hunting-web-backdoors
Hunt planted webshells and backdoors across a web source tree — PHP first (also JSP, ASP, Node) — triaging a directory at scale, statically decoding…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-20 00:13
Security & auditing
7,233 results
ctf-flag-hunting
Flag search strategy in CTF challenges. Use when you gain access to the target via RCE/LFI/SQLi/webshell, etc., but cannot find the flag using regular ls/cat commands. Covers all possible flag storage locations: file system, database, environment variables, source code, memory, etc. Search priorities ordered by success rate — try standard paths first, then search the entire disk
evasion-research
GitHub Security Research Methodology: Search GitHub for evasion/Loader/C2 technical repositories, analyze code patterns, and extract new techniques into the knowledge base. Use when the knowledge base has no evasion technique for the current detection environment — first search high-star GitHub repositories, analyze the code, then write to evasion-techniques-db.json or…
post-exploit-windows
Full Windows post-exploitation workflow. Used after obtaining a Windows shell via RCE/webshell/RDP. Covers system information gathering, UAC bypass, local privilege escalation, credential extraction (SAM/LSASS/browser), and domain information reconnaissance. Applies to standalone hosts and domain environments
recon-full
Active full-process asset reconnaissance. Use when you need to conduct complete reconnaissance on a target from scratch to vulnerability discovery, the first phase of a penetration test, or when you need a comprehensive understanding of the target's attack surface. Covers the complete chain of subdomain enumeration → port scanning → liveness detection → fingerprinting → POC scanning
security-scanner
Proactive security assessment with SAST, secrets detection, dependency scanning, and compliance checks. Use for pre-deployment audit. NOT for code review…
broken-authentication
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential…
vibe-security
Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix,…
memory-forensics
Analyzes volatile memory dumps to detect malware, rootkits, and security breaches in digital forensics.
picocom
Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation,…
re-format-pe
PE format parsing: DOS/NT headers, section table, imports/exports, TLS callbacks, Rich Header, certificate table. Trigger words: PE format, parse exe, section table, Delphi, VB6, vmt, MSVBVM60, RTTI, legacy programs
security-principles
Use this skill when handling secrets, credentials, PII, input validation, or any security-sensitive code. Covers secrets management, secure defaults,…
gke-workload-security
Workflows for auditing and hardening the security of GKE workloads.
security-requirement-extraction
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user…
cyber-audit
Check whether this machine is affected by a named CVE, malicious package, or supply-chain advisory; read-only, writes a report.
pentest-vuln-verify-test
Automatically verify web vulnerabilities (open redirect, XSS) through raw HTTP request manipulation and strict validation.
authorizing-api-requests
Use when authenticating or authorizing requests to any Mailtrap API (Email Send, Email Testing/Sandbox, Templates, Contacts, Sending Domains, Suppressions).…
ekata
Ekata integration. Manage data, records, and automate workflows. Use when the user wants to interact with Ekata data.
jumpcloud
JumpCloud integration. Manage data, records, and automate workflows. Use when the user wants to interact with JumpCloud data.
onespan
OneSpan integration. Manage data, records, and automate workflows. Use when the user wants to interact with OneSpan data.
waratek
Waratek integration. Manage data, records, and automate workflows. Use when the user wants to interact with Waratek data.
detecting-evasion-techniques-in-endpoint-logs
Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling.…
detecting-spearphishing-with-email-gateway
Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG)…
implementing-end-to-end-encryption-for-messaging
Implements a simplified Signal Protocol-style end-to-end encryption scheme for messaging, covering key exchange, forward secrecy, and the core cryptographic…