claude-ai-cyber-security-skills

In the author's own words, from each skill's SKILL.md.

• program-selection

  Evaluate HackerOne / Bugcrowd / Intigriti programs before committing time. Decide signal-to-noise, payout history, response time, scope size, and competition level. Use when the user is considering a new bug bounty target or asking "should I hunt this".

  skills/01-program-selection/SKILL.md on GitHub (opens in a new tab)

• scope-analysis

  Parse HackerOne / Bugcrowd / Intigriti scope into a structured asset list with in-scope, out-of-scope, and excluded-vuln-class breakdowns. Use when the user has chosen a program and needs to understand exactly what's allowed before recon.

  skills/02-scope-analysis/SKILL.md on GitHub (opens in a new tab)

• threat-modeling-mindmap

  Build a mental and visual map of the target application before hunting — entry points, trust boundaries, data flows, and high-value functionality. Use when user has scope parsed and wants to plan WHERE to hunt rather than diving into recon.

  skills/03-threat-modeling-mindmap/SKILL.md on GitHub (opens in a new tab)

• subdomain-enum

  Enumerate subdomains using passive and active techniques (subfinder, amass, chaos, assetfinder, crtsh, DNS brute force). Use when the user has a root domain in scope and needs the full subdomain list before probing.

  skills/04-subdomain-enum/SKILL.md on GitHub (opens in a new tab)

• asset-discovery

  Probe subdomain list with httpx/dnsx/naabu to identify live hosts, open ports, status codes, titles, and basic fingerprints. Use after subdomain-enum produces a sub list. Output feeds into fingerprinting and content discovery.

  skills/05-asset-discovery/SKILL.md on GitHub (opens in a new tab)

• fingerprinting

  Identify exact technology stack, frameworks, versions, and CMS on live hosts. Use when the user has a live host list and needs to know what's running before choosing vuln classes to test.

  skills/06-fingerprinting/SKILL.md on GitHub (opens in a new tab)

• js-analysis

  Extract endpoints, secrets, and hidden routes from JavaScript files using LinkFinder, SecretFinder, JSluice, and source-map analysis. Use when the user has live hosts and needs to mine the JS for attack surface that's not visible in the UI.

  skills/07-js-analysis/SKILL.md on GitHub (opens in a new tab)

• content-discovery

  Fuzz directories, files, and parameters using ffuf, feroxbuster, arjun, paramspider, and x8. Use when the user has live hosts and needs to find hidden routes, backup files, exposed configs, and untracked URL parameters.

  skills/08-content-discovery/SKILL.md on GitHub (opens in a new tab)

• continuous-monitoring

  Set up nightly monitoring of subdomain changes, JS file diffs, new endpoints, and CVE matches against in-scope assets, with Discord/Slack/Telegram notifications. Use when the user has an active engagement and wants to be alerted to new attack surface without manual re-recon.

  skills/09-continuous-monitoring/SKILL.md on GitHub (opens in a new tab)

• idor-hunting

  Hunt Insecure Direct Object Reference (IDOR) — test horizontal and vertical privilege escalation across user IDs, org IDs, tenant boundaries, and unguessable identifiers. Use when the user has an API endpoint with an identifier in the path/body that may be tested for unauthorized cross-user access.

  skills/10-idor-hunting/SKILL.md on GitHub (opens in a new tab)

• auth-bypass

  Hunt authentication and authorization bypasses — forced browsing, path traversal in auth, header injection, JWT downgrade, OAuth state confusion, role manipulation. Use when an endpoint returns 401/403 but appears reachable.

  skills/11-auth-bypass/SKILL.md on GitHub (opens in a new tab)

• ato-chains

  Hunt full Account Takeover (ATO) by chaining lower-severity findings — IDOR-to-email-disclosure, password-reset-token-theft, OAuth-redirect-uri abuse, response-manipulation, cookie scope, CRLF in Set-Cookie, race-condition on signup. Use when the user wants to escalate small findings to ATO or thinks an ATO path exists.

  skills/12-ato-chains/SKILL.md on GitHub (opens in a new tab)

• xss

  Hunt reflected, stored, and DOM-based Cross-Site Scripting (XSS) including CSP bypass, polyglot payloads, mutation XSS (mXSS), markdown XSS, and template XSS. Use when the user has identified a parameter or input that reflects to the page, or wants to test for XSS in a specific input.

  skills/13-xss/SKILL.md on GitHub (opens in a new tab)

• sqli

  Hunt SQL injection in REST/GraphQL/SOAP/raw parameters using sqlmap, ghauri, manual UNION/Time/Boolean techniques, and custom WAF-bypass tamper scripts. Use when an input flows into a database query or when the user has identified a parameter that might be vulnerable.

  skills/14-sqli/SKILL.md on GitHub (opens in a new tab)

• ssrf

  Hunt Server-Side Request Forgery (SSRF) — internal network access, cloud metadata exploitation, gopher/file/dict protocol abuse, and 11 IP-filter bypass techniques. Use when an endpoint accepts a URL, hostname, or file path as input.

  skills/15-ssrf/SKILL.md on GitHub (opens in a new tab)

• ssti

  Hunt Server-Side Template Injection (SSTI) in Jinja2, Twig, Freemarker, Velocity, Smarty, ERB, Handlebars, Mustache, and Spring (SpEL). Use when input is reflected in a way that suggests template rendering — error pages, email templates, PDF generators, dynamic content systems.

  skills/16-ssti/SKILL.md on GitHub (opens in a new tab)

• file-upload

  Hunt file upload vulnerabilities — bypass content-type/extension/magic-byte/size filters, achieve XSS via SVG/HTML upload, achieve RCE via .phtml/.jsp/.htaccess, exploit path traversal in filenames, and use polyglot files. Use when an endpoint accepts file uploads.

  skills/17-file-upload/SKILL.md on GitHub (opens in a new tab)

• graphql

  Hunt GraphQL-specific vulns — introspection abuse, field-level authorization (IDOR), batched queries for brute force, alias-based rate limit bypass, deep query DoS, mutation injection, schema disclosure, suggestion leakage, CSRF via GET, and CSRF via POST without preflight. Use when a GraphQL endpoint is present.

  skills/18-graphql/SKILL.md on GitHub (opens in a new tab)

• jwt-attacks

  Hunt JSON Web Token (JWT) vulnerabilities — alg=none bypass, RS256→HS256 key confusion, weak HMAC secret cracking, kid path traversal, JWKS injection, jku/x5u header attacks, embedded JWK confusion, expired-token acceptance, claim mutability, and token replay. Use when an app uses JWT for authentication or stateless sessions.

  skills/19-jwt-attacks/SKILL.md on GitHub (opens in a new tab)

• oauth-oidc

  Hunt OAuth 2.0 and OIDC flaws — redirect_uri abuse, state CSRF, PKCE bypass, scope manipulation, implicit-flow token theft, postMessage origin tricks, ID token sub claim swap, JWKS confusion, response_type confusion, and OAuth-CSRF. Use when an app has Google/GitHub/Facebook/Apple/custom OAuth or OpenID Connect.

  skills/20-oauth-oidc/SKILL.md on GitHub (opens in a new tab)

• business-logic

  Hunt business logic flaws — race conditions, workflow state bypass, parameter pollution affecting logic, coupon/discount abuse, refund logic, multi-step process bypass, integer overflow, negative quantities, double-spend. Use when looking for non-CVE bugs that require understanding the app's intended workflow.

  skills/21-business-logic/SKILL.md on GitHub (opens in a new tab)

• subdomain-takeover

  Detect and exploit subdomain takeover via dangling DNS records pointing to deprovisioned cloud services (S3, GitHub Pages, Heroku, Azure, Shopify, AWS CloudFront, etc.). Use after subdomain enumeration to identify takeover candidates.

  skills/22-subdomain-takeover/SKILL.md on GitHub (opens in a new tab)

• cache-poisoning

  Hunt web cache poisoning, CDN cache poisoning, and cache deception attacks. Use when target uses a CDN (Cloudflare, Akamai, Fastly, AWS CloudFront) or has Varnish/nginx caches and you want to identify cache key flaws that let attackers serve malicious content to other users.

  skills/23-cache-poisoning/SKILL.md on GitHub (opens in a new tab)

• http-smuggling

  Hunt HTTP Request Smuggling (CL.TE, TE.CL, TE.TE, H2.CL, H2.TE, downgrade smuggling). Use when target is behind a reverse proxy / load balancer / CDN and you want to test for desync attacks that bypass front-end security controls.

  skills/24-http-smuggling/SKILL.md on GitHub (opens in a new tab)

• llm-ai-security

  Hunt vulnerabilities in LLM-powered applications — direct/indirect prompt injection, system prompt extraction, ASCII smuggling, RCE via code tools, agentic AI exploits (ASI01-ASI10), data exfiltration via response channels, IDOR in chat history, jailbreak chains, RAG poisoning. Use when target has a chatbot, AI assistant, copilot, or agentic AI features.

  skills/25-llm-ai-security/SKILL.md on GitHub (opens in a new tab)

• mobile-recon-android

  Mobile (Android) app recon and analysis — decompile APK, extract secrets, find hardcoded endpoints, exposed Firebase / AWS / API keys, deeplink abuse, intent vulnerabilities, exported components, WebView XSS, MobSF static analysis. Use when target's scope includes Android apps (.apk).

  skills/26-mobile-recon-android/SKILL.md on GitHub (opens in a new tab)

• cloud-misconfig

  Hunt cloud misconfigurations exposed externally — open S3/GCS buckets, exposed IAM-tied EC2 metadata, Cognito misconfig, GitHub Actions secret leakage, exposed Kubernetes API, public Elastic / Kibana / Mongo, Firebase RTDB rules, weak AWS access keys discovered in JS/mobile. Use when leveraging leaked credentials or hunting cloud surface in scope.

  skills/27-cloud-misconfig/SKILL.md on GitHub (opens in a new tab)

• triage-validation

  Validate a bug bounty finding before writing a report — the 7-Question Gate, 4 pre-submission gates, always-rejected list, conditional chain table, CVSS 3.1 quick reference, and severity decision guide. Use BEFORE writing any report to avoid N/A and low quality submissions.

  skills/28-triage-validation/SKILL.md on GitHub (opens in a new tab)

• hackerone-reporting

  Write production-grade HackerOne reports — title formula, impact-led writing, CVSS 3.1 scoring, complete PoC formatting, attached files, and submission etiquette. Use AFTER triage-validation passes and you're ready to submit on HackerOne.

  skills/29-hackerone-reporting/SKILL.md on GitHub (opens in a new tab)

• bugcrowd-reporting

  Write Bugcrowd-format reports — VRT (Vulnerability Rating Taxonomy) mapping, P1-P5 severity, impact-led writing, and Bugcrowd-specific submission etiquette. Use AFTER triage-validation passes for Bugcrowd programs.

  skills/30-bugcrowd-reporting/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• awesome-agent-skillsby VoltAgent A curated collection of 1000+ agent skills from official dev teams and the community, compatible with Claude Code, Codex, Gemini CLI, Curso… 35.8k stars
• planning-with-filesby OthmanAdi Persistent file-based planning for AI coding agents and long-running tasks. Crash-proof markdown plans, session recovery after /clear and c… 27.5k stars · 6 skills
• video-shotcraftby Vincentwei1021 AI video skill for Claude Code & Codex — cinematic product videos with Remotion: 152 shot recipe cards, 209 motion previews, a production-r… 12.1k stars · 1 skill
• skillsby browser-act Browser automation CLI built for AI agents. Break through anti-bot walls, hand off to humans across platforms when stuck. Parallel multi-ta… 6.2k stars · 30 skills
• Continuous-Claude-v3by parcadei Context management for Claude Code. Hooks maintain state via ledgers and handoffs. MCP execution without context pollution. Agent orchestra… 3.9k stars · 30 skills
• ctf-skillsby ljagiello Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more 3.5k stars · 11 skills