Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/01-program-selection/SKILL.md
Evaluate HackerOne / Bugcrowd / Intigriti programs before committing time. Decide signal-to-noise, payout history, response time, scope size, and competition level. Use when the user is considering a new bug bounty target or asking "should I hunt this".
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/02-scope-analysis/SKILL.md
Parse HackerOne / Bugcrowd / Intigriti scope into a structured asset list with in-scope, out-of-scope, and excluded-vuln-class breakdowns. Use when the user has chosen a program and needs to understand exactly what's allowed before recon.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/03-threat-modeling-mindmap/SKILL.md
Build a mental and visual map of the target application before hunting — entry points, trust boundaries, data flows, and high-value functionality. Use when user has scope parsed and wants to plan WHERE to hunt rather than diving into recon.
SubhiSecReads credentialsSkillSubhiSec/claude-ai-cyber-security-skills/skills/04-subdomain-enum/SKILL.md
Enumerate subdomains using passive and active techniques (subfinder, amass, chaos, assetfinder, crtsh, DNS brute force). Use when the user has a root domain in scope and needs the full subdomain list before probing.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/05-asset-discovery/SKILL.md
Probe subdomain list with httpx/dnsx/naabu to identify live hosts, open ports, status codes, titles, and basic fingerprints. Use after subdomain-enum produces a sub list. Output feeds into fingerprinting and content discovery.
SubhiSecReads credentialsSkillSubhiSec/claude-ai-cyber-security-skills/skills/06-fingerprinting/SKILL.md
Identify exact technology stack, frameworks, versions, and CMS on live hosts. Use when the user has a live host list and needs to know what's running before choosing vuln classes to test.
SubhiSecReads credentialsSkillSubhiSec/claude-ai-cyber-security-skills/skills/07-js-analysis/SKILL.md
Extract endpoints, secrets, and hidden routes from JavaScript files using LinkFinder, SecretFinder, JSluice, and source-map analysis. Use when the user has live hosts and needs to mine the JS for attack surface that's not visible in the UI.
SubhiSecReads credentialsSkillSubhiSec/claude-ai-cyber-security-skills/skills/08-content-discovery/SKILL.md
Fuzz directories, files, and parameters using ffuf, feroxbuster, arjun, paramspider, and x8. Use when the user has live hosts and needs to find hidden routes, backup files, exposed configs, and untracked URL parameters.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/09-continuous-monitoring/SKILL.md
Set up nightly monitoring of subdomain changes, JS file diffs, new endpoints, and CVE matches against in-scope assets, with Discord/Slack/Telegram notifications. Use when the user has an active engagement and wants to be alerted to new attack surface without manual re-recon.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/10-idor-hunting/SKILL.md
Hunt Insecure Direct Object Reference (IDOR) — test horizontal and vertical privilege escalation across user IDs, org IDs, tenant boundaries, and unguessable identifiers. Use when the user has an API endpoint with an identifier in the path/body that may be tested for unauthorized cross-user access.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/11-auth-bypass/SKILL.md
Hunt authentication and authorization bypasses — forced browsing, path traversal in auth, header injection, JWT downgrade, OAuth state confusion, role manipulation. Use when an endpoint returns 401/403 but appears reachable.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/12-ato-chains/SKILL.md
Hunt full Account Takeover (ATO) by chaining lower-severity findings — IDOR-to-email-disclosure, password-reset-token-theft, OAuth-redirect-uri abuse, response-manipulation, cookie scope, CRLF in Set-Cookie, race-condition on signup. Use when the user wants to escalate small findings to ATO or thinks an ATO path exists.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/13-xss/SKILL.md
Hunt reflected, stored, and DOM-based Cross-Site Scripting (XSS) including CSP bypass, polyglot payloads, mutation XSS (mXSS), markdown XSS, and template XSS. Use when the user has identified a parameter or input that reflects to the page, or wants to test for XSS in a specific input.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/14-sqli/SKILL.md
Hunt SQL injection in REST/GraphQL/SOAP/raw parameters using sqlmap, ghauri, manual UNION/Time/Boolean techniques, and custom WAF-bypass tamper scripts. Use when an input flows into a database query or when the user has identified a parameter that might be vulnerable.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/15-ssrf/SKILL.md
Hunt Server-Side Request Forgery (SSRF) — internal network access, cloud metadata exploitation, gopher/file/dict protocol abuse, and 11 IP-filter bypass techniques. Use when an endpoint accepts a URL, hostname, or file path as input.
SubhiSecReads credentialsSkillSubhiSec/claude-ai-cyber-security-skills/skills/16-ssti/SKILL.md
Hunt Server-Side Template Injection (SSTI) in Jinja2, Twig, Freemarker, Velocity, Smarty, ERB, Handlebars, Mustache, and Spring (SpEL). Use when input is reflected in a way that suggests template rendering — error pages, email templates, PDF generators, dynamic content systems.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/17-file-upload/SKILL.md
Hunt file upload vulnerabilities — bypass content-type/extension/magic-byte/size filters, achieve XSS via SVG/HTML upload, achieve RCE via .phtml/.jsp/.htaccess, exploit path traversal in filenames, and use polyglot files. Use when an endpoint accepts file uploads.
Often used withssrfopen-redirect
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/18-graphql/SKILL.md
Hunt GraphQL-specific vulns — introspection abuse, field-level authorization (IDOR), batched queries for brute force, alias-based rate limit bypass, deep query DoS, mutation injection, schema disclosure, suggestion leakage, CSRF via GET, and CSRF via POST without preflight. Use when a GraphQL endpoint is present.
Often used withssrf
SubhiSecReads credentialsSkillSubhiSec/claude-ai-cyber-security-skills/skills/19-jwt-attacks/SKILL.md
Hunt JSON Web Token (JWT) vulnerabilities — alg=none bypass, RS256→HS256 key confusion, weak HMAC secret cracking, kid path traversal, JWKS injection, jku/x5u header attacks, embedded JWK confusion, expired-token acceptance, claim mutability, and token replay. Use when an app uses JWT for authentication or stateless sessions.
SubhiSecSkillSubhiSec/claude-ai-cyber-security-skills/skills/20-oauth-oidc/SKILL.md
Hunt OAuth 2.0 and OIDC flaws — redirect_uri abuse, state CSRF, PKCE bypass, scope manipulation, implicit-flow token theft, postMessage origin tricks, ID token sub claim swap, JWKS confusion, response_type confusion, and OAuth-CSRF. Use when an app has Google/GitHub/Facebook/Apple/custom OAuth or OpenID Connect.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
