技能雷达 · GITHUB
值得安装的 Agent Skills。
汇总公开仓库中已验证的 Skills。安装前先看清它能做什么、包内包含什么、热度如何，以及来源是否可靠。
- 目录范围
- 已验证
- Skills
- 10,772
- 仓库
- 1711
- 最近同步
- 2026年9月23日
yaklanglinux-security-bypass
- Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangmacos-security-bypass
- macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangnosql-injection
- NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangopen-redirect
- Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangrsa-attack-techniques
- RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding oracles.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangsandbox-escape-techniques
- Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangsqli-sql-injection
- SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangsteganography-techniques
- Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appended data, ADS), and text (whitespace, zero-width, homoglyphs) for hidden data.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangsubdomain-takeover
- Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangsymmetric-cipher-attacks
- Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key reuse, or meet-in-the-middle attacks.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangtunneling-and-pivoting
- Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTTP tunneling, ProxyChains, and multi-layer pivoting strategies.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangtype-juggling
- PHP type juggling and weak comparison (==) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types — common in legacy PHP and CTF-style code paths.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangunauthorized-access-common-services
- Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interfaces are exposed without authentication.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangvm-and-bytecode-reverse
- Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode, dispatcher loops, or maze-style challenges.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangwaf-bypass-techniques
- WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangweb-cache-deception
- Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to path confusion or cache key manipulation.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangwindows-av-evasion
- AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
yaklangwindows-lateral-movement
- Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.
- 安装量
- 1
- GitHub Stars
- 2224
- 最近更新
- 9月13日
deusyutranslate-book
Translate books (PDF/DOCX/EPUB) into any language using parallel sub-agents. Converts input - Markdown chunks - translated chunks - HTML/DOCX/EPUB/PDF.
- 安装量
- 1
- GitHub Stars
- 1874
- 最近更新
- 9月7日
timescalepostgres
Use this skill for any PostgreSQL database work — table design, indexing, data types, constraints, extensions (pgvector, PostGIS, TimescaleDB), search, and migrations. Trigger when user asks to: - Design or modify PostgreSQL tables, schemas, or data models - Choose data types, constraints, indexes, or partitioning strategies - Work with pgvector embeddings, semantic search, or RAG - Set up full-text search, hybrid search, or BM25 ranking - Use PostGIS for spatial/geographic data - Set up TimescaleDB hypertables for time-series data - Migrate tables to hypertables or evaluate migration candidates - Plan or execute safe schema migrations with zero downtime Keywords: PostgreSQL, Postgres, SQL, schema, table design, indexes, constraints, pgvector, PostGIS, TimescaleDB, hypertable, semantic search, hybrid search, BM25, time-series, migration
- 安装量
- 1
- GitHub Stars
- 1841
- 最近更新
- 9月16日
daymadeashare-news-fetcher
- 抓取 A 股消息面情报：从财联社、华尔街见闻、金十、新浪 7x24、东财快讯、 证监会/央行/上交所/财政部政策公告、东方财富股吧等公开来源抓取与股票相关的 新闻、政策、情绪，输出结构化 JSON 或 Markdown。 当用户提到“A 股消息面”、“抓新闻”、“个股消息”、“政策监管”、“股吧情绪”、 “财联社”、“东财快讯”、“市场情绪”或需要把某只股票相关的公开情报聚合出来时 触发。也适用于“帮我看看 000001 最近有什么消息”这类口语化请求。
- 安装量
- 1
- GitHub Stars
- 1396
- 最近更新
- 9月16日
daymadeasr-transcribe-to-text
- Transcribe audio/video to speaker-labeled text — who-said-what by default, plain-text opt-out; MLX-local on Apple Silicon or remote; local files, media URLs. Use for transcribing recordings/podcasts/lectures/meetings, ASR, speech-to-text, 转录, 语音转文字, 录音转文字, speaker diarization/说话人分离/识别/谁在说话, timestamps 字幕/时间戳/音画对齐, CAM++ voiceprint ID. This skill ALSO owns audio PREPROCESSING for ASR as a first-class trigger, even without transcription: convert any audio/video into an ASR-ready file (转换成适合 ASR 的格式, 转格式, convert/prepare audio for ASR, 音频预处理), downsample to 16kHz mono 16-bit (降采样, 重采样, 单声道, 归一化), merge multi-segment recorder dumps (多段合并/拼接, DJI TX01/TX02), transcode to small M4A + pitch-preserved speedup to cut metered-ASR billed minutes (转 M4A, 压缩上传, 加速, 1.3x, 飞书妙记/Feishu Minutes). Trigger even when it looks like a trivial one-line ffmpeg — the skill owns sample-rate/bit-depth/channel, merge-order, speed-vs-WER, format choices + a blessed prepareasrinput.py.
- 安装量
- 1
- GitHub Stars
- 1396
- 最近更新
- 9月16日
daymadebenchmark-due-diligence
Runs adversarial due-diligence on a benchmark the user envies — a founder, KOL, company, or product whose claimed success looks inflated — splitting marketing bubble from real signal, then mapping the validated playbook onto the user's own resources. Use whenever the user wants to 尽调/对标/拆解 a competitor or role-model, 抄/偷师 someone's playbook, suspects 水分/泡沫 in their claims (1 on Product Hunt, 0-to-1M users, funding, 估值几个亿), asks whether wins are 真本事 vs 运气/时机, or says someone is 太成功了/crushing it and wants the real story — even if they never say 尽调. Prefer over deep-research for debunking inflated claims and extracting a replicable playbook rather than a neutral briefing.
- 安装量
- 1
- GitHub Stars
- 1396
- 最近更新
- 9月16日
daymadebigdata-skill
- Pull Bigdata.com (RavenPack) financial and news data via the official bigdata-client SDK and /v1/ REST endpoints — structured financials, prices, analyst estimates, daily entity-sentiment series, annotated chunk search, screener — when the Bigdata MCP returns only pre-synthesized tearsheets but you need the machine-readable substrate. Use when the user mentions Bigdata.com, RavenPack, a bdv2 key, the bigdata MCP, rpentityid, chunk/queryunit cost, or wants structured financials, fundamentals, prices, sentiment, or annotated news.
- 安装量
- 1
- GitHub Stars
- 1396
- 最近更新
- 9月16日