JOIN IN
Contribute a skill
SploitAgent gets sharper with every skill added — and a contribution is a single Markdown file, no code. If you've got a technique you reach for on real (authorized) engagements, a cleaner way to explain a bug, or a defensive counterpart to an attack, it belongs here.
# Add a skill in three steps
Copy a template into the right domain folder.
cp skills/_templates/technique.md skills/<domain>/<slug>/SKILL.md
# arsenal.md and methodology.md templates also exist
Fill in the frontmatter and body. Pack concrete trigger signals into description,
and teach the mechanism — when it applies, why it works, exact commands, gotchas, how to verify.
Validate and regenerate the indexes, then open a pull request. CI schema-checks every skill.
python3 tools/catalog.py # validate + regenerate CATALOG.md & COVERAGE.md
# What makes a good skill
- Authorized-use framing — no real targets, no live credentials or secrets, nothing aimed at systems you aren't authorized to test.
- Strong trigger line — the
descriptionis how an agent decides to load it, so pack it with service/version names, vuln class, error strings, tool-output patterns, ports. - Teach the mechanism — tool, why over the alternatives, the exact command with a flag gloss, and the gotcha. Explain the reasoning, not just the payload.
- Correct
modes—pentest,bugbounty, ordefense— and the OWASP / MITRE / CWE tags where they apply. - Small and focused — one tight skill beats one giant file.
# New here?
You don't need to write ten of them — one solid skill is a great contribution, and your name is on it in the git history. The roadmap marks the 🟢 items as good first contributions.