THE LIBRARY
23 domains, 206 skills
Each skill is a single SKILL.md: a frontmatter block whose
description is the load trigger, and a body that teaches the mechanism rather than
pasting a payload. Every skill is tagged with OWASP / MITRE ATT&CK / CWE, so coverage is measurable.
# Domains at a glance
web 45
ai-ml 11
cloud 9
api 9
recon 9
defense 15
code-review 15
mobile 6
ad 5
network 8
wireless 2
privesc 4
exploit-dev 4
reverse-engineering 16
cryptography 2
social-eng 4
payloads 4
reporting 6
automation 3
tradecraft 9
# What each domain covers
| Domain | # | Covers |
|---|---|---|
web | 45 | XSS, SQLi, SSRF, SSTI, IDOR, XXE, CSRF, CORS, LFI, command injection, deserialization, OAuth, SAML, request smuggling, prototype pollution, cache poisoning, cache deception, host-header, CSP bypass, DOM clobbering, HTTP parameter pollution, postMessage, WebSocket, race conditions, business logic, file upload, JWT, 2FA/MFA bypass, account takeover, dependency confusion, client-side signing reversal, authenticated session handling, Python sandbox escape, Cypher injection, JDBC/connection-string RCE |
ai-ml | 11 | Prompt injection, jailbreaks, RAG poisoning, model extraction, agent/tool & MCP abuse, insecure output handling, supply chain, unbounded consumption |
cloud | 9 | IMDS credential theft, object-storage exposure, Kubernetes, container escape, exposed Docker/daemon API abuse, IAM privilege escalation, registries, GCP, Azure / Entra ID |
api | 9 | BOLA/BFLA, GraphQL, gRPC, mass assignment, authentication attacks, fuzzing, version drift, NoSQL injection |
recon | 9 | Subdomain enumeration, DNS analysis, content & JS discovery, OSINT, GitHub code-leak discovery, cloud-asset discovery, service enumeration, tech-stack fingerprinting |
defense | 15 | Detection engineering (pipeline + Sigma/ATT&CK), threat hunting, incident response, DFIR triage, network detection (NSM), cloud detection & response, Active Directory defense, malware triage, hardening baselines, threat modeling, log analysis, purple teaming |
code-review | 15 | Methodology, dangerous-sink catalog, secrets detection, CI/CD security, IaC (Terraform/Ansible/K8s), smart contracts (Solidity), Python, Node.js, PHP, Java/Spring, Go, Ruby/Rails, .NET/C#, C/C++, Rust |
mobile | 6 | Android & iOS assessment, certificate-pinning bypass, deep-link abuse, WebView abuse |
ad | 5 | Kerberoasting / AS-REP, ADCS (ESC1–8), ACL/DACL abuse, Kerberos delegation abuse (RBCD / S4U / coercion→relay), pivoting arsenal |
network | 8 | Service attacks, pivoting & tunneling, NTLM coercion & relay, password spraying & credential stuffing, perimeter appliance & VPN offensive, hash & credential cracking |
wireless | 2 | WPA2-PSK handshake/PMKID capture & cracking, evil-twin / rogue-AP enterprise (PEAP-MSCHAPv2) credential harvesting (pentest-only) |
privesc | 4 | Post-foothold enumeration & credential hunting, Linux arsenal, GTFOBins (sudo/SUID/capabilities), Windows token impersonation |
exploit-dev | 4 | Exploit chaining & impact amplification, PoC development, memory-corruption exploitation (ROP / format string / ret2libc) |
reverse-engineering | 16 | Native binary triage, deobfuscation (packed / JS / WASM / JSVMP), firmware extraction & analysis |
cryptography | 2 | Weak/textbook RSA (JWT RS256, custom signatures), symmetric oracles (CBC padding, ECB, hash length extension) |
payloads | 4 | WAF/filter bypass, XSS polyglots, reverse shells & TTY upgrade, file transfers |
reporting | 6 | Finding triage & validation, bug-bounty write-up, penetration-test report, CVSS/severity scoring, triage communication |
automation | 3 | Recon pipelines, custom nuclei templates |
tradecraft | 9 | Scope & rules of engagement, attack-scenario planning, attack-path mapping, pivot/decision-making across skills, target selection, duplicate avoidance, bug-bounty platform intelligence, complex multi-stage engagements |
social-eng | 4 | Authorized human-factor testing: methodology, phishing, vishing & pretexting, physical assessment (pentest-only) |
# What a skill looks like
The description line is what an agent matches against to decide whether to load
the skill — so it packs concrete trigger signals. The body always follows the same shape.
--- name: web-ssrf description: Discover and escalate Server-Side Request Forgery. Load when the app fetches a URL you influence: webhooks, "import from URL", PDF/image rendering, … domain: web type: technique modes: [pentest, bugbounty] owasp: [A10:2021-SSRF] cwe: [CWE-918] --- ## When it applies · Why it works · Method (exact commands) · Gotchas · Verify success