Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
yaklangSkillyaklang/hack-skills/skills/websocket-security/SKILL.md
WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.
6 projects use a version of this
yaklangSkillyaklang/hack-skills/skills/windows-av-evasion/SKILL.md
AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.
3 projects use a version of this
yaklangSkillyaklang/hack-skills/skills/windows-lateral-movement/SKILL.md
Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.
2 projects use a version of this
yaklangSkillyaklang/hack-skills/skills/windows-privilege-escalation/SKILL.md
Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.
4 projects use a version of this
yaklangSkillyaklang/hack-skills/skills/xslt-injection/SKILL.md
XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.
3 projects use a version of this
yaklangSkillyaklang/hack-skills/skills/xss-cross-site-scripting/SKILL.md
XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.
2 projects use a version of this
yaklangReads credentialsSkillyaklang/hack-skills/skills/xxe-xml-external-entity/SKILL.md
XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.
2 projects use a version of this
yaklangSkillyaklang/irify-sast-skill/skills/irify-sast/SKILL.md
IRify SAST — AI-powered static application security testing. Compile source code into SSA IR, then use SyntaxFlow DSL to trace data flow across function boundaries, detect vulnerabilities (SQLi, RCE, XXE), and answer questions like "where does user input go?". Supports 7 languages (Java, PHP, JS, Go, Python, C, Yak) and incremental compilation via ProgramOverLay. Requires yaklang MCP server: yak mcp -t ssa
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
