All authors
Claude Skills by 26zl
github.com/26zl531 skills6 installs902 views
- Offensive SqliSQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via ...Votes: 0GitHub stars: 65
- Offensive SsrfServer-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive SstiServer-Side Template Injection testing checklist: template engine identification (Jinja2, Twig, Freemarker, Pebble, Velocity), polyglot detection payloads, engine-specific RCE payloads, blind SSTI, and filter bypass. Use when testing web apps for template injection vulnerabilities. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive ToctouTime-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-...Votes: 0GitHub stars: 65
- Offensive Vuln ClassesExploit development curriculum covering core vulnerability classes with real-world CVE case studies: stack/heap buffer overflows, use-after-free, integer overflows, format strings, type confusion, and race conditions. Use when learning or teaching vuln classes, researching specific CVE patterns, or building exploit dev knowledge. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive Waf BypassWAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive Wifi ReconWi-Fi reconnaissance methodology \u2014 adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 ...Votes: 0GitHub stars: 65
- Offensive WifiWireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons / Mana evil twin attacks, captive-portal phishing, KRACK and FragAttacks, WPS Pixie Dust, deauthentication and disassociation attacks, rogue AP construction (hostapd-mana), 802....Votes: 0GitHub stars: 65
- Offensive Windows BoundariesWindows security boundary taxonomy and attack surface enumeration: kernel/user boundary, sandbox boundaries (LPAC, AppContainer), COM/RPC boundaries, hypervisor boundary, trust level transitions. Use when planning privilege escalation paths, sandbox escapes, or understanding Windows security architecture. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive Windows MitigationsDeep-dive on Windows exploit mitigations: ASLR, DEP/NX, CFG, CET/Shadow Stack, SEHOP, Heap Guard, ACG, Arbitrary Code Guard. Covers both the protection mechanism and known bypass techniques. Use when researching Windows exploit mitigations, planning bypass strategies, or understanding protection depth. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive Wpa EnterpriseWPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology \u2014 EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain cred...Votes: 0GitHub stars: 65
- Offensive Wpa2 PskWPA/WPA2-PSK attack methodology \u2014 four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal \u2014 the most common consumer/S...Votes: 0GitHub stars: 65
- Offensive Wpa3 SaeWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology \u2014 transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec....Votes: 0GitHub stars: 65
- Offensive WpsWPS (Wi-Fi Protected Setup) PIN attack methodology \u2014 Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS \u2014 common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade. Use only for authorized security r...Votes: 0GitHub stars: 65
- Offensive XssCross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive XxeXML External Entity injection testing checklist: classic XXE, blind XXE (out-of-band), XXE via file upload (SVG/docx), XXE in SOAP/REST, error-based XXE, XInclude attacks, and XXE filter bypass. Use for web app XXE testing and bug bounty. Use only for authorized security research, training, or assessment.Votes: 0GitHub stars: 65
- Offensive Z WaveZ-Wave attack methodology \u2014 sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting Z-Wave smart home devices (door locks, sensors, garage controllers) \u2014 common in mid-2010s smart home deployments still in production. Use only for authorized security ...Votes: 0GitHub stars: 65
- Offensive Zigbee Thread MatterZigbee, Thread, and Matter mesh-protocol attack methodology \u2014 IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection attacks, Zigbee Cluster Library command abuse for door locks and bulbs, Thread network credential theft, Matter commissioning chain analysis, and 6LoWPAN/IPv6 routing exploitation. Use when targeting smart-home or commercial mesh deployments, Zigbee-based ...Votes: 0GitHub stars: 65
- Report WritingBug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.Votes: 0GitHub stars: 65
- Sarif ParsingParses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.Votes: 0GitHub stars: 65
- Security ArsenalSecurity payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.Votes: 0GitHub stars: 65
- Security CommsUse to translate a security finding, incident, or program update for a specific audience — board, executives, engineering, customer success, end customers, legal, or procurement. Produces audience-tuned writeups: incident notification, breach disclosure, post-mortem, status update, remediation ask, and customer-facing advisory. Use when the same technical fact needs different framing per stakeholder, when drafting external disclosure, or when an exec/board/customer needs the "so what" without...Votes: 0GitHub stars: 65
- Security PayloadsUse when you need a specific exploit payload — XSS, SQLi, SSTI, SSRF, XXE, file upload bypass, auth bypass, command injection. Points to PayloadsAllTheThings + SecLists/Fuzzing locations, plus inline canonical payloads for the most common cases. Triggers on "xss payload", "sqli payload", "ssti payload", "ssrf bypass", "xxe payload", "command injection".Votes: 0GitHub stars: 65
- Security WordlistsUse when you need wordlists for fuzzing, password cracking, content discovery, username enumeration, or pattern matching. Points to SecLists, PayloadsAllTheThings, and seclists-rolling that are already cloned by this installer. Triggers on "wordlist", "rockyou", "fuzz list", "common passwords", "directory wordlist", "subdomain wordlist".Votes: 0GitHub stars: 65
- SemgrepRun Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases.Votes: 0GitHub stars: 65
- Sharp EdgesIdentifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.Votes: 0GitHub stars: 65
- Skill Curation RouterUse when choosing, ranking, curating, pruning, or de-duplicating Claude cybersecurity skills; when a broad cybersecurity task could match many skills; or when deciding which skill should be loaded first.Votes: 0GitHub stars: 65
- Skill Dependency AuditUse when auditing optional Python dependencies for vendored Claude skill helper scripts, checking missing imports, deciding whether dependencies belong in MCP runtime, or troubleshooting a skill script that fails with ModuleNotFoundError.Votes: 0GitHub stars: 65
- Supply Chain Prodsec HardeningUse for software supply chain, product security, SBOM, SLSA, provenance, Sigstore/cosign, dependency pinning, CI/CD hardening, artifact signing, build isolation, release security, vendor risk, and secure SDLC work.Votes: 0GitHub stars: 65
- Supply Chain Risk AuditorIdentifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.Votes: 0GitHub stars: 65
- Telecom 5g Security AssessmentUse for telecom and 5G security, mobile core, RAN, roaming, SS7, Diameter, GTP, IMS, SBA APIs, network slicing, SIM/eSIM, fraud, signaling, lawful intercept control review, and carrier-grade security assessments.Votes: 0GitHub stars: 65
- Triage ValidationFinding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.Votes: 0GitHub stars: 65
- Validate AllRun the full local validation suite for this installer before pushing or opening a PR. Runs shellcheck, bash syntax checks, tools_config validators, MCP sync validator, distro-compat validator, Claude skills validator, bats tests, ruff lint, and pytest. Triggers on phrases like "validate", "check before push", "run all checks", "make sure everything passes", "pre-commit check".Votes: 0GitHub stars: 65
- Variant AnalysisFind similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.Votes: 0GitHub stars: 65
- Web2 ReconWeb2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.Votes: 0GitHub stars: 65
- Web2 Vuln ClassesComplete reference for 22 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover,...Votes: 0GitHub stars: 65
- Web3 AuditSmart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.Votes: 0GitHub stars: 65
- Writeup TemplateUse after completing any substantive security workflow with this project, including CTF, bug bounty, CVE validation, guided MCP assessment, DFIR, pentest/recon, or troubleshooting. Generates a writeup at writeups/<category>/<descriptive-case-name>.md following the project's mandatory structure. Triggers on "write writeup", "document this challenge", "write up the solve", "document this finding", or right after a flag/finding/result is confirmed.Votes: 0GitHub stars: 65
- Yara Rule AuthoringGuides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.Votes: 0GitHub stars: 65
- Zeroize AuditDetects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.Votes: 0GitHub stars: 65
- Coding StyleKeep code comments and docstrings concise, neutral, human-authored in tone, and written in English unless another language is required. Use when writing, refactoring, or reviewing code where comments, identifiers, or docstrings may be added or changed; do not use to shorten required public API documentation, safety notes, or legal notices.Votes: 0GitHub stars: 2
- Data MinimizationKeep real personal and confidential data out of code, tests, fixtures, logs, error messages, examples, and prompts; use synthetic data, and mask identifiers when a real record is unavoidable. Use when writing tests, fixtures, seed data, logging, debugging output, or documentation, or when moving data between systems; do not use to remove lawful data processing that the product itself performs.Votes: 0GitHub stars: 2
- Destructive Ops ApprovalObtain explicit confirmation before irreversible or outward-facing operations such as force-pushes, history rewrites, mass deletion, data migrations, or production changes, and prefer the reversible alternative when one exists. Use when an action could destroy data, rewrite shared history, or change systems other people depend on; do not use to stall routine, easily reversible work.Votes: 0GitHub stars: 2
- Docs ConsolidationKeep project documentation in a small set of canonical files; extend an existing document instead of creating a new Markdown file, and merge overlapping documents rather than adding another. Use when writing, updating, or reorganizing documentation, or when a task would create a new .md file such as a summary, notes, plan, or per-feature guide; do not use to merge files a convention requires to stand alone, such as README, LICENSE, CHANGELOG, or generated references.Votes: 0GitHub stars: 2
- License ComplianceCheck the license before copying or vendoring third-party code, preserve required notices and attribution, and flag copyleft or unknown licenses before they enter the codebase. Use when copying code from other projects, adding dependencies, vendoring files, or maintaining attribution documents; do not use as legal advice beyond flagging conflicts for review.Votes: 0GitHub stars: 2
- No Ai TracesKeep delivered work free of AI self-reference, with no Co-Authored-By trailers or generated-with footers in commits and pull requests, and no comments, documentation, or changelog entries that narrate AI involvement, prompts, or the editing session. Use when writing commits, merge or squash messages, pull requests, release notes, changelogs, code comments, or documentation; do not use to bypass a policy that explicitly requires AI disclosure.Votes: 0GitHub stars: 2
- Secret HygieneNever write, echo, or commit secret values such as API keys, tokens, passwords, or private keys; reference them through environment variables or a secret manager, and report discovered secrets without reproducing the value. Use when writing code, tests, configuration, documentation, logs, or shell commands that touch credentials; do not use to weaken cryptographic material handling that the product itself must perform.Votes: 0GitHub stars: 2
- Simplify CodeSimplify recently changed or user-selected code while preserving observable behavior, public APIs, tests, and required safeguards. Use when asked to simplify, clean up, refactor for clarity, reduce nesting, remove duplication, or review an implementation for unnecessary complexity.Votes: 0GitHub stars: 2
- Supply Chain PinningAdd dependencies deliberately by justifying each new one, pinning versions or commits, respecting lockfiles, and never executing unpinned remote code. Use when adding or updating packages, container images, GitHub Actions, install scripts, or vendored code; do not use to block upgrades the user explicitly requested.Votes: 0GitHub stars: 2
- Surgical ImplementationMake the smallest justified code or configuration change, surface material assumptions, avoid unrelated cleanup, fix rather than silently skip defects found along the way, and define verifiable success criteria. Use when implementing features, fixes, refactors, or configuration changes in an existing repository; do not use for read-only analysis or broad rewrites the user explicitly requested.Votes: 0GitHub stars: 2