All authors
Claude Skills by H-mmer
github.com/H-mmer182 skills2 installs158 views
- Cmd TriageBatch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triageVotes: 0GitHub stars: 815
- Cmd ValidateValidate a finding through the 7-Question Gate + 4 gates. Kills weak findings FAST. Usage: /validate <finding description>Votes: 0GitHub stars: 815
- Pentest Agents Hunt Business LogicHunting skill for business-logic vulnerabilities (CWE-840 Business Logic Errors, CWE-841 Improper Enforcement of Behavioral Workflow, CWE-639 Authorization Bypass via User-Controlled Key in business contexts, CWE-362 race conditions on financial flows). Built from 44 corpus reports plus 8.8K shared-platform reports across HackerOne, Bugcrowd, Huntr, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Lilishop coupon overpurchasing (CVE-2024-50654 CVSS 7.5), WWBN AVideo wall...Votes: 0GitHub stars: 815
- Pentest Agents Hunt IdorHunting skill for Insecure Direct Object Reference / Broken Object Level Authorization (BOLA — OWASP API1:2023). Built from 1,117 public IDOR bug bounty reports across HackerOne, Bugcrowd, Intigriti, GitHub Security Advisories, Huntr, plus 2024-2026 meta verified against NVD — Sam Curry's automotive chain (Kia/Hyundai/Ferrari), CVE-2026-30956 (OneUptime tenant header bypass CVSS 9.9), CVE-2025-64431 (Zitadel V2Beta Org API), CVE-2026-32131 (Zitadel Management API), CVE-2025-61876 (Inforcer te...Votes: 0GitHub stars: 815
- Pentest Agents Hunt Info DisclosureHunting skill for Information Disclosure / Sensitive Data Exposure (CWE-200 / CWE-209 / CWE-215 / CWE-538 / CWE-668 / CWE-798). Built from 106 corpus reports plus 8K shared-platform reports across HackerOne, Bugcrowd, Huntr, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Spring Boot Actuator family (CVE-2025-41253 SpEL info-disclosure CVSS 7.5, CVE-2025-41243 Spring Cloud Gateway property modification CVSS 10.0, CVE-2025-22235 EndpointRequest.to wrong matcher CVSS 7.3,...Votes: 0GitHub stars: 815
- Pentest Agents Hunt Llm AiHunting skill for LLM and Agentic AI vulnerabilities — direct + indirect prompt injection, ASCII smuggling data exfil, agentic tool-use abuse, system prompt leakage, vector DB cross-tenant, model server RCE, insecure output handling. Built from public bug bounty reports across HackerOne, Huntr, Project Zero, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Microsoft 365 Copilot ASCII Smuggling (Johann Rehberger Aug 2024 disclosure), CVE-2025-46059 LangChain GmailToolkit ...Votes: 0GitHub stars: 815
- Pentest Agents Hunt OauthHunting skill for OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT authentication. Built from 365 public OAuth/SSO bug bounty reports across HackerOne, GitHub Security Advisories, PortSwigger Research, GitHub Security Lab, Detectify, Doyensec, Salt Labs, Semperis, Obsidian Security, Trace37 plus 2024-2026 meta verified against NVD — ruby-saml parser differentials (CVE-2025-25291/25292, GHSL-2024-329/330), Authentik regex redirect_uri (CVE-2024-52289), workers-oauth-provider PKCE down...Votes: 0GitHub stars: 815
- Pentest Agents Hunt RceHunting skill for remote code execution. Built from 1,218 public RCE bug bounty reports across HackerOne, Project Zero, Intigriti, GitHub Security Advisories, and curated awesome-* lists, plus 2024-2026 meta verified against NVD — React Server Components (CVE-2025-55182), runc Leaky Vessels (CVE-2024-21626), BentoML pickle (CVE-2025-27520/32375), LangChain REPL (CVE-2025-68613), Tekton git resolver (CVE-2026-40938), OpenProject git argument injection (CVE-2026-24685), ingress-nginx (CVE-2025-...Votes: 0GitHub stars: 815
- Pentest Agents Hunt XssHunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants. Built from public bug bounty reports across HackerOne, Intigriti, Bugcrowd, Huntr, and GitHub Security Advisories, plus 2024-2026 meta verified against NVD — DOMPurify nesting mXSS (CVE-2024-47875, GHSA-gx9m-whjm-85jf), DOMPurify depth-bypass family (CVE-2024-45801, GHSA-mmhx-hmjr-r674), DOMPurify mXSS via Re-Contextualization (GHSA-h8r8-wccr-v5f2), Auth0 nextjs-auth0 retur...Votes: 0GitHub stars: 815
- Pentest Agents Hunting Methodology1. Read program scope, policy, safe harbor 2. Read 5+ disclosed reports in hacktivity 3. Map crown jewels: what would hurt the company most? 4. Understand the business domain — what features handle money, PII, auth?Votes: 0GitHub stars: 815
- Pentest Agents Recon Methodology```bash subfinder -d target.com -silent -all | sort -u > subs.txt httpx -l subs.txt -silent -status-code -tech-detect | tee live-hosts.txt ```Votes: 0GitHub stars: 815
- Pentest Agents Report Writing`[Vulnerability] in [Component] Enables [Impact]`Votes: 0GitHub stars: 815
- Pentest Agents Sast MethodologyA single agent asked to "find vulnerabilities" will hallucinate. The pipeline decomposes the task into focused steps, with external state carrying the synthesis between steps. All agents run on except flow-tracing and gap-analysis, which pin opus for cross-file reasoning depth.Votes: 0GitHub stars: 815
- Pentest Agents Triage ValidationFirst NO = KILL. Do not continue.Votes: 0GitHub stars: 815
- Pentest Agents Vuln Classes**Setup**: Two accounts (attacker + victim). Log in as both.Votes: 0GitHub stars: 815
- Hunt Llm AiHunting skill for LLM and Agentic AI vulnerabilities — direct + indirect prompt injection, ASCII smuggling data exfil, agentic tool-use abuse, system prompt leakage, vector DB cross-tenant, model server RCE, insecure output handling. Built from public bug bounty reports across HackerOne, Huntr, Project Zero, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Microsoft 365 Copilot ASCII Smuggling (Johann Rehberger Aug 2024 disclosure), CVE-2025-46059 LangChain GmailToolkit ...Votes: 0GitHub stars: 815
- Hunt OauthHunting skill for OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT authentication. Built from 365 public OAuth/SSO bug bounty reports across HackerOne, GitHub Security Advisories, PortSwigger Research, GitHub Security Lab, Detectify, Doyensec, Salt Labs, Semperis, Obsidian Security, Trace37 plus 2024-2026 meta verified against NVD — ruby-saml parser differentials (CVE-2025-25291/25292, GHSL-2024-329/330), Authentik regex redirect_uri (CVE-2024-52289), workers-oauth-provider PKCE down...Votes: 0GitHub stars: 815
- Hunting Methodology1. Read program scope, policy, safe harbor 2. Read 5+ disclosed reports in hacktivity 3. Map crown jewels: what would hurt the company most? 4. Understand the business domain — what features handle money, PII, auth?Votes: 0GitHub stars: 815
- Sast MethodologyA single agent asked to "find vulnerabilities" will hallucinate. The pipeline decomposes the task into focused steps, with external state carrying the synthesis between steps. All agents run on `model: "inherit"` except flow-tracing and gap-analysis, which pin opus for cross-file reasoning depth.Votes: 0GitHub stars: 815
- Agent Auth TesterAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.Votes: 0GitHub stars: 815
- Agent BrainCentral knowledge coordinator. Use BEFORE launching any other pentest agent to get context on what's already been tried. Also use AFTER any agent completes to record findings, exhausted vectors, and learned patterns. The brain prevents redundant work across sessions and agents.Votes: 0GitHub stars: 815
- Agent Browser AgentBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.Votes: 0GitHub stars: 815
- Agent Browser Stealth AgentStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.Votes: 0GitHub stars: 815
- Agent Browser VerifierMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.Votes: 0GitHub stars: 815
- Agent Business LogicBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.Votes: 0GitHub stars: 815
- Agent Chain BuilderDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.Votes: 0GitHub stars: 815
- Agent Cloud ReconCloud misconfiguration scanner. Use for S3 bucket enumeration, Azure blob discovery, GCP storage checks, exposed cloud services, and cloud metadata analysis. Provide target domain or known cloud identifiers.Votes: 0GitHub stars: 815
- Agent Config AuditorSecurity header and server configuration auditor. Use for HTTP security header analysis, CSP evaluation, CORS policy review, TLS configuration assessment, cookie security, and server hardening checks. Provide target URL or list of URLs.Votes: 0GitHub stars: 815
- Agent CorrelatorFinding correlation engine. Use AFTER multiple agents have reported findings to discover attack chains. Combines individual findings into higher-impact chains (e.g., open redirect + CORS + SSRF = token theft). Run periodically or before final reporting.Votes: 0GitHub stars: 815
- Agent Cors HunterCORS Misconfiguration specialist (H1 #58). Use for testing cross-origin resource sharing policies, origin reflection, null origin bypass, and credential-bearing cross-origin requests.Votes: 0GitHub stars: 815
- Agent Csrf HunterCSRF specialist (H1 #57). Use for testing state-changing actions without proper token validation, SameSite cookie bypass, and CSRF in JSON/API endpoints.Votes: 0GitHub stars: 815
- Agent Dast Devils AdvocateAdversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.Votes: 0GitHub stars: 815
- Agent File UploadFile Upload vulnerability specialist (H1 #39). Use for testing upload restrictions, content-type bypass, extension filtering, path traversal in filenames, and web shell upload scenarios.Votes: 0GitHub stars: 815
- Agent Graphql AuditGraphQL API security specialist. Use for introspection analysis, query complexity attacks, injection testing, authorization bypass, and batching abuse on GraphQL endpoints.Votes: 0GitHub stars: 815
- Agent Idor HunterIDOR / BOLA specialist (H1 #55, OWASP API1:2023). Use for testing insecure direct object references and broken object level authorization across web apps, APIs, GraphQL endpoints, multi-tenant SaaS, mobile, automotive/IoT, and AI inference servers.Votes: 0GitHub stars: 815
- Agent Info DisclosureInformation Disclosure specialist (H1 #18, CWE-200/209/215/538/668/798). Use for finding exposed sensitive data: stack traces, debug endpoints, config files, environment variables, API keys, .git/.env exposure, Spring Actuator surfaces, source code leaks. Standalone is feeder-class — must chain to be reportable.Votes: 0GitHub stars: 815
- Agent Js AnalyzerJavaScript static analysis agent for client-side security review. Use for analyzing JS bundles, finding hardcoded secrets, tracing DOM XSS source-sink flows, identifying postMessage handlers, extracting API endpoints, and reviewing client-side access controls. Provide URLs or local JS file paths.Votes: 0GitHub stars: 815
- Agent Llm Ai HunterLLM and Agentic AI vulnerability specialist. Covers OWASP LLM Top 10 v2025 (LLM01-LLM10) and OWASP Agentic AI Top 10 (AA-01..AA-10). Dispatcher passes subtype — 'prompt-injection', 'indirect-injection', 'tool-abuse', 'rag-poisoning', 'vector-idor', 'mcp', 'model-server', 'output-handling', or 'ascii-smuggling' — in the task; falls back to inference. Use when a target ships a chatbot, RAG / search-over-docs, AI assistant, MCP server, agentic tool-use plugin, model registry, inference server, o...Votes: 0GitHub stars: 815
- Agent MonitorContinuous monitoring agent for authorized bug bounty programs. Modes: 'baseline' captures initial state, 'check' detects changes, 'scope' re-syncs platform scope. Runs in background.Votes: 0GitHub stars: 815
- Agent Nuclei WriterCustom nuclei template builder. Use when you've found a pattern that should be checked across multiple targets or when existing templates miss a specific vulnerability. Provide the vulnerability details and detection logic.Votes: 0GitHub stars: 815
- Agent Oauth HunterOAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT specialist. Dispatcher passes subtype — 'oauth', 'oidc', 'saml', or 'jwt' — in the task; falls back to inference. Use for redirect_uri / returnTo flaws, state/nonce/PKCE bypass, alg confusion (none/HS-with-RS-key/kid/jku), SAML XSW + comment injection + assertion replay, OIDC ID token validation gaps, code/token leak channels, cross-tenant impersonation, PKCE downgrade, and any flow involving a code, access_token, id_token, assertion, ...Votes: 0GitHub stars: 815
- Agent Open RedirectOpen Redirect specialist (H1 #38). Use for testing URL redirect parameters, login/logout flows, OAuth callbacks, and any endpoint that redirects based on user input.Votes: 0GitHub stars: 815
- Agent Poc BuilderBug bounty PoC and report builder. Use after confirming a vulnerability to create minimal reproduction steps, self-contained HTML demonstration pages, curl-based reproduction scripts, and platform-ready report drafts for HackerOne/Bugcrowd/Intigriti.Votes: 0GitHub stars: 815
- Agent Privilege EscalationPrivilege Escalation specialist (H1 #26). Use for testing vertical and horizontal privilege escalation, role manipulation, admin endpoint access, and permission boundary violations.Votes: 0GitHub stars: 815
- Agent Quality CheckReport quality scorer. Use BEFORE submitting any report to validate completeness, clarity, title strength, CVSS accuracy, PoC quality, and overall report grade. Provide the draft report path or content.Votes: 0GitHub stars: 815
- Agent Race ConditionRace Condition specialist (H1 #29). Use for testing TOCTOU flaws, double-spend, parallel request abuse on balance operations, coupon redemption, and any non-idempotent state changes.Votes: 0GitHub stars: 815
- Agent Rce HunterRemote Code Execution specialist (H1 #70). Use for testing command injection, template injection (SSTI), deserialization, expression language injection, and any vector that achieves server-side code execution.Votes: 0GitHub stars: 815
- Agent Recon RankerAttack surface ranker. Takes recon output + brain data, produces P1/P2/Kill prioritized attack plan with concrete curl commands for each P1 target. Use after recon to decide what to test first.Votes: 0GitHub stars: 815
- Agent ReconReconnaissance agent for target enumeration. Use for subdomain discovery, port scanning, service fingerprinting, tech stack identification, and OSINT gathering. Specify scope and depth: 'passive' for DNS/cert/OSINT only, 'active' for port scans and probing, 'deep' for comprehensive enumeration.Votes: 0GitHub stars: 815
- Agent Report WriterSecurity report generation agent. Use for compiling findings into formal penetration test reports, executive summaries, technical write-ups, and bug bounty submissions. Provide the findings directory or list of vulnerabilities to document.Votes: 0GitHub stars: 815