Claude Skills by ByamB4

github.com/ByamB4

21 skillsA× 17B× 40 installs58 views

Advisory MiningAMine GitHub Security Advisories and CVE databases for incomplete fixes, finding variant vulnerabilities in patched code or similar patterns in related packages.securityjavascriptgoVotes: 0GitHub stars: 46
Auth BypassADetect authentication and authorization bypass vulnerabilities including missing auth middleware, JWT algorithm confusion, IDOR, and session fixation.securitygobashVotes: 0GitHub stars: 46
Code Injection CodegenADetect code injection vulnerabilities in packages that dynamically generate or evaluate code via new Function(), eval(), vm.run*, or template literal interpolation.securityjavascripttypescriptVotes: 0GitHub stars: 46
Command InjectionBDetect OS command injection via shell execution sinks where user-controlled input reaches system commands without proper sanitization.securityjavascripttypescriptVotes: 0GitHub stars: 46
Cross PollinationACross-pollination multiplier technique: find a vulnerability in one package, then search for the same pattern across all similar packages to multiply findings.securityjavascriptpythonVotes: 0GitHub stars: 46
Decompression BombADetect decompression bomb vulnerabilities where compressed input can expand to exhaust memory, targeting buffer-based decompression without size limits.securityjavascriptpythonVotes: 0GitHub stars: 46
Skills DirectorySkills Directory Look up any of 103,619 scanned skills — grade, score, and every finding. Free.Check a skill
Entity ExpansionADetect XML/SVG/YAML entity expansion (Billion Laughs) vulnerabilities in parsers that allow unbounded entity definitions.securityjavascriptpythonVotes: 0GitHub stars: 46
Fp CheckASystematic false positive elimination for security findings. 6-gate verification, 13-item checklist, devil's advocate questioning. MANDATORY before any CVE submission.securityrustbashVotes: 0GitHub stars: 46
Jwt AttacksADetect JWT implementation vulnerabilities including algorithm confusion, none algorithm acceptance, weak secrets, and JWK injection attacks.securitygoshellVotes: 0GitHub stars: 46
Method ClobberingADetect method clobbering via user-controlled object keys that overwrite built-in methods like toString, valueOf, or hasOwnProperty, causing crashes or logic bypass.securityrustbashVotes: 0GitHub stars: 46
Path TraversalBDetect path traversal and Zip Slip vulnerabilities where user-controlled path components can escape intended directories.securityjavascripttypescriptVotes: 0GitHub stars: 46
Prototype PollutionADetect prototype pollution via object merge/clone/assign operations where __proto__ or constructor.prototype keys can modify Object.prototype.securityrustbashVotes: 0GitHub stars: 46
Recursion DosADetect stack overflow and infinite recursion DoS in recursive parsers, tree walkers, and serializers that lack depth limits.securitygobashVotes: 0GitHub stars: 46
RedosADetect Regular Expression Denial of Service (ReDoS) where crafted input causes catastrophic backtracking in regex patterns applied to user-controlled strings.securityjavascripttypescriptVotes: 0GitHub stars: 46
Report WritingAGenerate polished, human-sounding vulnerability disclosure reports for GHSA, HackerOne, and email. Auto-selects channel, calculates CVSS, and adapts tone.securityrustgoVotes: 0GitHub stars: 46
Sandbox EscapeADetect VM/sandbox escape vulnerabilities in packages using node:vm, simpleeval, or custom sandboxes that can be bypassed to achieve code execution.securitypythonrustVotes: 0GitHub stars: 46
SqliADetect SQL injection where user input reaches SQL query construction through string concatenation, template literals, or ORM raw query methods.securityjavascriptpythonVotes: 0GitHub stars: 46
SsrfBDetect Server-Side Request Forgery where user-controlled URLs can reach internal services, cloud metadata endpoints, or bypass network boundaries.securityjavascriptpythonVotes: 0GitHub stars: 46
SstiADetect Server-Side Template Injection where user input is passed as the template string itself rather than as template variables, enabling code execution.securityjavascriptpythonVotes: 0GitHub stars: 46
Target ReconATarget discovery methodology for finding high-quality npm/PyPI/GitHub packages to audit for vulnerabilities, with evaluation criteria and search strategies.securityjavascriptpythonVotes: 0GitHub stars: 46
XxeBDetect XML External Entity injection where XML parsers process untrusted input with external entity loading enabled, allowing file read or SSRF.securityjavascriptpythonVotes: 0GitHub stars: 46