All authors
Claude Skills by awarexone
github.com/awarexone64 skills6 installs105 views
- bug-bountyComplete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security t...Votes: 0GitHub stars: 5,833
- ArgusArgus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack), out-of-band confirmation of blind SSRF/XXE/SQLi/RCE/Log4Shell via interactsh, and an LLM red-team corpus (prompt-injection / jailbreak / system-prompt leak / exfil / indirect inje...Votes: 0GitHub stars: 5,833
- Bb MethodologyUse at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."Votes: 0GitHub stars: 5,833
- Bug BountyComplete bug bounty workflow — recon, pre-hunt learning, vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (ASI01-ASI10), A-to-B bug chaining, bypass tables, language-specific grep patterns, and reporting (7-Question Gate, 4 validation gates, CVSS 3.1, PoC generation, submission chec...Votes: 0GitHub stars: 5,833
- Cicd SecurityCI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.Votes: 0GitHub stars: 5,833
- Client ReverseClient-side request-signing and anti-bot token reversal for bug bounty — when a request carries a sign/sig/hmac/token/nonce/timestamp/X-Sensor header that Burp Repeater cannot replay, recover the signer just enough to reproduce the request outside the client. Packet-first staging (capture real request → prove replay works → only reverse if replay fails) across the locate→recover→runtime→validation→replay spine. Covers tracing backward from the signature field (writer→builder→entry→source), is...Votes: 0GitHub stars: 5,833
- Credential AttackPassword spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form / oauth / o365 / okta), rate-limit + lockout tactics, BBP legal guardrails, success detection, and the spray → authenticated /hunt chain pattern. Use when assessing whether credential attack is worth running on a target, picking the right mode, or recovering from common pitfalls.Votes: 0GitHub stars: 5,833
- Graphql AuditGraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, GraphQLmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.Votes: 0GitHub stars: 5,833
- Meme Coin AuditMeme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, token_scanner.py automation, and real exploit examples from 2024-2025. Use for any token audit, rug pul...Votes: 0GitHub stars: 5,833
- Mobile PentestMobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent. Covers APK/IPA decompile for hardcoded secrets + hidden API endpoints + base URLs the web app never exposes, exported-activity and deeplink intent injection, WebView addJavascriptInt...Votes: 0GitHub stars: 5,833
- Report WritingBug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.Votes: 0GitHub stars: 5,833
- Security ArsenalSecurity payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.Votes: 0GitHub stars: 5,833
- Triage ValidationFinding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.Votes: 0GitHub stars: 5,833
- Web2 ReconWeb2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.Votes: 0GitHub stars: 5,833
- Web2 Vuln ClassesComplete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS (postMessage), SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10, MCP/RAG attacks), API misconfig (mass assignment, JWT, prototype pollution, CORS), ATO (9 paths), SSTI, subdomain takeover, cloud misconfig, HTTP smuggling, cache ...Votes: 0GitHub stars: 5,833
- Web3 AuditSmart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.Votes: 0GitHub stars: 5,833
- Agentic App AuditBlack-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory poisoning, confused-deputy via connected tools, agent-to-agent IDOR, excessive agency / unconfirmed destructive actions, and privilege compromise where the agent holds broader perms than the user. Use when the target is a live assistant/agent product with tool access (bookings, email, payments, file/RAG, browsing) rather than a raw LLM chat box or an MCP server you can read.Votes: 0GitHub stars: 5,833
- Cloud PentestPost-access cloud exploitation for AWS, GCP, and Azure — what to do AFTER you obtain credentials or reach a metadata endpoint. Covers IAM enumeration and privilege escalation (iam:PassRole, CreatePolicyVersion, AssumeRole chains, GCP service-account impersonation, Azure managed-identity abuse), IMDSv1/v2 metadata credential theft, STS token abuse, S3/GCS/Blob bucket takeover and object exfil, Lambda/Cloud Functions env-var secrets, cross-account and cross-service pivoting, and turning leaked ...Votes: 0GitHub stars: 5,833
- Llm RedteamLLM application red-teaming — prompt injection (direct + indirect), jailbreak, system-prompt leak, data exfiltration, guardrail bypass, multi-turn crescendo, cross-lingual + cipher + invisible-unicode token smuggling, excessive agency / tool abuse, insecure output handling. Canonical OWASP LLM Top 10 + ASI01-ASI10 mapping. Use when a target exposes a chat/completions/assistant/copilot endpoint, an AI feature that consumes user text or documents, or any /v1/chat, /api/chat, /mcp surface.Votes: 0GitHub stars: 5,833
- Mcp Server AuditSecurity audit of Model Context Protocol (MCP) servers — tool poisoning, prompt injection via tool descriptions and results, unscoped/over-privileged tools, path traversal in file tools, command injection in shell/exec tools, SSRF in fetch tools, secret leakage through tool output, missing approval gates on state-changing actions, confused-deputy and rug-pull tool redefinition, token passthrough, and unsafe stdio/HTTP transport config. Covers auditing both first-party and third-party MCP serv...Votes: 0GitHub stars: 5,833
- Bug ChainingStandalone bug chaining skill — synthesized from omni-killchain, omni-references/chaining-impact, triage-validation, apex-hunter, web2-vuln-classes, bug-bounty, and bb-methodology. Covers the complete chaining mindset: 10-question filter, 15 proven chain patterns (A–O) with payout data, escalation ladders per vuln class, conditional-chain table (when a standalone bug needs a gadget), impact-writing rules, CVSS chain multipliers, and 30-minute chain-or-move decision clock. Use when you have a ...Votes: 0GitHub stars: 5,833
- Bugcrowd ReportingBugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-s...Votes: 0GitHub stars: 5,833
- JohnwickUse when the user says "run johnwick" / "/johnwick", hands you a bug-bounty target or scope and wants the full manual+recon+automated hunt run end-to-end, or asks to hunt a target with total coverage (every in-scope domain/subdomain, all JS, signup+login, then exploit and validate). Self-contained long-running orchestrator — recon, JS mining, auto-signup, and hunting for IDOR, SSRF, RCE, SSTI, XXE, SQLi, request smuggling, cache poisoning, race conditions, OAuth/JWT/SAML ATO, GraphQL, 403-byp...Votes: 0GitHub stars: 5,833
- JsmaxHigh-impact JavaScript analysis and exploitation engine. Use when you have a list of JS URLs and need to extract secrets, endpoints, JWTs, MD5 hashes, and critical data to prove high-impact vulnerabilities (PII dump, cloud takeover).Votes: 0GitHub stars: 5,833
- Omni KillchainElite end-to-end offensive bug-bounty hunting orchestrator. ALWAYS activate for: full-scope recon, killchain, bug hunting strategy, target triage, attack surface mapping, "find me a bug", "hunt on $target", high-payout vuln hunting, P1/P2 bug discovery, $10K+ bounty hunting, account takeover (ATO), authentication bypass, IDOR/BOLA, SSRF→cloud-metadata, RCE chains, file upload to RCE, dependency confusion, request smuggling, cache poisoning, OAuth/SAML/JWT abuse, GraphQL abuse, exposed service...Votes: 0GitHub stars: 5,833
- Pii HunterElite PII (Personally Identifiable Information) leak hunting skill for authorized bug bounty and pentests. ALWAYS activate for: mass PII exposure, data breach vectors, GDPR-reportable leaks, user data enumeration, unauth/cross-tenant PII read, API over-fetching, export/download PII bugs, search/autocomplete PII leaks, open datastores with user data, log/debug endpoints with PII, cache-based PII leaks, notification/webhook PII leaks, third-party analytics leaking PII, PDF/invoice generation ex...Votes: 0GitHub stars: 5,833
- Ai Agent SecurityReview AI agents with tools — shell, HTTP, files, browsers — for excessive agency, unsafe exec of model output, and missing human gates (CWE-78 / CWE-94).Votes: 0GitHub stars: 15
- Ai Application SecurityPre-ship security review for LLM-powered apps — RAG, chat APIs, output handling, and data exposure — without agent/tool focus.Votes: 0GitHub stars: 15
- Api SecurityAnalyze REST/RPC/API security design — use for BOLA/BFLA, mass assignment, auth on endpoints, rate limits, inventory gaps, and unsafe outbound API consumption (OWASP API Top 10 2023).Votes: 0GitHub stars: 15
- Attack Surface MappingMap application attack surface before deep scanning — use to inventory entry points, trust boundaries, data stores, and high-risk features that prioritize AXGuard skills and /axguard-audit.Votes: 0GitHub stars: 15
- Authentication AnalysisAnalyze authentication mechanisms — use when reviewing login, MFA, password storage, account recovery, API keys, or credential handling failures (CWE-287 / A07:2021 / API2:2023).Votes: 0GitHub stars: 15
- Authorization AnalysisAnalyze authorization and access control — use for IDOR/BOLA, missing ownership checks, privilege escalation, and function-level authZ gaps (CWE-639 / CWE-862 / CWE-863 / A01:2021 / API1:2023 / API5:2023).Votes: 0GitHub stars: 15
- Axguard AuditFull A-Z pre-ship security audit. Run when the user asks to audit, scan for vulnerabilities, security review before publish, or generate an AXguard report. Covers secrets, auth/IDOR, SQL/SSTI/injection, path traversal, SSRF, XSS, uploads, GraphQL, crypto, CORS/cloud, supply chain, debug exposure, and AI-agent risks; writes Markdown and HTML reports.Votes: 0GitHub stars: 15
- Axguard CsoChief Security Officer workflow for AXguard — STRIDE-lite threat model, OWASP-oriented prioritization, confidence-gated findings, then audit/triage/fix/report handoff. Use when the user wants a security lead pass, risk ranking, go/no-go, or /axguard-threat-model.Votes: 0GitHub stars: 15
- Axguard KnowledgePre-ship vulnerability class encyclopedia for AXguard — root causes, static detection hints, CWE/OWASP maps, and fix guidance for IDOR, auth, XSS, SSRF, SQLi, SSTI, deserialization, path traversal, secrets, cloud, CORS, JWT, upload, GraphQL, supply chain, LLM/agent, debug exposure, and crypto misuse. Load when auditing, triaging, or remediating and a class needs depth. Defensive static review only.Votes: 0GitHub stars: 15
- Axguard PreshipPre-ship security review checklist for the current repository. Use for focused release reviews covering auth, SQL/injection/SSTI, path, SSRF, XSS, uploads, GraphQL, crypto, secrets, cloud, supply chain, debug, and agent risks when a full /axguard-audit is not requested.Votes: 0GitHub stars: 15
- Axguard RemediateApply concrete defensive fixes for confirmed AXguard findings and re-audit. Use with /axguard-fix after triage. Prefer minimal patches, critical first, then verify with axguard audit/scan.Votes: 0GitHub stars: 15
- Axguard ReportProduce or polish AXguard Markdown and HTML audit reports from verified evidence. Use with /axguard-report. Prefer regenerating via axguard audit; tighten narrative only with confirmed findings.Votes: 0GitHub stars: 15
- Axguard SecurityAnalyze code for security vulnerabilities, investigate findings, verify fixes, and assess security risk before deployment. Use when reviewing security-sensitive changes, before ship/deploy, or when an agent should call AXGuard MCP instead of inventing its own scanner.Votes: 0GitHub stars: 15
- Axguard TriageTriage AXguard scanner output — false-positive filter, severity promotion, and keep/drop gates per vuln class. Use after an audit when the user wants signal, not volume, or runs /axguard-triage.Votes: 0GitHub stars: 15
- Cloud SecurityReview cloud and CORS misconfiguration in app code and IaC-adjacent configs — metadata URLs, public buckets, wildcard origins (CWE-918 / CWE-942 / A05:2021 / A10:2021).Votes: 0GitHub stars: 15
- Command InjectionAnalyze OS command and shell injection in application code — use when reviewing subprocess, exec, system, shell=True, or user-influenced shell strings (CWE-78 / CWE-77 / A03:2021).Votes: 0GitHub stars: 15
- Configuration SecurityFind security misconfiguration before ship — debug flags, verbose errors, exposed actuators/admin, weak defaults (CWE-489 / CWE-209 / A05:2021).Votes: 0GitHub stars: 15
- Deserialization SecurityAnalyze unsafe deserialization and object-decode sinks — use when reviewing pickle, YAML load, Java ObjectInputStream, PHP unserialize, or untrusted serialized blobs (CWE-502 / A08:2021).Votes: 0GitHub stars: 15
- File Upload SecurityAnalyze unsafe file upload handling — use when reviewing multipart uploads, extension/MIME checks, stored filenames, image processors, or user-supplied archives (CWE-434 / A04:2021).Votes: 0GitHub stars: 15
- Graphql SecurityAnalyze GraphQL API security — use when reviewing schemas, resolvers, introspection, batching, authorization per field, or CSRF on cookie-authenticated GraphQL endpoints (API1/API5/API8:2023).Votes: 0GitHub stars: 15
- Jwt SecurityAnalyze JWT implementation flaws — use when reviewing alg confusion, none algorithm, missing verify, weak secrets, or claim validation gaps (A07:2021 / API2:2023 / auth.jwt rules).Votes: 0GitHub stars: 15
- Mcp SecurityReview Model Context Protocol servers/clients and tool bridges for trust, supply-chain, and over-privileged tool exposure before ship.Votes: 0GitHub stars: 15
- Oauth SecurityAnalyze OAuth/OIDC integration security — use when reviewing redirect URIs, state/nonce, token handling, PKCE, or confused-deputy risks in authorization code flows (CWE-601 / A07:2021 / API2:2023).Votes: 0GitHub stars: 15
- Path TraversalAnalyze path traversal and unsafe file access — use when user input influences file paths, downloads, includes, zip extraction, or static file send APIs (CWE-22 / A01:2021).Votes: 0GitHub stars: 15