wizard
Interactive guidance setup with AskUserQuestion flow. TRIGGERS - ru wizard, configure guidance, setup encourage forbid, ru interactive setup.
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 11-05 00:16
General & other
53,583 results
defuddle
Extract clean markdown content from web pages using Defuddle CLI, removing clutter and navigation to save tokens. This skill MUST be used instead of WebFetch…
obsidian-cli
Interact with Obsidian vaults using the Obsidian CLI to read, create, search, and manage notes, tasks, properties, and more. Also supports plugin and theme…
review-work
Use after run-plan completes to independently verify the implementation. Reads only the plan document and inspects the codebase from scratch —…
uipath-functions
UiPath Coded Functions — deterministic Python or TypeScript/JavaScript units built with the `uip function` CLI (`new -l py|ts|js`, `init`, `serve`, `run`,…
uipath-insights
UiPath Insights historical monitoring via `uip insights`: job metrics, failure analysis, and process performance; queue totals, SLA risk, timelines, and…
apk-redteam-pipeline
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase…
exchange-owa-attack
Exchange/OWA NTLM AD leak, spray attack when mail subdomain.
firebase-supabase-attack
Exploit Firebase/Supabase for data via JS config leak probe.
hardcoded-credential-hunt
Detect hardcoded passwords in HTML forms, JavaScript, and API responses.
hunt-open-redirect
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta…
hunt-source-leak
Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery,…
hunt-ssti
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf,…
hunt-xxe
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML…
phpinfo-to-rce
Chain phpinfo to RCE via exec check when info.php exposed.
port-service-discovery
Nmap scan for MySQL, Redis, FTP, SSH, internal API services.
recon-playbook
Use when starting or restructuring an authorized external web and API assessment.
saml-sso-attack
Attack SAML SSO via XSW, signature strip, metadata extract.
web2-recon
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau),…
zimbra-attack
Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.
valyu-cli
Use the Valyu CLI when the user needs a knowledge-work answer grounded in real sources: private equity / M&A due diligence, financial analysis, SEC filings,…
hackernews-intel
Monitors Hacker News for user-configured keywords, deduplicates against a local SQLite cache, and sends Slack alerts for new matching posts. Use when asked to…
kill-the-standup
Reads yesterday's Linear issues and GitHub commits for the authenticated user, formats a standup update (done / doing / blockers), and posts it to Slack. Use…
npm-downloads-to-leads
Takes a list of npm package names (yours or competitors'), fetches 12 weeks of daily download data from the npm API, computes a breakout velocity score per…