417 skills found · Page 5 of 14
SnailSploit / offensive-data-exfiltrationDense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS,…
MengTo / elevenlabs-ttsGenerate ElevenLabs text-to-speech audio from scripts or inline text using local voice profiles
gosom / google-maps-scraperFind businesses, leads, emails, reviews, ratings, and contact details from Google Maps. Use for requests such as "find dentists in Berlin", "scrape Google Maps", "get local business leads", or "collect Google Maps reviews".
browser-act / youtube-channel-business-emailYouTube channel business email and contact extractor: accepts a channel id (UCxxx), handle (@name), or URL; navigates the channel About view; extracts the business email from the description text plus full channel metadata (name, id, country, subscriber count, view count, video count, joined date, e…
browser-act / google-maps-contact-extractExtracts business contact details from Google Maps search results and place detail pages, then visits each business website to collect emails, phone numbers, and social media profiles (Facebook, Instagram, Twitter/X, LinkedIn, YouTube, TikTok, Pinterest, Discord)
browser-act / producthunt-launchesScrape Product Hunt daily/weekly/monthly/yearly leaderboard launches with full product details, maker profiles, and website contact info
browser-act / trustpilot-company-infoTrustpilot company profile lookup on trustpilot.com — input a company domain (e.g. apple.com, shopify.com, shopwagandtail.com) and extract company metadata: official display name, businessUnitId, TrustScore (1-5), star rating, total review count, last-12-months review count, primary category and all…
browser-act / youtube-influencer-finder-api-skillThis skill helps users extract YouTube influencer profiles including social links, subscriber counts, and channel stats via the BrowserAct API.
lemonade-sdk / lemonadeLemonade helps users discover and run local AI apps by serving optimized LLMs right from their own GPUs and NPUs. Join our discord: https://discord.gg/5xXzkMu8Zk
Klavis-AI / klavisKlavis AI: MCP integration platforms that let AI agents use tools reliably at any scale
dotnet / coordinate-componentsShare state between components that don't have a direct parent-child parameter relationship, using cascading values, scoped services with change events, or CascadingValueSource via DI.
irinabuht12-oss / content-repurposerTransform one long-form piece into multiple platform-specific content derivatives including LinkedIn posts, tweet threads, email snippets, ad hooks, and video scripts while maintaining voice consistency
irinabuht12-oss / competitor-teardownSystematic competitive analysis covering positioning, messaging hierarchy, objection handling, and CTA strategy from landing page URLs or screenshots
irinabuht12-oss / email-sequence-writerWrite complete nurture email sequences with subject lines, preview text, and body copy using proven copywriting formulas
irinabuht12-oss / icp-research-assistantBuild detailed B2B buyer personas with pain points, objections, buying triggers, and messaging angles
irinabuht12-oss / ad-copy-variant-generatorAnalyzes your top performing ads, identifies what's working in the hooks, CTAs, messaging angles, and formats, then generates new variants that follow the same winning patterns while introducing enough variation to test meaningfully. Platform: Google and Meta.
elementalsouls / bugcrowd-reportingBugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-…
elementalsouls / hunt-brute-forceHunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concur…
elementalsouls / hunt-host-headerHunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and abso…
elementalsouls / hunt-sessionHunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session l…
elementalsouls / hunt-tls-networkHunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records.
elementalsouls / okta-attackOkta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirect_uri tam…
elementalsouls / hunt-mfa-bypassHunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without r…
elementalsouls / hunt-sstiHunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side.
elementalsouls / hunt-forgot-passwordHunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email, (2) reset token exposed directly in the API response body, (3) reset token not invalidated after use (replay), (4) password reset link work…
aipoch / OpenAlexFind, verify, and synthesize scientific literature — from "what's the seminal paper for X" through full multi-source reviews. Covers grounding claims in real retrieved sources, avoiding fabricated citations, handling retractions, and calibrating confidence to evidence strength.
brycewang-stanford / python-econ-computingUse when writing Python code for DSGE models, HANK models, numerical economic computation, causal inference, or quantitative economic data analysis
brycewang-stanford / unpaywall-apiFind free legal full-text versions of scholarly articles via Unpaywall
JimLiu / baoyu-designCreate polished design artifacts as self-contained HTML: UI mockups, interactive prototypes, wireframes, landing pages, dashboards, app screens, mobile apps, slide decks (a.k.a.
davidondrej / cmuxControl the cmux macOS terminal app: workspaces, panes, surfaces, browsers, notifications, settings, and hooks. Use only when the user explicitly names cmux. Read before running any cmux command.
