TORCH

In the author's own words, from each skill's SKILL.md — showing the first 30 of 56 files.

• claude-md-improver

  OFFLINE FALLBACK for the claude-md-management plugin - prefer that plugin when it is installed. Audit and improve CLAUDE.md files - scan for CLAUDE.md files, evaluate quality against templates, output a report, then make targeted updates. Invoke explicitly (/claude-md-improver) when the plugin is unavailable.

  skills/claude-md-improver/SKILL.md on GitHub (opens in a new tab)

• disclosure

  Drive responsible disclosure of a proven finding to a CVE. Package the report, find the vendor contact, report privately, coordinate a timeline, request the CVE (vendor CNA / GitHub / MITRE), and publish an advisory. Closes the research loop. Triggers - "disclose", "request a cve", "report this to the vendor".

  skills/disclosure/SKILL.md on GitHub (opens in a new tab)

• research

  Vulnerability-research loop toward a novel CVE. Target triage -> attack-surface map -> ranked hypotheses -> investigate (RE / fuzz / audit) -> a finding deepens the loop, a dead-end pivots to a new approach. Uses the full wiki + hunt skillset. Scaffolds and persists state under raw/research/<project>/. Triggers - "research", "find a cve", "analyze this binary/library", "audit this code for vulns".

  skills/research/SKILL.md on GitHub (opens in a new tab)

• wiki

  Search, query, and maintain the qmd-indexed wiki - semantic search, keyword search, re-index after adding pages, check index status.

  skills/wiki/SKILL.md on GitHub (opens in a new tab)

• hunt-burp

  Drive Burp Suite over its MCP server as an AI triage + attack layer - review proxy history for signals, replay via Repeater/send, OOB-gate blind bugs with Collaborator, fuzz via Intruder (RoE-safe), then hand off to the matching vuln-class hunt. Wiki-first, FIND schema output.

  skills/burp/hunt-burp/SKILL.md on GitHub (opens in a new tab)

• screenshot-burp

  Capture a Burp Suite Repeater request/response as a PoC image (targets/<eng>/poc/) by driving the Burp MCP + the Kali GUI. Replays a request in a Repeater tab, sends it, and grabs the request+response panes - a Burp-native PoC (client report / CTF writeup). Use when you want the evidence to come from Burp rather than a curl/terminal card, or whenever you drive a target through Burp and need the i…

  skills/burp/screenshot-burp/SKILL.md on GitHub (opens in a new tab)

• hunt-ad

  Active Directory attack hunting - enumeration to domain dominance. Spray-safe (lockout gate), AS-REP/Kerberoast, ACL + ADCS (ESC1-16), delegation, DCSync, lateral movement. Wiki-first, FIND schema output.

  skills/hunt/hunt-ad/SKILL.md on GitHub (opens in a new tab)

• hunt-api

  API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse. OWASP API Top 10. Wiki-first, FIND schema output.

  skills/hunt/hunt-api/SKILL.md on GitHub (opens in a new tab)

• hunt-auth

  Auth bypass and ATO hunting - legacy protocol matrix (XMLRPC, SharePoint /_vti_bin/, EWS, Citrix, etc.), JWT manipulation, password reset poisoning, SAML auth bypass, session fixation. Wiki-first, FIND schema output.

  skills/hunt/hunt-auth/SKILL.md on GitHub (opens in a new tab)

• hunt-bizlogic

  Business-logic flaw hunting - workflow/state bypass, price/quantity tampering, negative/overflow values, coupon/refund abuse, mass assignment, and logic races. The top-paying bug class with no scanner coverage. Wiki-first, FIND schema output.

  skills/hunt/hunt-bizlogic/SKILL.md on GitHub (opens in a new tab)

• hunt-cache

  Web cache poisoning + cache deception hunting - unkeyed input poisoning, cache-key analysis, path-confusion deception, header/parameter cloaking. Wiki-first, FIND schema output.

  skills/hunt/hunt-cache/SKILL.md on GitHub (opens in a new tab)

• hunt-cicd

  CI/CD pipeline attack hunting (GitHub Actions focus) - pwn requests (pull_request_target), script injection, self-hosted runner takeover, cache poisoning, OIDC-to-cloud token theft, poisoned pipeline execution. Wiki-first, FIND schema output.

  skills/hunt/hunt-cicd/SKILL.md on GitHub (opens in a new tab)

• hunt-cloud

  Cloud attack hunting for AWS / Azure / GCP - credential discovery, metadata SSRF, IAM privesc, service enumeration, persistence. Scope + billing aware. Wiki-first, FIND schema output.

  skills/hunt/hunt-cloud/SKILL.md on GitHub (opens in a new tab)

• hunt-core

  Shared discipline for every hunt-* skill: scope and authorization gating, the two-account rule, the confirmation gate that separates a real finding from a false positive, enumeration limits, stop conditions, marker discipline, wiki-first query and self-heal, FIND output, Deadends, and wiki distillation. ALWAYS LOADED alongside any hunt skill. Also trigger directly on "is this in scope", "is this…

  skills/hunt/hunt-core/SKILL.md on GitHub (opens in a new tab)

• hunt-deserialization

  Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output.

  skills/hunt/hunt-deserialization/SKILL.md on GitHub (opens in a new tab)

• hunt-federation

  OAuth and SAML attack hunting - redirect_uri bypass, state CSRF, SAML XSW (XSW1-XSW8), signature stripping, comment injection. Wiki-first, FIND schema output.

  skills/hunt/hunt-federation/SKILL.md on GitHub (opens in a new tab)

• hunt-ics

  ICS/SCADA/OT exploitation - Modbus (502), S7comm (102), EtherNet/IP (44818), DNP3, OpenPLC, Node-RED SCADA, PLC/HMI/coil/holding-register attacks. Use when a target exposes industrial protocols or the goal is to drive a plant to a dangerous state (over-pressure/over-speed/disable interlock) and read the flag the HMI/CCTV reveals.

  skills/hunt/hunt-ics/SKILL.md on GitHub (opens in a new tab)

• hunt-idor

  IDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and delete operations. Bounded ID sampling, never range sweeps. Wiki-first, FIND schema output. Trigger on IDOR, BOLA, broken access control, object level authorization, cross-tenant, "read another user's data"…

  skills/hunt/hunt-idor/SKILL.md on GitHub (opens in a new tab)

• hunt-injection

  GraphQL IDOR/auth-bypass, XXE file-read/SSRF (SVG/DOCX/SAML), SSTI detection and RCE. OOB-mandatory for blind XXE. Wiki-first, FIND schema output.

  skills/hunt/hunt-injection/SKILL.md on GitHub (opens in a new tab)

• hunt-llm

  LLM / AI application attack hunting - prompt injection (direct + indirect), excessive agency, insecure output handling, system-prompt + data leakage. OWASP LLM Top 10. Wiki-first, FIND schema output.

  skills/hunt/hunt-llm/SKILL.md on GitHub (opens in a new tab)

• hunt-m365

  Microsoft 365 / Entra ID attack - tenant discovery, user enumeration via OneDrive differential (2026 verified), AADSTS code reference, Smart Lockout math (hard cap 1-2 attempts/user), ROPC validation, Conditional Access mapping. Wiki-first, FIND schema output.

  skills/hunt/hunt-m365/SKILL.md on GitHub (opens in a new tab)

• hunt-macos

  macOS attack hunting - foothold to root/persistence on a macOS host. TCC/Gatekeeper/SIP bypass, keychain + credential loot, code-signing/entitlements abuse, XPC/dylib/library injection, launch-constraint evasion, MDM/installer abuse. Wiki-first, FIND schema output.

  skills/hunt/hunt-macos/SKILL.md on GitHub (opens in a new tab)

• hunt-mcp

  MCP server attack hunting - tool poisoning, indirect prompt injection via tool output, rug-pull updates, cross-tool shadowing, over-permissioned/excessive-agency tools, lethal trifecta. Wiki-first, FIND schema output.

  skills/hunt/hunt-mcp/SKILL.md on GitHub (opens in a new tab)

• hunt-rce

  RCE hunting - template injection, YAML/XML deserialization, dependency confusion, Kubernetes surfaces, CVE-specific exploits (Apache CVE-2021-41773, Spring CVE-2022-22963). OOB-mandatory for blind cases. Wiki-first, FIND schema output.

  skills/hunt/hunt-rce/SKILL.md on GitHub (opens in a new tab)

• hunt-secrets

  Exposed-secrets hunting - .git/ dir + history mining, exposed .env/config files, hardcoded keys in JS bundles + source maps, S3/blob exposure, public-repo secret search, CI/CD leakage. Live-validation mandatory. Wiki-first, FIND schema output.

  skills/hunt/hunt-secrets/SKILL.md on GitHub (opens in a new tab)

• hunt-smuggling

  HTTP request smuggling / desync hunting - CL.TE, TE.CL, TE.TE, CL.0, and HTTP/2 downgrade. Timing-based detection, differential confirmation, no-blind-claims. Wiki-first, FIND schema output.

  skills/hunt/hunt-smuggling/SKILL.md on GitHub (opens in a new tab)

• hunt-sqli

  SQLi and NoSQLi hunting - error-based, boolean-blind, time-based, UNION, NoSQL operator injection. sqlmap automation after manual confirmation. Wiki-first, FIND schema output.

  skills/hunt/hunt-sqli/SKILL.md on GitHub (opens in a new tab)

• hunt-ssrf

  SSRF hunting - OOB-mandatory methodology. Cloud metadata, blind SSRF via Collaborator/interactsh, redirect-based bypass, headless browser chains. Wiki-first, FIND schema output.

  skills/hunt/hunt-ssrf/SKILL.md on GitHub (opens in a new tab)

• hunt-upload

  File upload attack hunting - extension/content-type/magic-byte bypass to web-shell RCE, path traversal in filename, SVG/XML XSS, zip slip, and pixel-flood DoS. Wiki-first, FIND schema output.

  skills/hunt/hunt-upload/SKILL.md on GitHub (opens in a new tab)

• hunt-vpn

  Enterprise SSL VPN attack - vendor fingerprinting, CVE matrix (Cisco, Fortinet, Citrix, Palo Alto, Pulse/Ivanti), default credentials, pre-auth exploit commands. Wiki-first, FIND schema output.

  skills/hunt/hunt-vpn/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• Understand-Anythingby Egonex-AI Graphs that teach > graphs that impress. Turn any code into an interactive knowledge graph you can explore, search, and ask questions about… 86.5k stars · 9 skills
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 84.1k stars · 2 skills
• nanoclawby nanocoai A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other… 31k stars · 30 skills
• planning-with-filesby OthmanAdi Persistent file-based planning for AI coding agents and long-running tasks. Crash-proof markdown plans, session recovery after /clear and c… 27.5k stars · 6 skills
• bragby latent-spaces You built it. Now brag. Turn the project you just created into a short, shareable launch video with one command. 16.2k stars · 2 skills
• Skill_Seekersby yusufkaraaslan Convert documentation websites, GitHub repositories, and PDFs into Claude AI skills with automatic conflict detection 15.2k stars · 25 skills