security-skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 206 files.

• ad-adcs

  Attack Active Directory Certificate Services (ADCS) — ESC1–ESC8 template/CA misconfigurations to escalate to Domain Admin. Load with a domain foothold/creds where ADCS is present, on "certipy", "ESC1", "certificate template", or a CA server. Signals: Cert Publishers, pKIEnrollmentService, ports 443/135 on a CA, certipy find output.

  skills/ad/ad-adcs/SKILL.md on GitHub (opens in a new tab)

• ad-dacl-abuse

  Abuse Active Directory object ACLs/DACLs for lateral movement and escalation — GenericAll, WriteDACL, GenericWrite, WriteOwner, AddMember, ForceChangePassword, and DCSync rights. Load with domain creds + BloodHound showing an ACL edge, on "GenericAll", "WriteDACL", "DCSync", "abuse this edge".

  skills/ad/ad-dacl-abuse/SKILL.md on GitHub (opens in a new tab)

• ad-delegation-abuse

  Abuse Kerberos delegation to impersonate users and take over hosts — unconstrained, constrained (S4U2Self/S4U2Proxy), and resource-based (RBCD), including the coercion → NTLM-relay-to-LDAP → RBCD chain. Load in an AD environment when BloodHound/enum shows delegation rights, a machine account you control, GenericWrite/GenericAll over a computer, or coercion is possible. Signals: msDS-AllowedToActO…

  skills/ad/ad-delegation-abuse/SKILL.md on GitHub (opens in a new tab)

• ad-kerberoasting

  Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with any domain foothold or valid domain creds, on "kerberoast", "AS-REP", SPNs, service accounts, ports 88/389. Signals: domain creds in hand, SPNs set, accounts with pre-auth disabled.

  skills/ad/ad-kerberoasting/SKILL.md on GitHub (opens in a new tab)

• ad-pivot-arsenal

  One line: Active Directory, pivoting/tunneling, and password-cracking arsenal for authorized engagements. Trigger signals: "Active Directory", "domain", "kerberos", "kerberoast", "AS-REP", "BloodHound", "DCSync", "AD/.local domain", holding domain creds or a foothold. Authorized, in-scope targets only.

  skills/ad/ad-pivot-arsenal/SKILL.md on GitHub (opens in a new tab)

• ai-agent-tool-abuse

  Abuse an LLM agent's tools/functions — coerce it to call tools with attacker-chosen args for SSRF, RCE, data exfil, or privilege abuse. Load when the target is an agent with tools/ function-calling/plugins, MCP servers, code interpreters, or "the assistant can do X". Signals: function-calling, tool schemas, browse/email/query/exec tools, autonomous agents.

  skills/ai-ml/ai-agent-tool-abuse/SKILL.md on GitHub (opens in a new tab)

• ai-insecure-output-handling

  Exploit apps that trust LLM output — pass model text unsanitized into XSS sinks, SQL, shell, code, or downstream calls. Load when LLM output is rendered as HTML/markdown, executed, or fed to another system. Signals: chatbot output shown with innerHTML/dangerouslySetInnerHTML, "run this code", LLM-generated queries/commands, agent output used in eval/exec.

  skills/ai-ml/ai-insecure-output-handling/SKILL.md on GitHub (opens in a new tab)

• ai-jailbreak

  Bypass an LLM's safety/guardrails to make it produce restricted output or ignore its policy. Load when testing an AI product's content controls, "jailbreak", "guardrail bypass", refusal testing, or safety evals. Signals: a chatbot/assistant with a usage policy, refusals to test, content filters.

  skills/ai-ml/ai-jailbreak/SKILL.md on GitHub (opens in a new tab)

• ai-llm-dos

  Unbounded-consumption / denial-of-wallet attacks on LLM apps — force runaway tokens, cost, or latency. Load when testing an LLM product's limits/billing, on "LLM DoS", cost amplification, or resource exhaustion. Signals: user-controlled prompts/max_tokens, agent loops, no rate/'cost caps'.

  skills/ai-ml/ai-llm-dos/SKILL.md on GitHub (opens in a new tab)

• ai-mcp-security

  Assess Model Context Protocol (MCP) servers and agent tool integrations — tool poisoning, prompt injection via tool descriptions/results, over-broad scopes, and unauth tool exposure. Load when the target uses MCP servers, agent tool/function integrations, or connectors. Signals: mcp.json, MCP server, tool schemas, connector marketplace, agent with external tools.

  skills/ai-ml/ai-mcp-security/SKILL.md on GitHub (opens in a new tab)

• ai-model-extraction

  Extract or steal an ML/LLM model's parameters, training data, or system prompt via query access — model stealing, membership inference, training-data extraction. Load when testing an ML API/endpoint, "model extraction/inversion", data-leakage or IP-theft concerns, exposed inference endpoints. Signals: a predict/inference API, embeddings endpoint, fine-tuned model.

  skills/ai-ml/ai-model-extraction/SKILL.md on GitHub (opens in a new tab)

• ai-prompt-injection

  Test LLM-backed apps for prompt injection (direct + indirect) and its consequences: data exfil, tool/function abuse, guardrail bypass. Load when the target is a chatbot/assistant/ agent, summarizes untrusted content, has tools/functions, or does RAG. Signals: "ask AI", system prompts, function-calling, "summarize this URL/file", agentic actions.

  skills/ai-ml/ai-prompt-injection/SKILL.md on GitHub (opens in a new tab)

• ai-rag-poisoning

  Poison a RAG/knowledge-base pipeline so retrieved content hijacks the model (indirect prompt injection at scale) or exfiltrates data. Load when the app does retrieval over documents/URLs/ tickets/emails the attacker can influence, "RAG", vector DB, "knowledge base", agent that reads content. Signals: upload-to-KB, "chat with your docs", crawled sources.

  skills/ai-ml/ai-rag-poisoning/SKILL.md on GitHub (opens in a new tab)

• ai-sensitive-data-disclosure

  Make an LLM app disclose sensitive data it should never reveal: training-data memorization, secrets/PII in RAG context, cross-tenant leakage, conversation logs. Load when the target LLM has RAG/document access, is multi-tenant (per-user/per-org assistants), was fine-tuned on private data, or logs conversations. Signals: "ask your documents", per-org chatbots, upload a file and query it, admin/deb…

  skills/ai-ml/ai-sensitive-data-disclosure/SKILL.md on GitHub (opens in a new tab)

• ai-supply-chain

  Attack the ML/LLM supply chain — poisoned models, datasets, plugins, and unsafe model deserialization. Load when an app loads third-party models/weights (HuggingFace, .pt/.pkl/.h5), installs ML deps, uses plugins/extensions, or fine-tunes on external data. Signals: torch.load, pickle model files, model hub downloads, plugin marketplace, RAG over external corpora.

  skills/ai-ml/ai-supply-chain/SKILL.md on GitHub (opens in a new tab)

• ai-system-prompt-leakage

  Extract an LLM app's system prompt / hidden developer instructions — the attack map that reveals guardrails, tool definitions, internal endpoints, and planted secrets. Load when the target is a chatbot/assistant/agent with hidden instructions, refuses with policy-sounding language, names tools or functions in errors, or does RAG. Signals: "repeat your instructions", canned refusals, verbose tool-…

  skills/ai-ml/ai-system-prompt-leakage/SKILL.md on GitHub (opens in a new tab)

• api-auth-attacks

  Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.

  skills/api/api-auth-attacks/SKILL.md on GitHub (opens in a new tab)

• api-bola

  Broken Object/Function Level Authorization in REST/JSON APIs (the #1 API risk). Load on any REST API with object ids in paths/bodies (/api/v1/users/123, /orders/{id}), Bearer auth, mobile-app backends, or admin vs user function separation. Signals: predictable ids, verbs that skip re-authorization, "role" enforced only in the UI.

  skills/api/api-bola/SKILL.md on GitHub (opens in a new tab)

• api-fuzzing

  Discover and fuzz API endpoints, methods, params, and versions systematically. Load when you have an API base but not its full surface, an OpenAPI/Swagger/Postman spec, or "map/fuzz the API". Signals: /api, /v1, swagger.json, GraphQL, mobile backend, undocumented routes.

  skills/api/api-fuzzing/SKILL.md on GitHub (opens in a new tab)

• api-graphql

  Attack GraphQL APIs. Load on /graphql, /graphiql, /v1/graphql, a POST with {"query":"..."}, Apollo/Hasura/graphene stacks, or "query/mutation" language. Signals: introspection enabled, batched queries, deeply nested fields, __schema, aliases.

  skills/api/api-graphql/SKILL.md on GitHub (opens in a new tab)

• api-grpc

  Test gRPC / Protocol Buffers APIs — reflection, method enumeration, authz, and injection. Load on gRPC services (HTTP/2, content-type application/grpc, .proto files, ports like 50051), grpc-web, or "protobuf". Signals: grpc, protobuf, reflection service, ServerReflection.

  skills/api/api-grpc/SKILL.md on GitHub (opens in a new tab)

• api-mass-assignment

  Mass assignment / auto-binding privilege escalation. Load when an API binds JSON directly to a model (Rails, Spring, Django REST, Node/Mongoose), on signup/profile-update/create endpoints, or when responses expose fields you didn't send (role, isAdmin, balance, verified). Signals: ORM object binding, extra fields accepted silently.

  skills/api/api-mass-assignment/SKILL.md on GitHub (opens in a new tab)

• api-mongo-agg-facet-bypass

  Bypass a MongoDB aggregation-pipeline stage allowlist by nesting disallowed read stages inside $facet, then $unionWith/$lookup sibling collections to exfiltrate secrets (invite tokens, creds, hashes). Load when: an endpoint accepts a user-supplied `pipeline` (or errors like "operator-form queries not accepted, use the pipeline parameter"), a Node/Express + MongoDB backend, 24-hex `_id`s, or an "a…

  skills/api/api-mongo-agg-facet-bypass/SKILL.md on GitHub (opens in a new tab)

• api-testing-checklist

  A fast, ordered methodology for assessing an API end to end — REST/GraphQL/gRPC/SOAP — so nothing gets skipped. Load when the target is an API (or recon found one), on "test this API", "checklist", methodology triage, or to confirm coverage before reporting. Signals: /api, swagger/openapi.json, GraphQL /graphql, gRPC, JSON/XML endpoints, a mobile/SPA backend.

  skills/api/api-testing-checklist/SKILL.md on GitHub (opens in a new tab)

• api-versioning

  Find and attack old/shadow API versions that missed a fix — improper inventory management. Load when the API is versioned (/v1, /v2, /api/2021-01), on "old API", or after mapping the surface. Signals: version in path/header/subdomain, deprecated docs, mobile app using an older version.

  skills/api/api-versioning/SKILL.md on GitHub (opens in a new tab)

• automation-browser

  Drive a real browser against an in-scope web app with Playwright / agent-browser: automated login, form and payload submission through the UI, scraping JS-rendered pages, request/response interception, and evidence screenshots. Load on "browser automation", "fill this form", "submit payload", "screenshot this page", automated login, headless crawling, or UI-driven XSS testing. Signals: Playwright…

  skills/automation/automation-browser/SKILL.md on GitHub (opens in a new tab)

• automation-nuclei-templates

  Write custom nuclei templates to codify a finding into a repeatable, mass-scannable check. Load on "write a nuclei template", turning a manual bug into automation, checking a CVE across many hosts, or regression-scanning. Signals: a reproducible request→match, YAML templates, nuclei.

  skills/automation/automation-nuclei-templates/SKILL.md on GitHub (opens in a new tab)

• automation-recon-pipeline

  Chain recon tools into a repeatable, resumable pipeline for continuous bug-bounty coverage. Load on "automate recon", "recon pipeline", monitoring many programs, or scaling subdomain→ live→scan. Signals: wildcard scope at scale, wanting scheduled/continuous discovery.

  skills/automation/automation-recon-pipeline/SKILL.md on GitHub (opens in a new tab)

• cloud-azure

  Attack Azure / Entra ID — managed-identity token theft, Entra (Azure AD) role abuse, and app/ storage misconfig. Load when the target is on Azure, you hold Azure creds/a token, or see Entra/AAD/azurewebsites/blob.core.windows.net. Signals: 169.254.169.254 IMDS, Managed Identity, az cli, Entra roles, service principals.

  skills/cloud/cloud-azure/SKILL.md on GitHub (opens in a new tab)

• cloud-container-escape

  Break out of a container to the host. Load when you have a shell in a container/pod and want the node: privileged container, mounted docker.sock, dangerous capabilities, hostPath, or "escape the container". Signals: /.dockerenv, cgroup shows docker/k8s, CAP_SYS_ADMIN, mounted socket.

  skills/cloud/cloud-container-escape/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• Claude-BugHunterby elementalsouls A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated… 5.4k stars · 30 skills
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 185k stars · 6 skills
• paperclipby paperclipai The open-source app everyone uses to manage agents at work 111k stars · 30 skills
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 110k stars · 1 skill
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 93.5k stars · 5 skills
• awesome-claude-skillsby ComposioHQ A curated list of awesome Claude Skills, resources, and tools for customizing Claude AI workflows 78.8k stars