RedBlueSkills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 140 files.

• REPLACE-with-kebab-case-name

  REPLACE. One or two sentences an agent reads to decide WHEN to use this skill. Lead with the action, then the trigger conditions. Keep under 1024 characters.

  _template/SKILL.md on GitHub (opens in a new tab)

• attack-my-application

  Orchestrate a full, authorized security assessment of an application — web, API, cloud-native, CI/CD, mobile, network service, or LLM/AI-backed. Use when the operator says "attack my application" (or points you at a target and asks for a security review). This skill fingerprints the target, detects its surface type, confirms authorization and scope, then drives the RedBlueSkills library end to en…

  orchestrators/attack-my-application/SKILL.md on GitHub (opens in a new tab)

• api-authentication-monitoring

  Detect Broken Authentication abuse (API2:2023) against an API from auth-endpoint telemetry and token-validation events — invalid-signature spikes, alg:none / downgrade tokens, expired/replayed tokens, and credential stuffing or brute force. Use when building API authentication detections or triaging suspected token forgery or account takeover.

  skills/api/blue/detect/api-authentication-monitoring/SKILL.md on GitHub (opens in a new tab)

• api-bola-detection

  Detect Broken Object Level Authorization (BOLA / API1:2023) abuse against a REST or GraphQL API from access logs, gateway telemetry, and authorization decisions. Use when building API access-control detections, triaging suspected cross-tenant data access, or hunting for object-id enumeration.

  skills/api/blue/detect/api-bola-detection/SKILL.md on GitHub (opens in a new tab)

• api-data-exposure-monitoring

  Detect excessive data exposure (API3:2023) in an API from response telemetry and schema-diff analysis — endpoints returning sensitive field names, oversized payloads, or fields absent from the sanctioned response schema. Use when building data-exposure detections or reviewing API responses for sensitive-field leakage.

  skills/api/blue/detect/api-data-exposure-monitoring/SKILL.md on GitHub (opens in a new tab)

• api-function-authorization-monitoring

  Detect Broken Function Level Authorization abuse (BFLA / API5:2023) against an API from access logs and role/route telemetry — low-privilege principals reaching admin or internal operations, method tampering, and role-claim misuse. Use when building API function-authorization detections or triaging suspected privilege escalation.

  skills/api/blue/detect/api-function-authorization-monitoring/SKILL.md on GitHub (opens in a new tab)

• api-inventory-monitoring

  Detect and close Improper Inventory Management (API9:2023) for a REST or GraphQL API. Use when building an authoritative API inventory and reconciling live traffic against it to surface shadow endpoints, zombie hosts, and deprecated versions still receiving requests — and to catch access to undocumented or non-production surfaces.

  skills/api/blue/detect/api-inventory-monitoring/SKILL.md on GitHub (opens in a new tab)

• api-business-flow-hardening

  Harden sensitive business flows against Unrestricted Access (API6:2023) and detect automated abuse. Use when a business-critical flow (checkout, inventory/ seat reservation, referral/reward redemption, signup, booking, voting) must be protected from scripted abuse — adding device/human verification, server-side quantity and rate caps, and behavioural detection of machine-speed completion.

  skills/api/blue/harden/api-business-flow-hardening/SKILL.md on GitHub (opens in a new tab)

• api-cors-trust-hardening

  Configure an explicit browser-origin policy for sensitive APIs and verify allowed and denied cross-origin reads. CORS is not a replacement for authentication or CSRF protection.

  skills/api/blue/harden/api-cors-trust-hardening/SKILL.md on GitHub (opens in a new tab)

• api-jwt-validation-hardening

  Harden JWT authentication with a server-chosen algorithm/key policy and required issuer, audience, type, and time checks. Use when configuring API token verification, not general login or password storage.

  skills/api/blue/harden/api-jwt-validation-hardening/SKILL.md on GitHub (opens in a new tab)

• api-mass-assignment-hardening

  Harden an API against mass assignment / Broken Object Property Level Authorization (API3:2023) by binding only allowlisted, client-writable fields and authorizing sensitive property changes server-side. Use when designing or reviewing create/update endpoints that bind request bodies to objects.

  skills/api/blue/harden/api-mass-assignment-hardening/SKILL.md on GitHub (opens in a new tab)

• api-rate-limit-hardening

  Harden an API against Unrestricted Resource Consumption (API4:2023) with layered limits — gateway rate limiting, pagination and payload/complexity caps, and per-caller quotas on costly actions. Use when designing or reviewing an API that lacks throttling or bounds on a single caller's resource and cost footprint.

  skills/api/blue/harden/api-rate-limit-hardening/SKILL.md on GitHub (opens in a new tab)

• api-security-configuration-hardening

  Harden a REST or GraphQL API against Security Misconfiguration (API8:2023). Use when establishing a secure configuration baseline: strict CORS, a global error handler that never leaks internals, a security-header set, removal or authentication of debug/management/introspection endpoints, safe HTTP methods, and TLS enforcement — plus the config-drift checks that keep it that way.

  skills/api/blue/harden/api-security-configuration-hardening/SKILL.md on GitHub (opens in a new tab)

• api-ssrf-hardening

  Harden a REST or GraphQL API against Server-Side Request Forgery (SSRF / API7:2023) and detect exploitation attempts. Use when the API fetches client-supplied URLs (webhooks, importers, link previews, image/URL fields) and you need to constrain outbound destinations, enforce IMDSv2, and alert on egress to internal or metadata addresses.

  skills/api/blue/harden/api-ssrf-hardening/SKILL.md on GitHub (opens in a new tab)

• api-third-party-consumption-hardening

  Harden an application against Unsafe Consumption of APIs (API10:2023). Use when your service integrates third-party/upstream APIs (identity, payment, enrichment, shipping, inbound webhooks) and you need to treat their responses as untrusted: validating and sanitizing upstream data, enforcing TLS validation/pinning, refusing to blindly follow upstream-supplied redirects, and monitoring integration…

  skills/api/blue/harden/api-third-party-consumption-hardening/SKILL.md on GitHub (opens in a new tab)

• api-webhook-authentication-hardening

  Harden incoming webhooks with provider signature verification, signed freshness checks where supported, and durable idempotent processing.

  skills/api/blue/harden/api-webhook-authentication-hardening/SKILL.md on GitHub (opens in a new tab)

• api-cors-trust-assessment

  Assess whether a browser can read sensitive API responses from an untrusted origin. Use for CORS trust reviews, not generic CSRF or server-to-server authentication.

  skills/api/red/collection/api-cors-trust-assessment/SKILL.md on GitHub (opens in a new tab)

• api-excessive-data-exposure

  Find and prove excessive data exposure (part of API3:2023) in an API during an authorized test — endpoints that return more object properties than the caller needs, leaking sensitive or internal fields the client merely hides. Use when an API response may carry fields beyond what the consuming UI displays.

  skills/api/red/collection/api-excessive-data-exposure/SKILL.md on GitHub (opens in a new tab)

• api-broken-authentication

  Assess Broken Authentication (API2:2023) in an API during an authorized test — JWT verification flaws, weak or missing token expiry, credential stuffing and brute force against token/login endpoints, and reset/OTP abuse. Use when you need to confirm an API's authentication can be bypassed, forged, or overwhelmed.

  skills/api/red/credential-access/api-broken-authentication/SKILL.md on GitHub (opens in a new tab)

• api-jwt-validation-abuse

  Assess JWT signature and claim validation during an authorized API review. Use for bearer-token middleware that must reject unsigned, incorrectly signed, expired, or wrong-audience access tokens.

  skills/api/red/credential-access/api-jwt-validation-abuse/SKILL.md on GitHub (opens in a new tab)

• api-sensitive-business-flow-abuse

  Prove Unrestricted Access to Sensitive Business Flows (API6:2023) during an authorized assessment — automating a business-critical flow (checkout, ticket/ inventory reservation, referral/reward redemption, signup, comment/booking) at a rate or scale the business never intended. Use when an endpoint is technically authorized per request but lacks anti-automation controls, so a script can abuse the…

  skills/api/red/impact/api-sensitive-business-flow-abuse/SKILL.md on GitHub (opens in a new tab)

• api-unrestricted-resource-consumption

  Assess Unrestricted Resource Consumption (API4:2023) in an API during an authorized test — missing rate limits, pagination caps, payload-size limits, and cost controls that let a caller exhaust CPU, memory, money, or third-party quota. Use when you need to confirm an API lacks the throttling and limits that bound a single caller's resource use.

  skills/api/red/impact/api-unrestricted-resource-consumption/SKILL.md on GitHub (opens in a new tab)

• api-ssrf

  Find and prove Server-Side Request Forgery (SSRF / API7:2023) in a REST or GraphQL API during an authorized assessment. Use when the API fetches a client-supplied URL, hostname, or resource reference — webhooks, url/image/ callback parameters, document importers, link previews, PDF renderers — and you need to confirm the server can be coerced into requesting attacker-chosen internal or cloud-meta…

  skills/api/red/initial-access/api-ssrf/SKILL.md on GitHub (opens in a new tab)

• api-unsafe-consumption

  Prove Unsafe Consumption of APIs (API10:2023) during an authorized assessment — a target application that blindly trusts data from a third-party/upstream API it consumes. Use when the target integrates an external or partner API (payment, enrichment, OAuth/identity, shipping, webhooks-in) and you can influence that upstream's response to inject into the target: unvalidated data, redirects to atta…

  skills/api/red/initial-access/api-unsafe-consumption/SKILL.md on GitHub (opens in a new tab)

• api-webhook-authentication-assessment

  Assess incoming webhook signature validation and duplicate-event handling using synthetic deliveries. Use for webhook receivers, not outbound callback SSRF.

  skills/api/red/initial-access/api-webhook-authentication-assessment/SKILL.md on GitHub (opens in a new tab)

• api-bfla

  Find and prove Broken Function Level Authorization (BFLA / API5:2023) in an API during an authorized test — reaching administrative or cross-role operations with a lower-privilege principal. Use when an endpoint or HTTP method performs a privileged action and you need to confirm role/function checks are missing.

  skills/api/red/privilege-escalation/api-bfla/SKILL.md on GitHub (opens in a new tab)

• api-bola

  Find and prove Broken Object Level Authorization (BOLA / API1:2023) in a REST or GraphQL API during an authorized assessment. Use when an object identifier in a path, query, body, or GraphQL argument selects a record and you need to confirm one authenticated principal can read or modify another principal's or tenant's objects.

  skills/api/red/privilege-escalation/api-bola/SKILL.md on GitHub (opens in a new tab)

• api-mass-assignment

  Find and prove mass assignment / Broken Object Property Level Authorization (API3:2023) in an API during an authorized test — setting privileged or internal object properties by adding them to a request body. Use when a create/update endpoint binds request fields to an object and you need to confirm it accepts properties the caller should not control.

  skills/api/red/privilege-escalation/api-mass-assignment/SKILL.md on GitHub (opens in a new tab)

• api-improper-inventory

  Discover Improper Inventory Management (API9:2023) during an authorized assessment — shadow, zombie, and deprecated API versions; undocumented hosts and environments; and endpoints missing from the official spec. Use when the current API is well-guarded but older versions, non-production hosts, or forgotten endpoints may still be reachable and less protected.

  skills/api/red/recon/api-improper-inventory/SKILL.md on GitHub (opens in a new tab)

• api-security-misconfiguration

  Discover and characterize API Security Misconfiguration (API8:2023) during an authorized assessment — permissive CORS, verbose error/stack-trace leakage, missing security headers, unauthenticated debug/actuator endpoints, default credentials, dangerous HTTP methods, and unpatched framework defaults. Use when fingerprinting an API's configuration hygiene and turning misconfigurations into concrete…

  skills/api/red/recon/api-security-misconfiguration/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 291k stars · 1 skill
• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 282k stars · 30 skills
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 220k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 165k stars · 6 skills
• ui-ux-pro-max-skillby nextlevelbuilder An AI skill that provides design intelligence for building professional UI/UX across multiple platforms. 137k stars · 7 skills
• graphifyby Graphify-Labs Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Curs… 127k stars · 1 skill