AGENT SKILLS · MISSION KIT
Useful agent skills ranked by real adoption
Browse verified skills from public repositories. Compare what each skill does, package contents, install activity, and source evidence before adding it to your agent.
- CATALOG SCOPE
- VERIFIED
- skills
- 22,603
- repositories
- 3475
- last synced
- Oct 30, 2026
elementalsoulshunt-dom
Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPr
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulshunt-grpc
Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or wh
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulshunt-host-header
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirecturi/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and th
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulshunt-misc
Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulshunt-rce
Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulshunt-tls-network
Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulshunt-xss
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no /event-handler execution), see hunt-html-injection — escalate here once script execution is possible.
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulsrecon-scope-triage
Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the brand name, so for any target whose name is a common/dictionary word, the output is dominated by assets belonging to UNRELATED same-named companies (repos, cloud buckets, mobile apps, breach corpora, typosquats). Built from an authorized engagement where an ASM report's "Criticals" were overwhelmingly false positives and the combo/repos/m
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulsreport-writing
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Validation gates and the submittability/always-rejected decision are owned by triage-validation; this skill owns the written report itself (templates, tone, formulas). Use after validating a finding and before submitting. Never use "could potential
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulsvmware-vcenter-attack
VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-exploited), default credentials, SSO configuration disclosure, vmdir LDAP enumeration, ESXi Open SLP RCE history. ONLY for vCenter / Workspace ONE / Aria instances exposed to the in
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
elementalsoulsweb3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
- 1h installs
- 1
- GitHub stars
- 5.1K
- Updated
- Oct 15
yoshiko-pgdifit-review
Review a specific diff (branch, commit, or GitHub PR) and show the findings as comments inside difit, the local diff viewer. Explicit opt-in only — use when the user explicitly names difit, asks to open or annotate the review in the difit viewer, or invokes this skill by name. For ordinary requests to review code, diffs, commits, branches, or pull requests, review normally and respond in the conversation without launching difit.
- 1h installs
- 1
- GitHub stars
- 3.3K
- Updated
- Aug 28
forward-futureloop-library
Compatibility alias for Loopy. Use only when an existing installation or older instruction explicitly invokes loop-library; use Loopy for new installations and requests. Provides the same discovery, recommendation, audit, repair, adaptation, guided crafting, bounded execution, run debrief, project loop saving, and publication-preparation workflows.
- 1h installs
- 1
- GitHub stars
- 3.2K
- Updated
- Sep 11
owl-listenerdesign-impact-reporting
Communicate design's contribution to business and user outcomes in stakeholder language. Use when reporting results upward. For choosing the metrics in the first place, use metrics-definition (ux-strategy).
- 1h installs
- 1
- GitHub stars
- 2.9K
- Updated
- Sep 5
owl-listenerdesign-review-process
Establish review gates — criteria, checkpoints, and approval flow. Use when work ships without consistent review. For running one individual session, use design-critique.
- 1h installs
- 1
- GitHub stars
- 2.9K
- Updated
- Sep 5
owl-listenerdesign-system-adoption
Create adoption strategy and enablement materials to drive design system usage. Use when the system exists but teams ignore it. For contribution and versioning rules, use design-system-governance (design-systems).
- 1h installs
- 1
- GitHub stars
- 2.9K
- Updated
- Sep 5
owl-listenerempathy-map
Build a Says, Thinks, Does, Feels map for one user or segment. Use when sharing user understanding quickly. For a composite archetype with goals and behaviours use user-persona; for cross-session themes use affinity-diagram.
- 1h installs
- 1
- GitHub stars
- 2.9K
- Updated
- Sep 5
owl-listenerpresentation-deck
Structure a design presentation for a specific audience and decision. Use when presenting internally. For a portfolio narrative use case-study; for the written argument use design-rationale.
- 1h installs
- 1
- GitHub stars
- 2.9K
- Updated
- Sep 5
owl-listenerstate-machine
Model component behaviour as explicit states, events, and transitions. Use when a component has many interacting states that must be exhaustive. For the feel and feedback of a single interaction, use micro-interaction-spec.
- 1h installs
- 1
- GitHub stars
- 2.9K
- Updated
- Sep 5
owl-listenersummarize-interview
Turn one interview transcript into themes, supporting quotes, and action items. Use immediately after a session. For synthesising many sessions at once, use affinity-diagram.
- 1h installs
- 1
- GitHub stars
- 2.9K
- Updated
- Sep 5
mrgooniedocs-seeker
Searching internet for technical documentation using llms.txt standard, GitHub repositories via Repomix, and parallel exploration. Use when user needs: (1) Latest documentation for libraries/frameworks, (2) Documentation in llms.txt format, (3) GitHub repository analysis, (4) Documentation without direct llms.txt support, (5) Multiple documentation sources in parallel
- 1h installs
- 1
- GitHub stars
- 2.2K
- Updated
- Apr 3
juneyaooonihaisha
Use this skill when the user asks about Ni Haisha / 倪海厦 TCM course material, especially Shang Han Lun / 伤寒论, Jingui / 金匮要略, Zhongjing Xinfa / 仲景心法, clinical cases / 临床案例 / 倪师医案, Bagang Bianzheng / 八纲辨证, Fuyang Forum / 扶阳论坛, Yijinjing / 易筋经, Liang Dong dialogue / 梁冬对话倪师, Stanford lecture / 斯坦福大学演讲, Tianji / 天纪 / 易经 / 阳宅 / 紫微斗数, Huangdi Neijing / 黄帝内经, Shennong Bencao / 神农本草, acupuncture / 针灸, meridians, acupoints, acupuncture depth safety / 危险进针深度 / 气胸风险, six-channel pattern identification, sympt
- 1h installs
- 1
- GitHub stars
- 2.2K
- Updated
- Sep 16
antithesishqantithesis-launch
Launch an Antithesis run with snouty by discovering the harness layout, building the right Docker Compose config, running snouty validate, bailing on validation failure, and then submitting snouty launch with sane metadata. Use when the user wants to send, submit, or launch an Antithesis run. This skill takes duration in minutes as input.
- 1h installs
- 1
- GitHub stars
- 286
- Updated
- Oct 15
antithesishqantithesis-setup
Scaffold the Antithesis harness with docker-compose: initialize the working directory, write Dockerfiles and docker-compose.yaml with build directives, and prepare to submit your first Antithesis test run. If the desired setup is Kubernetes, defer to the antithesis-setup-k8s skill.
- 1h installs
- 1
- GitHub stars
- 286
- Updated
- Oct 15