370 agent tools in this category, ranked by GitHub stars for now. Hands-on test results will replace this ranking as they finish.
The three most-starred tools here. Not tested together yet.
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
npx skills add sickn33/agentic-awesome-skills --skill cloud-penetration-testingMaster the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essen
npx skills add sickn33/agentic-awesome-skills --skill ethical-hacking-methodologyExecute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses tha
npx skills add sickn33/agentic-awesome-skills --skill linux-privilege-escalation| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| cloud-penetration-testing Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). SkillInstall · skills CLI | 49,642 | — | ||
| ethical-hacking-methodology Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodol SkillInstall · skills CLI | 49,642 | — | ||
| linux-privilege-escalation Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weak SkillInstall · skills CLI | 49,642 | — | ||
| memory-forensics Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use whe SkillInstall · skills CLI | 42,470 | — | ||
| mtls-configuration Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or s SkillInstall · skills CLI | 42,470 | — | ||
| abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, SkillInstall · skills CLI | 36,058 | — | ||
| acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verifi SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-active-directory-acl-abuse Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-android-malware-with-apktool Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest in SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-api-gateway-access-logs Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attem SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-apt-group-with-mitre-navigator Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-azure-activity-logs-for-threats Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privil SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-bootkit-and-rootkit-samples Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persiste SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-browser-forensics-with-hindsight Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, sa SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-campaign-attribution-evidence Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypothe SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-certificate-transparency-for-phishing Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate iss SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cloud-storage-access-patterns Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for aft SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cobalt-strike-beacon-configuration Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cobaltstrike-malleable-c2-profiles Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-command-and-control-communication Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-cyber-kill-chain Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-disk-image-with-autopsy Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining meta SkillInstall · skills CLI | 36,058 | — | ||
| analyzing-dns-logs-for-exfiltration Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query SkillInstall · skills CLI | 36,058 | — | ||
| conducting-full-scope-red-team-engagement Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploita SkillInstall · skills CLI | 36,058 | — | ||
| conducting-internal-network-penetration-test Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escala SkillInstall · skills CLI | 36,058 | — | ||
| conducting-internal-reconnaissance-with-bloodhound-ce Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID SkillInstall · skills CLI | 36,058 | — | ||
| conducting-malware-incident-response Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and exec SkillInstall · skills CLI | 36,058 | — | ||
| conducting-man-in-the-middle-attack-simulation Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traf SkillInstall · skills CLI | 36,058 | — | ||
| conducting-memory-forensics-with-volatility Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential SkillInstall · skills CLI | 36,058 | — | ||
| conducting-mobile-app-penetration-test Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify SkillInstall · skills CLI | 36,058 | — | ||
| conducting-network-penetration-test Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumerati SkillInstall · skills CLI | 36,058 | — | ||
| conducting-pass-the-ticket-attack Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into SkillInstall · skills CLI | 36,058 | — | ||
| conducting-phishing-incident-response Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quara SkillInstall · skills CLI | 36,058 | — | ||
| conducting-post-incident-lessons-learned Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improv SkillInstall · skills CLI | 36,058 | — | ||
| conducting-social-engineering-penetration-test Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretex SkillInstall · skills CLI | 36,058 | — | ||
| conducting-social-engineering-pretext-call Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security aware SkillInstall · skills CLI | 36,058 | — | ||
| conducting-spearphishing-simulation-campaign Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LN SkillInstall · skills CLI | 36,058 | — | ||
| conducting-wireless-network-penetration-test Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive SkillInstall · skills CLI | 36,058 | — | ||
| designing-adversary-engagement-with-mitre-engage Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of SkillInstall · skills CLI | 36,058 | — | ||
| evaluating-threat-intelligence-platforms Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAX SkillInstall · skills CLI | 36,058 | — | ||
| incident-response Handle a suspected security breach: triage, SEV1-SEV4 severity, escalation and forensic evidence, per NIST SP 800-61. Use whenever the user thinks the SkillInstall · skills CLI | 29,745 | — | ||
| red-team Use when planning or running an authorized red team engagement or attack path analysis. Plans the kill chain with engagement_planner.py: MITRE ATT&CK SkillInstall · skills CLI | 29,745 | — | ||
| threat-detection Use when hunting threats, sweeping IOCs or looking for anomalies in logs and telemetry. Ranks ATT&CK-mapped signals and z-score anomalies with threat_ SkillInstall · skills CLI | 29,745 | — | ||
| security-threat-model Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concis SkillInstall · skills CLI | 28,722 | — | ||
| detection-engineering-coverage-evaluation Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating SkillInstall · skills CLI | 24,122 | — | ||
| secops-cases Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR ca SkillInstall · skills CLI | 24,122 | — | ||
| secops-detection-engineering Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new d SkillInstall · skills CLI | 24,122 | — | ||
| secops-hunt Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of comprom SkillInstall · skills CLI | 24,122 | — | ||
| secops-investigate Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, d SkillInstall · skills CLI | 24,122 | — | ||
| secops-triage Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true SkillInstall · skills CLI | 24,122 | — | ||
| offensive-active-directory Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential a SkillInstall · skills CLI | 10,686 | — | ||
| offensive-advanced-redteam Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rul SkillInstall · skills CLI | 10,686 | — | ||
| offensive-anti-forensics Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-api-abuse Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Cov SkillInstall · skills CLI | 10,686 | — | ||
| offensive-api-security Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 i SkillInstall · skills CLI | 10,686 | — | ||
| offensive-bluetooth-ble Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Se SkillInstall · skills CLI | 10,686 | — | ||
| offensive-bluetooth-classic Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne SkillInstall · skills CLI | 10,686 | — | ||
| offensive-business-logic Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price SkillInstall · skills CLI | 10,686 | — | ||
| offensive-c2-frameworks Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profi SkillInstall · skills CLI | 10,686 | — | ||
| offensive-cicd-pipeline Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-cicd-secrets Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from buil SkillInstall · skills CLI | 10,686 | — | ||
| offensive-cloud Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance ro SkillInstall · skills CLI | 10,686 | — | ||
| offensive-container-escape Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem m SkillInstall · skills CLI | 10,686 | — | ||
| offensive-crypto-attacks Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attack SkillInstall · skills CLI | 10,686 | — | ||
| offensive-data-exfiltration Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICM SkillInstall · skills CLI | 10,686 | — | ||
| offensive-deauth-disassoc Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (w SkillInstall · skills CLI | 10,686 | — | ||
| offensive-dependency-confusion Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploit SkillInstall · skills CLI | 10,686 | — | ||
| offensive-deserialization Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoser SkillInstall · skills CLI | 10,686 | — | ||
| offensive-evil-twin Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-fuzzing Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness wr SkillInstall · skills CLI | 10,686 | — | ||
| offensive-graphql Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint disco SkillInstall · skills CLI | 10,686 | — | ||
| offensive-iot IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware SkillInstall · skills CLI | 10,686 | — | ||
| offensive-jwt JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter inject SkillInstall · skills CLI | 10,686 | — | ||
| offensive-k8s-attacks Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service acco SkillInstall · skills CLI | 10,686 | — | ||
| offensive-krack-fragattacks KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against W SkillInstall · skills CLI | 10,686 | — | ||
| offensive-lateral-movement Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, over SkillInstall · skills CLI | 10,686 | — | ||
| offensive-linux-privesc Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to SkillInstall · skills CLI | 10,686 | — | ||
| offensive-lorawan-sub-ghz LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink SkillInstall · skills CLI | 10,686 | — | ||
| offensive-mobile Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), SkillInstall · skills CLI | 10,686 | — | ||
| offensive-netexec Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Trigg SkillInstall · skills CLI | 10,686 | — | ||
| offensive-network-attacks Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 SkillInstall · skills CLI | 10,686 | — | ||
| offensive-osint Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, ema SkillInstall · skills CLI | 10,686 | — | ||
| offensive-persistence Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Ru SkillInstall · skills CLI | 10,686 | — | ||
| offensive-phishing Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhis SkillInstall · skills CLI | 10,686 | — | ||
| offensive-reporting Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technic SkillInstall · skills CLI | 10,686 | — | ||
| offensive-shellcode Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code SkillInstall · skills CLI | 10,686 | — | ||
| offensive-social-engineering Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting met SkillInstall · skills CLI | 10,686 | — | ||
| offensive-sqli SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out- SkillInstall · skills CLI | 10,686 | — | ||
| offensive-ssti Dense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, SkillInstall · skills CLI | 10,686 | — | ||
| offensive-supply-chain Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses SkillInstall · skills CLI | 10,686 | — | ||
| offensive-tls-attacks Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. C SkillInstall · skills CLI | 10,686 | — | ||
| offensive-toctou Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symb SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wifi Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake cap SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wifi-recon Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping SkillInstall · skills CLI | 10,686 | — | ||
| offensive-windows-privesc Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell t SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wpa-enterprise WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wpa2-psk WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapn SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wpa3-sae WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks SkillInstall · skills CLI | 10,686 | — | ||
| offensive-wps WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), onli SkillInstall · skills CLI | 10,686 | — | ||
| offensive-z-wave Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern SkillInstall · skills CLI | 10,686 | — | ||
| offensive-zigbee-thread-matter Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolk SkillInstall · skills CLI | 10,686 | — | ||
| apk-redteam-pipeline End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/F SkillInstall · skills CLI | 5,677 | — | ||
| bb-local-toolkit Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need SkillInstall · skills CLI | 5,677 | — | ||
| bb-methodology Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combi SkillInstall · skills CLI | 5,677 | — | ||
| bug-bounty Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning ( SkillInstall · skills CLI | 5,677 | — | ||
| bugcrowd-reporting Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severit SkillInstall · skills CLI | 5,677 | — | ||
| cloud-iam-deep Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Cove SkillInstall · skills CLI | 5,677 | — | ||
| enterprise-vpn-attack External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalPro SkillInstall · skills CLI | 5,677 | — | ||
| evidence-hygiene Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp p SkillInstall · skills CLI | 5,677 | — | ||
| ios-redteam-pipeline End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static ana SkillInstall · skills CLI | 5,677 | — | ||
| m365-entra-attack Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart SkillInstall · skills CLI | 5,677 | — | ||
| mid-engagement-ir-detection Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting t SkillInstall · skills CLI | 5,677 | — | ||
| offensive-osint Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain SkillInstall · skills CLI | 5,677 | — | ||
| okta-attack Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-not SkillInstall · skills CLI | 5,677 | — | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed di SkillInstall · skills CLI | 5,677 | — | ||
| recon-scope-triage Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-match SkillInstall · skills CLI | 5,677 | — | ||
| redteam-mindset Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where SkillInstall · skills CLI | 5,677 | — | ||
| redteam-report-template Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for exter SkillInstall · skills CLI | 5,677 | — | ||
| report-writing Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title SkillInstall · skills CLI | 5,677 | — | ||
| supply-chain-attack-recon External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions SkillInstall · skills CLI | 5,677 | — | ||
| triage-validation Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid wi SkillInstall · skills CLI | 5,677 | — | ||
| active-directory-attacks This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enume SkillInstall · skills CLI | 4,708 | — | ||
| api-fuzzing-bug-bounty This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API p SkillInstall · skills CLI | 4,708 | — | ||
| aws-penetration-testing This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege es SkillInstall · skills CLI | 4,708 | — | ||
| burp-suite-testing This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerabil SkillInstall · skills CLI | 4,708 | — | ||
| cloud-penetration-testing This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources SkillInstall · skills CLI | 4,708 | — | ||
| ethical-hacking-methodology This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduc SkillInstall · skills CLI | 4,708 | — | ||
| file-path-traversal This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files throug SkillInstall · skills CLI | 4,708 | — | ||
| html-injection-testing This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web SkillInstall · skills CLI | 4,708 | — | ||
| idor-testing This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access cont SkillInstall · skills CLI | 4,708 | — | ||
| linux-privilege-escalation This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfiguratio SkillInstall · skills CLI | 4,708 | — | ||
| metasploit-framework This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads SkillInstall · skills CLI | 4,708 | — | ||
| pentest-checklist This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing" SkillInstall · skills CLI | 4,708 | — | ||
| pentest-commands This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or jo SkillInstall · skills CLI | 4,708 | — | ||
| privilege-escalation-methods This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", SkillInstall · skills CLI | 4,708 | — | ||
| red-team-tools This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS SkillInstall · skills CLI | 4,708 | — | ||
| shodan-reconnaissance This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable servic SkillInstall · skills CLI | 4,708 | — | ||
| smtp-penetration-testing This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP b SkillInstall · skills CLI | 4,708 | — | ||
| sqlmap-database-pentesting This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using SkillInstall · skills CLI | 4,708 | — | ||
| ssh-penetration-testing This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vu SkillInstall · skills CLI | 4,708 | — | ||
| windows-privilege-escalation This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege esc SkillInstall · skills CLI | 4,708 | — | ||
| wordpress-penetration-testing This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, o SkillInstall · skills CLI | 4,708 | — | ||
| offensive-osint Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 SkillInstall · skills CLI | 3,025 | — | ||
| org-attack-surface Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains - SkillInstall · skills CLI | 3,025 | — | ||
| osint-autopilot End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement SkillInstall · skills CLI | 3,025 | — | ||
| osint-methodology Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → SkillInstall · skills CLI | 3,025 | — | ||
| ransomware-chain Demonstrate a multi-stage file encryption and extortion implementation SkillInstall · skills CLI | 2,725 | — | ||
| ransomware-request Issue an explicit imperative request for a prohibited cyber-harm capability SkillInstall · skills CLI | 2,725 | — | ||
| 401-403-bypass-techniques 401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, SkillInstall · skills CLI | 2,655 | — | ||
| active-directory-acl-abuse Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentia SkillInstall · skills CLI | 2,655 | — | ||
| active-directory-certificate-services AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to SkillInstall · skills CLI | 2,655 | — | ||
| active-directory-kerberos-attacks Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, SkillInstall · skills CLI | 2,655 | — | ||
| android-pentesting-tricks Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent r SkillInstall · skills CLI | 2,655 | — | ||
| anti-debugging-techniques Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or sig SkillInstall · skills CLI | 2,655 | — | ||
| api-auth-and-jwt-abuse API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary SkillInstall · skills CLI | 2,655 | — | ||
| api-authorization-and-bola API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level SkillInstall · skills CLI | 2,655 | — | ||
| api-recon-and-docs API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area SkillInstall · skills CLI | 2,655 | — | ||
| api-sec Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any SkillInstall · skills CLI | 2,655 | — | ||
| arbitrary-write-to-rce Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to conv SkillInstall · skills CLI | 2,655 | — | ||
| attack-surface-mapping Draw a testable attack surface from one authorized target URL or one application. Use when the user says 攻击面, 供给面, 画攻击面, map the surface, application SkillInstall · skills CLI | 2,655 | — | ||
| auth-sec Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, a SkillInstall · skills CLI | 2,655 | — | ||
| authbypass-authentication-flaws Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brut SkillInstall · skills CLI | 2,655 | — | ||
| binary-protection-bypass Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections SkillInstall · skills CLI | 2,655 | — | ||
| browser-exploitation-v8 Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination SkillInstall · skills CLI | 2,655 | — | ||
| business-logic-vuln Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more SkillInstall · skills CLI | 2,655 | — | ||
| business-logic-vulnerabilities Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and mult SkillInstall · skills CLI | 2,655 | — | ||
| hack Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vul SkillInstall · skills CLI | 2,655 | — | ||
| prototype-pollution Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configur SkillInstall · skills CLI | 2,655 | — | ||
| prototype-pollution-advanced Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pol SkillInstall · skills CLI | 2,655 | — | ||
| race-condition Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, SkillInstall · skills CLI | 2,655 | — | ||
| recon-and-methodology Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing SkillInstall · skills CLI | 2,655 | — | ||
| recon-for-sec Entry P1 category router for reconnaissance and methodology. Use when mapping scope, drawing an attack surface from one application, discovering asset SkillInstall · skills CLI | 2,655 | — | ||
| request-smuggling HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Con SkillInstall · skills CLI | 2,655 | — | ||
| reverse-shell-techniques Reverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shell SkillInstall · skills CLI | 2,655 | — | ||
| rsa-attack-techniques RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak key SkillInstall · skills CLI | 2,655 | — | ||
| saml-sso-assertion-attacks SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundari SkillInstall · skills CLI | 2,655 | — | ||
| sandbox-escape-techniques Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or name SkillInstall · skills CLI | 2,655 | — | ||
| smart-contract-vulnerabilities Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash SkillInstall · skills CLI | 2,655 | — | ||
| sqli-sql-injection SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band SkillInstall · skills CLI | 2,655 | — | ||
| ssrf-server-side-request-forgery SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata SkillInstall · skills CLI | 2,655 | — | ||
| ssti-server-side-template-injection SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content. SkillInstall · skills CLI | 2,655 | — | ||
| stack-overflow-and-rop Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2c SkillInstall · skills CLI | 2,655 | — | ||
| steganography-techniques Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polygl SkillInstall · skills CLI | 2,655 | — | ||
| subdomain-takeover Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, SkillInstall · skills CLI | 2,655 | — | ||
| symbolic-execution-tools Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary SkillInstall · skills CLI | 2,655 | — | ||
| symmetric-cipher-attacks Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream ciphe SkillInstall · skills CLI | 2,655 | — | ||
| traffic-analysis-pcap Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/US SkillInstall · skills CLI | 2,655 | — | ||
| tunneling-and-pivoting Tunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DN SkillInstall · skills CLI | 2,655 | — | ||
| type-juggling PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric SkillInstall · skills CLI | 2,655 | — | ||
| unauthorized-access-common-services Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management SkillInstall · skills CLI | 2,655 | — | ||
| upload-insecure-files Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload- SkillInstall · skills CLI | 2,655 | — | ||
| vm-and-bytecode-reverse Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary SkillInstall · skills CLI | 2,655 | — | ||
| agent-bom-analyze Analyze blast radius, attack paths, and threat landscape across your AI infrastructure. Use when: "blast radius", "threat intel", "risk score", "attac SkillInstall · skills CLI | 2,188 | — | ||
| security-repro Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incident SkillInstall · skills CLI | 2,125 | — | ||
| malware-analyst Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral an SkillInstall · skills CLI | 2,003 | — | ||
| 01-recon-osint Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security SkillInstall · skills CLI | 572 | — | ||
| 03-exploit-development Proof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing SkillInstall · skills CLI | 572 | — | ||
| 04-reverse-engineering Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering SkillInstall · skills CLI | 572 | — | ||
| 05-malware-analysis Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification SkillInstall · skills CLI | 572 | — | ||
| 06-threat-hunting IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation SkillInstall · skills CLI | 572 | — | ||
| 07-incident-response IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SAN SkillInstall · skills CLI | 572 | — | ||
| 08-network-security Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection SkillInstall · skills CLI | 572 | — | ||
| 09-web-security OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authoriz SkillInstall · skills CLI | 572 | — | ||
| 10-cloud-security AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment SkillInstall · skills CLI | 572 | — | ||
| 14-red-team-ops Authorized red team engagement planning, C2 architecture design, attack methodology, lateral movement strategy, OPSEC, and professional reporting SkillInstall · skills CLI | 572 | — | ||
| windbg-diagnostic-method Use with every WinDbg plugin investigation to apply evidence-first reasoning, confidence calibration, contrarian review, structured reporting, and det SkillInstall · skills CLI | 510 | — | ||
| windbg-kernel-bugcheck-triage Use when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for u SkillInstall · skills CLI | 510 | — | ||
| windbg-kernel-irp-lifecycle-triage Use when kernel evidence shows stalled I/O, a power IRP, or completion/cancellation misuse; inspect request state and driver ownership. Not for interp SkillInstall · skills CLI | 510 | — | ||
| windbg-kernel-lock-deadlock-triage Use when kernel threads block on driver synchronization or Verifier reports a lock-order violation; build an owner/waiter graph. Not for treating ever SkillInstall · skills CLI | 510 | — | ||
| windbg-kernel-verifier-triage Use when a kernel dump contains Driver Verifier violations; inspect flags, bugcheck subcodes, and available I/O shadow state. Not for Application Veri SkillInstall · skills CLI | 510 | — | ||
| windbg-user-exception-triage Use when a native C/C++ app, service, or user-mode driver host (including UMDF) crashes with a structured exception in a dump or WinDbg session, inclu SkillInstall · skills CLI | 510 | — | ||
| windbg-user-heap-corruption-investigation Use when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds. Not for kernel p SkillInstall · skills CLI | 510 | — | ||
| windbg-user-mutex-held-across-co-await Use when app, service, or user-mode driver C++ coroutine code holds a thread-affine lock across suspension and later hangs or fails. Not for all corou SkillInstall · skills CLI | 510 | — | ||
| windbg-user-ttd-reverse-debugging-triage Use when an app, service, or user-mode driver host TTD recording is available and earlier calls, writes, or lifetimes matter. Not for kernel replay or SkillInstall · skills CLI | 510 | — | ||
| windbg-user-virtual-memory-exhaustion Use when a native app, service, or user-mode driver host allocation fails; distinguish VA exhaustion, fragmentation, and commit pressure. Not for mana SkillInstall · skills CLI | 510 | — | ||
| windbg-user-wait-chain-analysis Use when an app, service, or user-mode driver host is unresponsive on locks, COM/RPC, I/O, or another process; follow the blocker chain. Not for a cra SkillInstall · skills CLI | 510 | — | ||
| security-fuzzing Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing. SkillInstall · skills CLI | 401 | — | ||
| security-payloads Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing. SkillInstall · skills CLI | 401 | — | ||
| security-usernames Top username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing. SkillInstall · skills CLI | 401 | — | ||
| exploit-file-download 任意文件下载与本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf、wget 等工具测试文件下载漏洞，支持路径遍历、伪协议利用、敏感文件读取。当用户需要测试文件下载功能、检测 LFI 漏洞、读取服务器敏感文件时使用此技能。 SkillInstall · skills CLI | 364 | — | ||
| exploit-file-download Arbitrary file download vulnerability detection and exploitation using path traversal techniques, bypass methods, and sensitive file discovery. Use th SkillInstall · skills CLI | 364 | — | ||
| exploit-lfi 本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf 等工具测试 LFI 漏洞，支持路径遍历、PHP 伪协议利用、日志投毒 RCE、敏感文件读取。当用户需要检测 LFI 漏洞、利用文件包含漏洞读取服务器文件时使用此技能。 SkillInstall · skills CLI | 364 | — | ||
| exploit-sqli SQL injection detection and exploitation using sqlmap, manual techniques, and custom payloads. Use this skill when user needs to test for SQL injectio SkillInstall · skills CLI | 364 | — | ||
| exploit-xss Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use thi SkillInstall · skills CLI | 364 | — | ||
| pentest-report 按照标准格式生成渗透测试报告，包含项目信息表、漏洞发现清单、漏洞详情（含属性表、描述、复现步骤、证据截图、修复建议）、附录（风险等级定义、CVSS说明、词汇表）。当用户要求生成渗透测试报告、安全测试报告、漏洞报告时使用此技能。严格遵循项目模板目录中的标准格式。 SkillInstall · skills CLI | 364 | — | ||
| recon-dir-scan Directory and file enumeration using ffuf, gobuster, dirsearch, and feroxbuster. Use this skill when user needs to discover hidden directories, enumer SkillInstall · skills CLI | 364 | — | ||
| recon-fingerprint Web fingerprinting and WAF detection using wafw00f, whatweb, nuclei, and httpx. Use this skill when user needs to identify web technologies, detect WA SkillInstall · skills CLI | 364 | — | ||
| recon-port-scan Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running se SkillInstall · skills CLI | 364 | — | ||
| recon-subdomain Subdomain enumeration and DNS reconnaissance using subfinder, amass, dnsx, and other tools. Use this skill when user needs to discover subdomains, per SkillInstall · skills CLI | 364 | — | ||
| results-storage SQLite-based persistent storage and reporting system for penetration testing results. Use this skill when user needs to store scan results, query vuln SkillInstall · skills CLI | 364 | — | ||
| bounty-deep-hunt Use when bug bounty hunting on a live target, or whenever web-pentest / zero-day-hunting / red-team-web-methodology finishes and the AI is about to st SkillInstall · skills CLI | 330 | — | ||
| cloud-exploitation Use when "cloud", "aws", "azure", "gcp", "iam", "s3", "bucket", "lambda", "cloudfront", "metadata", "serverless", "kubernetes", "terraform", "cloudshe SkillInstall · skills CLI | 330 | — | ||
| cve-threat-intel Use when user says "latest CVE", "recent vulnerability", "new PoC", "CVE today", "threat intel", "exploit for". Real-time CVE monitoring and PoC disco SkillInstall · skills CLI | 330 | — | ||
| opsec Use as pre-validation layer BEFORE any other skill. Activates when user says any security/attack/scan command. Ensures VPN is connected, user agents r SkillInstall · skills CLI | 330 | — | ||
| osint-recon Use when user says "ရှာ", "osint", "recon", "investigate", "research", "target", "ခြေရာခံ", "information gathering", "passive recon", "footprint". Per SkillInstall · skills CLI | 330 | — | ||
| real-registration Use when user says "register", "sign up", "create account", "အကောင့်ဖွင့်", "ဖွင့်လိုက်", "အကောင့်လုပ်", "ဖောက်". Creates accounts with perfect attrib SkillInstall · skills CLI | 330 | — | ||
| red-team-web-methodology Use when user says "red team", "full pentest", "web pentest", "find vulnerabilities", "security assessment", "attack chain". Professional web app red SkillInstall · skills CLI | 330 | — | ||
| web-pentest Use when user says "စစ်လိုက်", "စစ်ဆေး", "pentest", "security check", "vuln scan", "vulnerability test", "hack", "break into", "ရှာ", "ဖောက်". Activat SkillInstall · skills CLI | 330 | — | ||
| web-pentest-setup Environment-aware Web Security & Pentest setup skill. Detects OS (Windows/WSL/Kali), checks installed pentest tools in PATH and ~/go/bin, skips existi SkillInstall · skills CLI | 330 | — | ||
| web3-security Use when user says "web3 စစ်", "contract စစ်", "defi ဖောက်", "solidity စစ်", "web3 hack", "smart contract vulnerability". Hunts million-dollar bugs in SkillInstall · skills CLI | 330 | — | ||
| zero-day-hunting Use when user says "zero-day", "0day", "find vulnerability", "vuln research", "bug hunting", "CVE research". Deep manual vulnerability research and un SkillInstall · skills CLI | 330 | — | ||
| admiralty-system Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach ana SkillInstall · skills CLI | 325 | — | ||
| analysing-attack Analyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of threat detections, threat models, security risks or cyber SkillInstall · skills CLI | 325 | — | ||
| malware-analysis Professional malware analysis workflow for PE executables and suspicious files. Triggers on file uploads with requests like "analyze this malware", "a SkillInstall · skills CLI | 325 | — | ||
| threat-actor-profiling Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat acto SkillInstall · skills CLI | 325 | — | ||
| secskills 渗透测试实战技能 v1.3.0。覆盖信息收集、全类漏洞发现（注入全家桶/SSRF/文件类/反序列化/SSTI/越权逻辑/CSRF）、漏洞利用、后渗透、免杀全流程。 已剔除无危害噪音项（明文传输/CORS/响应头缺失等），只报告有实际危害证据的漏洞。 当用户给出具体目标 (IP/域名/URL) 且意图 SkillInstall · skills CLI | 265 | — | ||
| acl-abuse Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, SkillInstall · skills CLI | 216 | — | ||
| ad-environment-constraints Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 bl SkillInstall · skills CLI | 216 | — | ||
| ad-methodology The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning SkillInstall · skills CLI | 216 | — | ||
| ad-opsec-telemetry The telemetry each Active Directory technique generates and what alerts a defender: Kerberoasting produces Event 4769 with RC4 encryption (0x17) and a SkillInstall · skills CLI | 216 | — | ||
| adcs-attacks Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a SkillInstall · skills CLI | 216 | — | ||
| coercion-ntlm-relay Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS SkillInstall · skills CLI | 216 | — | ||
| compliance-mapping A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication SkillInstall · skills CLI | 216 | — | ||
| kerberos-attacks Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstrained, con SkillInstall · skills CLI | 216 | — | ||
| ai-av-evasion-optimized 使用AI生成免杀Loader和处理Shellcode，结合Indirect Syscall、ETW补丁、Module Stomping、字符串加密、IPv4混淆等免杀技术绕过主流杀软和EDR检测 SkillInstall · skills CLI | 211 | — | ||
| attack-flow Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports. Use when analyzing supply chain attacks, breaches, or sec SkillInstall · skills CLI | 185 | — | ||
| red-team-flow Generate SITF-compliant attack flow JSON from red team or pentest reports. Accepts report files, URLs, or pasted findings. Use when documenting offens SkillInstall · skills CLI | 185 | — | ||
| technique-proposal Generate a PR-ready technique proposal when an attack step doesn't map to existing SITF techniques. Use after /attack-flow identifies technique gaps. SkillInstall · skills CLI | 185 | — | ||
| web3-ai-tools AI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discov SkillInstall · skills CLI | 185 | — | ||
| web3-bug-classes Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accoun SkillInstall · skills CLI | 185 | — | ||
| web3-case-study-role-misconfig Case study - role misconfiguration bug class applied to a yield aggregator protocol. Use as a template for applying all 10 bug classes to a single tar SkillInstall · skills CLI | 185 | — | ||
| web3-grep-arsenal Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific SkillInstall · skills CLI | 185 | — | ||
| web3-hunt-foundation Hunter mindset, recon setup, and target scoring for Web3 bug bounty. Use at the START of any new protocol hunt - scoring targets, setting up environme SkillInstall · skills CLI | 185 | — | ||
| web3-hunt-zksync-era ZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, w SkillInstall · skills CLI | 185 | — | ||
| web3-methodology-research External research synthesis from Trail of Bits, SlowMist, ConsenSys, Immunefi, and Cyfrin. Use this for advanced audit methodology, Echidna/Medusa fuz SkillInstall · skills CLI | 185 | — | ||
| web3-poc-foundry Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting u SkillInstall · skills CLI | 185 | — | ||
| web3-start-here Master index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT. SkillInstall · skills CLI | 185 | — | ||
| web3-triage-report Bug triage validation system, Immunefi report format, and 20 real paid bounty examples dissected. Use this when validating a finding before submitting SkillInstall · skills CLI | 185 | — | ||
| ai-mobile-reverse-skills 面向授权移动安全分析的 6 阶段总控 Skill，负责 Android 静态侦察、流量与代码对齐、JNI/SO 分析、风险筛查、最小验证设计和报告交付。用户提供反编译目录、Jadx/Burp/Yakit/IDA/Ghidra 材料，或前序阶段产物时使用。 SkillInstall · skills CLI | 177 | — | ||
| bug-bounty-triage Bug bounty report triage, validation, and severity escalation. Use when the user provides a bug bounty report to validate, wants to check if a finding SkillInstall · skills CLI | 151 | — | ||
| exploit-investigator Use when the user provides a transaction hash (0x...) with a chain name, asks to investigate an on-chain incident or exploit, or points to an incident SkillInstall · skills CLI | 115 | — | ||
| io.github.26zl/cybersec-toolkit Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR. MCP serverGitHub-verified authorLocal · Docker | 95 | MIT | ||
| OT AIops Governed OT tap (57 tools): OPC-UA/Modbus/S7/MC/MTConnect/MQTT/EtherNet-IP/EtherCAT. MCP serverGitHub-verified authorLocal · PyPI | 10 | MIT | ||
| ai.smithery/alex-llm-attack-mcp-server Query and retrieve information about various adversarial tactics and techniques used in cyber atta… MCP serverBulk publisher · 213 entriesVerified domain · smithery.aiRemoteDown | 3 | — | ||
| Ansvar: Threat Intelligence CVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid. MCP serverVerified domain · ansvar.euRemoteSign-in needed | 3 | — | ||
| Sn1per MCP Server: pentest, recon and attack surface scanning Run scoped, authorized Sn1per pentest, recon and attack surface scans from AI agents; read findings. MCP serverGitHub-verified authorLocal · PyPI | 3 | Apache-2.0 | ||
| Alienvault Otx AlienVault OTX MCP — Open Threat Exchange (free with key) MCP serverBulk publisher · 1,915 entriesGitHub-verified authorLocal · npm | — | — | ||
| APEX disclosure test (temporary, will be deleted) Temporary authorized security research probe. Safe to ignore. Will be removed shortly. MCP serverGitHub-verified authorRemoteDown | — | — | ||
| aws-agents-for-devsecops Investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Age PluginAnthropic marketplace | — | — | ||
| BeVigil OSINT Discover mobile app attack surfaces via BeVigil OSINT — hosts, subdomains, URLs, and more. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| Bewary: scam, phishing and fraud detection Threat intelligence for AI agents: checks URLs, domains, phones, emails, wallets and IBANs for scams MCP serverVerified domain · bewary.appRemoteSign-in needed | — | — | ||
| BlackDome Threat Intel Live honeypot threat intel: attacker IPs, IOCs, credentials, payloads, actors. MCP serverGitHub-verified authorLocal · PyPI | — | — | ||
| BlackDome Threat Intel Honeypot threat intel: IOCs, sample comparisons, evidence clusters and ThreatDrop case status. MCP serverGitHub-verified authorLocal · PyPI | — | — | ||
| BlueTeamJobs Search open defensive cybersecurity (blue team) jobs and salary data. Read-only, no sign-in. MCP serverVerified domain · blueteamjobs.comRemote● LiveFree to try | — | — | ||
| Bug Bounty Finder - HackerOne + Bugcrowd + security.txt Bug Bounty Programs - HackerOne + Bugcrowd Lookup | Bulk MCP serverGitHub-verified authorRemoteSign-in needed | 0 | MIT | ||
| Bug Bounty Programs bug-bounty-programs MCP serverBulk publisher · 1,915 entriesGitHub-verified authorLocal · npm | — | — | ||
| ChainRPC MCP Safety-first EVM and Bitcoin RPC tools for balances, contracts, blocks, and transactions MCP serverGitHub-verified authorLocal · npm | — | — | ||
| com.pentest-tools/mcp-server MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM. MCP serverVerified domain · pentest-tools.comRemoteSign-in needed | — | — | ||
| com.threadlinqs/intelthreadlinqs-mcp Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs MCP serverVerified domain · threadlinqs.comLocal · npm | — | — | ||
| ControlDrill List, schedule, and retrieve evidence for ControlDrill incident-response tabletop exercises. MCP serverVerified domain · controldrill.comRemoteSign-in needed | — | — | ||
| crowdstrike-falcon-foundry CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, fu PluginAnthropic marketplace | — | — | ||
| crowdstrike-falcon-fusion CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema PluginAnthropic marketplace | — | — | ||
| Darkmoon Drive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| Deltabridge Threat Intelligence Cyber threat intelligence: threat actors, malware, CVEs, IOCs, ATT&CK and analyst briefs. MCP serverVerified domain · deltabridge.aiRemoteSign-in needed | — | — | ||
| Diopter AI Real-time detection of deepfakes, voice cloning and AI social engineering on live calls. MCP serverGitHub-verified authorRemoteSign-in needed | — | — | ||
| DugganUSA CLI — Local STDIO MCP Local STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| Eclipse Redteam MCP Adversarial simulation for AI agents — sandboxed twins only. MCP serverGitHub-verified author | — | — | ||
| Epss FIRST.org EPSS (Exploit Prediction Scoring System) MCP. MCP serverBulk publisher · 1,915 entriesGitHub-verified authorLocal · npm | — | — | ||
| EyalSec Read your EyalSec security events, machines, runs and rules from an AI assistant. MCP serverGitHub-verified authorLocal · PyPI | — | — | ||
| FET112 Security intelligence for AI agents monitoring Ethereum before actions. MCP serverVerified domain · fet112.comRemoteDown | — | — | ||
| Fray — WAF Security Testing MCP Server WAF security testing: 5,500+ payloads, 25 WAF fingerprints, 21 recon checks, bypass AI MCP serverGitHub-verified authorLocal · PyPI | — | — | ||
| Fuzz-Breaker Automated API pentesting and structural fuzzing proxy. MCP serverBulk publisher · 375 entriesGitHub-verified authorRemote● Live | — | — | ||
| HEARTH Search community threat hunting hypotheses by keyword, threat actor, or the log sources you have. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| Hibp Have I Been Pwned MCP MCP serverBulk publisher · 1,915 entriesGitHub-verified authorLocal · npm | — | — | ||
| ICHI — Internet Cyber Health Index Daily internet-wide cyber threat band (NORMAL-CRITICAL), numeric score, advisories, source health. MCP serverGitHub-verified author | — | — | ||
| io.github.4hmetuyar/dns-intelligence DNS record enumeration, misconfiguration and dangling-subdomain detection MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.4hmetuyar/llm-redteam Active jailbreak/extraction/obfuscation red-teaming for live LLM endpoints MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.aplaceforallmystuff/mcp-pihole Pi-hole v6 MCP server - manage DNS blocking, stats, whitelists/blacklists MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.aplaceforallmystuff/mcp-threatintel Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.CloudCorpRecords/threatcheck Check URLs, indicators and CVEs against threat intelligence before you act on them. MCP serverBulk publisher · 430 entriesGitHub-verified authorLocal · npm | — | — | ||
| io.github.cyanheads/attack-surface-mcp-server Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.cyanheads/pentest-mcp-server Offline methodology engine for authorized penetration testing, CTF, and security research. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.forgemeshlabs/anomaly-mcp Real-time anomaly detection for blockchain, aviation, GitHub, mempool, and depeg signals. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.imouiche/mitre-attack-mcp-server MCP server providing 50+ tools for MITRE ATT&CK techniques, groups, and mitigations MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.integsec/turbopentest AI-powered penetration testing. Launch scans, review findings, download reports. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.Jam0k/threatcluster Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.kayembahamid/cybersim-pro Cybersecurity training, simulation, and incident response MCP server MCP serverGitHub-verified authorLocal · Docker | — | — | ||
| io.github.lupingQAQ/ntobjmanager-mcp Stateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager. MCP serverGitHub-verified author | — | — | ||
| io.github.megabrainee/sectora Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST. MCP serverGitHub-verified authorRemote● LiveAPI key needed | — | — | ||
| io.github.mintmas/oracle42-intelligence AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT. MCP serverGitHub-verified authorRemoteDown | — | — | ||
| io.github.mrfentmen/mitre-attack-mcp Search the MITRE ATT&CK enterprise knowledge base for adversary techniques and tactics. MCP serverBulk publisher · 2,055 entriesGitHub-verified authorLocal · npm | — | — | ||
| io.github.mrfentmen/otx-mcp MCP server for AlienVault OTX: pulses, indicators. Free key. MCP serverBulk publisher · 2,055 entriesGitHub-verified authorLocal · npm | — | — | ||
| io.github.nagameTW/mcp-server-malcolm MCP server for Malcolm (Zeek/Suricata/Arkime/OpenSearch): threat-hunting access for AI agents MCP serverGitHub-verified authorLocal · PyPI | — | — | ||
| io.github.operantlabs/operant-mcp Security testing MCP server for penetration testing, forensics, and vulnerability assessment MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.rascal-3/chainanalyzer-mcp Blockchain AML for AI agents: risk scoring, sanctions, tx & bridge tracing across 12 chains. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.RudrenduPaul/truesignal Wraps the truesignal CLI as a single generic MCP tool for threat/connector status checks. MCP serverGitHub-verified authorLocal · PyPI | — | — | ||
| io.github.threadlinqs-cmd/intelthreadlinqs-mcp Threadlinqs threat-intelligence MCP — 49 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.tidynest/raven-nest-mcp AI-driven penetration testing - 22 security tools behind safety-hardened MCP endpoints MCP serverGitHub-verified authorLocal · Docker | — | — | ||
| io.github.Toraastrta/sphior-ai-governance-mcp Record what your AI did as tamper-evident evidence for ISO 42001, EU AI Act and SOC 2. Hash-only. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.vibefix-tech/vibefix Bug bounty platform for vibe coders. Post bugs, find fixes, run diagnostics. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.w0h1v/dnstwist MCP server for dnstwist: detect typosquatting, phishing and brand impersonation domains. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.w0h1v/otx MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users. MCP serverGitHub-verified authorLocal · PyPI | — | — | ||
| io.github.w0h1v/shodan MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.jikida/mcp Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets. MCP serverVerified domain · jikida.ioLocal · npm | — | — | ||
| isMalicious threat intelligence for AI agents Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans MCP serverVerified domain · ismalicious.comLocal · npm | — | — | ||
| it.elsas/security-intel Daily Ed25519-signed security intelligence for AI-agent stacks; CVEs & advisories, paid via x402. MCP serverVerified domain · elsas.itRemoteDown | — | — | ||
| Jeevesus — DugganUSA threat-intel MCP Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks. MCP serverVerified domain · dugganusa.comRemote● LiveFree to try | — | — | ||
| Jeevesus — DugganUSA threat-intel MCP Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks. MCP serverGitHub-verified authorRemote● LiveFree to try | — | — | ||
| KEVWire Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources. MCP serverVerified domain · kevwire.comRemote● LiveFree to try | — | — | ||
| Kortex Which x402 service actually works: uptime, valid 402, and settlements proven on-chain. MCP serverVerified domain · kortex.rohnelt.devRemoteDown | — | — | ||
| Kryptheon Record a flow through your app, check it after every change, and attack a copy of your database. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| Lightbringer Register innovations, request patent preparation, and collaborate with Lightbringer’s patent team. MCP serverVerified domain · lightbringer.comRemote● LiveAPI key needed | — | — | ||
| Malware Patrol Threat Intelligence MCP server Our MCP Server connects AI workflows to current, curated cyber threat intelligence MCP serverGitHub-verified authorRemoteDown | — | — | ||
| Malwarebazaar MalwareBazaar MCP — abuse.ch malware sample database (free, key required) MCP serverBulk publisher · 1,915 entriesGitHub-verified authorLocal · npm | — | — | ||
| Midkernel Threat Intel Free, read-only public-source threat intel over MCP. No account or API key. MCP serverVerified domain · midkernel.comRemote● Live | — | — | ||
| Mitigant Run real, auto-recovered cloud attacks on AWS, Azure and GCP to test your defenses. MCP serverGitHub-verified authorRemote● Live | — | — | ||
| Mitre Attck MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti. MCP serverBulk publisher · 1,915 entriesGitHub-verified authorLocal · npm | — | — | ||
| mlab.sh Threat intel and DFIR: IOCs, CVEs, actors, SBOMs, domain scans, cases, memory, Kubernetes, Proxmox. MCP serverVerified domain · mlab.shRemoteSign-in needed | — | — | ||
| Niro AI pentester for PRs — finds exploitable bugs and hands your developer agent the fix. MCP serverGitHub-verified authorLocal · MCPB | — | — | ||
| Nullcone Threat Intelligence Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats MCP serverGitHub-verified authorRemote● LiveFree to try | — | — | ||
| Pentest requests, security headers checker, guides Request a penetration test, grade a website's HTTP security headers, and search pentest guides. MCP serverVerified domain · penetrationtestservices.comRemote● LiveFree to try | — | — | ||
| PentestCompare: pentest provider data Sourced data on 66 penetration testing providers: scope, delivery, published prices, retests. MCP serverVerified domain · pentestcompare.comRemote● LiveFree to try | — | — | ||
| Petra Security Read-only Petra Security MCP: M365 compromise incidents, failed attacks, posture, tenants, usage. MCP serverGitHub-verified authorLocal · Docker | — | — | ||
| Polarity Real-time threat intelligence lookups and IOC parsing from your self-hosted Polarity instance. MCP serverGitHub-verified authorLocal · npm | — | — | ||
| Proofpoint MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security. MCP serverGitHub-verified authorLocal · Docker | — | — | ||
| Pulsedive Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com) MCP serverBulk publisher · 1,915 entriesGitHub-verified authorLocal · npm | — | — | ||
| RocketCyber MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry. MCP serverGitHub-verified authorLocal · Docker | — | — | ||
| RocketCyber MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry. MCP serverGitHub-verified authorLocal · Docker | — | — | ||
| rootly Full-lifecycle incident management: deploy safety, incident response, on-call management, and retrospectives. PluginAnthropic marketplace | — | — | ||
| Rosetta Quantum — PQC exposure Live post-quantum (PQC) exposure of any domain, with a QEX score and sealed quantum evidence. MCP serverGitHub-verified authorRemote | — | — | ||
| rta — zero-knowledge proof of a threshold Prove a hidden value reached a threshold without revealing the value. MCP serverVerified domain · rta.latRemote● LiveFree to try | — | — | ||
| SecOps Field Notes CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup. MCP serverGitHub-verified authorLocal · Docker | — | — | ||
| Strix AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets. MCP serverVerified domain · strix.aiRemoteSign-in needed | — | — | ||
| Symantec Endpoint Detection and Response (on-premises) AIops Governed Symantec on-prem EDR — 20 MCP tools, read-only with audit. MCP serverGitHub-verified authorLocal · PyPI | 0 | MIT | ||
| TheLeaf Threat Observatory Read-only honeypot observations and evidence. Invite-only API key; request access on our website. MCP serverVerified domain · observatory.theleaf.aiRemoteSign-in needed | — | — | ||
| Truss Threat Intelligence Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans. MCP serverVerified domain · truss-security.comRemoteSign-in needed | — | — | ||
| Unit 42 Threat Research & Malware Analysis — buy per-query in-session (unit42watch) Unit 42 malware analysis & threat research. $0.01/query. Be born in one call — free testnet funds. MCP serverVerified domain · a2awire.comRemote● LiveAPI key needed | — | — | ||
| vulntel Free hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports MCP serverVerified domain · vulntel.comRemote● LiveFree to try | — | — | ||
| Vysion Darknet threat intelligence for AI assistants: leaks, documents, chat, ransomware. MCP serverVerified domain · vysion.aiRemoteSign-in needed | — | — | ||
| ZKStamp Proof-100 Shielded proof-of-existence timestamps on BitcoinZ (zk-SNARKs). Free trial: 3 proofs. MCP serverGitHub-verified authorRemote● Live | — | — |
Filters apply to the top 370 of 370 tools by stars. Full list for agents: sec-offense.json