The library

gpt-5-4-prompting · When crafting prompts for Codex subagents or other LLM-heavy workflows.

offensive-fast-checking · When needing a quick vulnerability surface scan before in-depth testing.

sast-analysis · When auditing source code in CI/CD or pre-release security review.

offensive-reporting · When translating raw pentest data into boardroom-ready security reports.

ts-library · When releasing TypeScript utility libraries to npm with strong type guarantees.

sast-businesslogic · Finding exploitable gaps in payment, workflow, and authorization logic that scanners miss

offensive-business-logic · Finding high-value logic chains in fintech/marketplace apps where scanners miss compound flows

cm-tdd · Catching regressions and hidden edge cases that manual testing cannot verify

sast-fileupload · Finding RCE paths through file upload that extension blocklists and static analysis miss

offensive-deserialization · Achieving RCE on Java/.NET/PHP/Python apps that deserialize untrusted objects without allowlists

sast-graphql · Finding query string injection that reaches GraphQL parsers (not resolver SQL injection)

offensive-file-upload · Finding RCE or XSS through file upload when MIME validation or extension checks are sole defense

poke-agents-mcp · Headless orchestration of local agent runs without UI when scripting multi-agent workflows

sast-hardcodedsecrets · Finding exposed API keys, credentials, and tokens that code review and linters miss

offensive-graphql · Bypassing GraphQL authorization when individual resolvers don't check permissions uniformly

sast-idor · Finding authorization gaps where IDs are trusted directly without ownership verification

offensive-idor · Accessing other users' data when IDs are sequential or predictable and authorization is missing

sast-jwt · Finding JWT signature bypass, algorithm confusion, and key exposure in token handling

offensive-open-redirect · Chaining open redirect with phishing or SSRF when URL parameters trust user input

cm-start · Setting up codymaster scaffolding for new projects without manual config

sast-missingauth · Finding unprotected endpoints that forgot authentication decorators or checks

offensive-parameter-pollution · Bypassing security controls when backend and frontend parse parameters differently

sast-pathtraversal · Large codebases needing path traversal scanned in parallel without overwhelming context

offensive-race-condition · Bug bounty race condition testing on registration, payments, and single-use tokens

commit · Rapid multi-file commits with auto-generated messages matching repo conventions

sast-rce · Finding command injection and eval-like RCE across large codebases in parallel

sast-report · Executive-facing security report consolidating 10+ vulnerability types into one prioritized list

offensive-request-smuggling · Bug bounty request smuggling on multi-tier proxies and load balancers (Nginx, HAProxy, AWS ALB)

cm-dockit · One-shot knowledge base generation from source code without writing separate documentation

sast-sqli · Finding SQLi across authentication and bulk data endpoints in large codebases

offensive-sqli · Bug bounty exploitation of SQL injection on login and export endpoints

sast-ssrf · Finding SSRF that reaches internal microservices, cloud metadata (169.254.169.254), or database servers

offensive-ssrf · AWS/GCP credential theft via IMDSv1 metadata endpoint and internal database access

check-before-commit · Pre-commit quality gates preventing style/error commits from reaching main

sast-ssti · Finding SSTI in microtemplate rendering (Jinja2, ERB, Handlebars) on dynamic pages

offensive-ssti · RCE via template injection on Jinja2, ERB, and Handlebars endpoints

project-structure-viewer · Quick understanding of unfamiliar codebase layout without reading all files

niri · Rapid keyboard-driven workflow setup for developers using Linux Wayland

sast-xss · Use for specialized sast-xss scenarios where standard approaches are insufficient.

arbitrum-dapp-skill · Opinionated guide for building dApps on Arbitrum using Stylus (Rust) and/or Solidity

gnome · Use for specialized gnome scenarios where standard approaches are insufficient.

sast-xxe · Use for specialized sast-xxe scenarios where standard approaches are insufficient.

cross-review · Run a cross-review using the opposite CLI reviewer for proposal review and change assessment

gh-cli · GitHub CLI (gh) comprehensive reference for repositories, issues, pull requests, Actions, projects, releases, gists, codespaces,...

offensive-bluetooth-ble · Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade...

predicate-snapshot · ML-powered DOM pruning for 95% smaller browser prompts

offensive-bluetooth-classic · Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks,...

offensive-deauth-disassoc · Deauthentication and disassociation attacks against 802

laravel-best-practices · Laravel best practices and architecture patterns for building production-ready applications

offensive-evil-twin · Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana...