hunt-session
Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 11-05 00:16
General & other
53,583 results
hunt-ssrf
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange…
hunt-xss
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.
subdomain-takeover-hunt
Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
google-drive
Manage Google Drive files with manifest-tracked push/pull workflows via rclone. Use when the user needs to download, upload, list, or manage files on Google…
canai-yolo
Opt-in CanAI MCP power tool that can publish site PHP: FluentSnippets (create/update/publish PHP/CSS/JS snippets). Not for routine template/page/content work —…
graphic-chart
Generates data visualization charts (bar, line, area, pie, doughnut, scatter, radar, treemap) as PNG using Apache ECharts v6. 1080×1080px default, 5 style…
graphic-gif
Creates animated looping GIFs from CSS animations (default) or AI image-to-video. 800×800px default, 6 animation types, 4 style presets. Trigger when user says…
pricing-finder
Tell it what your product is (URL or description) and it finds 5 competitors globally, fetches their actual pricing pages, extracts every tier and price point,…
vc-finder
Takes a startup product URL or description, detects the industry and funding stage, identifies 5 comparable funded companies, searches who invested in those…
hindsight-upgrade
Check for and install hindsight-skills updates. Detects new versions, offers upgrade options, and shows what changed.
account-dossier
Research ONE target company as an outbound prospect and produce a decision-ready account dossier: signal stack, fit against YOUR ICP, decision-makers, lead…
client-health-check
Scores every active client account green / yellow / red on 6 health criteria and outputs a health table + action plan for the reds. Built for B2B service…
upsell-mapper
Builds a client × services cross-sell map for a B2B service company: which active client uses which services, where the gaps are, and which gaps are realistic…
nuxt-geo-best-practices
Nuxt GEO (Generative Engine Optimization) guidelines for getting cited by ChatGPT, Perplexity, Claude, Google AI Overviews, and Gemini. Covers AI crawler…
magi
Use when brainstorming ideas, features, or directions for a project where independent perspectives from different model families (Claude/Codex/Gemini) would…
using-backstage-identity
Use when a Backstage frontend plugin needs information about the currently logged-in user — their entity ref, profile info, ownership refs, or auth token.…
ad-delegation-attack
Kerberos delegation attacks (unconstrained/constrained/RBCD). Use when BloodHound discovers delegation configurations, or when control has been obtained over a service account/machine account with an SPN. Through abuse of the S4U protocol, impersonation of any user across services can be achieved, commonly used for privilege escalation and lateral movement within the domain.
browser-xterm-interaction
Playwright Browser MCP and xterm.js terminal interaction methodology. Use when you need to operate an embedded terminal in a web page via a browser, a CTF range pseudo-terminal, Cloud Shell, or a terminal in an online IDE. Covers terminal content reading (5 methods), command execution, output capture, and screenshot fallback strategy. As long as the target page contains any form of Web…
cicd-pipeline-attack
CI/CD pipeline and supply chain attack methodology. When discovering that a target uses CI/CD systems such as GitHub Actions/Jenkins/GitLab CI/CircleCI/Terraform Cloud/Atlantis, when pipeline security needs to be tested, or when discovering...
cross-domain-attack-chain
Web and AI cross-domain attack chain methodology. Triggered when the target system contains both traditional Web applications and AI/LLM components, and it is necessary to assess the impact of Web vulnerabilities on AI systems or the impact of AI vulnerabilities on Web systems. Covers bidirectional attack chains: Web→AI (XSS stealing conversations/SSRF invoking model APIs/SQLi poisoning RAG/file upload RAG poisoning) and…
oa-system-attack
Exploitation of vulnerabilities in domestic OA/intranet systems. When domestic OA systems such as Seeyon, Weaver/E-cology, Yonyou/NC/U8, Landray, Tongda, Ezoffice, Kingdee, iOffice, etc. are discovered on the intranet…
oss-bucket-exploit
Object storage (S3/OSS/COS/OBS) Bucket misconfiguration exploitation. Use when AWS S3, Alibaba Cloud OSS, Tencent Cloud COS, Huawei Cloud OBS, or other object storage services are discovered, or when headers such as x-amz-*, x-oss-*, x-cos-* are seen in HTTP responses. Covers Bucket enumeration, ACL...
serverless-attack
Serverless/cloud function security testing and attacks. Use when the target involves Serverless services such as AWS Lambda, Tencent Cloud SCF, Alibaba Cloud FC, Azure Functions, etc. When the API Gateway backend is discovered to be triggered by Lambda/SCF, through cloud-aksk-exploit…