The library

offensive-parameter-pollution · Bypassing security controls when backend and frontend parse parameters differently

uk-grocery-cli · Automating recurring grocery orders across multiple UK chains with price comparison before checkout

sast-pathtraversal · Large codebases needing path traversal scanned in parallel without overwhelming context

offensive-race-condition · Bug bounty race condition testing on registration, payments, and single-use tokens

commit · Rapid multi-file commits with auto-generated messages matching repo conventions

sast-rce · Finding command injection and eval-like RCE across large codebases in parallel

discord-channel-memory · Maintaining agent memory across 3+ Discord channels without loading full history at session start

sast-report · Executive-facing security report consolidating 10+ vulnerability types into one prioritized list

offensive-request-smuggling · Bug bounty request smuggling on multi-tier proxies and load balancers (Nginx, HAProxy, AWS ALB)

cm-dockit · One-shot knowledge base generation from source code without writing separate documentation

sast-sqli · Finding SQLi across authentication and bulk data endpoints in large codebases

offensive-sqli · Bug bounty exploitation of SQL injection on login and export endpoints

cm-browse · Quick content extraction and link discovery from any web page

sast-ssrf · Finding SSRF that reaches internal microservices, cloud metadata (169.254.169.254), or database servers

offensive-ssrf · AWS/GCP credential theft via IMDSv1 metadata endpoint and internal database access

check-before-commit · Pre-commit quality gates preventing style/error commits from reaching main

diagram · Generating architecture diagrams, flowcharts, and sequence diagrams from code or text

sast-ssti · Finding SSTI in microtemplate rendering (Jinja2, ERB, Handlebars) on dynamic pages

offensive-ssti · RCE via template injection on Jinja2, ERB, and Handlebars endpoints

project-structure-viewer · Quick understanding of unfamiliar codebase layout without reading all files

niri · Rapid keyboard-driven workflow setup for developers using Linux Wayland

sast-xss · Use for specialized sast-xss scenarios where standard approaches are insufficient.

arbitrum-dapp-skill · Opinionated guide for building dApps on Arbitrum using Stylus (Rust) and/or Solidity

gnome · Use for specialized gnome scenarios where standard approaches are insufficient.

sast-xxe · Use for specialized sast-xxe scenarios where standard approaches are insufficient.

cross-review · Run a cross-review using the opposite CLI reviewer for proposal review and change assessment

media · Media Management (\*arr Stack) Skill

gh-cli · GitHub CLI (gh) comprehensive reference for repositories, issues, pull requests, Actions, projects, releases, gists, codespaces,...

offensive-bluetooth-ble · Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade...

predicate-snapshot · ML-powered DOM pruning for 95% smaller browser prompts

etf-news · Fetch and tag news articles by Indian ETF category with sentiment scores

offensive-bluetooth-classic · Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks,...

generating-stem-flashcards · Generates atomic flashcards from technical/STEM source material

offensive-deauth-disassoc · Deauthentication and disassociation attacks against 802

laravel-best-practices · Laravel best practices and architecture patterns for building production-ready applications

offensive-evil-twin · Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana...

github · GitHub & Git Integration Skill

offensive-krack-fragattacks · KRACK (CVE-2017-13077

wx-backup-decrypt · Decrypt and extract WeChat backup database (

offensive-lorawan-sub-ghz · LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join...

llm-wiki · SOP for agent-maintained personal knowledge base: ingest, query, lint, graph, update, and delete knowledge assets

stylix · NixOS declarative system theming where all apps must inherit a consistent color palette from a single wallpaper or scheme.

offensive-wifi-recon · Initial wireless engagement phase to build target topology before active attacks (deauth, evil-twin, handshake capture).

trent-openclaw-security · Post-deployment security audit of OpenClaw agents to catch configuration drift and multi-setting attack chains before production.

agenix · Declarative secret management for NixOS infrastructure where secrets must be versioned and reproduced identically across hosts.

offensive-wifi · Red-team wireless assessments where authorized testing of WPA/WPA2/WPA3 PSK, EAP, or WPS security is needed.

offensive-wpa-enterprise · Corporate Wi-Fi engagements where 802.1X authentication is used and client cert validation is lax (BYOD, unmanaged devices).

autoloop · Service/ops issues on GitHub that can be auto-fixed (config updates, restart cycles, cleanup) with delayed human verification.

kiro-skill · Feature development where spec-first methodology improves clarity and reduces implementation rework.

offensive-wpa2-psk · WPA2-PSK (pre-shared key) network cracking where offline dictionary attack is faster than online brute-force.