Skill-uri pentru agenți pe care le poți verifica înainte să le instalezi
Skill-uri SKILL.md publice din depozite GitHub cu peste 50 de stele și de la producători, scanate și evaluate. Instalează oricare dintre ele cu o singură comandă în Claude Code, Cursor, Codex, GitHub Copilot sau Gemini CLI.
8.136 de skill-uri din 220 de depozite · actualizat acum 7 minute
287 de skill-uri
- offensive-xxeSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecuritateVerifică întâi★ 7,7 K↓ —
- mcp-auditrohitg00/pro-workflowAudit connected MCP servers for token overhead, redundancy, and security. Use when sessions feel slow or before adding new MCPs.SecuritateFără avertismente★ 2,9 K↓ —
- agent-skills-platformFrancyJGLisboa/agent-skills-platformCreate cross-platform agent skills from workflow descriptions. Activates when users ask to create an agent, automate a repetitive workflow, create a custom skill, or need advanced agent creation. Triggers on phrases like create agent for, automate workflow, create skill for, every day I have to, daily I need to, turn process into agent, need to automate, create a cross-platform skill, validate this skill, export this skill, migrate this skill, audit this skill, is this skill safe, vet a skill before installing, what does this skill access. Supports single skills, multi-agent suites, transcript processing, template-based creation, interactive configuration, cross-platform export, spec validation, and security auditing of third-party skills before install.SecuritateFără avertismente★ 2,4 K↓ —
- android-permissions-securityandroid/skillsAudits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing AndroidManifest.xml, defining custom permissions, securing Services, Receivers, and Providers, verifying caller signatures and UID using Binder, or implementing runtime permission flows.OficialSecuritateVerifică întâi★ 9,1 K↓ —
- j-spaceTiger3807861189/J-Space-Cognition-SuiteOperate a selective workspace for complex reasoning, long tasks, repository engineering, coordinated agents, and authorized security analysis. Use when work requires durable state, evidence, cross-file consistency, or recovery; keep direct answers lightweight.SecuritateFără avertismente★ 3 K↓ —
- ethical-hacking-methodologyzebbern/claude-code-guideThis skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.SecuritateVerifică întâi★ 4,7 K↓ —
- security-scananbeime/skill对进入系统的文件或 URL 执行安全与合规扫描，输出 pass/reject 判定与扫描报告，作为所有文档处理的强制前置关卡。SecuritateFără avertismente★ 8,5 K↓ —
- hunt-rceelementalsouls/Claude-BugHunterHunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.SecuritateVerifică întâi★ 5,2 K↓ —
- hunt-nextjselementalsouls/Claude-BugHunterHunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.SecuritateVerifică întâi★ 5,2 K↓ —
- hunt-laravelelementalsouls/Claude-BugHunterHunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.SecuritateVerifică întâi★ 5,2 K↓ —
- hunt-springbootelementalsouls/Claude-BugHunterHunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SPEL (CVE-2022-22963), heap dump credential extraction. Use when target runs Spring Boot — detected via X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.SecuritateVerifică întâi★ 5,2 K↓ —
- hunt-rcesickn33/agentic-awesome-skillsHunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.SecuritateVerifică întâi★ 48,2 K↓ —
- offensive-fuzzing-courseSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecuritateVerifică întâi★ 7,7 K↓ —
- offensive-linux-privescSnailSploit/Claude-RedComprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to root: SUID/SGID binary abuse via GTFOBins, Linux capabilities exploitation (cap_setuid, cap_dac_override, cap_dac_read_search), sudo misconfigurations including NOPASSWD rules and Baron Samedit (CVE-2021-3156), cron job abuse through writable scripts, PATH hijacking, and wildcard injection with tar/rsync/chown. Includes writable /etc/passwd attacks, NFS no_root_squash exploitation, kernel exploits (DirtyPipe CVE-2022-0847, DirtyCow CVE-2016-5195, PwnKit CVE-2021-4034), Docker group container escapes, LD_PRELOAD and LD_LIBRARY_PATH hijacking for shared library injection, systemd service misconfigurations, and sensitive file enumeration for credential harvesting. Integrates automated enumeration with LinPEAS, linux-exploit-suggester, pspy for process monitoring, and GTFOBins for binary exploitation. Each technique includes detection signatures and defender-side viSecuritateVerifică întâi★ 7,7 K↓ —
- offensive-initial-accessSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecuritateVerifică întâi★ 7,7 K↓ —
- offensive-container-escapeSnailSploit/Claude-RedContainer escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN, cgroup v1 notify_on_release escape, runc CVEs such as CVE-2019-5736 and CVE-2024-21626 Leaky Vessels, kernel exploits from within containers, and Dockerfile misconfigurations like --privileged and host namespace sharing. Includes enumeration with capsh, amicontained, deepce, CDK, and nsenter. Maps to MITRE ATT&CK T1611 Escape to Host. Use this skill when the engagement scope includes container breakout, Docker escape, container privilege escalation, host access from container, or when you land inside a containerized environment and need to reach the underlying host.SecuritateVerifică întâi★ 7,7 K↓ —
- offensive-ai-securitySnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecuritateVerifică întâi★ 7,7 K↓ —
- offensive-rceSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecuritateVerifică întâi★ 7,7 K↓ —
- offensive-persistenceSnailSploit/Claude-RedComprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques include cron and at jobs, systemd timers and services, SSH authorized_keys injection, shell profile backdoors (.bashrc/.bash_profile), PAM module backdoors, LD_PRELOAD hijacking, kernel module rootkits, web shells, and Git hook abuse. Provides operator-ready command sequences for SharPersist, Impacket ticketer, schtasks, sc.exe, crontab, and systemctl with OPSEC considerations for each method. Maps to MITRE ATT&CK T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1546 (Event Triggered Execution), T1556 (Modify ASecuritateVerifică întâi★ 7,7 K↓ —
- offensive-exploit-dev-courseSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecuritateVerifică întâi★ 7,7 K↓ —
- near-smart-contractsinternet-court/internet-court-skillNEAR Protocol smart contract development in Rust. Use when writing, reviewing, or deploying NEAR smart contracts. Covers contract structure, state management, cross-contract calls, testing, security, and optimization patterns. Based on near-sdk v5.x with modern macro syntax.SecuritateVerifică întâi★ 6,8 K↓ —
- hunt-llm-aielementalsouls/Claude-BugHunterHunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling (Unicode Tags block U+E0000-U+E007F, invisible to humans, decoded by the model), tool-use exfiltration (model has fetch/browse tool, attacker injects OOB URL, model exfils chat history/secrets), markdown-image zero-click exfil, system-prompt extraction, IDOR-via-AI (cross-tenant data). Targets: chatbots, RAG, summarizers, agentic copilots, MCP tools. Detection: any LLM-backed endpoint, doc upload triggering AI processing, autonomous agent with tools. Validate: OOB/Collaborator callback for exfil, verbatim-reproducible system-prompt leak (run twice), verifiable cross-tenant leak or RCE. Confabulation is NOT a finding. Use when hunting AI features, chatbots, RAG, agentic systems, MCP.SecuritateVerifică întâi★ 5,2 K↓ —
- hunt-oauthelementalsouls/Claude-BugHunterHunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.SecuritateVerifică întâi★ 5,2 K↓ —
hunt-springboot
elementalsouls/Claude-BugHunter
SecuritateActualizat acum 17 ore
De la autor
Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SPEL (CVE-2022-22963), heap dump credential extraction. Use when target runs Spring Boot — detected via X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.
Instalare
npx skills add elementalsouls/Claude-BugHunter --skill hunt-springboot -a claude-code
Se instalează în .claude/skills/hunt-springboot/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Fără descărcare: licența acestui skill (MIT) nu ne permite să-i redistribuim fișierele. Comenzile de instalare le iau direct de pe GitHub.
La ce are acces
Doar instrucțiuniFolosește rețeauaLicență: MIT
Verificări de siguranță pe SKILL.md
- Trimite o descărcare direct într-un shellRidicat
De ce 55
Securitate55
Proveniență85
Întreținere100
Licență100
Adopție59
Fișiere (1)
- SKILL.md