SuperAPI AI DirectoryFind an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-29 00:09
7,617 results
1Panel server management panel exploit toolkit, covering four types of vulnerabilities: CVE-2025-54424 (client certificate bypass RCE, WebSocket terminal interactive Shell), CVE-2024-39911 (frontend User-Agent SQL injection to write Webshell), CVE-2024-39907 (backend orderBy...
ArgoCD Continuous Delivery Platform Exploitation and Detection Skill. Covers exploitation techniques for all known high-risk vulnerabilities in ArgoCD, including: - CVE-2024-31989: Redis unauthorized cache poisoning leads to K8s cluster takeover - CVE-2022-29165: SSO authentication bypass - CVE-2023-22482: Redis sensitive information disclosure - CVE-2024-40638:…
ComfyUI-Manager exploit skill covering the complete attack chain of two CVEs: CVE-2025-67303 (unauthorized read/write of configuration files leading to RCE) and CVE-2026-22777 (CRLF injection downgrading the security level leading to RCE). Both ultimately achieve remote code execution by installing a malicious custom node. When the user mentions...
Database service attack methodology. Use when database ports such as Redis (6379), MSSQL (1433), PostgreSQL (5432), MySQL (3306), MongoDB (27017), etc. are discovered. Covers unauthorized access, weak password brute-forcing, command execution, file read/write, and privilege escalation. This skill should be used in any scenario involving database attacks, database privilege escalation, or database exploitation.
Dify LLM application development platform vulnerability exploitation skill, covering two CVEs: CVE-2025-56520 (remote file upload interface SSRF, reading internal network resources without authentication) and CVE-2025-55182 (React Server Components deserialization RCE, the Dify console is built on Next.js). When the user mentions…
GeoServer GIS server exploitation toolkit, covering five types of high-risk vulnerabilities: CVE-2024-36401 (OGC XPath expression unauthenticated RCE, supports reverse shell), CVE-2025-58360 (WMS SLD_BODY XXE arbitrary file read/SSRF, supports batch scanning and enhanced reverse shell version),…
Gradio ML application framework exploit toolkit, covering two types of high-risk vulnerabilities and multiple variants: CVE-2024-47167 (component_server LFI/SSRF) and queue/join file proxy SSRF. When users mention Gradio, CVE-2024-47167, component_server, gradio…
Apache HugeGraph Graph Database Exploitation Toolkit, covering two types of high-severity vulnerabilities: CVE-2024-27348 (Gremlin Groovy sandbox bypass RCE), CVE-2024-43441 (JWT authentication bypass). When users mention HugeGraph, hugegraph, graph database, Gremlin, graph engine, …
GNU InetUtils telnetd exploit toolkit, covering two types of high-severity vulnerabilities: CVE-2026-24061 (USER environment variable "-f root" authentication bypass, directly obtaining a root shell), CVE-2026-32746 (LINEMODE SLC subnegotiation buffer overflow detection, including a complete Telnet protocol negotiation client).…
Apache OFBiz exploit and detection skills. Covers exploitation techniques for all known high-risk OFBiz vulnerabilities, including: - CVE-2023-49070: XML-RPC deserialization RCE (<=18.12.09) - CVE-2023-51467: Authentication bypass (<=18.12.10) - CVE-2024-32113: Path traversal leading to RCE…
Portainer vulnerability exploitation and detection skills. Covers exploitation methods for all known high-risk Portainer vulnerabilities, including: - Default credentials/weak password authentication bypass - CVE-2024-29296: User enumeration (CE 2.19.4) - CVE-2018-12678: Request Splitting SSRF→RCE (<=1.17) -...
Apache RocketMQ message middleware vulnerability exploitation and detection skills. Covers exploitation methods for all known high-risk vulnerabilities in RocketMQ, including: - CVE-2023-33246: Broker command injection RCE (<=5.1.0, <=4.9.5) - CVE-2023-37582: NameServer arbitrary file write (incomplete fix) -…
Use static checks and TypeSafe Jev to review suspicious behavior, prompt injection, data exfiltration, and installation risks in local Skills, MCP configurations, and source code. Suitable for pre-installation review or malicious behavior investigation, outputting file line numbers, evidence, and unscanned scope.
How the platform's API gateway fronts a service — it validates the caller's token, injects identity headers, and attaches CORS — plus how a consumer calls a…
Use when a design involves sign-in, roles, or permissions — writing specs/design/security.md, deciding the roles-to-permissions matrix, or configuring Thunder…
How end-user identity works on the platform — Thunder, the IDP wired into the API gateway, signs users in and components authorize them. Covers the auth…
Use Jev to organize and judge authorized jailbreak or prompt-injection evaluations, including batch transcripts, multi-turn sessions and multi-agent review.…
Detects security vulnerabilities via static pattern matching based on OWASP Top 10
Security audit for code changes. Triggered by "/security-review" when reviewing auth, crypto, input handling, or when user explicitly requests a security audit.
Multi-agent security vulnerability scanning, verification, and PoC validation for codebases. Deploys teams of senior security engineers to systematically…
Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
Detects execution surface risks, supply chain vulnerabilities, data exfiltration vectors, and prompt injection patterns in Claude Code plugins. Use when…
Detects execution surface risks, supply chain vulnerabilities, data exfiltration vectors, and prompt injection patterns in Claude Code plugins. Use when…
HACKING SKILLS / HackSkills for bug bounty hunters, web security engineers, red team learners, and security-focused agents. Use when the task involves…