SuperAPI AI DirectoryFind an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-20 00:13
7,244 results
IOC (Indicators of Compromise) analysis and countermeasure methodology. Blue team perspective: how to collect, enrich, and correlate IOCs for threat hunting. Red team perspective: how to avoid your own infrastructure and tools generating identifiable IOCs, and how to make IOCs quickly expire. Use when the red team needs to assess its own exposure surface or plan C2 infrastructure
Use John the Ripper for offline password cracking. Use when you need to crack hashes (MD5/SHA/NTLM/Kerberos/ZIP/RAR/PDF/SSH Key, etc.). John supports automatic hash type detection, dictionary attacks, rule-based mangling, incremental brute force, built-in *2john…
Istio Service Mesh security policy bypass. Use when the target K8s cluster uses Istio, requests are denied by AuthorizationPolicy (403 RBAC denied), or an Envoy sidecar is discovered. Core technique: UID 1337 bypasses Envoy. Any time you encounter Istio in K8s…
Kubernetes Sidecar container traffic hijacking and sensitive information theft. Use when the target Pod has an Istio/Envoy/Linkerd sidecar, the challenge mentions 'invisible bystander' or 'shared network', or traffic needs to be sniffed from inside the Pod. Covers tcpdump packet capture, sidecar plaintext traffic capture, and shared network namespace exploitation. As long as in K8s…
Use k8spider for Kubernetes cluster DNS service discovery and reconnaissance. Use when you need to enumerate Services in a K8s cluster with low privileges, probe DNS services, scan network segments for PTR/SRV records, or attempt AXFR zone transfers. k8spider only needs DNS access to discover all services in the cluster, without requiring the API Server…
A collection of advanced Kerberos protocol attack techniques. Use the advanced techniques in this skill when basic Kerberoasting/AS-REP Roasting and delegation attacks are not enough. Covers sAMAccountName spoofing (noPac/CVE-2021-42278), Kerberos relay…
Log analysis and log evasion methodology. Understand how blue teams track attack behavior through logs (SIEM/Event Log/Syslog), and how red teams evade logging or precisely erase traces. Use when designing trace-free operations or analyzing log monitoring coverage
Use Nikto for web server vulnerability scanning. Use when you need to detect known vulnerabilities, outdated software versions, dangerous files/CGIs, and misconfigurations in web servers. Nikto has 7000+ built-in checks, covering common OWASP issues. This skill should be used in any scenario involving web vulnerability scanning, server security checks, or configuration audits
Use xray for automated Web vulnerability scanning. Use when comprehensive vulnerability scanning of Web applications is needed (XSS/SQLi/command injection/SSRF/XXE/path traversal/file upload/weak passwords, etc.). xray is a comprehensive Web security assessment tool produced by Chaitin Technology, supporting three modes: active scanning, passive proxy scanning, and basic crawler scanning, with built-in rich detection plugins and community POCs. Any involving...
Spring Security best practices for Spring Boot services covering authentication/authorization, validation, CSRF, secrets management, response headers, rate limiting, and dependency security.
IRify SAST — AI-powered static application security testing. Compile source code into SSA IR, then use SyntaxFlow DSL to trace data flow across function…
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,…
Read-only ClickHouse security audit of users, roles, grants, row policies, settings profiles, quotas, named collections, table functions and engines,…
Solidity security patterns, common vulnerabilities, and pre-deploy audit checklist. The specific code patterns that prevent real losses — not just warnings,…
Writing or reviewing code that handles untrusted input, secrets, outbound requests, rendered content, or third-party dependencies — the OWASP Top 10:2025 lens…
Detect accidentally committed secrets, credentials, and sensitive information in code.
First entry point for AI model analysis (dispatcher): identify the input form—model files go to file-layer reverse engineering (re-ai-model), API-only goes to behavior-layer assessment (re-ai-attack), malicious behavior goes to malicious analysis. Trigger words: AI model analysis, AI model security, model file, model leakage, model reverse engineering, model analysis entry point.
Guide for understanding and contributing to the awesome-ai-security curated resource list. Use this skill when adding resources, organizing categories, or…
Expert in Gravito security and authentication. Trigger this when setting up Auth, configuring CSP, or implementing security middleware.
Router skill for API penetration testing across REST, GraphQL, gRPC, and WebSocket. Covers OWASP API Top 10 (2023) including BOLA/BFLA/BOPLA, JWT attack…
Discover project conventions and surface security concerns. Use when starting work in a new or unfamiliar project, when asked to "learn the codebase", "check…
Security audits and secure coding. Use for vulnerability detection or auth implementation.
Performs security audits and vulnerability assessments on Ruby on Rails application code. Use when reviewing Rails code for security risks, assessing…
Manage cloud security posture operations. Auto-activating skill for Security Advanced. Triggers on: cloud security posture, cloud security posture Part of the…