Agent skills for Penetration Testers

83 agent skills are labelled for Penetration Testers work. They are listed by code score, out of 100.

All 83

exploiting-adcs-with-certipy mukul975/Anthropic-Cybersecurity-Skills
Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Sha…

Verified84B
cosmos-vulnerability-scanner trailofbits/skills
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWas…

Verified84B
conducting-api-security-testing mukul975/Anthropic-Cybersecurity-Skills
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The te…

Verified82B
assessing-vector-and-embedding-weaknesses mukul975/Anthropic-Cybersecurity-Skills
Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when…

Verified81B
auditing-foundry-smart-contract-security mukul975/Anthropic-Cybersecurity-Skills
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testin…

Verified81B
performing-binary-exploitation-analysis mukul975/Anthropic-Cybersecurity-Skills
Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use whe…

Verified81B
performing-vulnerability-scanning-with-nessus mukul975/Anthropic-Cybersecurity-Skills
Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patch…

Verified81B
performing-web-application-penetration-test mukul975/Anthropic-Cybersecurity-Skills
Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authoriza…

Verified80B
exploiting-ms17-010-eternalblue-vulnerability mukul975/Anthropic-Cybersecurity-Skills
Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metaspl…

79B
orchestrating-llm-attacks-with-pyrit mukul975/Anthropic-Cybersecurity-Skills
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and T…

79B
red-teaming-llms-with-garak mukul975/Anthropic-Cybersecurity-Skills
Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoint - Hugging Face models, OpenAI-compatible APIs, or Bedrock -…

79B
attacking-oauth-with-device-code-phishing mukul975/Anthropic-Cybersecurity-Skills
Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and piv…

78B
implementing-continuous-security-validation-with-bas mukul975/Anthropic-Cybersecurity-Skills
Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, S…

78B
ai-security alirezarezvani/claude-skills
Use when assessing an AI/ML system or LLM agent for prompt injection, jailbreaks, model inversion, data poisoning or tool abuse. Maps findings to MITRE ATLAS and scores robustness…

78B
red-team alirezarezvani/claude-skills
Use when planning or running an authorized red team engagement or attack path analysis. Plans the kill chain with engagement_planner.py: MITRE ATT&CK techniques, choke points, OPS…

78B
abusing-dpapi-for-credential-access mukul975/Anthropic-Cybersecurity-Skills
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome,…

77B
escaping-containers-to-host mukul975/Anthropic-Cybersecurity-Skills
Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security asse…

77B
exploiting-deeplink-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, an…

77B
mapping-attack-paths-with-bloodhound-ce mukul975/Anthropic-Cybersecurity-Skills
Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths usin…

77B
testing-for-system-prompt-leakage mukul975/Anthropic-Cybersecurity-Skills
Extracts LLM system prompts using direct requests, jailbreak/instruction-override framing, translation/encoding tricks, and few-shot replay, combining manual payloads with automat…

77B
penetration-testing-with-strix usestrix/strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond —…

76B
auditing-entra-id-with-aadinternals mukul975/Anthropic-Cybersecurity-Skills
Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testin…

75B
coercing-authentication-with-coercer-petitpotam mukul975/Anthropic-Cybersecurity-Skills
Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM…

75B
enumerating-cloud-with-cloudfox mukul975/Anthropic-Cybersecurity-Skills
Run CloudFox's read-only Describe/List/Get enumeration (all-checks, role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack paths and surface exploi…

75B
exploiting-nopac-cve-2021-42278-42287 mukul975/Anthropic-Cybersecurity-Skills
Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to…

75B
testing-oauth2-implementation-flaws mukul975/Anthropic-Cybersecurity-Skills
Tests OAuth 2.0 and OpenID Connect implementations for authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE b…

75B
post-exploiting-microsoft-graph-with-graphrunner mukul975/Anthropic-Cybersecurity-Skills
Runs GraphRunner, a PowerShell post-exploitation toolset built on the Microsoft Graph API, to perform tenant recon, establish persistence (OAuth app injection, inbox rules), escal…

74B
testing-api-for-mass-assignment-vulnerability mukul975/Anthropic-Cybersecurity-Skills
Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying writable endpoints, adding undocumented fields to request bodies (role, isAdmin, price, balance), an…

74B
security-bounty-hunter affaan-m/ECC
Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findin…

73B
security-research code-yeongyu/oh-my-openagent
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibr…

73B
ida-reverse zhaoxuya520/reverse-skill
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to an…

73B
conducting-pass-the-ticket-attack mukul975/Anthropic-Cybersecurity-Skills
Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonat…

73B
emulating-cloud-attacks-with-stratus-red-team mukul975/Anthropic-Cybersecurity-Skills
Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle…

73B
exploiting-aws-with-pacu mukul975/Anthropic-Cybersecurity-Skills
Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence…

73B
exploiting-vulnerabilities-with-metasploit-framework mukul975/Anthropic-Cybersecurity-Skills
Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, and post-exploitation modules) to validate that identified CVEs and vulnerabilities are actually exploitable,…

73B
performing-ai-driven-osint-correlation mukul975/Anthropic-Cybersecurity-Skills
Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot to correlate OSINT findings—usernames, emails, social profiles, domain records, breach databases, and dark-w…

73B
performing-kerberoasting-attack mukul975/Anthropic-Cybersecurity-Skills
Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, an…

73B
performing-kubernetes-penetration-testing mukul975/Anthropic-Cybersecurity-Skills
Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter,…

73B
performing-phishing-simulation-with-gophish mukul975/Anthropic-Cybersecurity-Skills
Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user group…

73B
relaying-ntlm-for-adcs-esc8 mukul975/Anthropic-Cybersecurity-Skills
Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollme…

73B
pentest-checklist davila7/claude-code-templates
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "fo…

73B
radare2 zhaoxuya520/reverse-skill
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import ins…

72B
conducting-mobile-app-penetration-test mukul975/Anthropic-Cybersecurity-Skills
Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data stora…

72B
executing-red-team-exercise mukul975/Anthropic-Cybersecurity-Skills
Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization's people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, Brute Ratel, M…

72B
exploiting-constrained-delegation-abuse mukul975/Anthropic-Cybersecurity-Skills
Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S…

72B
exploiting-prototype-pollution-in-javascript mukul975/Anthropic-Cybersecurity-Skills
Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applications to achieve XSS, RCE, or authentication bypass through pro…

72B
broken-authentication davila7/claude-code-templates
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evalu…

72B
offensive-wpa-enterprise SnailSploit/Claude-Red
WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks wit…

72B
security-audit cloudflare/security-audit-skill
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, s…

71B
attacking-entra-id-with-roadtools mukul975/Anthropic-Cybersecurity-Skills
Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx. Use for authorized red-team…

71B
building-c2-redirector-infrastructure mukul975/Anthropic-Cybersecurity-Skills
Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TL…

71B
conducting-internal-reconnaissance-with-bloodhound-ce mukul975/Anthropic-Cybersecurity-Skills
Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, s…

71B
continuous-llm-red-teaming-with-promptfoo mukul975/Anthropic-Cybersecurity-Skills
Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when…

71B
executing-red-team-engagement-planning mukul975/Anthropic-Cybersecurity-Skills
Build the foundational red team engagement plan - scope definition, Rules of Engagement (restrictions, communication plan, emergency stop procedures, legal authorization), MITRE A…

71B
exploiting-broken-function-level-authorization mukul975/Anthropic-Cybersecurity-Skills
Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them with regular-user credentials via HTTP metho…

71B
exploiting-insecure-data-storage-in-mobile mukul975/Anthropic-Cybersecurity-Skills
Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPr…

71B
exploiting-template-injection-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution. Use when p…

71B
operating-havoc-c2 mukul975/Anthropic-Cybersecurity-Skills
Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting op…

71B
performing-api-rate-limiting-bypass mukul975/Anthropic-Cybersecurity-Skills
Tests API rate limiting for bypass vulnerabilities using Python (requests/aiohttp) and Burp Suite Turbo Intruder to manipulate headers (e.g. X-Forwarded-For spoofing), IPs, HTTP m…

71B
performing-cloud-penetration-testing-with-pacu mukul975/Anthropic-Cybersecurity-Skills
Run authorized AWS penetration tests with Pacu, the open-source AWS exploitation framework, to enumerate IAM configuration, scan for privilege escalation paths, and test data acce…

71B
performing-mobile-app-certificate-pinning-bypass mukul975/Anthropic-Cybersecurity-Skills
Bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception during authorized security assessments. Covers OkHttp, TrustMan…

71B
testing-api-for-broken-object-level-authorization mukul975/Anthropic-Cybersecurity-Skills
Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric IDs, UUIDs, slu…

71B
idor-testing davila7/claude-code-templates
This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or…

71B
abusing-shadow-credentials-for-privesc mukul975/Anthropic-Cybersecurity-Skills
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticat…

70B
building-c2-infrastructure-with-sliver-framework mukul975/Anthropic-Cybersecurity-Skills
Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fr…

70B
conducting-network-penetration-test mukul975/Anthropic-Cybersecurity-Skills
Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identificat…

70B
conducting-spearphishing-simulation-campaign mukul975/Anthropic-Cybersecurity-Skills
Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standi…

70B
conducting-wireless-network-penetration-test mukul975/Anthropic-Cybersecurity-Skills
Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin a…

70B
exploiting-api-injection-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting payloads tailo…

70B
operating-sliver-c2 mukul975/Anthropic-Cybersecurity-Skills
Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversar…

70B
performing-ios-app-security-assessment mukul975/Anthropic-Cybersecurity-Skills
Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception…

70B
performing-open-source-intelligence-gathering mukul975/Anthropic-Cybersecurity-Skills
Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization…

70B
performing-ssrf-vulnerability-exploitation mukul975/Anthropic-Cybersecurity-Skills
Tests web application URL parameters for Server-Side Request Forgery by probing cloud metadata endpoints (AWS/GCP/Azure at 169.254.169.254), internal network services, and protoco…

70B
performing-vlan-hopping-attack mukul975/Anthropic-Cybersecurity-Skills
Simulates VLAN hopping attacks using switch spoofing and 802.1Q double tagging techniques in authorized lab environments to test VLAN segmentation effectiveness and switch port se…

70B
testing-android-intents-for-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent h…

70B
testing-mobile-api-authentication mukul975/Anthropic-Cybersecurity-Skills
Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation,…

70B
testing-websocket-api-security mukul975/Anthropic-Cybersecurity-Skills
Tests WebSocket API implementations for missing upgrade-handshake authentication, Cross-Site WebSocket Hijacking (CSWSH), message injection, insufficient input validation, message…

70B
api-fuzzing-bug-bounty davila7/claude-code-templates
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bou…

70B
red-team-tools davila7/claude-code-templates
This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate…

70B
sqlmap-database-pentesting davila7/claude-code-templates
This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and col…

70B
web-security-testing davila7/claude-code-templates
Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.

70B
burpsuite-project-parser trailofbits/skills
Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings…

70B
firebase-apk-scanner trailofbits/skills
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK fi…

70B

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.