AGENT SKILLS · 任务装备

值得安装的 Agent Skills

汇总公开仓库中已验证的 Skills。安装前先看清它能做什么、包内包含什么、热度如何，以及来源是否可靠。

目录范围: 已验证
Skills: 22,719
仓库: 3485
最近同步: 2026年10月31日

22,719 Skills

netlify-frameworks

Deploy and configure web frameworks on Netlify — build settings and SSR/edge adapters plus local platform emulation and env vars. Use when setting up or fixing a framework deploy (Next.js / Astro / Nuxt / SvelteKit / Remix / React Router / TanStack Start / SolidStart / Gatsby / Angular / Vite / Express / Hydrogen / Hugo / Eleventy / Vue / React), adding SSR or edge functions or middleware wired to Netlify context, fixing SPA redirect and catch-all rules, setting a build command or publish direct

1小时安装量: 1
GitHub Stars: 41
最近更新: 10月15日

查看详情 →

audio-song-generate

歌词驱动的完整歌曲生成（含人声），也支持强节奏成品级纯音乐。仅当用户明确要求生成歌曲/音频成品，并提供或同意补充风格与歌词参数时触发；普通音乐讨论、歌词创作、闲聊式演唱请求不触发。

1小时安装量: 1
GitHub Stars: 34
最近更新: 8月28日

查看详情 →

development-timeline

Record development stages and verification evidence, then generate offline HTML reports of delivery, waits, rework, and improvements. Use for PM milestone delivery, pauses, handoffs, or development retrospectives.

1小时安装量: 1
GitHub Stars: 0
最近更新: 10月6日

查看详情 →

sector-overview

Create comprehensive industry and sector landscape reports covering market dynamics, competitive positioning, key players, and thematic trends. Use for client requests, sector initiations, thematic research pieces, or internal knowledge building. Triggers on "sector overview", "industry report", "market landscape", "sector analysis", "industry deep dive", or "thematic research".

1小时安装量: 1
GitHub Stars: 4万
最近更新: 9月21日

Apache-2.01 文件

查看详情 →

ask-questions-if-underspecified

Clarify requirements before implementing. Use when serious doubts arise.

1小时安装量: 1
GitHub Stars: 4.8万
最近更新: 10月14日

查看详情 →

autobrowse

Self-improving browser automation via the auto-research loop. Iteratively runs a browsing task, reads the trace, and improves the navigation skill (strategy.md) until it reliably passes. Supports parallel runs across multiple tasks using sub-agents. Use when you want to build or improve browser automation skills for specific website tasks.

1小时安装量: 1
GitHub Stars: 3733
最近更新: 9月29日

查看详情 →

tooling

Implementation details for the EF Core dotnet-ef CLI and tooling. Use when changing dotnet-ef commands, the ef wrapper, EFCore.Tools (PMC), or EFCore.Tasks MSBuild integration.

1小时安装量: 1
GitHub Stars: 1.5万
最近更新: 10月15日

查看详情 →

bugcrowd-reporting

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

evidence-hygiene

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-api-misconfig

Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {isadmin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: proto injection in JSON merge / Object.assign / lodash .merge → polluted prototype reaches sink (RCE in Node, XSS in

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-aspnet

Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-business-logic

Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstra

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-cicd

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pullrequesttarget Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachabl

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-clickjacking

Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-dispatch

Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the appropriate skills and print the taxonomy. Not for direct user invocation.

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-dom

Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPr

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-grpc

Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or wh

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-host-header

Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirecturi/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and th

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-misc

Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-rce

Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-tls-network

Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

hunt-xss

Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no /event-handler execution), see hunt-html-injection — escalate here once script execution is possible.

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

recon-scope-triage

Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the brand name, so for any target whose name is a common/dictionary word, the output is dominated by assets belonging to UNRELATED same-named companies (repos, cloud buckets, mobile apps, breach corpora, typosquats). Built from an authorized engagement where an ASM report's "Criticals" were overwhelmingly false positives and the combo/repos/m

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →

report-writing

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Validation gates and the submittability/always-rejected decision are owned by triage-validation; this skill owns the written report itself (templates, tone, formulas). Use after validating a finding and before submitting. Never use "could potential

1小时安装量: 1
GitHub Stars: 5106
最近更新: 10月15日

查看详情 →