Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplificat...
中文简介正在准备中。当前显示原文说明。
ajtazer/heckit☆ 22026年10月7日 更新
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
中文简介正在准备中。当前显示原文说明。
ajtazer/heckit☆ 22026年10月7日 更新
Exploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment.
中文简介正在准备中。当前显示原文说明。
ajtazer/heckit☆ 22026年10月7日 更新
Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersonation, RBAC misconfiguration exploitation including wildcard permissions and privilege escalation via role binding, direct etcd access for secret extraction, kubelet API abuse on port 10250 and read-only port 10255, pod escape via hostPID hostNetwork and hostPath volume mounts, Kubernetes secrets enumeration and decoding, admission controller bypass techniques, network policy bypass and lateral movement, cloud metadata service access from pods for credential theft on AWS EKS GCP GKE and Azure AKS, CRD and operator abuse for persistence, and node compromise via DaemonSet deployment. Tools include kubectl, kube-hunter, peirates, kubeaudit, kdigger, kubeletctl. Maps to MITRE ATT&CK T1609 Container Administration Command, T1610 Deploy Container, T1613 Container and Resource Discovery. Use this skill when assessing Kubernetes clusters,...
中文简介正在准备中。当前显示原文说明。
ajtazer/heckit☆ 22026年10月7日 更新
This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.
中文简介正在准备中。当前显示原文说明。
danstrem2/clawdbot-skill-master-pack☆ 22026年2月1日 更新
Azure Blob Storage SDK for Python. Use for uploading, downloading, listing blobs, managing containers, and blob lifecycle. Triggers: "blob storage", "BlobServiceClient", "ContainerClient", "BlobClient", "upload blob", "download blob".
中文简介正在准备中。当前显示原文说明。
danstrem2/clawdbot-skill-master-pack☆ 22026年2月1日 更新
Plan, execute, and measure business events — conferences, webinars, workshops, product launches, networking events, trade shows, and corporate gatherings. Complete event lifecycle from concept to post-event ROI analysis.
中文简介正在准备中。当前显示原文说明。
johnalbertini14-glitch/openclaw-skills☆ 22026年2月26日 更新
Complete agency operations system — client lifecycle, pricing, project delivery, team management, and growth strategy for service businesses.
中文简介正在准备中。当前显示原文说明。
johnalbertini14-glitch/openclaw-skills☆ 22026年2月26日 更新
Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Use when designing new APIs, reviewing existing ones, generating OpenAPI specs, building test suites, or debugging production issues.
中文简介正在准备中。当前显示原文说明。
johnalbertini14-glitch/openclaw-skills☆ 22026年2月26日 更新
Control and manage VirtualBox virtual machines directly from openclaw. Start, stop, snapshot, clone, configure and monitor VMs using VBoxManage CLI. Supports full lifecycle management including VM creation, network configuration, shared folders, and performance monitoring.
中文简介正在准备中。当前显示原文说明。
johnalbertini14-glitch/openclaw-skills☆ 22026年2月26日 更新
Designs marketing automation workflows: email triggers, branching logic, lead scoring rules, lifecycle stage transitions. Outputs Mermaid diagrams and implementation specs for HubSpot, Klaviyo, and Mailchimp.
中文简介正在准备中。当前显示原文说明。
ekatasingh1107/b2b-gtm-skills☆ 22026年4月12日 更新