THE LIBRARY
19 domains, 121 skills
Each skill is a single SKILL.md: a frontmatter block whose
description is the load trigger, and a body that teaches the mechanism rather than
pasting a payload. Every skill is tagged with OWASP / MITRE ATT&CK / CWE, so coverage is measurable.
# Domains at a glance
web 36
ai-ml 9
cloud 9
api 8
recon 8
defense 6
code-review 6
mobile 5
ad 5
network 6
wireless 2
privesc 3
exploit-dev 2
reverse-engineering 3
social-eng 4
payloads 2
reporting 3
automation 2
tradecraft 2
# What each domain covers
| Domain | # | Covers |
|---|---|---|
web | 36 | XSS, SQLi, SSRF, SSTI, IDOR, XXE, CSRF, CORS, LFI, deserialization, OAuth, SAML, request smuggling, prototype pollution, cache poisoning, host-header, WebSocket, race conditions, business logic, file upload, JWT, account takeover, dependency confusion, client-side signing reversal, authenticated session handling, Python sandbox escape, Cypher injection, JDBC/connection-string RCE |
ai-ml | 9 | Prompt injection, jailbreaks, RAG poisoning, model extraction, agent/tool & MCP abuse, insecure output handling, supply chain, unbounded consumption |
cloud | 9 | IMDS credential theft, object-storage exposure, Kubernetes, container escape, exposed Docker/daemon API abuse, IAM privilege escalation, registries, GCP, Azure / Entra ID |
api | 8 | BOLA/BFLA, GraphQL, gRPC, mass assignment, authentication attacks, fuzzing, version drift, NoSQL injection |
recon | 8 | Subdomain enumeration, DNS analysis, content & JS discovery, OSINT, cloud-asset discovery, service enumeration, tech-stack fingerprinting |
defense | 6 | Detection engineering (Sigma/ATT&CK), hardening baselines, DFIR triage, threat modeling, log analysis, purple teaming |
code-review | 6 | Methodology, dangerous-sink catalog, secrets detection, CI/CD security, Python, Node.js |
mobile | 5 | Android & iOS assessment, certificate-pinning bypass, deep-link abuse, WebView abuse |
ad | 5 | Kerberoasting / AS-REP, ADCS (ESC1–8), ACL/DACL abuse, Kerberos delegation abuse (RBCD / S4U / coercion→relay), pivoting arsenal |
network | 6 | Service attacks, pivoting & tunneling, NTLM coercion & relay, password spraying & credential stuffing, perimeter appliance & VPN offensive, hash & credential cracking |
wireless | 2 | WPA2-PSK handshake/PMKID capture & cracking, evil-twin / rogue-AP enterprise (PEAP-MSCHAPv2) credential harvesting (pentest-only) |
privesc | 3 | Linux arsenal, GTFOBins (sudo/SUID/capabilities), Windows token impersonation |
exploit-dev | 2 | Exploit chaining & impact amplification, PoC development |
reverse-engineering | 3 | Native binary triage, deobfuscation (packed / JS / WASM / JSVMP), firmware extraction & analysis |
payloads | 2 | WAF/filter bypass, XSS polyglots |
reporting | 3 | Finding triage & validation, bug-bounty write-up, penetration-test report |
automation | 2 | Recon pipelines, custom nuclei templates |
tradecraft | 2 | Scope & rules of engagement, complex multi-stage engagements |
social-eng | 4 | Authorized human-factor testing: methodology, phishing, vishing & pretexting, physical assessment (pentest-only) |
# What a skill looks like
The description line is what an agent matches against to decide whether to load
the skill — so it packs concrete trigger signals. The body always follows the same shape.
--- name: web-ssrf description: Discover and escalate Server-Side Request Forgery. Load when the app fetches a URL you influence: webhooks, "import from URL", PDF/image rendering, … domain: web type: technique modes: [pentest, bugbounty] owasp: [A10:2021-SSRF] cwe: [CWE-918] --- ## When it applies · Why it works · Method (exact commands) · Gotchas · Verify success