All authors
Claude Skills by SecurityTalent
github.com/SecurityTalent36 skills1 installs92 views
- ApexDiscoveryComprehensive apex/root domain discovery using multiple techniques. USE WHEN user mentions find related domains, apex domains, root domains, company domains, acquisitions, subsidiary domains, reverse whois, domain footprint, OR wants to discover all domains owned by an organization before subdomain enumeration.Votes: 0GitHub stars: 12
- AsnReconASN and IPv4 range reconnaissance using bgp.he.net. USE WHEN user mentions ASN lookup, find IP ranges, company IP space, BGP reconnaissance, owned IP addresses, network footprint, OR wants to discover what IP ranges a company owns. Searches bgp.he.net free-form, extracts ASNs and IPv4 prefixes.Votes: 0GitHub stars: 12
- JsAnalyzerStatic analysis for JavaScript files targeting security vulnerabilities. USE WHEN user says 'analyze js', 'scan javascript', 'find sinks', 'js security', 'analyze these js files', OR user starts Claude in a folder with JS files and wants security analysis. Extracts URLs, paths, sources, sinks, postMessage handlers, secrets, and more.Votes: 0GitHub stars: 12
- SubdomainEnumSubdomain enumeration with Light and Full workflows, plus intelligent target prioritization. USE WHEN user mentions subdomain enumeration, find subdomains, subdomain recon, recon, reconnaissance, quick subdomain scan, fast recon, full recon, prioritize targets, OR wants to enumerate attack surface. Light = subfinder only (fast). Full = all tools (comprehensive). Both include optional prioritized reporting.Votes: 0GitHub stars: 12
- Api Recon And DocsAPI reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.Votes: 0GitHub stars: 12
- CrawlDeep web crawling using hakrawler and gospider for subdomain discovery, endpoint extraction, and JavaScript analysis. Use this skill when users request to crawl URLs, discover subdomains, extract endpoints, map web applications, or perform reconnaissance tasks. All outputs (categorized results, bash logs, summaries) are saved to timestamped folders with format crawl_{DOMAIN}_{timestamp}.Votes: 0GitHub stars: 12
- JsaComprehensive JavaScript security analysis tool that uses Chrome DevTools MCP to analyze web applications.Votes: 0GitHub stars: 12
- Osint EnrichOSINT enrichment and target dossier generation using publicly available information.Votes: 0GitHub stars: 12
- Pulse TemplateA personalized daily news digest skill with **resilient multi-tier fetching**. Goes out, reads the internet for you, picks the best stuff, and emails you a curated digest.Votes: 0GitHub stars: 12
- Recon And MethodologyReconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.Votes: 0GitHub stars: 12
- CacheDeceptionWeb cache deception and poisoning exploitation. USE WHEN user mentions cache deception, cache poisoning, CDN bypass, URL parsing discrepancy, path confusion, static extension bypass, or cache key manipulation. Based on Martin Doyhenard's "Gotta Cache 'em all" research.Votes: 0GitHub stars: 12
- Ssrf Server Side Request ForgerySSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.Votes: 0GitHub stars: 12
- 401 403 Bypass Techniques401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.Votes: 0GitHub stars: 12
- 403BypassAutomated 403 Forbidden bypass testing using Jason Haddix's techniques. USE WHEN you encounter 403 responses during recon, content discovery returns 403 paths, or user mentions 403 bypass, forbidden bypass, access control bypass, or WAF bypass.Votes: 0GitHub stars: 12
- Api Auth And Jwt AbuseAPI authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.Votes: 0GitHub stars: 12
- Api Authorization And BolaAPI authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.Votes: 0GitHub stars: 12
- Api SecEntry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.Votes: 0GitHub stars: 12
- Bac AnalyzerPassive traffic analyzer that examines captured HTTP traffic (HAR, Caido JSON, Burp XML) to identify potential Broken Access Control (BAC) and Insecure Direct Object Reference (IDOR) vulnerabilities. USE WHEN user mentions analyze traffic, check for IDOR, BAC analysis, analyze HAR, analyze Caido, broken access control, or IDOR scan.Votes: 0GitHub stars: 12
- Active Directory Acl AbuseActive Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.Votes: 0GitHub stars: 12
- Active Directory Certificate ServicesAD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.Votes: 0GitHub stars: 12
- Active Directory Kerberos AttacksKerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.Votes: 0GitHub stars: 12
- Anti Debugging TechniquesAnti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.Votes: 0GitHub stars: 12
- Android Pentesting TricksAndroid pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.Votes: 0GitHub stars: 12
- Ai Ml SecurityAI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.Votes: 0GitHub stars: 12
- Llm Prompt InjectionLLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.Votes: 0GitHub stars: 12
- Skill CreatorGuide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends AI capabilities with specialized knowledge, workflows, or tool integrations.Votes: 0GitHub stars: 12
- SkillabcIntelligent orchestration layer that analyzes requests, selects the most relevant OpenCode skills, combines workflows intelligently, and coordinates multi-skill execution.Votes: 0GitHub stars: 12
- BugBountyWorkflowBug bounty hunting workflow and report writing expertise. USE WHEN user mentions bug bounty, vulnerability report, HackerOne, Bugcrowd, PoC creation, severity assessment, CVSS scoring, responsible disclosure, or needs help writing security reports. Provides templates and workflow guidance.Votes: 0GitHub stars: 12
- TabletopExerciseComprehensive cybersecurity tabletop exercise design and facilitation framework. USE WHEN designing incident response scenarios, creating executive or technical tabletops, generating atomics for exercise runners, identifying missing SOPs/playbooks, or evaluating organizational preparedness. Includes threat model integration, CISA-aligned methodologies, and automated gap analysis.Votes: 0GitHub stars: 12
- Code Security AuditorPerform pre-execution security audits of untrusted codebases through static analysis. Use when analyzing a codebase for potential malicious behavior, supply chain risks, or security vulnerabilities before local execution. Triggered by requests like "analyze this project for security risks", "audit this code before running", "check if this codebase is safe", or similar security review requests.Votes: 0GitHub stars: 12
- Java Backend ArchitectComprehensive skill for designing and building scalable Spring Boot backend systems with clean architecture, JWT auth, MySQL, REST APIs, Docker, Redis, Kafka, microservices, and production deployment. Trigger when users ask to create, scaffold, or architect Java/Spring Boot backend services.Votes: 0GitHub stars: 12
- Otp Bruteforce TestingDetect, validate, and exploit OTP (one-time password) brute-force vulnerabilities in phone/email verification, MFA, password-reset, and transaction-confirmation flows. Use when a target issues numeric one-time codes (4-8 digits via SMS/email), when OTP verification endpoints appear unthrottled, when reviewing authentication or account-recovery code, or when assessing rate limiting on verification APIs. Produces PoC scripts, response-oracle analysis, CVSS scoring, and remediation guidance.Votes: 0GitHub stars: 12
- Stack Bounds Format AuditingDetect, audit, and validate stack buffer overflows caused by incorrect bounds arithmetic in string formatting and memory copy operations (snprintf, swprintf, sprintf, strncpy, memcpy) writing into fixed stack buffers where the size argument is not decremented as the destination pointer advances. Use when auditing C/C++ network protocol serializers, URL/URI builders, message formatters, IPC serialization, or logging routines concatenating attacker-controlled fields. Reproduces HackerOne #25515...Votes: 0GitHub stars: 12
- Url Parser Confusion TestingDetect SSRF filter bypasses and URL-parsing inconsistencies caused by malformed URL syntax — triple-slash (http:///host/path), backslashes, encoded delimiters, userinfo, numeric IP forms, IPv4-mapped IPv6. Use when reviewing URL validation, hostname allowlists, SSRF protections, redirect handling, or any code that parses user-supplied URLs (curl/libcurl CURLU, WHATWG URL, Python urllib, Node, Go, Java). Reproduces and extends HackerOne #3923212 (curl URL API triple-slash). Produces parser-dif...Votes: 0GitHub stars: 12
- Clickjacking TestingClickjacking overlays a target page in a transparent or hidden iframe, tricking victims into clicking UI elements they cannot see. Detect by attempting to load the target in an iframe and checking for `X-Frame-Options` (DENY/SAMEORIGIN) or `Content-Security-Policy: frame-ancestors` headers. Frame-busting JavaScript can be bypassed via double-framing, `sandbox` attribute, `onBeforeUnload` exploitation, and IE `location` variable redefinition. Tools: Burp Suite (Clickjacking PoC generation).Votes: 0GitHub stars: 12
- Open Redirect TestingUse when testing redirect or return-URL parameters for open redirect vulnerabilities. Trigger on: ?redirect=, ?url=, ?next=, ?return_to=, ?continue=, ?dest=, ?destination=, ?return=, ?go= parameters; post-login/logout redirect flows; OAuth callback ?state=; any endpoint that reads a URL from input and issues a 301/302/307. Detects filter bypass via @-symbol, subdomain abuse, backslash normalization, double URL encoding, unicode homographs, null bytes, protocol-relative URLs, data:/javascript:...Votes: 0GitHub stars: 12