HACK.SKILLS
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
Install
npx skills add yaklang/hack-skillsThe master entry is named hack; start there.
This is third-party code. Review the repository files before installing.
What it does
The set organizes offensive-security knowledge into installable, searchable and composable skills for authorized testing, bug bounty and CTF. The structure is three-tier: a master entry, six category routers and 102 deep topic skills across 14 domains, from web and API to privilege escalation, Active Directory attacks, mobile security, binary exploitation, reverse engineering, crypto attacks, smart contracts and LLM security. The material is a distillation of public sources into compact, auditable methods, without directly copying large dictionaries or full payload lists. Loading is on demand: from the master entry to a category and then to a specific technique.
Who it is for. For security specialists, penetration testers and CTF players working within authorized engagements.
Good fit when
- You run an authorized pentest or bug bounty and need a route through methods
- You prepare for a CTF in web, pwn, crypto or reverse
- You need a structured attack checklist for API or Active Directory
Not a fit when
- You have no written authorization to test the target system
- You need defense and hardening rather than offensive methods
Example request
Draft an authorization testing order for this API within an approved pentestLimitations
The material is strictly for authorized testing and education; use without the system owner's permission is not acceptable. The skills give methods and routes, not ready exploits for a specific target, and do not replace a specialist's skill.
How to disable. Remove the hack skill folders from your agent's skills directory.
Security check
- Offensive methods can cause harm without the system owner's permission
- Requires strictly authorized use and legal responsibility
README in short
The README describes an Agent Skills knowledge base for practical security, built for bug bounty, pentest, CTF and authorized research. One master entry, six categories and 102 deep skills across 14 domains, with a loading priority from general to specific. The material is distilled from public sources into compact, auditable methods without copying dictionaries directly. The repository is available as source, a web catalog and an offline archive. MIT licensed.
SKILL.md
--- name: api-sec description: >- Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill. --- # API Security Router This is the routing entry point for API security testing. Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.
FAQ
What is this set for?
For authorized penetration testing, bug bounty, CTF and educational study of security methodology.
Are there ready dictionaries and payloads?
No, the authors deliberately avoid copying large dictionaries and full lists, offering distilled methods and tables instead.
Related
NVIDIA's open stack for running OpenClaw, Hermes and LangChain Deep Agents in OpenShell sandboxes with network policy and managed inference
Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents
Trail of Bits skills
Trail of Bits Skills Marketplace
Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing
Nine skills that let an agent run Strix pentests, fix validated findings and add security scanning to CI