All authors
Claude Skills by NetVar1337
github.com/NetVar1337861 skills0 installs44 views
- Diagram Generatorgenerate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineeri...Votes: 0GitHub stars: 2
- Digital ForensicsUse for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.Votes: 0GitHub stars: 2
- Docs GeneratorCreates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: write report, write docs, produce a report, writeup, technical documentation, report, documentation.Votes: 0GitHub stars: 2
- Dotnet Reverse.NET / C# binary reverse engineering. Use when the target is a .NET assembly (PE header containing CLR, .exe/.dll managed program), C# compiler output (including NativeAOT), red team Sharp* tools (Rubeus / SharpHound / etc.), .NET obfuscated programs (ConfuserEx / SmartAssembly / Babel / Eazfuscator), or .NET loaders / info-stealers / wrapped malware. Prefer dnSpyEx + de4dot; integrate with dnSpy MCP when the AI needs to operate directly. Not for pure native binaries (use reverse-engineering ...Votes: 0GitHub stars: 2
- Edr Bypass ReUse when reverse engineering and measuring EDR, Defender, AV, or XDR behavior pinned to a Windows build, vendor, sensor, and policy: user-mode hooks, kernel callbacks, minifilters, WFP, ETW/ETW-TI, AMSI, memory scanners, and cloud ingestion. Treat unhooking, direct or indirect syscalls, ETW/AMSI patches, call-stack spoofing, sleep masks, and process injection as falsifiable bypass hypotheses with sensor-health, clean-baseline, positive-control, event-loss, delayed-verdict, and rollback eviden...Votes: 0GitHub stars: 2
- Email SecurityUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.Votes: 0GitHub stars: 2
- Firmware PentestFirmware / IoT penetration chain. Start from a raw .bin / .img blob and run the full loop: reverse engineering → extraction → emulation → exploitation. The methodology follows the nine phases of OWASP FSTM; the toolchain centers on binwalk v3, unblob, EMBA, Firmadyne, and AFL++. Applicable scenarios: router/camera/smart-home firmware auditing, firmware upgrade package reversing, IoT CVE reproduction, embedded 0-day hunting. Trigger keywords: firmware, IoT, binwalk, unblob, UART, JTAG, squashf...Votes: 0GitHub stars: 2
- Ghidra ReverseUse for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.Votes: 0GitHub stars: 2
- Go Rust ReverseUse for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.Votes: 0GitHub stars: 2
- Hardware SecurityUse for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.Votes: 0GitHub stars: 2
- Ida ReverseIDA Pro reverse engineering assistance skill. Whenever the user mentions reverse engineering, decompilation, analyzing binaries/PE/ELF/APK/DLL/SO, cracking, finding passwords, vulnerability analysis, virus analysis, or firmware analysis, or needs to analyze exe/dll/so/elf/macho/sys files, you MUST use this skill. Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "t...Votes: 0GitHub stars: 2
- Identity FederationUse for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.Votes: 0GitHub stars: 2
- Js ReverseUse when doing frontend JavaScript reverse engineering with js-reverse-mcp; applies to signature-chain locating, page observation forensics, runtime sampling, local environment-patched reproduction, and evidence-based output. Prefer the js-reverse_* tools present in the current environment; bring in jshookmcp when a stronger browser/CDP/Hook surface is needed.Votes: 0GitHub stars: 2
- Llm SecurityUse for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.Votes: 0GitHub stars: 2
- Macos ReverseUse for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.Votes: 0GitHub stars: 2
- Malware AnalysisUse when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.Votes: 0GitHub stars: 2
- Mobile ReverseUse for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.Votes: 0GitHub stars: 2
- Ot IcsUse for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.Votes: 0GitHub stars: 2
- Patch Diff ExploitN-day patch diffing through to exploitation. Infer the vulnerability from the vendor-released patch, write a PoC, and turn it into a usable attack module. Applicable scenarios: a known CVE number with a patch but no PoC, SRC/red team needing to hit assets that were not updated in time, N-day weaponization, Patch Tuesday tracking. Core method: obtain before/after binaries → align symbols → binary diff → inspect newly added security checks to infer the bug class → write a PoC to trigger the vul...Votes: 0GitHub stars: 2
- Pentest ToolsActive penetration testing toolchain. Covers reconnaissance, port scanning, vulnerability scanning, web penetration, SQL injection, directory brute forcing, password cracking, and similar scenarios. Exposes 20+ security tools to the AI agent via MCP servers (pentestMCP / mcp-security-hub). Trigger keywords: penetration testing, port scanning, Nmap, vulnerability scanning, Nuclei, SQL injection, SQLMap, directory brute force, FFUF, password cracking, Hashcat, reconnaissance, subdomains, web pe...Votes: 0GitHub stars: 2
- Src HunterPractical SRC / crowdsource testing / bug bounty vulnerability hunting workflow skill. Includes: 5-phase methodology (intake → recon → enum → hunt → report), 19 attack-class playbooks (SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS), 305 structured payloads, 263 WAF/EDR bypass variants, 2,887 real disclosed High/Critical HackerOne cases, 77,000+ WooYun case statistics, a Chinese-domestic OA / middleware fingerprint lib...Votes: 0GitHub stars: 2
- Protocol ReverseUse for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.Votes: 0GitHub stars: 2
- Pwn ChainFull-chain engineering methodology for going from reverse engineering to a working exploit. Applicable scenarios: you have the binary + the vulnerability + the target environment, and need to write an exploit that reliably gets through (not a script that only reproduces locally once and crashes the moment it goes remote). Covers three major directions: stack overflow / heap exploitation / kernel pwn. Emphasizes the engineering gap between "CTF passes locally → real remote stable exploitation"...Votes: 0GitHub stars: 2
- Radare2Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.Votes: 0GitHub stars: 2
- Radio SdrUse for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.Votes: 0GitHub stars: 2
- Reverse EngineeringProvides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone cryp...Votes: 0GitHub stars: 2
- Dsl Vm ReverseReverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.Votes: 0GitHub stars: 2
- Supply Chain SecurityUse for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.Votes: 0GitHub stars: 2
- Thick ClientUse for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.Votes: 0GitHub stars: 2
- Threat HuntingUse for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.Votes: 0GitHub stars: 2
- Wifi WirelessUse for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.Votes: 0GitHub stars: 2
- Windows AdUse for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.Votes: 0GitHub stars: 2
- ReviewUse before high-blast-radius builds to adversarially review SPEC.md ('review the spec', /ck:review).Votes: 0GitHub stars: 2
- Ring 1 BootkitUse when reversing or detecting a Ring-1.io-class bootkit cheat: bootmgfw implant, Hyper-V SLAT/MTF hooks, cloned game page tables, EPT-hidden inject, or the Aftermath Labs ring-1.io corpus and 2026 writeup.Votes: 0GitHub stars: 2
- Rop ChainsROP/JOP chain construction: gadgets, stack pivots, Windows x64 calling, syscall stubs, retpoline/CFG constraints.Votes: 0GitHub stars: 2
- Rust Driver ReconstructionRust reconstruction of closed-source Windows kernel drivers after reverse engineering, preserving WDM/KMDF architecture, ABI layouts, IOCTL contracts, IRQL, concurrency, PnP/power, and observable behavior. Use for reimplementing or porting a reversed .sys driver with windows-drivers-rs, wdk-build, wdk-sys, wdk, or cargo-wdk. Do NOT use for ordinary Rust applications or source-available driver refactors.Votes: 0GitHub stars: 2
- Rust ReviewUse when auditing Rust (especially unsafe/FFI/concurrency) for memory safety, panics, and async pitfalls.Votes: 0GitHub stars: 2
- Sarif ParsingUse to parse/filter/dedupe SARIF from CodeQL/Semgrep/other scanners (does not run scans).Votes: 0GitHub stars: 2
- Secrets AutomationUse when setting up unattended secret access (service accounts, vault scoping, non-echoing tokens).Votes: 0GitHub stars: 2
- Secure Boot Uefi ResearchBoot-trust chain research: UEFI phases and variable services (PK/KEK/db/dbx), Secure Boot enforcement points, BCD policy persistence (testsigning/nointegritychecks), BitLocker key hierarchy and PCR binding, measured boot vs secure boot, bootkit precedents and their bypass classes, lab setup for OVMF/hardware research. Use when work touches boot trust, BitLocker, or pre-OS code.Votes: 0GitHub stars: 2
- Security Product Vulnerability ResearchUse when hunting new vulnerabilities in the latest stable enterprise security product: endpoint protection, EDR/XDR, antivirus, DLP, firewall/VPN, email/web gateway, SIEM/SOAR, scanner, sandbox, agent, management server, update engine, parser, kernel driver, or cloud connector. Maps hostile-content pipelines and management trust boundaries to RCE, privilege escalation, bypass, or fleet-wide com...Votes: 0GitHub stars: 2
- Security State Machine EngineeringUse to design/test/recover security workflows with durable state and side effects.Votes: 0GitHub stars: 2
- SemgrepUse to run Semgrep security/quality scans, including multi-language parallel workers.Votes: 0GitHub stars: 2
- Sercanarga Engineering StyleUse when applying Sercan Arga evidence-backed engineering style.Votes: 0GitHub stars: 2
- Session BootstrapUse at session start, after context loss, or when the agent seems lost in the environment. Map cwd, repo state, relevant skills, and constraints, then take the first action on the operator's actual request.Votes: 0GitHub stars: 2
- Simplify CodeUse for parallel cleanup of recent code changes (delete complexity, keep behavior).Votes: 0GitHub stars: 2
- Skill CuratorUse when adding, improving, consolidating, or evaluating agent skills and their Markdown references. Find real workflow gaps, avoid duplicate skills, write trigger-precise SKILL.md files, and validate each skill as an executable instruction surface.Votes: 0GitHub stars: 2
- Skill SyncUse when installing, copying, or checking local skills across agent harnesses. Treat ~/.agents/skills as the source of truth, sync selected skill directories to the target loader, and verify SKILL.md is discoverable.Votes: 0GitHub stars: 2
- Snailsploit FrameworksUse when applying SnailSploit's AATMF, SEF, P.R.O.M.P.T, AATMF Toolkit, LLM Red Teamer's Playbook, or Claude-Red frameworks to adversarial AI assessment and offensive-security research.Votes: 0GitHub stars: 2
- Sogen Usermode EmulatorUse when running or extending momo5502 Sogen: syscall-level Windows/Linux userspace emulation with real ntdll/kernel32, Unicorn/icicle/WHP/KVM/FEX backends, GDB-invisible debug, snapshots, or DRM/malware detonation without a real OS. Distinct from Kevlar (kernel DriverEntry) and Qiling (API reimplementation).Votes: 0GitHub stars: 2