326 skills · sorted by relevance
Proof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing
The English summary is being prepared. Showing the original description.
Expert guide for Headless CMS integration (Sanity, Payload CMS, Strapi, Contentful, Storyblok) with modern frameworks / Panduan ahli integrasi Headless CMS (Sanity, Payload, Strapi, Contentful) dengan framework modern.
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs, delayed tasks, retry behavior, worker-only config drift, and payload-to-side-effect chains. Use when the user asks to trace a queue payload, inspect async job execution, explain worker-only behavior, follow retries or dead-letter handling, or connect an enqueued item to a later file, cache, email, or privilege-bearing side effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
Implement ONE tdmcp tool from a spec — the canonical file pattern (Zod schema + …Impl + register… ToolRegistrar), a bridge Python payload via buildPayloadScript, and an offline msw unit test — touching only new files, never shared registries. Use when coding/implementing/writing a tdmcp tool, generator, effect, control, CHOP/TOP/SOP builder, or Python bridge work, especially when several features are built in parallel.
The English summary is being prepared. Showing the original description.
Operate and debug the DNS C2 system non-interactively. This skill should be used when Claude needs to launch an exploit, send commands to a compromised session and collect output, diagnose why a payload is not calling home, or inspect C2 server state. Triggers on requests like "run the exploit", "send whoami to the session", "why isn't the payload calling back", "check what sessions are active", or "debug the C2".
The English summary is being prepared. Showing the original description.
Payload CMS v3 — TypeScript-native headless CMS with code-first collections, hooks, access control, Local/REST/GraphQL APIs, admin panel, and database adapter pattern
The English summary is being prepared. Showing the original description.
Reverse shell generation and listener management. Generates platform-specific reverse shell payloads (bash, python, php, powershell, java, ruby, perl, netcat, socat, msfvenom) and sets up listeners in the Kali container. Supports one-liner generation, encoded payloads for WAF/filter bypass, listener setup with session capture, and shell stabilization. Chains from /pentester, /metasploit, or /post-exploit when command execution is confirmed.
The English summary is being prepared. Showing the original description.
Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.
The English summary is being prepared. Showing the original description.
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
The English summary is being prepared. Showing the original description.
Exploit Document Object Model (DOM) Based Cross-Site Scripting (XSS) vulnerabilities. Unlike Reflected or Stored XSS, the attack payload is executed purely on the client-side as a result of modifying the DOM environment, often without the payload ever reaching the backend server.
The English summary is being prepared. Showing the original description.
Bypass antivirus and Endpoint Detection & Response solutions during red team operations using payload obfuscation, process injection, AMSI bypass, ETW patching, and custom loaders. Use this skill when AV/EDR is blocking your payloads, tooling, or post-exploitation activities. Covers shellcode encryption, syscall-based injection, unhooking techniques, and living-off-the-land approaches for opsec-safe red team operations.
The English summary is being prepared. Showing the original description.
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
The English summary is being prepared. Showing the original description.
Carves injected PE images and position-independent shellcode from a memory dump or carved region, identifies the payload type, and prepares it for disassembly or emulation. Activates for requests to recover injected code, carve shellcode from memory, or reconstruct a dumped payload for analysis.
The English summary is being prepared. Showing the original description.
Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.
The English summary is being prepared. Showing the original description.
Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.
The English summary is being prepared. Showing the original description.
Catalog APIs, persistence models, and message/event payloads into DATA_MODEL.md at the project root. Use after implementation when a diff touches request/response types, schemas, ORM models, queue payloads, or webhook shapes. Triggers on "document data model", "update DATA_MODEL", "catalog API shapes".
The English summary is being prepared. Showing the original description.
Analyze suspicious SMS/email messages, phishing links, redirects, domains, payloads, malware indicators, and suspected C2 infrastructure safely. Use when the user provides spam, smishing/phishing content, raw .eml headers, URLs, QR links, attachments, hashes, strange payloads, redirect chains, DNS/WHOIS/RDAP questions, C2 clues, exploit-chain questions, or asks what defenses to apply.
The English summary is being prepared. Showing the original description.
Design and review native presenter classes in WordPress plugins without requiring better-data - converting DTOs or domain objects into REST arrays, admin table rows, JS config payloads, email variables, and public view models with allowlisted fields, context methods, redaction by default, locale/date/number formatting, no DTO mutation, and correct WordPress escaping boundaries. Use when adding FooPresenter, response mappers, admin-row arrays, wp_send_json payloads, rest_ensure_response data, wp_add_inline_script config, or when code returns raw DTOs, WP_Post, WC_Order, get_object_vars, json_encode, or unescaped HTML from controllers.
The English summary is being prepared. Showing the original description.
Implement ONE tdmcp tool from a spec — the canonical file pattern (Zod schema + …Impl + register… ToolRegistrar), a bridge Python payload via buildPayloadScript, and an offline msw unit test — touching only new files, never shared registries. Use when coding/implementing/writing a tdmcp tool, generator, effect, control, CHOP/TOP/SOP builder, or Python bridge work, especially when several features are built in parallel.
The English summary is being prepared. Showing the original description.
Collect and analyze on-device performance metrics and crash diagnostics using MetricKit. Use when setting up MXMetricManager, handling MXMetricPayload or MXDiagnosticPayload, processing crash/hang/disk-write diagnostics via MXCallStackTree, adding custom signpost metrics, or uploading telemetry to an analytics backend.
The English summary is being prepared. Showing the original description.
Call MCP (Model Context Protocol) server tools on the Unique AI Platform using the unique-cli mcp command. Use when the user asks to invoke, call, or execute an MCP tool, or when they need to send a JSON payload to an MCP server through the CLI. The JSON payload is forwarded 1:1 to the platform's MCP call-tool API.
The English summary is being prepared. Showing the original description.
Derive a SET of simulation personas for an agent from product artifacts — backend payloads, UI screenshots, journey/product docs, and sample real user messages — instead of designing one persona by hand. Identifies who actually interacts with the agent and how they behave, then creates the personas via the CLI. Best for text/chat agents and for new agents with no interaction history. Use when the user says "make personas from these screenshots/payloads", "who are my users", "create a set of personas", "derive personas from my product", "build a persona library", or "I have backend data, turn it into personas".
The English summary is being prepared. Showing the original description.
Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition and aging, SPF/DKIM/DMARC alignment), payload delivery vectors (Office macro weaponization, HTA droppers, ISO/IMG container abuse, LNK shortcut hijacking, OneNote embedded payloads, HTML smuggling), email authentication bypass techniques (SPF softfail exploitation, DKIM replay attacks, display name spoofing, homoglyph and cousin domain registration), credential harvesting with MFA bypass (EvilGinx2 transparent proxy, Modlishka session relay, pixel-perfect HTML cloning), spear phishing pretext development informed by OSINT, email security gateway evasion, QR code phishing (quishing), and callback phishing for initial access. Integrates with GoPhish for campaign management, EvilGinx2 for adversary-in-the-middle credential interception, King Phisher for template design, and the Social Engineering Toolkit for paylo...
The English summary is being prepared. Showing the original description.