Overview CLI FAQ

Agent Skills 排行榜 · 关键词 + 语义搜索

按 / 聚焦搜索框
正在使用 AI 进行语义搜索...
29,248
总 Skills
223.7M
总安装量
2,809
贡献者
# Skill 仓库 描述 安装量
5451 vueuse-functions vueuse/skills
VueUse Functions This skill is a decision-and-implementation guide for VueUse composables in Vue.js / Nuxt projects. It maps requirements to the most suitable VueUse function, applies the correct usage pattern, and prefers composable-based solutions over bespoke code to keep implementations concise, maintainable, and performant. When to Apply Apply this skill whenever assisting user development work in Vue.js / Nuxt. Always check first whether a VueUse function can implement the requirement. Pre...
 3.4K
5452 g2b-order-plan-search nomadamas/k-skill
g2b-order-plan-search Get the full instructions (required first step) Run this and follow its output as the primary instructions for this skill: npx -y @nomadamas/k-skill@0 instruct g2b-order-plan-search The CLI detects the current runtime (Dolshoi vault/CloakBrowser vs generic) and prints only the applicable instructions, always up to date. Helper files bundled with the CLI are listed by: npx -y @nomadamas/k-skill@0 files g2b-order-plan-search If npx is unavailable, install Node.js 18+ or follo...
 3.4K
5453 saju-fortune nomadamas/k-skill
saju-fortune Get the full instructions (required first step) Run this and follow its output as the primary instructions for this skill: npx -y @nomadamas/k-skill@0 instruct saju-fortune The CLI detects the current runtime (Dolshoi vault/CloakBrowser vs generic) and prints only the applicable instructions, always up to date. Helper files bundled with the CLI are listed by: npx -y @nomadamas/k-skill@0 files saju-fortune If npx is unavailable, install Node.js 18+ or follow https://github.com/NomaDa...
 3.4K
5454 format-string-exploitation yaklang/hack-skills
SKILL: Format String Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after for...
 3.4K
5455 xxe-xml-external-entity yaklang/hack-skills
SKILL: XML External Entity Injection (XXE) — Expert Attack Playbook AI LOAD INSTRUCTION : Expert XXE techniques. Covers all injection contexts (SOAP, REST JSON→XML parsers, Office files, SVG), OOB exfiltration (critical when direct read fails), blind XXE detection, and XXE-to-SSRF chain. Base models often miss OOB and non-XML context XXE. For real-world CVE chains, Office docx XXE step-by-step, PHP expect:// RCE, and Solr XXE+RCE, load the companion SCENARIOS.md . 0. RELATED ROUTING Also load: u...
 3.4K
5456 file-access-vuln yaklang/hack-skills
File Access Router 这是文件系统、下载接口、上传链路与文件预览处理的分类入口。 When to Use 参数、文件名、下载接口或导入流程会影响文件路径 目标支持上传、预览、转码、解压、分享、下载或代理文件访问 你需要判断当前更偏向路径穿越、LFI，还是上传验证与处理链问题 Skill Map Path Traversal LFI : 路径穿越、文件读取、wrapper、包含链 Upload Insecure Files : 上传校验、存储路径、处理链、覆盖、预览与分享边界 Recommended Flow 先看入口是路径参数、下载接口还是上传流程 再看问题出现在 accept、store、process、serve 哪一段 小样本路径链和上传绕过样本已经并入主专题 skill，不再单独走 payload 入口 Related Categories injection-checking business-logic-vuln
 3.4K
5457 ssti-server-side-template-injection yaklang/hack-skills
SKILL: Server-Side Template Injection (SSTI) — Expert Attack Playbook AI LOAD INSTRUCTION : Expert SSTI techniques. Covers polyglot detection probes, engine fingerprinting, Jinja2/FreeMarker/Twig/ERB RCE chains, client-side Angular SSTI, and bypass techniques. Base models often miss sandbox escape MRO chains and non-Jinja2 engines. For PHP CMS template eval, Jira SSTI, Confluence OGNL, and Spring Cloud Gateway SpEL, load the companion SCENARIOS.md . 0. RELATED ROUTING Before using full engine-sp...
 3.4K
5458 kernel-exploitation yaklang/hack-skills
SKILL: Linux Kernel Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI. 0. RELATED ROUTING binary-protection-bypass —...
 3.4K
5459 http-parameter-pollution yaklang/hack-skills
SKILL: HTTP Parameter Pollution (HPP) AI LOAD INSTRUCTION : Model the full request path : browser → CDN/WAF → reverse proxy → app framework → business code. Duplicate keys ( a=1&a=2 ) are not an error at HTTP level; each hop may pick first, last, join, or array-ify. Test HPP when WAF and app disagree, or when internal HTTP clients rebuild query strings. Routing note: when the same parameter appears multiple times, or WAF/backend stacks differ, use the Section 1 matrix to test first/last/merge as...
 3.4K
5460 your-skill-name grafana/skills
Your Skill Title Overview Brief introduction to what this skill covers. Focus on Grafana-specific knowledge — don't explain general programming concepts the AI already knows well. Key Concepts Document the important concepts, patterns, or syntax. Code examples are more effective than prose. Example rate ( http_requests_total [ 5m ] ) Common Patterns Describe the most frequently needed patterns or configurations. Show more
 3.4K
5461 appllama-usage appllama/appllama-skills
Appllama Usage Skill Appllama is the design library of top-grossing mobile apps — their real screens, flows, and UI patterns, with revenue and download context. The MCP puts that library in an agent's hands: not just a research tool, a builder's tool. You study what already wins, then you build something better. Pair this skill with appllama-app-design-skill for every design/implementation step — this skill tells you what to study; that one tells you how to build. Ground rules (read first) Show ...
 3.4K
5462 course-guide rohitg00/ai-engineering-from-scratch
Course Guide You are the wayfinding layer over the AI Engineering from Scratch curriculum: 503 lessons, 20 phases. The learner tells you what they want to understand, build, or fix; you tell them exactly where in the course that lives and which command to run next. Works with any agent. Routing table The curriculum's single source of truth is the Contents section of the repo README: every phase has a table listing each lesson's number, title, type (Build/Learn), language, and directory path. Rea...
 3.4K
5463 saramin-talent-search nomadamas/k-skill
saramin-talent-search 사람인 인재풀에서 유료 열람/연락처 확인/제안 발송 전에 현재 보이는 마스킹 후보 정보를 비교해 “열람할 만한 후보”를 추천한다. 개발자 전용이 아니며 모든 직무에 role-adaptive하게 적용한다. Use when 사용자가 사람인 인재풀에서 후보를 찾아달라고 요청한다. 기업회원 로그인/2차 인증이 완료된 브라우저 세션에서 후보를 검색해야 한다. 유료 열람 전 shortlist, 점수, 근거, 리스크, 후보 URL이 필요하다. Hard boundaries Allowed: 사람인 인재풀 브라우저 세션 열기 및 검색 필터 입력 현재 보이는 마스킹 후보 목록/프로필/이력서 읽기 후보 분석, 점수화, shortlist 작성, 유료 열람 추천 Show more Installs 837 Repository nomadamas/k-skill GitHub Stars 6.6K First Seen Jun 21, 2026 Security Audits Gen Age...
 3.4K
5464 job-posting-match nomadamas/k-skill
job-posting-match Get the full instructions (required first step) Run this and follow its output as the primary instructions for this skill: npx -y @nomadamas/k-skill@0 instruct job-posting-match The CLI detects the current runtime (Dolshoi vault/CloakBrowser vs generic) and prints only the applicable instructions, always up to date. Helper files bundled with the CLI are listed by: npx -y @nomadamas/k-skill@0 files job-posting-match If npx is unavailable, install Node.js 18+ or follow https://gi...
 3.4K
5465 typescript-best-practices alleneubank/claude-code
TypeScript best practices Apply the type-system-discipline principle skill first; this skill grounds it in TypeScript syntax. Show more Installs 3.4K Repository cursor/plugins GitHub Stars 6.9K First Seen May 24, 2026 Security Audits Gen Agent Trust Hub Pass Socket Pass Snyk Pass
 3.4K
5466 ce-debug everyinc/compound-engineering-plugin
Debug and Fix Find root causes, then fix them. This skill investigates bugs systematically — tracing the full causal chain before proposing a fix — and optionally implements the fix with test-first discipline. <bug_description> $ARGUMENTS </bug_description> Core Principles Investigate before fixing. Do not propose a fix until you can explain the full causal chain from trigger to symptom with no gaps. "Somehow X leads to Y" is a gap. Predictions for uncertain links. When the causal chain has unce...
 3.4K
5467 c-review trailofbits/skills
C/C++ Security Review Runs in the main conversation (invoke via /c-review:c-review ). Orchestrator owns the Task* ledger as bookkeeping for retries; workers and judges have no Task tools. Workers and judges are named plugin subagents ( c-review:c-review-worker , c-review:c-review-dedup-judge , c-review:c-review-fp-judge ); tool sets are declared in plugins/c-review/agents/*.md . Findings are exchanged via markdown-with-YAML files in a shared output directory. When to Use Native C/C++ application...
 3.4K
5468 chakra-ui-builder chakra-ui/chakra-ui
Chakra UI Builder You are building UI with Chakra UI v3 and helping developers set up Chakra UI in their projects. Your job is to produce clean, accessible, responsive code that fits the project — not generic boilerplate. Read the project context first, then build or set up. Step 1 — Read the project context Check package.json if available. Look for: Chakra UI version (use v3 patterns by default; only use v2 if explicitly on v2) Framework: Next.js App Router, Pages Router, Vite, plain React Type...
 3.4K
5469 arc-region-switch aws/agent-toolkit-for-aws
ARC Region switch Expert Overview Makes the agent an expert on Amazon Application Recovery Controller (ARC) Region switch — the feature for orchestrating cross-Region workload failover and switchover. Supports technical questions, customer positioning, and SA engagement preparation. Region switch orchestrates recovery for applications already deployed multi-Region. It does not create multi-Region architecture or handle data replication — it orchestrates failover of existing replicas and resource...
 3.4K
5470 deserialization-insecure yaklang/hack-skills
SKILL: Insecure Deserialization — Expert Attack Playbook AI LOAD INSTRUCTION : Expert deserialization techniques across Java, PHP, and Python. Covers gadget chain selection, traffic fingerprinting, tool usage (ysoserial, PHPGGC), Shiro/WebLogic/Commons Collections specifics, Phar deserialization, and Python pickle abuse. Base models often miss the distinction between finding the sink and finding a usable gadget chain. 0. RELATED ROUTING jndi-injection when deserialization leads to JNDI lookup (e...
 3.4K
5471 request-smuggling yaklang/hack-skills
SKILL: HTTP Request Smuggling — Expert Attack Playbook AI LOAD INSTRUCTION : Expert HTTP desync techniques. Covers CL.TE, TE.CL, TE.TE obfuscation variants, HTTP/2 downgrade and pseudo-header confusion, client-side desync (browser fetch pipelines), and tool-assisted fuzzing. Assumes familiarity with raw HTTP/1.1 framing and reverse-proxy topologies. This is not “header injection” — it is message boundary disagreement between hops. Routing note: load this skill when you suspect CDN/reverse-proxy ...
 3.4K
5472 position-sizer tradermonty/claude-trading-skills
Position Sizer Overview Calculate the optimal number of shares to buy for a long stock trade based on risk management principles. Supports three sizing methods: Fixed Fractional : Risk a fixed percentage of account equity per trade (default: 1%) ATR-Based : Use Average True Range to set volatility-adjusted stop distances Kelly Criterion : Calculate mathematically optimal risk allocation from historical win/loss statistics All methods apply portfolio constraints (max position %, max sector %) and...
 3.4K
5473 phaser-arcade-physics gamedev-skills/awesome-gamedev-agent-skills
Phaser 4 Arcade Physics Add movement and collision to a Phaser game with the lightweight Arcade Physics engine (AABB rectangles and circles only). Targets Phaser 4.2 for new projects; inspect the installed major before editing an existing project. When to use Use for top-down or platformer movement, velocity/acceleration/gravity, bouncing, world bounds, and collision/overlap resolution between sprites, groups, and tiles. Use when the scene enables physics: { default: 'arcade' } and code calls th...
 3.4K
5474 unity-build-pipeline gamedev-skills/awesome-gamedev-agent-skills
Unity Build Pipeline Configure, script, and automate Unity 6.3 LTS player builds: scenes, platform target, scripting backend, stripping, and headless/CI builds. Targets Unity 6.3 LTS (6000.3) . When to use Use when setting up Build Settings/Profiles, choosing a platform and scripting backend (Mono vs IL2CPP), reducing build size with managed stripping, scripting a repeatable build with BuildPipeline.BuildPlayer , or wiring a CI/headless build. Use when the project has ProjectSettings/EditorBuild...
 3.4K
5475 autoresearch github/awesome-copilot
Autoresearch: Autonomous Iterative Experimentation An autonomous experimentation loop for any programming task. You define the goal and how to measure it; the agent iterates autonomously -- modifying code, running experiments, measuring results, and keeping or discarding changes -- until interrupted. This skill is inspired by Karpathy's autoresearch , generalized from ML training to any programming task with a measurable outcome . Agent Behavior Rules DO guide the user through the Setup phase in...
 3.4K
5476 browser-exploitation-v8 yaklang/hack-skills
SKILL: Browser / V8 Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression ba...
 3.4K
5477 race-condition yaklang/hack-skills
SKILL: Race Conditions — Testing & Exploitation Playbook AI LOAD INSTRUCTION : Treat race conditions as authorization/state integrity issues: non-atomic read-then-write lets multiple requests observe stale state. Prioritize one-time or balance-like operations. Combine parallel transport (HTTP/1.1 last-byte sync, HTTP/2 single-packet, Turbo Intruder gates) with application evidence (duplicate success responses, inconsistent balances, duplicate ledger rows). Authorized testing only. Routing note: ...
 3.4K
5478 csp-bypass-advanced yaklang/hack-skills
SKILL: CSP Bypass — Advanced Techniques AI LOAD INSTRUCTION : Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest unsafe-inline bypass without checking if the CSP actually uses it, or miss the critical base-uri and object-src gaps. 0. RELATED ROUTING xss-cross-site-scripting for XSS vectors to deliver after CSP bypass dangling-markup-injection when CSP blocks scripts but HTML...
 3.4K
5479 animate delphi-ai/animate-skill
Building Animations Initial Response When this skill is first invoked without a specific question, respond only with: I'm ready to build animations that feel right, my knowledge comes from Emil Kowalski's animation philosophy. Do not provide any other information until the user asks a question. A construction skill. It does ONE thing: turn a request for motion into an implementation that would survive a strict review. It does not audit a codebase (that's improve-animations ), critique a diff (th...
 3.4K
5480 understand-chat egonex-ai/understand-anything
/understand-chat Answer questions about this codebase using the knowledge graph in the project's data directory ( .ua/knowledge-graph.json , or the legacy .understand-anything/knowledge-graph.json when that directory is present). Graph Structure Reference The knowledge graph JSON has this structure: project — {name, description, languages, frameworks, analyzedAt, gitCommitHash} nodes[] — each has {id, type, name, filePath?, summary, tags[], complexity, languageNotes?} Code node types: file, func...
 3.4K
5481 spec-impl klerith/fernando-skills
Contains Shell Commands This skill contains shell command directives ( !`command` ) that may execute system commands. Review carefully before installing. /spec-impl — Implementer of approved specs Session context Current repository state: ! git status --short Current branch: ! git branch --show-current Specs available in this folder: ! ls specs/ 2>/dev/null || echo "The specs/ folder does not exist" Branch-creation config: ! cat specs/.spec-config.yml 2>/dev/null || echo "AutoCreateBranch: true ...
 3.4K
5482 threejs-materials-lighting gamedev-skills/awesome-gamedev-agent-skills
three.js Materials & Lighting Make three.js surfaces look right: pick the correct material, light the scene, enable shadows, and add image-based lighting. Patterns target r184 , verified against r184 (lighting is physically based by default since r155). When to use Use when a mesh renders black or flat, when choosing a material, adding lights, enabling shadows, or setting up environment-map reflections (IBL). Use when code constructs MeshStandardMaterial , DirectionalLight , etc., or sets render...
 3.4K
5483 threejs-scene-setup gamedev-skills/awesome-gamedev-agent-skills
three.js Scene Setup Create the foundation of a three.js app: module loading, the scene/camera/renderer trio, the render loop, responsive resizing, and camera controls. Patterns target r184 . Read the installed three version before changing an existing project because examples and addons move across releases. When to use Use when bootstrapping a three.js scene, fixing a blank/black canvas, making the canvas responsive, setting up the animation loop, or adding OrbitControls . Use when package.jso...
 3.4K
5484 ima-dai-sdk google/skills
IMA DAI SDK Use the IMA DAI SDK to load HLS or DASH streams into the app for: Livestream events configured in Google Ad Manager. Video on demand (VOD) content ingested into Google Ad Manager. Prerequisites Review the platform-specific integration guides for the target platforms: Web/HTML5/ReactJs/NodeJs/Angular: Read StreamManager guide for loading stream URL from Google full-service DAI into <video> element. ChromeCast: Read StreamManager guide for integrating the IMA DAI SDK into a ChromeCast ...
 3.4K
5485 google-cloud-filestore-autoscale google/skills
Google Cloud Filestore Autoscale This skill enables agents to inspect, evaluate, and modify Google Cloud Filestore instance capacities across GCP projects based on configured thresholds. Quick Start Ensure gcloud is installed. See gcloud installation guide if needed. Enable essential APIs: gcloud services enable file.googleapis.com monitoring.googleapis.com --quiet Inspect fleet capacity and free space (see "Discovery & Read Operations" below). Evaluate against configured up/down capacity thresh...
 3.4K
5486 happyhorse skills-shell/superpowers
Install the belt CLI skill: npx skills add belt-sh/cli HappyHorse 1.0 Video Generation Generate and edit physically realistic videos with Alibaba's HappyHorse 1.0 models via inference.sh CLI. Quick Start Requires inference.sh CLI ( belt ). Install instructions belt login belt app run alibaba/happyhorse-1-0-t2v --input '{"prompt": "a horse galloping across a sunlit meadow"}' HappyHorse Models Show more Installs 2.6K Repository 101-skills/superpowers First Seen Aug 31, 2026 Security Audits Gen Age...
 3.4K
5487 seedance skills-shell/superpowers
Install the belt CLI skill: npx skills add belt-sh/cli Seedance 2.0 Video Generation Generate videos with synchronized audio using ByteDance's Seedance 2.0 via inference.sh CLI. Quick Start Requires inference.sh CLI ( belt ). Install instructions belt login belt app run bytedance/seedance-2-0 --input '{ "prompt": "a jazz band performing in a dimly lit club", "generate_audio": true }' Show more Installs 2.6K Repository 101-skills/superpowers First Seen Aug 31, 2026 Security Audits Gen Agent Trust...
 3.4K
5488 symbolic-execution-tools yaklang/hack-skills
SKILL: Symbolic Execution Tools — Expert Analysis Playbook AI LOAD INSTRUCTION : Expert symbolic execution techniques using angr, Z3, and Unicorn Engine. Covers CTF challenge automation, constraint solving patterns, function hooking, SimProcedure replacement, and emulation-based unpacking. Base models often produce broken angr scripts due to incorrect state initialization or missing hooks for libc functions. 0. RELATED ROUTING anti-debugging-techniques when anti-debug checks need to be symbolica...
 3.4K
5489 open-redirect yaklang/hack-skills
SKILL: Open Redirect — Expert Attack Playbook AI LOAD INSTRUCTION : Open redirect techniques. Covers parameter-based redirects, JavaScript sinks, filter bypass, and chaining with phishing, CSRF Referer bypass, OAuth token theft, and SSRF. Often underrated but critical for phishing and as a building block in multi-step exploit chains. 1. CORE CONCEPT Open redirect occurs when an application redirects users to a URL derived from user input without validation. The trusted domain acts as a "launchpa...
 3.4K
5490 mobile-ssl-pinning-bypass yaklang/hack-skills
SKILL: Mobile SSL Pinning Bypass — Expert Attack Playbook AI LOAD INSTRUCTION : Expert SSL pinning bypass techniques for mobile platforms. Covers Android and iOS bypass methods (Frida, Objection, Xposed, SSL Kill Switch), framework-specific bypasses (Flutter, React Native, Xamarin), and troubleshooting non-standard pinning implementations. Base models miss framework-specific hook points and multi-layer pinning configurations. 0. RELATED ROUTING Before going deep, consider loading: android-pentes...
 3.4K
5491 memory-md-management giuseppe-trisciuoglio/developer-kit
Memory.md Management Provides comprehensive project memory file management capabilities including auditing, quality assessment, and targeted improvements. This skill ensures the coding agent has optimal project context by maintaining high-quality documentation files such as CLAUDE.md . Overview Project memory files such as CLAUDE.md are the primary mechanism for providing project-specific context to coding agent sessions. This skill manages their complete lifecycle: discovery, quality assessment...
 3.4K
5492 canslim-screener tradermonty/claude-trading-skills
CANSLIM Stock Screener - Phase 3 (Full CANSLIM) Overview This skill screens US stocks using William O'Neil's proven CANSLIM methodology, a systematic approach for identifying growth stocks with strong fundamentals and price momentum. CANSLIM analyzes 7 key components: C urrent Earnings, A nnual Growth, N ewness/New Highs, S upply/Demand, L eadership/RS Rank, I nstitutional Sponsorship, and M arket Direction. Phase 3 implements all 7 of 7 components (C, A, N, S, L, I, M), representing 100% of the...
 3.4K
5493 roblox-datastores gamedev-skills/awesome-gamedev-agent-skills
Roblox DataStores Persist data across sessions in Roblox with DataStoreService : loading on join, saving on leave and shutdown, safe updates, retries, and ordered stores for leaderboards. Server-side only. When to use Use to save/load player progress (coins, inventory, levels), build persistent leaderboards, or fix data loss, overwrites, and throttling. Use when server code calls DataStoreService , GetDataStore , GetAsync , SetAsync , UpdateAsync , or GetOrderedDataStore . When not to use: gener...
 3.4K
5494 sentry openai/skills
Sentry (Read-only Observability) Quick start If not already authenticated, ask the user to provide a valid SENTRY_AUTH_TOKEN (read-only scopes such as project:read , event:read ) or to log in and create one before running commands. Set SENTRY_AUTH_TOKEN as an env var. Optional defaults: SENTRY_ORG , SENTRY_PROJECT , SENTRY_BASE_URL . Defaults: org/project {your-org} / {your-project} , time range 24h , environment prod , limit 20 (max 50). Always call the Sentry API (no heuristics, no caching). I...
 3.4K
5495 insecure-source-code-management yaklang/hack-skills
SKILL: Insecure Source Code Management AI LOAD INSTRUCTION : This skill covers detection and recovery of exposed version-control metadata, common backup artifacts, and related misconfigurations. Use only in authorized assessments. Treat recovered credentials and URLs as sensitive; do not exfiltrate real data beyond scope. For broad discovery workflow, cross-load recon-for-sec and recon-and-methodology when those skills exist in the workspace. 0. QUICK START High-value paths to probe first (GET o...
 3.4K
5496 crlf-injection yaklang/hack-skills
SKILL: CRLF Injection — Expert Attack Playbook AI LOAD INSTRUCTION : CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks. 1. CORE CONCEPT CRLF = \r\n (Carriage Return + Line Feed, %0D%0A ). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitizatio...
 3.4K
5497 web-cache-deception yaklang/hack-skills
SKILL: Web Cache Deception — Expert Attack Playbook AI LOAD INSTRUCTION : Web cache deception and poisoning techniques. Covers path confusion attacks, CDN cache behavior exploitation, cache key manipulation, and the distinction between cache deception (steal data) and cache poisoning (serve malicious content). Presented by Omer Gil at Black Hat 2017 and significantly expanded since. Advanced Reference Also load CACHE_POISONING_TECHNIQUES.md when you need: Web Cache Poisoning vs Web Cache Decepti...
 3.4K
5498 http-host-header-attacks yaklang/hack-skills
SKILL: HTTP Host Header Attacks — Injection & Routing Abuse AI LOAD INSTRUCTION : Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework-specific behaviors. Base models often miss the double-Host trick, absolute-URI override, and connection-state attacks. 0. RELATED ROUTING web-cache-deception when Host injection is combined with cache behavior ssrf-server-side-request-for...
 3.4K
5499 skill-authoring grafana/skills
Authoring & Improving Grafana Skills How to write, review, and improve SKILL.md files so they pass the repo's CI gate and score well against the Anthropic-aligned rubric Tessl uses. Critical rules (always) Description is the primary trigger — third-person, ≤1024 chars, must include explicit "Use when..." phrasing AND list concrete trigger terms users naturally say. See references/descriptions.md for the pushy-description pattern that combats undertriggering. Body under 500 lines — split into ref...
 3.4K
5500 prometheus-cardinality-troubleshooter grafana/skills
Prometheus Cardinality Troubleshooter You are an expert in diagnosing live Prometheus cardinality problems. When a user reports a Prometheus performance, memory, or cost issue that smells like cardinality, use this guide to triage systematically. This skill is diagnostic and operational . For schema design and prevention, route to prometheus-label-strategy . Before You Remediate: The One Rule Under pressure, the tempting move is to labeldrop the high-cardinality label at scrape time. Do not. You...
 3.4K