AGENT SKILLS · 任务装备
值得安装的 Agent Skills
汇总公开仓库中已验证的 Skills。安装前先看清它能做什么、包内包含什么、热度如何，以及来源是否可靠。
- 目录范围
- 已验证
- Skills
- 22,002
- 仓库
- 3343
- 最近同步
- 2026年10月24日
zhaoxuya520ctf-sandbox
Thin PRIMARY for CTF / AWD / 靶场 multi-type orchestration. Hands off to the sidecar CTF-Sandbox-Orchestrator. Use when the user says CTF, AWD, 靶场, or 比赛题 and no more specific pwn/APK/IDA route already won.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520database-security
Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520diagram-generator
generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520edr-bypass-re
逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。 触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective D
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520firmware-pentest
固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520ghidra-reverse
Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520go-rust-reverse
Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520hardware-security
Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520ida-reverse
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "看看这个exe", "分析这个dll", "帮我破解", "找一下密码", "这个软件怎么注册", etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520identity-federation
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520llm-security
Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520macos-reverse
Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520malware-analysis
Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520mobile-reverse
Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520ot-ics
Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520patch-diff-exploit
N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520pentest-tools
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520protocol-reverse
Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520radio-sdr
Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520reverse-engineering
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520reverse-skill-router
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520threat-hunting
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520threat-intelligence
Use for authorized OSINT and cyber threat intelligence that enriches IOCs, campaigns, impersonation, scams, or threat actors from public sources. Includes bounded X/Twitter search through Xquik, source preservation, corroboration, and evidence handoff.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日
zhaoxuya520wifi-wireless
Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
- 安装量
- 1
- GitHub Stars
- 4.3万
- 最近更新
- 9月22日