All authors
Claude Skills by FJRG2007
github.com/FJRG2007111 skills3 installs246 views
- Cloud ExploitCloud exploitation — AWS IAM privilege escalation (21 Rhino primitives), IMDS/SSRF → credential pivot, S3 misconfiguration, Azure RBAC abuse, Kubernetes pod escape and RBAC, Terraform state leaks.Votes: 0GitHub stars: 2
- OpsecOperational security — scan rate limits, user-agent rotation, traffic shaping, evidence handling, detection awareness, scope enforcement, and anti-detection patterns for bug bounty and VAPT engagements.Votes: 0GitHub stars: 2
- Post ExploitPost-exploitation — privilege escalation (Windows Potato/UAC/SUID/sudo), credential access (LSASS/SAM/Responder/spray), and lateral movement (Pass-the-Hash/WMI/tunneling). Applies after initial foothold for VAPT/red team engagements.Votes: 0GitHub stars: 2
- Report WritingBug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.Votes: 0GitHub stars: 2
- Triage ValidationFinding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.Votes: 0GitHub stars: 2
- Web2 Vuln ClassesComplete reference for 22 web2 bug classes. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10), API misconfig (mass assignment, JWT, prototype pollution, CORS), ATO taxonomy, SSTI, subdomain takeover, cloud misconfigs, HTTP smuggling, cache poisoning, MFA bypass (9 patterns), SAML attacks, insecure deserialization (Python/Java/.NET/PHP/Ruby), and prototype pollution...Votes: 0GitHub stars: 2
- Bug HuntFind what looks finished but breaks in real use - flows that fail on the second step, state lost on reload, round trips that do not round-trip, roles that see a dead button, existing data the change never handled. Use for any "find the bugs", QA, or "is this really done" pass over a feature or a whole app.Votes: 0GitHub stars: 2
- Perf AuditMeasure and fix load and runtime speed where users feel it - Core Web Vitals from a real trace, request waterfalls, oversized bundles and payloads, N+1 queries, render-blocking work, slow interactions. Use when a page or flow feels slow, before shipping a heavy view, or for any performance or optimisation pass.Votes: 0GitHub stars: 2
- Scale AuditFind what breaks as data, users and traffic grow - unbounded queries and lists, missing indexes, per-row work, in-memory filtering, missing pagination, connection and rate limits, work that should be a background job. Use before launch, when data is growing, or for any scalability review.Votes: 0GitHub stars: 2
- Search QualityCheck that a search box finds the right thing and says "no results" when nothing matches - fuzzy matching tuned so loose it returns everything, missing typo tolerance, bad ranking, no empty state. Use on any search, filter, finder or command palette.Votes: 0GitHub stars: 2
- Upgrade StripeGuide for upgrading Stripe API versions and SDKsVotes: 0GitHub stars: 2