hunt-ato
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token,…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-17 00:11
Security & auditing
7,130 results
gandalf-llm-pentester
Automated red-team toolkit for stress-testing LLM defenses with AI-powered attack validation and risk analysis
ccpa
California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor — business threshold analysis, consumer rights fulfillment…
Red Team Tools and Methodology
This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS…
hunt-cache-poison
Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS…
conducting-cloud-penetration-testing
This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the…
centrifugo
Centrifugo real-time messaging server expert for WebSocket PUB/SUB, channel management, JWT authentication, event proxying, and horizontal scaling with…
dalonso-security-repo
Microsoft Security threat hunting queries, KQL examples, Sentinel workbooks, and security analytics notebooks
exploiting-nosql-injection-vulnerabilities
Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, and similar databases to demonstrate authentication bypass, data extraction, and…
docs-starter-kit
Generates comprehensive documentation templates for open-source and internal projects including README, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, LICENSE, and…
awesome-pentest-tools-catalog
Curated penetration testing and red team tools collection organized by penetration testing lifecycle and MITRE ATT&CK framework
Burp Suite Web Application Testing
This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability…
bb-local-toolkit
Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to…
testing-for-email-header-injection
Tests web application email functionality (contact forms, password reset, newsletter subscriptions) for CRLF/SMTP header injection using Burp Suite and OWASP…
testing-for-xml-injection-vulnerabilities
Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side…
websecurityacademy-solutions
Solutions and walkthroughs for PortSwigger Web Security Academy labs covering SQLi, XSS, CSRF, SSRF, and 30+ vulnerability categories
auth-module-builder
Implements secure authentication patterns including login/registration, session management, JWT tokens, password hashing, cookie settings, and CSRF protection.…
awesome-ai-security-reference
Navigate AI security resources, learning paths, and tools from the Awesome AI Security curated list
h-pentest-ai-platform
AI-powered penetration testing platform with multi-agent architecture, 52+ attack knowledge base, and automated vulnerability scanning
security-requirement-extraction
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user…
security-best-practices
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best…
hunt-business-logic
Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb),…
analyzing-windows-event-logs-in-splunk
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral…
dependency-doctor
Audits project dependencies for outdated packages, duplicates, heavy/problematic libraries, security vulnerabilities, and risky version combinations. Generates…