communitytools

In the author's own words, from each skill's SKILL.md — showing the first 30 of 50 files.

• transilience-report-style

  Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.

  formats/transilience-report-style/SKILL.md on GitHub (opens in a new tab)

• ai-threat-testing

  Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.

  skills/ai-threat-testing/SKILL.md on GitHub (opens in a new tab)

• api-security

  API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.

  skills/api-security/SKILL.md on GitHub (opens in a new tab)

• attack-path-stitcher

  Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.

  skills/attack-path-stitcher/SKILL.md on GitHub (opens in a new tab)

• authenticated-session-acquisition

  Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication ski…

  skills/authenticated-session-acquisition/SKILL.md on GitHub (opens in a new tab)

• authentication

  Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.

  skills/authentication/SKILL.md on GitHub (opens in a new tab)

• blockchain-security

  Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.

  skills/blockchain-security/SKILL.md on GitHub (opens in a new tab)

• client-side

  Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

  skills/client-side/SKILL.md on GitHub (opens in a new tab)

• cloud-containers

  Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.

  skills/cloud-containers/SKILL.md on GitHub (opens in a new tab)

• cloud-defense

  Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team posture review of the lateral-movement -> privilege-escalation -> exfiltration -> evasion chain.

  skills/cloud-defense/SKILL.md on GitHub (opens in a new tab)

• coordination

  Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.

  skills/coordination/SKILL.md on GitHub (opens in a new tab)

• cryptography

  Cryptanalysis techniques — lattice attacks, padding oracles, weak-RNG exploitation, signature forgery, secret-sharing recovery.

  skills/cryptography/SKILL.md on GitHub (opens in a new tab)

• cve-poc-generator

  CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.

  skills/cve-poc-generator/SKILL.md on GitHub (opens in a new tab)

• cve-risk-score

  Retrieve CVE risk scores from NVD. Auto-invoked whenever a CVE ID is mentioned to display CVSS score, severity, CWE, and description.

  skills/cve-risk-score/SKILL.md on GitHub (opens in a new tab)

• dfir

  Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.

  skills/dfir/SKILL.md on GitHub (opens in a new tab)

• essential-tools

  Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards.

  skills/essential-tools/SKILL.md on GitHub (opens in a new tab)

• firewall-review

  Evidence-safe firewall ruleset audit reference specification — 22 documented detector patterns (17 vendor-agnostic plus 5 FortiGate-specific), a 15-check semantic catalogue, CIS Fortinet FortiGate Benchmark guidance, a custom customer-policy benchmark, and consolidated network-team Excel profiles including grouped observation/severity presentation. Separates configuration-proven findings from run…

  skills/firewall-review/SKILL.md on GitHub (opens in a new tab)

• github-workflow

  GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review. Use when asked to commit, push, create PRs/branches/issues, or manage git workflow.

  skills/github-workflow/SKILL.md on GitHub (opens in a new tab)

• hackerone

  HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.

  skills/hackerone/SKILL.md on GitHub (opens in a new tab)

• hackthebox

  HackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions

  skills/hackthebox/SKILL.md on GitHub (opens in a new tab)

• infrastructure

  Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

  skills/infrastructure/SKILL.md on GitHub (opens in a new tab)

• injection

  Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.

  skills/injection/SKILL.md on GitHub (opens in a new tab)

• mobile-security

  Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC, storage, crypto, signing), dynamic analysis (Frida/objection, TLS-pinning + root/jailbreak bypass, traffic interception), and privacy testing.

  skills/mobile-security/SKILL.md on GitHub (opens in a new tab)

• network-appliance-offensive

  Offensive testing of perimeter network appliances and VPN crypto — IKE/IPsec (aggressive-mode, transform/DH enum, NAT-T), Check Point SIC/OPSEC, safe firmware/patch-level inference for FortiGate/PAN-OS/Cisco ASA/Citrix feeding CVE applicability, NTLM Type-2 target-info decode, handshake-completion TLS-version probing, and an RST-TTL forgery discriminator. The active/offensive counterpart to the s…

  skills/network-appliance-offensive/SKILL.md on GitHub (opens in a new tab)

• osint

  Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.

  skills/osint/SKILL.md on GitHub (opens in a new tab)

• patt-fetcher

  Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment.

  skills/patt-fetcher/SKILL.md on GitHub (opens in a new tab)

• pci-secure-software

  Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers source/doc evidence, and emits an evidence-bound per-requirement verdict (MET / NOT_MET / PARTIALLY_MET / NOT_APPLICABLE / REQUIRES_MANUAL_REVIEW) with file+line citations,…

  skills/pci-secure-software/SKILL.md on GitHub (opens in a new tab)

• pentest-engagement

  Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mode (a list of IPs/CIDRs, e.g. 1500 hosts) — machine-prudent BATCHED tool-first nmap sweep (host discovery + bounded com…

  skills/pentest-engagement/SKILL.md on GitHub (opens in a new tab)

• protect-with-password

  Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type). Use when asked to password-protect / encrypt / lock one or more deliverable files with a single password before sharing.

  skills/protect-with-password/SKILL.md on GitHub (opens in a new tab)

• reconnaissance

  Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.

  skills/reconnaissance/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 280k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 220k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• ui-ux-pro-max-skillby nextlevelbuilder An AI skill that provides design intelligence for building professional UI/UX across multiple platforms. 136k stars · 7 skills
• graphifyby Graphify-Labs Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Curs… 127k stars · 1 skill