AI Agent Skills

HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Lin…

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability clas…

Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.

Use when reviewing code for bugs, security issues, performance problems, or adherence to best practices. Provides structured code review with severity levels and actiona…

Prove blind SSRF by injecting an out-of-band callback into URL params and forwarding headers, then watching for the hit. Use when testing for SSRF.

Generate complete, production-ready OpenAPI 3.x and Swagger 2.0 specifications from natural language descriptions, code, or partial specs. Use this skill whenever the us…

Cloud Container Attack Tool (CCAT) is a tool for testing security of container environments.

汽车/安卓/固件/代码安全测试工具集

Review Odoo code for correctness, security, performance, and version-specific standards (Odoo 16, 17, 18, or 19). Use when reviewing Odoo modules, diffs, or pull request…

Securify v2.0

A comprehensive collection of cheatsheets for reverse engineering, binary analysis, and assembly programming tools. This repository serves as a one-stop reference for se…

Replay captured requests with swapped identities and bumped object IDs to surface broken access control. Use when testing for IDOR or authz flaws.

Forge and re-sign captured JWTs to test signature validation - algorithm confusion (alg:none, RS256 to HS256), key injection, and secret cracking. Use when testing JWT o…

Commit to Git safely: runs tests, security-reviews the diff, strips secrets and dead code, and enforces clean messages. Use before any commit or push.

Performing security tests inside your CI