Nützliche Agent Skills nach echter Nutzung sortiert

hunt-source-leak

Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info files, asset-manifest.json API route discovery, .DSStore file listing. Use at the START of every recon session — these findings often unlock the entire attack surface.

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

hunt-spa-api

Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely m

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

hunt-springboot

Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SPEL (CVE-2022-22963), heap dump credential extraction. Use when target runs Spring Boot — detected via X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

hunt-sqli

Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection (HackerOne Salesforce), time-based blind SQLi in GraphQL resolvers, and SQLi on OIDC-proxy backends. Use when hunting SQLi on any target. Dedicated NoSQL operator injection (MongoDB/Couc

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

hunt-ssti

Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval revea

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

hunt-subdomain

Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps cloudapp.azure.com regional-pool re-issue (1-click OAuth ATO via wildcard replyto, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel cname.vercel-dns.com deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis o

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

ios-redteam-pipeline

End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static analysis, Info.plist + entitlements + Keychain secret extraction, App Transport Security (ATS) misconfig + certificate-pinning bypass (frida-ios-dump, objection, SSL Kill Switch 2), URL-scheme / Universal Link hijack, exported-service enumeration, Frida runtime instrumentation. Companion to apk-redteam-pipeline for the iOS side of a mobile app catalog

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

mid-engagement-ir-detection

Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those observations into deliverable findings. Built from authorized red-team work where the client patched a confirmed SQLi within 30 minutes of detection AND an external attacker locked multiple new accounts during a single test session. Use when (a) running ANY active engagement against a monitored target, (b) a previously-confirmed finding stops

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

okta-attack

Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirecturi tampering), MFA enumeration, post-compromise admin API surface. Many enterprise orgs use Okta instead of (or alongside) Entra ID. Distinct endpoints, distinct rate-limiting, distinct factor flows. Use whe

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

osint-methodology

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset types, severity rubric (CRITICAL/HIGH/MEDIUM/LOW/INFO), confidence upgrade workflows, time budgeting, asset-level triage rules, scale-based tactics, identity-fabric mapping (Entra/Okta/ADFS/Google/SAML/M365 Teams+SharePoint+OAuth), API and auth

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

MIT2 Dateien

redteam-mindset

Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when scope is "external red team" not "bug bounty / WAPT".

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

redteam-report-template

Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different cadence. Built from an authorized engagement deliverable where 14 findings were packaged into a 52KB MD + 2.2MB DOCX with 16 embedded screenshots. Use when the engagement is "external red team for an enterprise client" (not H1/Bugcrowd/Intigrit

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

security-arsenal

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

supply-chain-attack-recon

External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the

Installationen / 1h: 1
GitHub Stars: 4581
Aktualisiert: 20. Sept.

ccch1mneyyy

bug

Turn a reported defect into an actionable bug report or issue draft. Use when the user asks to capture or document a bug; a request to fix broken behavior should proceed to diagnosis and repair.

Installationen / 1h: 1
GitHub Stars: 3113
Aktualisiert: 20. Sept.

arxiv-preflight

Run a submission-readiness preflight on a manuscript before arXiv upload. Use when the user is preparing an arXiv submission, asks to check a paper before uploading, mentions hallucinated or fake references, leftover LLM meta-comments / prompts in text, placeholder data (TODO, TBD, XX%), AI-use disclosure, scholarly integrity, research integrity, or arXiv moderation risk — even if they don't say \"preflight\". Also trigger on phrases like \"check my paper before arXiv\", \"verify my references\"

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT22 Dateien

author-response-builder

Turns reviewer comments into structured, professional point-by-point responses linked to manuscript revisions, clarifications, rebuttals, and additional analyses.

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT9 Dateien

conference-abstract-writer

Condenses a full study into conference-submission abstract format. Use when adapting a manuscript abstract or study summary to meet a specific conference's word limit, structured format (Background/Methods/Results/Conclusion), character limits, or required section headings. Also triggers on "adapt my abstract for [conference]", "shorten my abstract to 250 words", "reformat for ASCO/ASGCT/SfN/AACR", "I need a conference abstract", or "cut my abstract to fit the word limit".

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT5 Dateien

figure-legend-writer

Writes complete, publication-grade figure legends that can stand on their own. Use when writing or revising figure legends for any scientific figure — bar charts, line graphs, scatter plots, box plots, heatmaps, survival curves, flow cytometry plots, western blots, microscopy images, or schematic diagrams. Also triggers on "write a figure legend for", "help me describe this figure", "my figure needs a legend", "write Figure 1 legend", or "what should a figure legend include".

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT6 Dateien

graphical-abstract-generator

Converts a biomedical study storyline into a graphical abstract and, when direct image capability is available, generates the graphical abstract directly; otherwise it falls back to prompts, Mermaid flowcharts, or designer-facing briefs.

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT11 Dateien

introduction-logic-builder

Builds background-gap-objective logic for biomedical manuscript introductions with clear study positioning and disciplined narrative structure.

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT8 Dateien

introduction-section-writer

Writes the full Introduction section of a biomedical manuscript based on an approved or sufficiently clear study logic, while preserving evidence boundaries and introduction discipline.

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT12 Dateien

latex-manuscript-format-converter

Converts existing manuscript content into LaTeX format aligned with a target journal, conference, or template while preserving manuscript meaning and structural integrity.

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT9 Dateien

lay-summary-for-cross-disciplinary-teams

- Rewrites technical research content into a structured lay summary that cross-disciplinary teams can quickly understand and act on. Use when the user wants to explain research to colleagues outside their specialty — clinicians, wet-lab scientists, bioinformaticians, product managers, or leadership. Trigger on: "lay summary", "explain my research to the team", "non-technical summary", "cross-disciplinary summary", "translate my findings", "align our team on the study", or any request to communic

Installationen / 1h: 1
GitHub Stars: 1896
Aktualisiert: 17. Sept.

MIT4 Dateien