skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 39 files.

• ad-breach

  Full Active Directory attack-path enumeration and exploitation methodology on Linux: comprehensive LDAP/SMB/RPC enumeration from zero-creds to Domain Admin, BloodHound attack-graph analysis, Kerberos weaknesses (AS-REP roasting, Kerberoasting, resource-based constrained delegation abuse), GenericAll/ACL exploitation chains, credential harvesting (DCSync, LAPS, GPP), AD CS attacks (ESC1-ESC8), NTL…

  ad-breach/SKILL.md on GitHub (opens in a new tab)

• ai-llm-hunter

  Systematic LLM/AI security testing methodology — prompt injection (direct & indirect), system prompt leakage, exfiltration, agentic trust-boundary abuse, and cross-tenant IDOR in AI-backed systems. Use when testing any product powered by an LLM, AI agent, or agentic framework.

  ai-llm-hunter/SKILL.md on GitHub (opens in a new tab)

• attack-surface

  Maps every entry point, component, and trust boundary of a target before testing begins prevents missed coverage and prioritizes the highest-value attack paths. Trigger when the user provides a target and wants to know where to start, says "map the attack surface", "what should I test", or "where do I begin", or is starting any engagement after scope-grill is complete.

  attack-surface/SKILL.md on GitHub (opens in a new tab)

• bugbounty-reporter

  Converts raw bug bounty findings into a complete, triage-ready report clear description, numbered reproduction steps, self-contained PoC, risk, and remediation. Trigger when the user has a confirmed bug bounty finding and needs to write it up, says "write this up", "report this", or "format this for H1/Bugcrowd/Intigriti", or has raw notes, a request/response, or a PoC needing a submission-ready…

  bugbounty-reporter/SKILL.md on GitHub (opens in a new tab)

• caveman

  Ultra-compressed response mode for cybersecurity contexts strips filler while keeping CVEs, payloads, CVSS scores, and findings exact. User-triggered only never self-activated. Trigger when the user explicitly says "/caveman", "caveman mode", "be brief", "tl;dr", "just the findings", "straight to the point", "keep it short", or similar explicit brevity requests.

  caveman/SKILL.md on GitHub (opens in a new tab)

• check-exploit

  Search known exploit databases and sources for a given service, version, or CVE, from searchsploit to Vulners, MSF, and beyond. Trigger when the user has identified a service/version and wants to know if public exploits exist, provides a CVE ID and wants PoC or weaponized exploit references, ran nmap/banner grabbing and wants to cross-reference exploit databases, wants to know if a vulnerability…

  check-exploit/SKILL.md on GitHub (opens in a new tab)

• clickjacking-hunter

  Complete clickjacking (UI redressing) methodology framing protection detection, single-click and multi-step PoC construction, JS frame-busting bypass, drag-and-drop and OAuth consent variants, and report structure. Trigger when the user asks to test for clickjacking or UI redressing, wants to check if a sensitive endpoint (account delete, 2FA disable, OAuth consent) is frameable, needs to build a…

  clickjacking-hunter/SKILL.md on GitHub (opens in a new tab)

• compliance-gap-analyzer

  Aggregates audit findings mapped to framework controls, classifies each control, identifies blind spots, prioritizes gaps by severity, and produces a complete gap report supports ISO 27001, NIST CSF, PCI-DSS, and OWASP. Trigger when the user provides audit findings tagged to framework controls and asks for a gap report, asks what controls are failing or what their biggest compliance gaps are, nee…

  compliance-gap-analyzer/SKILL.md on GitHub (opens in a new tab)

• control-lookup

  Looks up any control ID across ISO 27001, NIST CSF, PCI-DSS v4, and OWASP returns the full control card, cross-framework mappings with confidence level, related controls, and testing hints. Trigger when the user provides a control ID and asks what it means, asks how controls map across frameworks, searches for a control by keyword or description, needs testing hints or evidence criteria before wr…

  control-lookup/SKILL.md on GitHub (opens in a new tab)

• ctf-writeup

  Generates a clean, publishable CTF challenge writeup from solve notes suitable for HTB, CTFtime, personal blogs, and team wikis. Trigger when the user solved a CTF challenge and wants to document it, says "write up this challenge", "generate a writeup", or "document my solve", or wants a record of solutions for their team's internal wiki.

  ctf-writeup/SKILL.md on GitHub (opens in a new tab)

• cvss-scorer

  Computes an exact CVSS v3.1 base score and vector from a vulnerability description infers metrics from context, asks one sharp question only when ambiguity would change the severity level. Trigger when the user needs a CVSS score for a vulnerability finding, is writing a bug bounty report or pentest finding needing a severity vector, says "score this" or "what's the CVSS?", or has a vulnerability…

  cvss-scorer/SKILL.md on GitHub (opens in a new tab)

• deadangle

  A final accuracy check for offensive security work — it re-tests each conclusion against the evidence and labels every part confirmed, inferred, or assumed, so an unverified result never goes out as if it were proven. Trigger when the user says "deadangle" or "/deadangle", before delivering a finding/vulnerability conclusion/attack path, after completing recon and summarizing coverage, before pre…

  deadangle/SKILL.md on GitHub (opens in a new tab)

• droid-recon

  Full static analysis methodology for Android APK files on Linux — decompiles with apktool and jadx, hunts for hardcoded secrets and API keys, maps endpoints and network surface, fingerprints the tech stack, detects vulnerability patterns, and produces a structured Markdown report aligned to OWASP MASVS. Trigger when the user provides an APK file and asks for a security review, secret scan, endpoi…

  droid-recon/SKILL.md on GitHub (opens in a new tab)

• economist-attack

  Weighs each attack path's effort against its likely impact, pursuing the highest-value surfaces first to find the most important weakness with the least wasted effort it shapes the order you test in, not what you test. Trigger when doing any offensive security engagement and deciding where to focus effort, when the attack surface is large and not everything can be tested with equal depth, or when…

  economist-attack/SKILL.md on GitHub (opens in a new tab)

• engagement-handoff

  Documents the current state of an active pentest engagement so the next agent session can continue without losing context, covering findings, coverage, next steps, and open threads. Trigger when the user says "handoff", "save progress", "pick this up next session", or "summarize the engagement", when the context window is getting long and work needs to continue in a fresh session, or at the end o…

  engagement-handoff/SKILL.md on GitHub (opens in a new tab)

• find-skills

  Helps users discover and install Rifteo agent skills when they ask questions like "is there a skill for X", "how do I write a finding", "find a skill that can...", or want to extend their agent for security and audit work.

  find-skills/SKILL.md on GitHub (opens in a new tab)

• finding-writer

  Converts raw pentest notes, logs, or observations into a structured audit finding ready for a security report. Trigger when the user pastes raw notes, tool output, or a quick observation from a pentest, describes a vulnerability needing structure for a client report, has a log snippet or HTTP request/response revealing a security issue, or wants to turn a single-line note into a deliverable write…

  finding-writer/SKILL.md on GitHub (opens in a new tab)

• graphql-raider

  Complete GraphQL security testing methodology — introspection abuse and schema enumeration, field suggestion oracle (when introspection is disabled), query depth/batching DoS, alias-based rate limit bypass, injection through arguments (SQL/NoSQL/SSTI), broken object-level and field-level authorization (IDOR via mutations), CSRF via GET mutations and content-type bypass, subscription hijacking via…

  graphql-raider/SKILL.md on GitHub (opens in a new tab)

• hexstrike-forge

  A 5-phase structured pentest methodology for the hexstrike-ai MCP server, covering passive recon through finding delivery with triage gates, parallel execution, and tool failure recovery.

  hexstrike-forge/SKILL.md on GitHub (opens in a new tab)

• high-severity-hunter

  Expert bug hunting mindset for bug bounty and pentest engagements. Context-driven: derives attack priorities from program scope, tech stack, features, and enumeration results rather than a fixed checklist. Hunts High/Critical severity bugs first, then falls to Medium and Low. POC-or-kill rule enforced throughout. Covers all attack classes, the target context tells you where to look. Use at the st…

  high-severity-hunter/SKILL.md on GitHub (opens in a new tab)

• hpp-hunter

  Complete HTTP Parameter Pollution methodology server behavior fingerprinting, server-side and client-side HPP, WAF bypass via parameter splitting, OAuth/payment/access-control abuse, header and JSON body pollution, and report structure. Trigger when the user wants to test for HTTP Parameter Pollution, is trying to bypass a WAF with a known-blocked payload, sees a payment/role/redirect parameter a…

  hpp-hunter/SKILL.md on GitHub (opens in a new tab)

• idor-hunter

  Systematic IDOR/BOLA detection methodology recon, multi-account testing, bypass techniques, and report structure. Trigger when the user asks to test authorization controls or object-level access restrictions, wants to hunt for IDOR or BOLA on an API or web app, needs a structured methodology for multi-account access testing, is doing a bug bounty or pentest and wants to maximize IDOR coverage, or…

  idor-hunter/SKILL.md on GitHub (opens in a new tab)

• js-analyzer

  Full JavaScript analysis methodology for pentesting and bug bounty JS file discovery, secret extraction, endpoint mapping, DOM XSS, prototype pollution, postMessage abuse, client-side logic flaws, source map extraction, and hardcoded credential hunting. Trigger when the user wants to analyze JavaScript files from a target, asks to find endpoints/API routes/hidden parameters in JS bundles, wants t…

  js-analyzer/SKILL.md on GitHub (opens in a new tab)

• jwt-cracker

  Full JWT attack methodology alg:none, RS256 to HS256 confusion, weak secret brute-force, kid injection, jku/jwk injection, and claim tampering. Trigger when the user asks to test JWT tokens, authentication bypass, or token forgery, wants to try alg:none/algorithm confusion/weak secret brute-force, needs to test kid/jku/x5u/jwk injection, asks to check if exp/iss/aud claims are validated, is tryin…

  jwt-cracker/SKILL.md on GitHub (opens in a new tab)

• less-aggressive-attack

  Tests for vulnerabilities less aggressively — read-only where possible, confirming a flaw without exercising its full impact or causing damage, under a strict set of safety rules. Not the default; activate only when the user explicitly signals safety as a constraint, e.g. "don't break anything", "read-only", "non-destructive testing", "careful with production", "keep it clean", or "just prove the…

  less-aggressive-attack/SKILL.md on GitHub (opens in a new tab)

• less-noise-attack

  Runs offensive work in a low-noise mode — passive recon first, minimal footprint, and only deliberate, targeted active actions that blend with legitimate traffic, so the engagement stays below detection thresholds. Not the default; activate only when the user explicitly signals stealth as the priority, e.g. "stay under the radar", "avoid the SOC", "be stealthy", "ghost mode", "don't trigger alert…

  less-noise-attack/SKILL.md on GitHub (opens in a new tab)

• nuclei-template-writer

  Convert a vulnerability description or HTTP request/response pair into a ready-to-run Nuclei YAML template handles auth strategies, matcher selection, OOB detection, and multi-step flows. Trigger when the user found a vulnerability and wants to automate detection on other targets, pastes an HTTP request/response and asks for a Nuclei template, says "write a nuclei template for this" or "automate…

  nuclei-template-writer/SKILL.md on GitHub (opens in a new tab)

• pentest-report

  Generates a complete, client-ready penetration test report from all findings in the current engagement executive summary, risk table, technical findings, and recommendations. Trigger when the user says "generate the report", "write the report", or "produce the deliverable", is at the end of an engagement with all findings confirmed and written up, or wants a draft report to review before sending…

  pentest-report/SKILL.md on GitHub (opens in a new tab)

• redirect-forge

  Complete open redirect detection and exploitation methodology parameter discovery, 30+ bypass techniques, OAuth token theft, SSRF chaining, CSP abuse, phishing escalation, and report structure. Trigger when the user asks to test for open redirect or unvalidated redirect/forward, sees a parameter like ?next=/?url=/?redirect=/?return=/?goto= in a URL, wants to steal OAuth tokens via redirect_uri ma…

  redirect-forge/SKILL.md on GitHub (opens in a new tab)

• redmind

  Red team mindset that shifts the agent to offensive security thinking across any target or engagement type. Trigger when the goal of the engagement is offensive (finding what can be broken, bypassed, or abused), the user wants to understand a target's security posture from an attacker's perspective, or the objective is to find vulnerabilities, simulate an attacker, or test whether controls hold u…

  redmind/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• claude-memby thedotmack Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and inject… 101k stars · 20 skills
• oh-my-openagentby code-yeongyu OmO: Just type "mass ulw" keyword with your prompt. Now you are the master of graph engineering. 70.1k stars · 25 skills
• claude-code-best-practiceby shanraisshan from vibe coding to agentic engineering - practice makes claude perfect 67.6k stars · 9 skills
• CowAgentby zhayujie Open-source personal AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent,… 47.4k stars · 3 skills
• cogneeby topoteretes Cognee is the open-source AI memory platform for agents. Give your AI agents persistent long-term memory with small models for free 32.4k stars · 11 skills
• vibe-coding-cnby tradecatlabs Vibe Coding 从入门到精通教程｜AI 结对编程工作流｜Prompt、Skill、Workflow、上下文管理、codex实战指南 17.6k stars · 21 skills