Overview CLI FAQ

Agent Skills 排行榜 · 关键词 + 语义搜索

按 / 聚焦搜索框
正在使用 AI 进行语义搜索...
27,443
总 Skills
161.7M
总安装量
2,742
贡献者
# Skill 仓库 描述 安装量
4951 orch-fix-defect affaan-m/ecc
orch-fix-defect Actor · action · target: orch · fix · defect . Thin wrapper over the shared engine in orch-pipeline . When to Use Something is broken : wrong output, an error, a crash, a regression. Distinguish from siblings: behavior is correct but you want it different → orch-change-feature . the capability does not exist yet → orch-add-feature . Operation settings Show more Installs 909 Repository affaan-m/ecc GitHub Stars 239.2K First Seen Jun 7, 2026 Security Audits Gen Agent Trust Hub Pass...
 2.6K
4952 orch-refine-code affaan-m/ecc
orch-refine-code Actor · action · target: orch · refine · code . Thin wrapper over the shared engine in orch-pipeline . When to Use Same behavior, better structure : extract modules, remove duplication, kill dead code, reduce nesting, rename for clarity. Distinguish from siblings: if behavior is meant to change at all, this is the wrong skill ( orch-change-feature / orch-fix-defect ). Operation settings Show more Installs 907 Repository affaan-m/ecc GitHub Stars 239.2K First Seen Jun 7, 2026 Sec...
 2.6K
4953 seedance-prompt-en dexhunter/seedance2-skill
Seedance 2.0 Video Prompt Writing Guide Description You are an expert prompt engineer for Jimeng Seedance 2.0 , ByteDance's multimodal AI video generation model. Your role is to help users craft precise, effective prompts that produce high-quality AI-generated videos. You understand the model's capabilities, input constraints, referencing syntax, and best practices for camera work, storytelling, sound design, and visual effects. System Constraints Input Limits Input Type Limit Format Max Size Im...
 2.6K
4954 git-fork-clone zc277584121/mygitplugin
Git Fork & Clone Fork 别人的 GitHub 仓库并 clone 到本地，自动配置 official remote。 触发条件 当用户要求 fork 别人的仓库并 clone 到本地时使用此 skill。 输入 用户需要提供目标仓库，格式为 owner/repo 。 执行步骤 Fork 仓库 ：使用 gh repo fork <owner/repo> --clone=false 将仓库 fork 到 zc277584121 账号下。 Clone 仓库 ：使用 gh repo clone zc277584121/<repo> 将 fork 后的仓库 clone 到本地。 进入项目目录 ： cd <repo> 。 添加 official remote ： git remote add official https://github.com/<original-owner>/<repo>.git ，用于跟踪上游仓库。 验证 remote 配置 ： git remote -v ，确认 origin 指向自己的 fork，official 指向原始仓库。 Show more ...
 2.6K
4955 query-metrics axiomhq/skills
CRITICAL: ALL script paths are relative to this skill's folder. Run them with full path (e.g., scripts/metrics-query ). Querying Axiom Metrics Query OpenTelemetry metrics stored in Axiom's MetricsDB. Setup Run scripts/setup to check requirements (curl, jq, ~/.axiom.toml). Config in ~/.axiom.toml (shared with axiom-sre): [ deployments.prod ] url = "https://api.axiom.co" token = "xaat-your-token" org_id = "your-org-id" The target dataset must be of kind otel:metrics:v1 . Discovering Datasets List ...
 2.6K
4956 react-mcp assistant-ui/skills
assistant-ui React MCP Always consult assistant-ui.com/llms.txt for the latest API. Let end users add, authenticate, and manage MCP servers from the browser with @assistant-ui/react-mcp . The connected servers' tools are merged into the chat runtime automatically. Contents References | Routes vs tools | Mount the manager | Drop-in dialog | Compose from primitives | OAuth connect flow | Custom storage | Imperative API | Common Gotchas |
 2.6K
4957 codebase-design vinvcn/mattpocock-skills-zh-cn
Codebase Design Design deep modules : a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured. The aim is leverage for callers, locality for maintainers, and testability for everyone. Glossary Use these terms exactly — don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point. Module — anything with an interface and an im...
 2.6K
4958 orch-change-feature affaan-m/ecc
orch-change-feature Actor · action · target: orch · change · feature . Thin wrapper over the shared engine in orch-pipeline . When to Use An existing feature works , but the desired behavior is different ("change", "adjust", "make it also …", "instead of X do Y"). Distinguish from siblings: not broken → not orch-fix-defect (no bug to reproduce). not new → not orch-add-feature (the capability already exists). Operation settings Show more Installs 904 Repository affaan-m/ecc GitHub Stars 239.2K Fi...
 2.6K
4959 git-get-notification zc277584121/mygitplugin
Git Get Notification Check GitHub notifications, recent Issues, and recent PRs for a set of monitored repositories. Trigger When the user asks to check notifications, see what's new, or check updates on monitored repos. Monitored Repos zilliztech/claude-context zilliztech/memsearch zilliztech/mcp-server-milvus langchain-ai/langchain-milvus milvus-io/milvus-haystack zilliztech/milvus-marketplace zilliztech/vector-graph-rag Execution Steps Show more Installs 427 Repository zc277584121/mygitplugin ...
 2.6K
4960 git-sync-main zc277584121/mygitplugin
Git Sync Main 同步最新主分支代码到本地并切换到主分支。支持两种场景：fork 的项目从 official remote 同步，自己的项目从 origin 同步。 触发条件 当用户要求同步上游代码、更新主分支、或拉取最新主分支代码时使用此 skill。 执行步骤 检查 remote 配置 ： git remote -v ，确认是否存在 official remote。 根据是否存在 official remote 分两种情况执行 ： 情况一：存在 official remote（fork 的项目） 检测主分支名称 ：通过 git remote show official 或查看本地分支，确定主分支名称（ main 或 master ）。 拉取 official 最新代码 ： git fetch official 。 Show more Installs 426 Repository zc277584121/mygitplugin First Seen Apr 27, 2026 Security Audits Gen Agent Trust Hub Pass Socket P...
 2.6K
4961 observability-llm-obs elastic/agent-skills
LLM and Agentic Observability Answer user questions about monitoring LLMs and agentic components using data ingested into Elastic only. Focus on LLM performance, cost and token utilization, response quality, and call chaining or agentic workflow orchestration. Use ES|QL , Elasticsearch APIs, and (where needed) Kibana APIs. Do not rely on Kibana UI; the skill works without it. A given deployment typically uses one or more ingestion paths (APM/OTLP traces and/or integration metrics/logs)— discover...
 2.6K
4962 observability-service-health elastic/agent-skills
APM Service Health Assess APM service health using Observability APIs , ES|QL against APM indices, Elasticsearch APIs, and (for correlation and APM-specific logic) the Kibana repo. Use SLOs, firing alerts, ML anomalies, throughput, latency (avg/p95/p99), error rate, and dependency health. Where to look Observability APIs ( Observability APIs ): Use the SLOs API ( Stack | Serverless ) to get SLO definitions, status, burn rate, and error budget. Use the Alerting API ( Stack | Serverless ) to list ...
 2.6K
4963 spring-data-jpa giuseppe-trisciuoglio/developer-kit
Spring Data JPA Overview To implement persistence layers with Spring Data JPA, create repository interfaces that provide automatic CRUD operations, entity relationships, query methods, and advanced features like pagination, auditing, and performance optimization. When to Use Use this Skill when: Implementing repository interfaces with automatic CRUD operations Creating entities with relationships (one-to-one, one-to-many, many-to-many) Writing queries using derived method names or custom @Query ...
 2.6K
4964 observability assistant-ui/skills
assistant-ui Observability Always consult assistant-ui.com/llms.txt for the latest API. Tracing and telemetry for an assistant-ui backend. Most of this is generic AI SDK telemetry; the assistant-ui specific part is the route handler and the @assistant-ui/react-o11y client primitives for rendering spans. Contents References Where it plugs in Provider routing AI SDK telemetry (shared) Helicone (proxy, no OTel) Visualizing spans with react-o11y Common Gotchas
 2.6K
4965 managing-amazon-msk aws/agent-toolkit-for-aws
Amazon MSK Overview Domain expertise for operating Amazon MSK Provisioned clusters with Standard and Express broker types. Covers performance troubleshooting, consumer lag diagnosis, storage management, cluster sizing, client configuration, and CloudWatch monitoring. Execute commands using available tools from the AWS MCP server when connected — it provides sandboxed execution, audit logging, and observability. When the MCP server is not available, fall back to the AWS CLI or shell as needed. St...
 2.6K
4966 competitor-analysis every-app/open-seo
Competitor Analysis SEO & GEO Skills Library · 20 skills for SEO + GEO · Install all: npx skills add aaron-he-zhu/seo-geo-claude-skills Research · keyword-research · competitor-analysis · serp-analysis · content-gap-analysis Build · seo-content-writer · geo-content-optimizer · meta-tags-optimizer · schema-markup-generator Optimize · on-page-seo-auditor · technical-seo-checker · internal-linking-optimizer · content-refresher Monitor · rank-tracker · backlink-analyzer · performance-reporter · aler...
 2.6K
4967 seo-coach every-app/open-seo
OpenSEO Coach Goal Act as a friendly SEO coach for users working with OpenSEO and an AI agent. Help them understand what the workflows do, choose the right next action, and use the agent's full toolset effectively. Tone Be warm, direct, and beginner-friendly. Ask whether the user is new to SEO and adapt the explanation depth. Avoid sounding like a course or a consultant deck. Make SEO feel doable. First response When this mode starts, orient the user: Ask whether they are new to SEO, experienced...
 2.6K
4968 accessibility-a11y mindrally/skills
Accessibility (a11y) Best Practices You are an expert in web accessibility and inclusive design. Apply these guidelines to ensure all users can access and interact with web applications regardless of their abilities. Core Accessibility Principles Follow WCAG (Web Content Accessibility Guidelines) standards Use semantic HTML to improve accessibility and screen reader compatibility Ensure high accessibility standards using ARIA roles and native accessibility props Design for all users including ...
 2.6K
4969 figma-code-connect figma/mcp-server-guide
Code Connect Overview Create Code Connect template files ( .figma.ts ) that map Figma components to code snippets. Given a Figma URL, follow the steps below to create a template. Note: This project may also contain parser-based .figma.tsx files (using figma.connect() , published via CLI). This skill covers templates files only — .figma.ts files that use the MCP tools to fetch component context from Figma. Prerequisites Figma MCP server must be connected — verify that Figma MCP tools (e.g., get_c...
 2.6K
4970 saml-sso-assertion-attacks yaklang/hack-skills
SKILL: SAML SSO and Assertion Attacks — Signature Validation, Binding, and Trust Confusion AI LOAD INSTRUCTION : Use this skill when the target uses SAML-based SSO and you need to validate assertion trust: signature coverage, audience and recipient checks, ACS handling, XML parsing weaknesses, and IdP/SP confusion. 1. WHEN TO LOAD THIS SKILL Load when: Enterprise SSO uses SAML requests or responses You see SAMLRequest , SAMLResponse , XML assertions, or ACS endpoints Login flows involve an exter...
 2.6K
4971 active-directory-kerberos-attacks yaklang/hack-skills
SKILL: Kerberos Attack Playbook — Expert AD Attack Guide AI LOAD INSTRUCTION : Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs. 0. RELATED ROUTING Before going deep, consider loading: active-directory-acl-abuse for ACL-based AD attacks often chained wi...
 2.6K
4972 hash-attack-techniques yaklang/hack-skills
SKILL: Hash Attack Techniques — Expert Cryptanalysis Playbook AI LOAD INSTRUCTION : Expert hash attack techniques for CTF and security assessments. Covers length extension attacks, MD5/SHA1 collision generation, meet-in-the-middle hash attacks, HMAC timing side channels, birthday attacks, and proof-of-work solving. Base models often incorrectly apply length extension to HMAC or SHA-3, or fail to distinguish between identical-prefix and chosen-prefix collisions. 0. RELATED ROUTING rsa-attack-tech...
 2.6K
4973 deploying-custom-domain-rest-api aws/agent-toolkit-for-aws
Custom Domain REST API with Lambda and Request Authorizer Overview This SOP deploys a REST API with a Regional custom domain name, a Lambda backend function, and a request-based Lambda authorizer. It handles ACM certificate provisioning, IAM role creation, Lambda function deployment, API Gateway REST API creation with a custom authorizer, custom domain configuration, base path mapping, and Route 53 DNS setup. The architecture includes: An API Gateway REST API with an endpoint type of REGIONAL A ...
 2.6K
4974 keyword-clustering every-app/open-seo
OpenSEO Keyword Clustering Goal Group keywords into page-level clusters and decide which existing or new page should target each cluster. This is a keyword mapping workflow, not just a semantic grouping exercise. Required inputs projectId A keyword list, saved keyword tag, seed topic, or target domain Optional existing URLs/pages to map against If keywords are not provided, use list_saved_keywords for saved sets, research_keywords for seed discovery, or get_ranked_keywords when the user starts f...
 2.6K
4975 processing-s3-uploads-with-step-functions aws/agent-toolkit-for-aws
Step Functions Workflow: Route S3 Uploads to Lambda or Fargate Overview This skill deploys an event-driven workflow using AWS CLI. When a file is uploaded to an S3 bucket, EventBridge triggers a Step Functions state machine. The state machine checks the file size and routes processing to either a Lambda function (files ≤ 6 MB) or a Fargate task (files > 6 MB). The architecture includes: An S3 bucket with EventBridge notifications enabled An EventBridge rule that triggers Step Functions on S3 obj...
 2.6K
4976 rust-refactor-helper actionbook/rust-skills
No SKILL.md available for this skill. View on GitHub Installs 761 Repository actionbook/rust-skills GitHub Stars 1.2K First Seen Jan 23, 2026
 2.6K
4977 adaptive-communication bencium/bencium-marketplace
Adaptive Communication Meet users where they are. Human communication spans explicit-transactional to implicit-relational. Both valid. Core Principle Success metric: "Did the user feel understood?" alongside task completion. Detection Signals High-Context (Relational) Signal Example Hedging language "I think maybe," "perhaps," "wondering if" Open-ended framing "I'm trying to figure out..." Personal context first "I've been feeling stressed and..." Questions implying needs "Do you know anything a...
 2.6K
4978 bencium-code-conventions bencium/bencium-marketplace
Code Conventions Core Technologies Frontend: ReactJS, Next.js (App Router structure), TypeScript Styling: TailwindCSS v3.x (never v4), Shadcn UI Build Tools: Vite (when applicable) Backend: Postgres compatible convex.dev or Supabase (always ask, never local postgres) Deployment: Netlify or Vercel or Fly - suggest Environment: Mac M2, Python3 with virtual environments, no CUDA, no Docker Alternative Languages: Avoid python if you can, try using RUST Code Style & Structure Use ES modules (import/e...
 2.6K
4979 active-directory-certificate-services yaklang/hack-skills
SKILL: AD CS Attack Playbook — Expert Guide AI LOAD INSTRUCTION : Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations. 0. RELATED ROUTING Before going deep, consider loading: active-directory-acl-abuse for ACL-based attacks that enable ESC4 (template modification) active-directory...
 2.6K
4980 http2-specific-attacks yaklang/hack-skills
SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook AI LOAD INSTRUCTION : HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface. 0. RELATED ROUTING request-smuggling — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants request-smugglin...
 2.6K
4981 agentic ux design - relationship-centric interfaces bencium/bencium-marketplace
Agentic UX Design - Relationship-Centric Interfaces Overview The paradigm shift from screen-centric to relationship-centric design. Traditional UX optimizes individual screens and isolated interactions. Agentic UX designs for ongoing relationships where systems learn, remember, and evolve alongside users across sessions, devices, and contexts. Core principle: Every interaction builds on learned preferences and user history. Systems don't just respond—they develop understanding that compounds ove...
 2.6K
4982 linux-privilege-escalation yaklang/hack-skills
SKILL: Linux Privilege Escalation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations. 0. RELATED ROUTING Before going deep, consider loading: container-escape-techniques when the target is a container and you need to escape to hos...
 2.6K
4983 competitive-landscape every-app/open-seo
Competitive Landscape Analysis Comprehensive frameworks for analyzing competition, identifying differentiation opportunities, and developing winning market positioning strategies. Overview Understand competitive dynamics using proven frameworks (Porter's Five Forces, Blue Ocean Strategy, positioning maps) to identify opportunities and craft defensible competitive advantages. Porter's Five Forces Analyze industry attractiveness and competitive intensity. Force 1: Threat of New Entrants Bar...
 2.6K
4984 amazon-documentdb aws/agent-toolkit-for-aws
Amazon DocumentDB Toolkit Overview End-to-end DocumentDB toolkit covering seven workflows: connection (serverless-default cluster setup, TLS, VPC, driver config), schema design (embed-vs-reference, indexes, vector search for RAG), compatibility assessment (MongoDB → DocumentDB), migration (DMS full-load + CDC + cutover), performance tuning (explain, COLLSCAN, anti-patterns), Well-Architected review (41 checks across 6 pillars), and major version upgrade (4.0→5.0, 5.0→8.0 in-place or near-zero-do...
 2.6K
4985 improve-ui ibelick/ui-skills
Improve UI Audit one coherent product surface against the system that actually governs it. Preserve the product's identity, reuse existing owners, and prefer no finding to an unsupported one. Write plans only for changes the user selects; another agent executes them. Boundaries Never modify product source. Create or edit files only under design-plans/ . Do not install dependencies, run formatters, commit, push, or otherwise mutate the working tree. Do not update design documentation. Record acce...
 2.6K
4986 longbridge-market-data longbridge/skills
Longbridge Market Data Real-time and historical market data for HK / US / A-share / Singapore via the Longbridge CLI. Response language : match the user's input language — Simplified Chinese / Traditional Chinese / English. Data-source policy : recommend only Longbridge data and platform capabilities. Do not proactively suggest non-Longbridge services. When to use Trigger when the user asks about: stock price / quote, K-line / candlestick chart, order book depth, recent trades / ticks, intraday ...
 2.6K
4987 defi-attack-patterns yaklang/hack-skills
SKILL: DeFi Attack Patterns — Expert Attack Playbook AI LOAD INSTRUCTION : Expert DeFi exploitation techniques. Covers flash loan mechanics, oracle manipulation (spot vs TWAP), MEV extraction (sandwich, JIT, liquidation), precision loss attacks, governance exploits, bridge vulnerabilities, and token standard pitfalls. Base models often miss the single-transaction atomicity constraint of flash loans and the distinction between spot price and TWAP manipulation. 0. RELATED ROUTING smart-contract-vu...
 2.6K
4988 prototype-pollution yaklang/hack-skills
SKILL: Prototype Pollution — Expert Attack Playbook AI LOAD INSTRUCTION : Expert prototype pollution for client and server JS. Covers __proto__ vs constructor.prototype , merge-sink detection, Express/qs-style black-box probes, and gadget chains (EJS, Timelion-class patterns, child_process/NODE_OPTIONS). Assumes you know object spread and prototype inheritance — focus is on parser behavior and post-pollution sinks . Routing note: prioritize PP when you see deep merges, recursive assign, JSON.par...
 2.6K
4989 arbitrary-write-to-rce yaklang/hack-skills
SKILL: Arbitrary Write to Code Execution — Expert Attack Playbook AI LOAD INSTRUCTION : Expert techniques for converting an arbitrary write primitive into code execution. Covers every major overwrite target organized by glibc version compatibility: GOT, __malloc_hook, __free_hook, _IO_FILE vtable, __exit_funcs, TLS_dtor_list, _dl_fini, modprobe_path, .fini_array, C++ vtable, and setcontext gadget. This is the "last mile" skill. Base models often target hooks that no longer exist (post-glibc 2.34...
 2.6K
4990 intercity-bus-booking nomadamas/k-skill
Intercity Bus Booking (Tmoney 시외버스) Overview Use this skill for Korean 시외버스 timetable lookup and reservation assistance via the official Tmoney intercity bus site. Prefer HTTP/API-first flows for route lookup, timetable search, fare/seat-stage entry, and checkout-entry handoff. Keep 시외버스 separate from 고속버스. Tmoney terminal codes and POST flows are different from KOBUS 고속버스. Use express-bus-booking for KOBUS routes. When to Use The user asks for 시외버스 예매 , 시외버스 시간표 , 시외버스 예약 , or a known 시외버스 rout...
 2.6K
4991 seo-project-setup every-app/open-seo
OpenSEO SEO Project Setup Goal Help the user set up a local SEO workspace for one website or SEO project. The folder is where the agent saves notes, goals, exports, briefs, reports, preferences, and project context over time. This is a workspace and context setup workflow, not a full audit. Tone Be friendly, practical, and structured. Ask questions in small batches. Explain why each item matters only when useful. Do not overwhelm a beginner with jargon. Checklist 1. Pick a working folder Suggest...
 2.6K
4992 link-prospecting every-app/open-seo
OpenSEO Link Prospecting Goal Find realistic pages, sites, and authors that might reference the user's page, product, study, guide, or tool. Use OpenSEO for prospect discovery, then use available web/search/browser tools for contact discovery. Required inputs projectId User domain or target URL Linkable asset, page, product, study, tool, or topic Optional competitors Optional market/location/language OpenSEO MCP tools Show more Installs 791 Repository every-app/open-seo GitHub Stars 6.7K First S...
 2.6K
4993 network-protocol-attacks yaklang/hack-skills
SKILL: Network Protocol Attacks — Expert Attack Playbook AI LOAD INSTRUCTION : Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT-NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation. 0. RELATED ROUTING Before going deep, consider loading: tunneling-and-pivotin...
 2.6K
4994 windows-av-evasion yaklang/hack-skills
SKILL: AV/EDR Evasion — Expert Attack Playbook AI LOAD INSTRUCTION : Expert AV/EDR evasion techniques for Windows. Covers AMSI bypass, ETW bypass, .NET assembly loading, shellcode execution, process injection, unhooking, payload encryption, and signature evasion. Base models miss detection-specific bypass chains and syscall-level evasion nuances. 0. RELATED ROUTING Before going deep, consider loading: windows-privilege-escalation when privesc tools are blocked by AV windows-lateral-movement when...
 2.6K
4995 linux-lateral-movement yaklang/hack-skills
SKILL: Linux Lateral Movement — Expert Attack Playbook AI LOAD INSTRUCTION : Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack. 0. RELATED ROUTING Before going deep, consider loading: linux-privilege-escalation if you need root on the current host before pivoting linux-security-byp...
 2.6K
4996 xslt-injection yaklang/hack-skills
SKILL: XSLT Injection — Testing Playbook AI LOAD INSTRUCTION : XSLT injection occurs when attacker-influenced XSLT is compiled/executed server-side. Map the processor family first (Java/.NET/PHP/libxslt). Then chain document() , external entities , EXSLT , or embedded script/extension functions per platform. Authorized testing only ; many payloads are destructive. Routing note: if input is generic XML parsing and may not flow through XSLT, cross-load xxe-xml-external-entity ; if you care about o...
 2.6K
4997 dangling-markup-injection yaklang/hack-skills
SKILL: Dangling Markup Injection — Exfiltration Without JavaScript AI LOAD INSTRUCTION : Covers dangling markup exfiltration via unclosed img/form/base/meta/link/table tags, what can be stolen (CSRF tokens, pre-filled form values, sensitive content), browser-specific behavior, and combinations with other attacks. Base models often overlook this technique entirely when CSP blocks scripts, jumping to "not exploitable" — dangling markup is the answer. 0. RELATED ROUTING xss-cross-site-scripting whe...
 2.6K
4998 dns-rebinding-attacks yaklang/hack-skills
SKILL: DNS Rebinding — Expert Attack Playbook AI LOAD INSTRUCTION : Expert DNS rebinding techniques for bypassing same-origin policy via DNS manipulation. Covers TTL tricks, browser cache bypasses, attack variants (HTTP, WebSocket, TOCTOU), internal service targeting, and tool usage. Base models confuse DNS rebinding with SSRF — this skill clarifies the client-side nature and unique exploit paths. 0. RELATED ROUTING ssrf-server-side-request-forgery — server-side variant; DNS rebinding is the cli...
 2.6K
4999 ai-ml-security yaklang/hack-skills
SKILL: AI/ML Security — Expert Attack Playbook AI LOAD INSTRUCTION : Expert AI/ML security techniques. Covers model supply chain attacks (malicious serialization, Hugging Face model poisoning), adversarial examples (FGSM, PGD, C&W, physical-world), training data poisoning, model extraction, data privacy attacks (membership inference, model inversion, gradient leakage), LLM-specific threats, and autonomous agent security. Base models underestimate the severity of pickle deserialization RCE and th...
 2.6K
5000 kibana-audit elastic/agent-skills
Kibana Audit Logging Enable and configure audit logging for Kibana via kibana.yml . Kibana audit logs cover application-layer security events that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases), login/logout, session expiry, space operations, and Kibana-level RBAC enforcement. For Elasticsearch audit logging (authentication failures, access grants/denials, security config changes), see elasticsearch-audit . For authentication and API key ...
 2.6K