@skills · Owner

Agent skills by yaklang

104 skills indexed from github.com/yaklang. Reference any of them in AdaL, Claude Code, Cursor or any coding agent — nothing to install.

• 401-403-bypass-techniques · Skill · 1,563 stars

  401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP

• active-directory-acl-abuse · Skill · 1,563 stars

  Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, L

• active-directory-certificate-services · Skill · 1,563 stars

  AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrol

• active-directory-kerberos-attacks · Skill · 1,563 stars

  Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, dele

• ai-ml-security · Skill · 1,563 stars

  AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealin

• android-pentesting-tricks · Skill · 1,563 stars

  Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redire

• anti-debugging-techniques · Skill · 1,563 stars

  Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/e

• api-auth-and-jwt-abuse · Skill · 1,563 stars

  API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weakn

• api-authorization-and-bola · Skill · 1,563 stars

  API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level auth

• api-recon-and-docs · Skill · 1,563 stars

  API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for A

• api-sec · Skill · 1,563 stars

  Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deepe

• arbitrary-write-to-rce · Skill · 1,563 stars

  Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert i

• auth-sec · Skill · 1,563 stars

  Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and en

• authbypass-authentication-flaws · Skill · 1,563 stars

  Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-for

• binary-protection-bypass · Skill · 1,563 stars

  Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in E

• browser-exploitation-v8 · Skill · 1,563 stars

  Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and

• business-logic-vuln · Skill · 1,563 stars

  Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than

• business-logic-vulnerabilities · Skill · 1,563 stars

  Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-ste

• classical-cipher-analysis · Skill · 1,563 stars

  Classical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requir

• clickjacking · Skill · 1,563 stars

  Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whe

• cmdi-command-injection · Skill · 1,563 stars

  Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sin

• code-obfuscation-deobfuscation · Skill · 1,563 stars

  Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control f

• container-escape-techniques · Skill · 1,563 stars

  Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabil

• cors-cross-origin-misconfiguration · Skill · 1,563 stars

  CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and br

• crlf-injection · Skill · 1,563 stars

  CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-

• csp-bypass-advanced · Skill · 1,563 stars

  Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted end

• csrf-cross-site-request-forgery · Skill · 1,563 stars

  CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.

• csv-formula-injection · Skill · 1,563 stars

  CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting

• dangling-markup-injection · Skill · 1,563 stars

  Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF bloc

• defi-attack-patterns · Skill · 1,563 stars

  DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabi

• dependency-confusion · Skill · 1,563 stars

  Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to mal

• deserialization-insecure · Skill · 1,563 stars

  Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or sim

• dns-rebinding-attacks · Skill · 1,563 stars

  DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser cont

• email-header-injection · Skill · 1,563 stars

  Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP message

• expression-language-injection · Skill · 1,563 stars

  Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Conflu

• file-access-vuln · Skill · 1,563 stars

  Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview

• format-string-exploitation · Skill · 1,563 stars

  Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbit

• ghost-bits-cast-attack · Skill · 1,563 stars

  Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to by

• graphql-and-hidden-parameters · Skill · 1,563 stars

  GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQ

• hack · Skill · 1,563 stars

  Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit p

• hack-skills · Collection · 1,563 stars
• hash-attack-techniques · Skill · 1,563 stars

  Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF an

• heap-exploitation · Skill · 1,563 stars

  Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging t

• http-host-header-attacks · Skill · 1,563 stars

  HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access con

• http-parameter-pollution · Skill · 1,563 stars

  HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and applicatio

• http2-specific-attacks · Skill · 1,563 stars

  HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggl

• idor-broken-object-authorization · Skill · 1,563 stars

  IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-l

• injection-checking · Skill · 1,563 stars

  Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based

• insecure-source-code-management · Skill · 1,563 stars

  Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during au

• ios-pentesting-tricks · Skill · 1,563 stars

  iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulatio

• jndi-injection · Skill · 1,563 stars

  JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path re

• jwt-oauth-token-attacks · Skill · 1,563 stars

  JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-bindin

• kernel-exploitation · Skill · 1,563 stars

  Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via comm

• kubernetes-pentesting · Skill · 1,563 stars

  Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubel

• lattice-crypto-attacks · Skill · 1,563 stars

  Lattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems,

• linux-lateral-movement · Skill · 1,563 stars

  Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting,

• linux-privilege-escalation · Skill · 1,563 stars

  Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron a

• linux-security-bypass · Skill · 1,563 stars

  Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or au

• llm-prompt-injection · Skill · 1,563 stars

  LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltratio

• macos-process-injection · Skill · 1,563 stars

  macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variable

• macos-security-bypass · Skill · 1,563 stars

  macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based pro

• memory-forensics-volatility · Skill · 1,563 stars

  Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code in

• mobile-ssl-pinning-bypass · Skill · 1,563 stars

  Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or

• network-protocol-attacks · Skill · 1,563 stars

  Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks,

• nosql-injection · Skill · 1,563 stars

  NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abus

• ntlm-relay-coercion · Skill · 1,563 stars

  NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL r

• oauth-oidc-misconfiguration · Skill · 1,563 stars

  OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback bind

• open-redirect · Skill · 1,563 stars

  Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled

• path-traversal-lfi · Skill · 1,563 stars

  Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem

• prototype-pollution · Skill · 1,563 stars

  Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring l

• prototype-pollution-advanced · Skill · 1,563 stars

  Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollutio

• race-condition · Skill · 1,563 stars

  Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/

• recon-and-methodology · Skill · 1,563 stars

  Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan

• recon-for-sec · Skill · 1,563 stars

  Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inven

• request-smuggling · Skill · 1,563 stars

  HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-

• reverse-shell-techniques · Skill · 1,563 stars

  Reverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shells, PT

• rsa-attack-techniques · Skill · 1,563 stars

  RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, sm

• saml-sso-assertion-attacks · Skill · 1,563 stars

  SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, a

• sandbox-escape-techniques · Skill · 1,563 stars

  Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace

• skills · Collection · 1,563 stars
• smart-contract-vulnerabilities · Skill · 1,563 stars

  Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan,

• sqli-sql-injection · Skill · 1,563 stars

  SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execu

• ssrf-server-side-request-forgery · Skill · 1,563 stars

  SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or

• ssti-server-side-template-injection · Skill · 1,563 stars

  SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.

• stack-overflow-and-rop · Skill · 1,563 stars

  Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, r

• steganography-techniques · Skill · 1,563 stars

  Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots,

• subdomain-takeover · Skill · 1,563 stars

  Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expir

• symbolic-execution-tools · Skill · 1,563 stars

  Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary anal

• symmetric-cipher-attacks · Skill · 1,563 stars

  Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key

• traffic-analysis-pcap · Skill · 1,563 stars

  Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiF

• tunneling-and-pivoting · Skill · 1,563 stars

  Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICM

• type-juggling · Skill · 1,563 stars

  PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coerc

• unauthorized-access-common-services · Skill · 1,563 stars

  Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management inte

• upload-insecure-files · Skill · 1,563 stars

  Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RC

• vm-and-bytecode-reverse · Skill · 1,563 stars

  Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytec

• waf-bypass-techniques · Skill · 1,563 stars

  WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft

• web-cache-deception · Skill · 1,563 stars

  Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users du

• websocket-security · Skill · 1,563 stars

  WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed A

• windows-av-evasion · Skill · 1,563 stars

  AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signat

• windows-lateral-movement · Skill · 1,563 stars

  Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the

• windows-privilege-escalation · Skill · 1,563 stars

  Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits,

• xslt-injection · Skill · 1,563 stars

  XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-cont

• xss-cross-site-scripting · Skill · 1,563 stars

  XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.

• xxe-xml-external-entity · Skill · 1,563 stars

  XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.

Browse the @skills marketplace