Claude Configs

The most comprehensive Claude Code guide: agentic workflows, hooks, skills, MCP servers, quizzes, and production-ready templates. 430K+ lines.

A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.

'Analyzes bootkit and advanced rootkit malware infecting the Master

Monitor Certificate Transparency logs using crt.sh and Certstream to

Extract and analyze Cobalt Strike beacon configuration from PE files

'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

Investigate compromised Docker containers by analyzing images, layers,

Parse and analyze email headers (Received chain, Return-Path, Message-ID)

'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,

Examine Linux system artifacts (auth logs, cron/systemd persistence,

'Analyzes malicious VBA macros embedded in Microsoft Office documents

'Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

'Analyzes encryption algorithms, key management, and file encryption

Generate domain permutations with dnstwist and check DNS resolution

'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,

'Auditing Google Cloud Platform IAM permissions to identify overly permissive

'Auditing Kubernetes cluster RBAC configurations to identify overly permissive

'Builds an automated malware submission and analysis pipeline that collects

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates

Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains,

Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting

'Builds a structured vulnerability scanning workflow using tools like

'This skill outlines methodologies for performing authorized penetration

Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile.

Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK

Configure AWS Verified Access to provide VPN-less zero trust network

'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce

'Designs and implements VLAN-based (802.1Q) network segmentation on

'Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels,

'Installs, configures, and tunes Snort 3 to monitor network traffic

'Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets,

'Configures Microsoft Defender for Endpoint (MDE) advanced protection