Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,738 results · page 25 of 58
- View details
ssti-freemarkerSkillSecurity
Guide Freemarker/Java server-side template injection exploitation during authorized penetration testing.
Ready to connect★ 271
- View details
ssti-jinja2SkillSecurity
Guide Jinja2/Python server-side template injection exploitation during authorized penetration testing.
Ready to connect★ 271
- View details
ssti-twigSkillSecurity
Guide Twig/PHP server-side template injection exploitation during authorized penetration testing.
Ready to connect★ 271
- View details
trust-attacksSkillSecurity
Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation. Covers trust enumeration (nltest, PowerView, BloodHound), SID history injection (child domain to forest root via golden/diamond ticket with extra SIDs), inter-realm TGT forging u
Ready to connect★ 271
- View details
unknown-vector-analysisSkillSecurity
Analyze custom applications, scripts, and binaries that standard technique skills could not exploit. Performs source code review, attack surface mapping, CVE research, and PoC adaptation. Route here when ANY technique agent returns saying standard patterns do not match, the target uses a custom/unkn
Ready to connect★ 271
- View details
web-discoverySkillSecurity
Discover web application injection points and route to the correct exploitation skill during authorized penetration testing.
Ready to connect★ 271
- View details
windows-credential-harvestingSkillSecurity
Harvest stored credentials from a Windows system for privilege escalation or lateral movement.
Ready to connect★ 271
- View details
windows-discoverySkillSecurity
Windows local privilege escalation enumeration and attack surface mapping.
Ready to connect★ 271
- View details
windows-service-dll-abuseSkillSecurity
Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.
Ready to connect★ 271
- View details
windows-token-impersonationSkillSecurity
Exploit Windows token privileges for local privilege escalation to SYSTEM.
Ready to connect★ 271
- View details
windows-uac-bypassSkillSecurity
Bypass Windows User Account Control to escalate from medium to high integrity.
Ready to connect★ 271
- View details
xmpp-enumerationSkillSecurity
XMPP/Jabber service enumeration for Openfire, ejabberd, Prosody, and other XMPP servers. Trigger when ports 5222 (client), 5223 (legacy TLS), or 5269 (server-to-server) are found open. Covers authentication testing, user enumeration, MUC room discovery, and server fingerprinting. Do NOT use for AD e
Ready to connect★ 271
- View details
xss-domSkillSecurity
Guide DOM-based XSS exploitation during authorized penetration testing.
Ready to connect★ 271
- View details
xss-reflectedSkillSecurity
Guide reflected XSS exploitation during authorized penetration testing.
Ready to connect★ 271
- View details
xss-storedSkillSecurity
Guide stored (persistent) and blind XSS exploitation during authorized penetration testing.
Ready to connect★ 271
- View details
xxeSkillSecurity
Guide XML External Entity (XXE) injection exploitation during authorized penetration testing.
Ready to connect★ 271
- View details
aikido-securitySkillSecurity
Aikido Security integration. Manage data, records, and automate workflows. Use when the user wants to interact with Aikido Security data.
Ready to connect★ 270
- View details
bash-herestring-newline-secretsSkillSecurity
Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings. Use when: (1) Password authentication fails with correct password, (2) Secret created with `<<< "value"` syntax, (3) Error like "password authentication fai
Ready to connect★ 265
- View details
wayback-api-archive-recoverySkillSecurity
Recover data from archived REST APIs using Wayback Machine. Use when: (1) Recovering data from defunct services like Vine, Twitter, or other platforms, (2) Need to find which API endpoints were archived vs which require authentication, (3) Building data recovery pipelines from web.archive.org. Cover
Ready to connect★ 265
- View details
mcp-serverSkillSecurity
Use when exposing Spring Boot 3 application capabilities through Model Context Protocol tools, resources, or prompts. Covers Spring AI 1.x tool callback registration, transports, schemas, errors, security, and standalone MCP Java SDK compatibility.
Ready to connect★ 260
- View details
spring-security-jwtSkillSecurity
Use when an application issues and validates its own first-party JWT access and refresh tokens, including authentication filters, password encoding, RBAC, and method security. For JWTs issued by Keycloak, Auth0, Okta, Cognito, or another authorization server, use oauth2-resource-server.
Ready to connect★ 260
- View details
MiscSkillSecurity
Miscellaneous techniques, including steganography, traffic analysis, encoding conversion, forensics, AI security, and other non-traditional CTF categories.
Ready to connect★ 261
- View details
mcp-engine-onboardingSkillSecurity
Use when a user types onboarding, asks to set up SemanticOps MCP, wants help choosing Free vs Pro, or wants licensing, modes, masking, guardrails, preferences, model safety, tests, reporting, diagnostics, RLS testing, or Enterprise posture tailored to their workflow. For changing security, policy, o
Ready to connect★ 256
- View details
critical-interval-security-checkerSkillSecurity
Analyzes code to identify security-critical time intervals and timing vulnerabilities in authentication, authorization, and time-sensitive security operations. Use this skill when reviewing code for proper timeout enforcement, token expiration, session management, rate limiting, password reset valid
Ready to connect★ 252
- View details
cve-reachability-analyzerSkillSecurity
Analyze CVE reachability in software repositories by examining how vulnerable dependencies are imported and used. Determines whether vulnerable components, classes, or functions are reachable from project code through call chain analysis, reflection detection, dynamic loading patterns, and configura
Ready to connect★ 252
- View details
cve-watchlist-action-recommendation-generatorSkillSecurity
Generate prioritized CVE watchlists and actionable security recommendations for repositories. Use when analyzing CVE scan results, creating security reports, prioritizing vulnerability remediation, or generating security gate reports for CI/CD. Takes CVE scan results (JSON/SARIF from npm audit, pip-
Ready to connect★ 252
- View details
exploitability-analyzerSkillSecurity
Analyze detected vulnerabilities to assess realistic exploitability by examining control flow, input sources, sanitization logic, and execution context. Use when users need to: (1) Determine if a vulnerability is actually exploitable in practice, (2) Assess severity and impact of security issues, (3
Ready to connect★ 252
- View details
fuzzing-input-generatorSkillSecurity
Generate randomized and edge-case inputs to detect unexpected failures, bugs, and security vulnerabilities through fuzz testing. Use when creating test cases for robustness testing, generating adversarial inputs, testing error handling, finding edge cases, or security testing. Produces Python test c
Ready to connect★ 252
- View details
security-patch-advisorSkillSecurity
Proposes secure remediation strategies for detected security vulnerabilities including buffer overflows, injection risks, insecure deserialization, improper authentication, and unsafe cryptographic usage. Provides recommended security checks, safer API alternatives, design-level changes, code exampl
Ready to connect★ 252
- View details
cli-reviewSkillSecurity
Runs a Greptile CLI review for the current local branch, installing or authenticating the CLI when needed, then summarizes JSON findings for the user. Use when the user wants Greptile feedback before opening a PR, outside a hosted PR review flow, or directly from a local checkout.
Ready to connect★ 244
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
52,524 of the 52,958 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.