Loading...
Loading...
Found 4,044 Skills
Claude-BugHunter — a Claude Code skill bundle for bug hunting and external red-team work (82 skills, 15 slash commands, 681 disclosed-report patterns across 24 vulnerability classes). MIT + CC-BY-4.0; referenced externally only, no content copied.
HTTP request smuggling and desynchronization auditing covering CL.TE, TE.CL, TE.TE obfuscation, HTTP/2 to HTTP/1.1 downgrade desync (H2.CL, H2.TE), header newline injection, and reverse-proxy/origin parser normalization. Use when auditing multi-tier load balancers, CDNs, and reverse proxy deployments.
Linux local privilege boundary auditing covering SUID/SGID binaries, POSIX file capabilities (`getcap`), `sudoers` NOPASSWD/wildcard rules, writable systemd unit paths, cron job scripts, and kernel sysctl hardening.
Docker and OCI container isolation auditing covering `--privileged` risks, dangerous Linux capabilities (`CAP_SYS_ADMIN`, `CAP_DAC_READ_SEARCH`), hostPath/docker.sock mounts, seccomp/AppArmor profiles, and rootless user namespaces.
Practical coverage-guided fuzzing methodology using AFL++, libFuzzer, Honggfuzz, and Cargo-Fuzz, covering fuzz harness writing, seed corpus curation, custom structure-aware mutators, sanitizer integration, and coverage maximization.
Endpoint Detection and Response (EDR) sensor telemetry auditing covering Event Tracing for Windows (ETW), AMSI integration, kernel callback health, user-mode hook integrity, and anti-tamper protection verification.
A reverse proxy is a server that sits between clients and backend servers, forwarding client requests to the appropriate server while hiding the backend infrastructure and often providing load balancing or caching. Misconfigurations in a reverse proxy, such as improper access controls, lack of input sanitization in proxypass directives, or trusting client-provided headers like X-Forwarded-For,...
Cross-Site Request Forgery (CSRF/XSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. - OWASP The Prime Cross Site Request Forgery Audit and Exploitation Toolkit. When...
LaTeX Injection is a type of injection attack where malicious content is injected into LaTeX documents. LaTeX is widely used for document preparation and typesetting, particularly in academia, for producing high-quality scientific and mathematical documents. Due to its powerful scripting capabilities, LaTeX can be exploited by attackers to execute arbitrary commands if proper safeguards are not...
Use when user says "create workflow", "create a workflow", "design workflow", "orchestrate", "automate multiple steps", "coordinate agents", "multi-agent workflow". Creates orchestration workflows from natural language using Socratic questioning to plan multi-agent workflows with visualization.
Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.
Schedule a protected Supabase Edge Function or HTTP-facing RPC through Crontap with an external clock and observable delivery. Use when a user needs recurring Supabase work with retries, history, or failure alerts.