HACK.SKILLS
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
- 2,586 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Offensive methods can cause harm without the system owner's permission
- Requires strictly authorized use and legal responsibility
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/hack-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Offensive methods can cause harm without the system owner's permission
- Requires strictly authorized use and legal responsibility
This is third-party code. Review the repository files before installing.
What it does
The set organizes offensive-security knowledge into installable, searchable and composable skills for authorized testing, bug bounty and CTF. The structure is three-tier: a master entry, six category routers and 102 deep topic skills across 14 domains, from web and API to privilege escalation, Active Directory attacks, mobile security, binary exploitation, reverse engineering, crypto attacks, smart contracts and LLM security. The material is a distillation of public sources into compact, auditable methods, without directly copying large dictionaries or full payload lists. Loading is on demand: from the master entry to a category and then to a specific technique.
Who it is for. For security specialists, penetration testers and CTF players working within authorized engagements.
Good fit when
- You run an authorized pentest or bug bounty and need a route through methods
- You prepare for a CTF in web, pwn, crypto or reverse
- You need a structured attack checklist for API or Active Directory
Not a fit when
- You have no written authorization to test the target system
- You need defense and hardening rather than offensive methods
Example request
Draft an authorization testing order for this API within an approved pentestLimitations
The material is strictly for authorized testing and education; use without the system owner's permission is not acceptable. The skills give methods and routes, not ready exploits for a specific target, and do not replace a specialist's skill.
How to disable. Remove the hack skill folders from your agent's skills directory.
FAQ
What is this set for?
For authorized penetration testing, bug bounty, CTF and educational study of security methodology.
Are there ready dictionaries and payloads?
No, the authors deliberately avoid copying large dictionaries and full lists, offering distilled methods and tables instead.
Discussion
No questions or reviews yet.
Related
SkillsA security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST
CTF Skills
ctf-skills
Skills for solving CTF challenges: web, pwn, crypto, reverse engineering, forensics, OSINT, malware and ML attacks
A pack of CTF skills: one entry point classifies a challenge and routes it to a focused skill for crypto, forensics, pwn, reverse and OSINT
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
README in short
The README describes an Agent Skills knowledge base for practical security, built for bug bounty, pentest, CTF and authorized research. One master entry, six categories and 102 deep skills across 14 domains, with a loading priority from general to specific. The material is distilled from public sources into compact, auditable methods without copying dictionaries directly. The repository is available as source, a web catalog and an offline archive. MIT licensed.
README badge
Original SKILL.md
--- name: api-sec description: >- Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill. --- # API Security Router This is the routing entry point for API security testing. Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.