hunt-subdomain
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 11-05 00:16
General & other
53,585 results
source-leak-hunt
Mass scan for exposed env files, backups, and git configs.
staging-subdomain-hunt
Hunt staging via crt.sh when production is WAF-hardened.
wp-plugin-automation
Scripts and workflows to batch-test popular WordPress plugin CVEs across hundreds of domains. Covers automated plugin detection, version extraction from…
wp-plugin-rest-auth-bypass
Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth,…
gh-issue-to-demand-signal
Takes a competitor's public GitHub repo URL, fetches their open issues via the GitHub REST API, filters noise locally, clusters issues into 6 demand…
oss-launch-kit
Higher-level OSS launch orchestrator that analyzes repos, selects channels, and coordinates launch plans.
vc-curated-match
Accepts a product description and URL to algorithmically identify relevant Venture Capital investors targeting exactly that stage, industry, and niche based on…
atelier-review-me
Review a diff against the atelier standard before it lands. Read-only by contract, it reports findings and never edits the tree, mapping each changed file to…
operate-vmos-edge-cli
Use when a task involves VMOS Edge Desktop — creating or controlling Android virtual devices on edge hosts, interacting with the Electron desktop UI via CDP,…
flutter-project-init
Creates a new Flutter project with Clean Architecture, domain pattern boilerplate, and production-ready setup
calibration-check
Evaluate whether sports-model probabilities match observed frequencies. Use for Brier score, log loss, reliability bins, ECE, segment checks, and recalibration…
leakage-audit
Audit sports modeling tables and workflows for target, temporal, join, preprocessing, and split leakage. Use before trusting backtests or reported predictive…
google-doc-style
Write all reader-facing prose in the style of the Google Developer Documentation Style Guide. Use this skill whenever you produce explanatory text a person…
azure-hybrid-lateral
Azure Cloud to on-premises AD lateral movement methodology. When Azure/Entra ID permissions have been obtained and it is necessary to cross over to the on-premises Active Directory environment, when the target is discovered to use hybrid identity architectures such as Azure AD Connect/Cloud Sync/PTA/Federation, or when it is necessary to exploit...
cobalt-strike
Cobalt Strike operational methodology. Use when you need to use CS for team collaboration penetration testing, configure Listeners/Payloads, manage Beacon sessions, perform post-exploitation operations (privilege escalation/lateral movement/credential theft), or write Aggressor automation scripts. Covers TeamServer deployment, Listener configuration, Payload...
gogo-scan
Use gogo for port scanning and fingerprinting. gogo is a high-speed port scanner produced by chainreactors, supporting active/passive fingerprinting, intelligent grouped output, and automatic TLS handshake extraction of certificate information. Differences from fscan: gogo focuses on scanning accuracy and fingerprint coverage (2000+ fingerprint rules), while fscan also covers weak passwords and...
k8s-network-recon
Network reconnaissance and service discovery within a Kubernetes cluster. Use when a Pod Shell has been obtained, other services in the cluster need to be discovered, and a K8s internal network scan is to be performed. Covers DNS PTR reverse lookup, SRV record enumeration, AXFR zone transfer, and K8Spider usage. Any in a Pod…
network-poisoning-attack
Methodology for network-layer poisoning and protocol spoofing attacks in internal network penetration. Used when NTLM authentication needs to be obtained through network poisoning or a man-in-the-middle attack needs to be achieved. Covers ARP poisoning, DHCP poisoning, DHCPv6/mitm6 spoofing, DNS spoofing, ADIDNS record injection, WPAD hijacking, WSUS poisoning, ICMP redirection, NBT Name Overwrite. Usually used as a prerequisite for NTLM...
spray-dir-brute
Use spray for high-performance directory brute-forcing and fingerprinting. Use when directory/file enumeration, backup file discovery, or fingerprinting is needed for web targets. spray is a next-generation directory brute-forcing tool by chainreactors, with performance exceeding ffuf by 50%+, supporting smart filtering, mask dictionaries, resumable transfers, and batch targets. Anything involving directory brute-forcing, path enumeration, backup file scanning, Web...
money-plan
Generate an executable action plan for a certain "viable" opportunity selected by the user: a small-cost validation first step, specific actions for the first two weeks, honest income expectations, and a stop-loss line. Trigger words: "I want to do XX, help me make a plan"/"How do I start this"/"Give me an action plan"/"money plan"/"I choose this". Prerequisite: this opportunity has preferably already passed the money-verify judgment as viable/uncertain.
money-verify
The anti-fraud core of the cheat-on-money skill. Scores a specific side job/side hustle/project against an anti-fraud rubric, verifies negative and genuine payment evidence online in real time, and outputs a High-risk/Questionable/Viable verdict + first verification step + honest income expectations. Trigger words: "Is XX legit"/"Is this project a scam"/"Help me check this side job"/"money…
git-weekly-report-cn
Use when the user needs to organize Git commit records into a structured daily report, weekly report, or work summary.
salt-story
Zhihu Salt Selection story writing. Generate short paid stories with twists, appeal, and no AI flavor. Applicable when users mention Salt Selection, Zhihu stories, paid stories, writing stories, making up stories, and similar scenarios.