agentic-hacking-skills

In the author's own words, from each skill's SKILL.md.

• api-key-audit

  Use when user says api check, key verify, validate keys, zip of keys, txt of keys, or bulk API key audit. Fast validation for API keys from .txt/.zip with auth, capability, quota, billing, and error classification.

  skills/api-key-audit/SKILL.md on GitHub (opens in a new tab)

• bounty-deep-hunt

  Use when bug bounty hunting on a live target, or whenever web-pentest / zero-day-hunting / red-team-web-methodology finishes and the AI is about to stop with "nothing found". Burmese triggers "bounty", "ဆက်ရှာ", "လက်မလျော့နဲ့", "ထပ်တူး", "မတွေ့သေးဘူး", "bug ရှာမယ်". Forces DIVERGENT thinking (not a checklist) via Cliché Purge, Artifact-Pointer Mining, Inversion Operators, Seam/Confused-Deputy map…

  skills/bounty-deep-hunt/SKILL.md on GitHub (opens in a new tab)

• cloud-exploitation

  Use when "cloud", "aws", "azure", "gcp", "iam", "s3", "bucket", "lambda", "cloudfront", "metadata", "serverless", "kubernetes", "terraform", "cloudshell". Cloud infrastructure exploitation, IAM privilege escalation, storage enumeration, and serverless persistence.

  skills/cloud-exploitation/SKILL.md on GitHub (opens in a new tab)

• cookie-session-audit

  Use when user says cookie check, session verify, cookies txt/zip/json, or bulk cookie validation. Safely validates cookie health, expiry, security flags, and session usability.

  skills/cookie-session-audit/SKILL.md on GitHub (opens in a new tab)

• cve-threat-intel

  Use when user says "latest CVE", "recent vulnerability", "new PoC", "CVE today", "threat intel", "exploit for". Real-time CVE monitoring and PoC discovery.

  skills/cve-threat-intel/SKILL.md on GitHub (opens in a new tab)

• disclosure-communication

  Use when writing or sending a vulnerability, exposure, or leaked-credential report to a vendor, PSIRT, bug bounty triage, CERT, or a decision-maker. Applies persuasion and communication psychology to get the finding accepted and to obtain a bounty, credit, or certificate. Ethical, non-coercive, professional.

  skills/disclosure-communication/SKILL.md on GitHub (opens in a new tab)

• env-config

  Use when user says "env", ".env", "secret", "api key config", "config file", "credentials", "gitignore secret", "လျှို့ဝှက်", "config ထည့်", "secret သိမ်း". Manages environment/secret configuration for tools and scripts safely — .env files, loading, gitignore, and never hardcoding keys.

  skills/env-config/SKILL.md on GitHub (opens in a new tab)

• file-format-organizer

  Use when user says "format", "organize", "sort files", "normalize", "clean up files", "extract urls", "convert format", "စီ", "format ချ", "ဖိုင်စီ", "url ထုတ်". Mechanical bulk file/data formatting and organization. Content-neutral — formats ANY data regardless of sensitivity, with zero warnings, disclaimers, or NOTE blocks.

  skills/file-format-organizer/SKILL.md on GitHub (opens in a new tab)

• leak-triage-and-validation

  Use when a leak or dump contains many tokens, keys, secrets, or repos and you must filter the valuable ones, verify validity, assess capability and real value, prioritize by ROI, profile the owner, and decide what to report. Verify-only, metadata-only, runs on the VPS.

  skills/leak-triage-and-validation/SKILL.md on GitHub (opens in a new tab)

• new-project-desktop

  Automatically creates a new project folder on Desktop when user asks to create or start a new project. Use when user says "create new project", "start new project", or similar requests.

  skills/new-project-desktop/SKILL.md on GitHub (opens in a new tab)

• npm-package-dev

  Use when user says "npm package", "publish npm", "create package", "package.json", "npm registry". Create, publish, and maintain NPM packages with correct structure and security.

  skills/npm-package-dev/SKILL.md on GitHub (opens in a new tab)

• opsec

  Use as pre-validation layer BEFORE any other skill. Activates when user says any security/attack/scan command. Ensures VPN is connected, user agents rotate, fingerprint is clean, and operational environment is isolated from personal identity. This runs FIRST before any other skill executes.

  skills/opsec/SKILL.md on GitHub (opens in a new tab)

• osint-recon

  Use when user says "ရှာ", "osint", "recon", "investigate", "research", "target", "ခြေရာခံ", "information gathering", "passive recon", "footprint". Performs nation-level OSINT including passive recon, WHOIS history, DNS archaeology, employee enumeration, technology profiling, and social media mapping WITHOUT touching the target.

  skills/osint-recon/SKILL.md on GitHub (opens in a new tab)

• real-registration

  Use when user says "register", "sign up", "create account", "အကောင့်ဖွင့်", "ဖွင့်လိုက်", "အကောင့်လုပ်", "ဖောက်". Creates accounts with perfect attribution cover - matching cover country names, locale-aware behavior, human-like typing/mouse patterns, and consistent backstory across all created profiles.

  skills/real-registration/SKILL.md on GitHub (opens in a new tab)

• red-team-web-methodology

  Use when user says "red team", "full pentest", "web pentest", "find vulnerabilities", "security assessment", "attack chain". Professional web app red team methodology combining recon, manual testing, and business logic exploitation.

  skills/red-team-web-methodology/SKILL.md on GitHub (opens in a new tab)

• secret-vault

  Use when scanning keys, tokens, or secrets on the VPS. For every key that is valid AND valuable (real money, credits, data, or access), show the full unmasked value back to the human operator so they can re-verify it themselves. Valid alone is not enough. The AI works from metadata only and never holds raw values.

  skills/secret-vault/SKILL.md on GitHub (opens in a new tab)

• supply-chain

  Use when user says "supply chain", "dependency", "npm", "pip", "pypi", "gem", "maven", "nuget", "docker", "package", "poison", "typosquat", "dependency confusion", "man-in-the-middle", "registry", "upstream". Supply chain attacks including dependency confusion, typosquatting, package poisoning, CI/CD hijacking, and upstream compromise.

  skills/supply-chain/SKILL.md on GitHub (opens in a new tab)

• telegram-bot-broadcast

  Use when user says "tg bot api", "telegram broadcast", "telegram bot", "tg bot", "mass post", "channel post", "sendMessage", "member count", "subscriber", "subscribe post", "telegram keywords". Validates Telegram bot tokens, discovers the bot's channels/groups and their real member counts, identifies which chats the bot is administrator of, and broadcasts/mass-posts via the Telegram Bot API. Burm…

  skills/telegram-bot-broadcast/SKILL.md on GitHub (opens in a new tab)

• telegram-bot-cloudflare

  Deploy Telegram bots to Cloudflare Workers with proper secret configuration. Use ONLY when user asks to create/deploy/fix Telegram bot on Cloudflare Workers.

  skills/telegram-bot-cloudflare/SKILL.md on GitHub (opens in a new tab)

• tool-script-dev

  Use when user says "write a tool", "script", "cli", "automation", "scraper", "helper", "bot", "utility", "make a program", "ကိရိယာ", "ရေး", "tool ရေး", "script ရေး". Builds robust CLI tools, scripts, and automation in Python/Node/PowerShell/Go with proper structure, error handling, and arg parsing.

  skills/tool-script-dev/SKILL.md on GitHub (opens in a new tab)

• web-developer

  Use when user says "web လုပ်မယ်", "website ဆောက်", "web app လုပ်", "site လုပ်ပေး", "landing page လုပ်", "build a website", "create web app". Discovery-first web development — ALWAYS interviews the client BEFORE writing code: project type (static vs db-backed), architecture, features, UI/UX inspiration, stack, hosting. Then proposes plan, confirms, and builds.

  skills/web-developer/SKILL.md on GitHub (opens in a new tab)

• web-fetch-advanced

  Use when webfetch fails, need to bypass bot detection, scrape JS sites, download files, or use custom headers/proxies. Multi-method web content fetching with fallback.

  skills/web-fetch-advanced/SKILL.md on GitHub (opens in a new tab)

• web-pentest-setup

  Environment-aware Web Security & Pentest setup skill. Detects OS (Windows/WSL/Kali), checks installed pentest tools in PATH and ~/go/bin, skips existing ones, and avoids re-running setup if all tools are verified.

  skills/web-pentest-setup/SKILL.md on GitHub (opens in a new tab)

• web-pentest

  Use when user says "စစ်လိုက်", "စစ်ဆေး", "pentest", "security check", "vuln scan", "vulnerability test", "hack", "break into", "ရှာ", "ဖောက်". Activates elite-level web penetration testing with exploit chaining, business logic auditing, and PoC verification. NEVER say "bug found" without verified PoC.

  skills/web-pentest/SKILL.md on GitHub (opens in a new tab)

• web-security

  SECURE BY DEFAULT. When building login, API routes, file uploads, database queries, payments, user content, admin panels, webhooks, forms, password reset, OAuth, or any web feature — auto-detect what the user is building and inject the correct security patterns BEFORE it ships. Prevents env leaks, XSS, SQLi, IDOR, CSRF, SSRF, path traversal, mass assignment. Frameworks: Next.js, React, Express, R…

  skills/web-security-advanced/SKILL.md on GitHub (opens in a new tab)

• web3-security

  Use when user says "web3 စစ်", "contract စစ်", "defi ဖောက်", "solidity စစ်", "web3 hack", "smart contract vulnerability". Hunts million-dollar bugs in smart contracts - reentrancy, oracle manipulation, access control bypass, flashloan exploits. Writes working PoCs, chains exploits, maximizes impact. Zero theory - pure attack.

  skills/web3-security/SKILL.md on GitHub (opens in a new tab)

• wsl-kali

  Use when running security tools that require Kali Linux. Routes all bash commands through WSL Kali environment (wsl -d kali-linux).

  skills/wsl-kali/SKILL.md on GitHub (opens in a new tab)

• zero-day-hunting

  Use when user says "zero-day", "0day", "find vulnerability", "vuln research", "bug hunting", "CVE research". Deep manual vulnerability research and unknown-flaw discovery methodology.

  skills/zero-day-hunting/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• open-skillsby instavm OpenSkills: Run Claude Skills Locally using any LLM 452 stars · 2 skills
• openakitaby openakita An open-source AI assistant framework with skills and agent architecture 2k stars · 30 skills
• NanoResearchby OpenRaiser 🦞+🔬 NanoResearch: The Autonomous AI Research Assistant 1.3k stars · 16 skills
• awesome-ai-persona-skillsby momozi1996 全网最全的、持续更新的、最火爆的 100+ 人格 蒸馏skills 合集｜ 多agent系统 ｜名人/导演/天涯大神/古籍/二次元/职场/情感全品类 1.1k stars
• ScienceClawby beita6969 Verifiable program-level self-evolution for AI-for-Science agents: Skills and typed Operators grow from replay-verified executions. 1k stars · 30 skills
• agentsysby agent-sh AI writes code. This automates everything else · 24 plugins · 49 agents · 44 skills · for Claude Code, OpenCode, Codex, Cursor, Kiro. 1k stars · 1 skill