1 | Transfer files between systems using HTTP, SMB, FTP, netcat, base64 encoding, and living-off-the-land techniques for both Linux and Windows. Use when moving tools or exfiltratin... |
Tech-Stack ID (7)
| Skill | Dir | Files | Description |
|---|---|---|---|
techstack-backend | skills/techstack-backend/ | 2 | Backend tech-stack identification — web servers, runtimes, languages, frameworks, databases, APIs, and CMS via HTTP headers, cookies, error pages, and API discovery. |
techstack-correlation | skills/techstack-correlation/ | 2 | Correlation, confidence scoring, and conflict resolution across all tech-stack signals. Cross-validates and assigns High/Medium/Low confidence per technology. |
techstack-frontend | skills/techstack-frontend/ | 2 | Frontend tech-stack identification — JavaScript frameworks, meta-frameworks, CSS frameworks, UI libraries, build tools, and CMS via DOM, JS globals, HTML, and bundle patterns. |
techstack-identification | skills/techstack-identification/ | 1 | OSINT-based technology stack identification. Routes to 6 domain sub-skills (frontend, backend, infra, security, osint, correlation) to discover a target's stack from publicly av... |
techstack-infra | skills/techstack-infra/ | 2 | Infrastructure tech-stack identification — cloud providers, CDN/WAF, DNS services, TLS/CT, DevOps tooling, plus asset discovery (domains, subdomains, IPs). |
techstack-osint | skills/techstack-osint/ | 2 | OSINT-side tech-stack identification — public repositories (GitHub/GitLab), job postings & ATS, and Wayback Machine historical snapshots. |
techstack-security | skills/techstack-security/ | 2 | Security-posture and third-party SaaS identification — security headers, CSP, HSTS, email auth, security.txt, plus payments/analytics/auth/CRM/support integrations. |
AI / LLM Security (5)
| Skill | Dir | Files | Description |
|---|---|---|---|
ai-threat-testing | skills/ai-threat-testing/ | 25 | Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, da... |
llm-testing | skills/llm-testing/ | 10 | Testing prompts and wordlists for evaluating Large Language Model (LLM) security, safety, and robustness. Curated test cases for bias detection, data leakage prevention, alignme... |
agentic-app-audit | skills/agentic-app-audit/ | 1 | Black-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory poisoning, confused-depu... |
llm-redteam | skills/llm-redteam/ | 1 | LLM application red-teaming — prompt injection (direct + indirect), jailbreak, system-prompt leak, data exfiltration, guardrail bypass, multi-turn ... |
mcp-server-audit | skills/mcp-server-audit/ | 1 | Security audit of Model Context Protocol (MCP) servers — tool poisoning, prompt injection via tool descriptions and results, unscoped/over-privileg... |
Offensive Research (6)
| Skill | Dir | Files | Description |
|---|---|---|---|
cryptography | skills/cryptography/ | 24 | Cryptanalysis techniques — lattice attacks, padding oracles, weak-RNG exploitation, signature forgery, secret-sharing recovery. |
cve-poc-generator | skills/cve-poc-generator/ | 2 | CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report. |
cve-risk-score | skills/cve-risk-score/ | 2 | Retrieve CVE risk scores from NVD. Auto-invoked whenever a CVE ID is mentioned to display CVSS score, severity, CWE, and description. |
dfir | skills/dfir/ | 31 | Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when inves... |
reverse-engineering | skills/reverse-engineering/ | 22 | Static and dynamic reverse engineering — ELF/PE analysis, custom-VM bytecode, packed binaries, anti-debug bypass, Frida hooking. |
source-code-scanning | skills/source-code-scanning/ | 7 | Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code,... |
Tooling / Workflow (10)
| Skill | Dir | Files | Description |
|---|---|---|---|
caido-mode | skills/caido-mode/ | 1415 | Full Caido SDK integration for Claude Code. Search HTTP history, replay/edit requests, manage scopes/filters/environments, create findings, export curl commands, and control int... |
coordination | skills/coordination/ | 20 | Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements. |
essential-tools | skills/essential-tools/ | 9 | Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards. |
github-workflow | skills/github-workflow/ | 4 | GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review. Use when asked to commit, push, create PRs/branches/issues, or manage git wo... |
patt-fetcher | skills/patt-fetcher/ | 1 | Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment. |
script-generator | skills/script-generator/ | 1 | Generates optimized, syntax-validated scripts on demand. Never executes — only generates, optimizes, and validates. |
skill-prune | skills/skill-prune/ | 1 | Identify and remove negative-ROI skill content — orphan files, never-read entries, duplicates, content reintroducing challenge-specific lore. Inverse of /skill-update. Use durin... |
skill-update | skills/skill-update/ | 4 | Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits. Use when creating, updating, or improv... |
transilience-report-style | skills/transilience-report-style/ | 11 | Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards. |
argus | skills/argus/ | 1 | Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null... |
Other (12)
| Skill | Dir | Files | Description |
|---|---|---|---|
Android-Pentesting-Skill | skills/android-pentesting-skill/ | 187 | > Comprehensive Android APK security audit with static analysis, dynamic instrumentation, source-to-sink tracing, IPC/component abuse analysis, and CVSS 4.0 reporting. Covers de... |
SecLists Fuzzing (Curated) | skills/seclists-fuzzing-curated/ | 9 | Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing. |
SecLists Passwords (Curated) | skills/seclists-passwords-curated/ | 11 | Top password lists for authorized security testing: common passwords, darkweb leaks, worst passwords. Curated essentials (<10MB). |
SecLists Pattern-Matching | skills/seclists-pattern-matching/ | 12 | Sensitive data patterns for security testing: API keys, credit cards, emails, SSNs, phone numbers, IPs, and more. Use for data discovery and validation. |
SecLists Payloads (Curated) | skills/seclists-payloads-curated/ | 11 | Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing. |
SecLists Usernames (Curated) | skills/seclists-usernames-curated/ | 4 | Top username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing. |
SecLists Web-Shells | skills/seclists-web-shells/ | 62 | Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells. Use for security research and detection system testing. |
blockchain-security | skills/blockchain-security/ | 4 | Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address p... |
enterprise-vpn-attack | skills/enterprise-vpn-attack/ | 1 | External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti... |
m365-entra-attack | skills/m365-entra-attack/ | 1 | Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional A... |
okta-attack | skills/okta-attack/ | 1 | Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypa... |
vmware-vcenter-attack | skills/vmware-vcenter-attack/ | 1 | VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugi... |