1,116 skills found ¡ Page 32 of 38
jamditis / supply-chain-hardeningInstall-time cooldowns for npm/bun plus a sandboxed pre-install scan for bypasses. Use for supply-chain attacks or npm security.
prekuter / migrationBring an existing codebase into Dryforge, once. Reads the code, asks what code cannot show â business rules, security policy, what is intentional â and writes the project docs at the entry points agents already read
jamditis / api-hardeningAPI hardening for Express, FastAPI, and serverless. Use for rate limiting, CORS, input validation, API keys, or OWASP API Top 10.
jamditis / secure-authSecure authentication patterns (OWASP, NIST). Use for login, registration, password reset, sessions, JWT, OAuth, MFA, passkeys.
Microck / compliance-architectureEnterprise-grade compliance architecture for SOC 2, HIPAA, GDPR, PCI-DSS. Provides compliance checklists, security controls, audit guidance, and regulatory requirements for serverless and cloud architectures.
Microck / ai-llm-engineeringOperational skill hub for LLM system architecture, evaluation, deployment, and optimization (modern production standards). Links to specialized skills for prompts, RAG, agents, and safety.
Microck / blockchain-developerExpert blockchain developer specializing in smart contract development, DApp architecture, and DeFi protocols. Masters Solidity, Web3 integration, and blockchain security with focus on building secure, gas-efficient, and innovative decentralized applications.
pegasi-ai / reinsStop AI agents from doing things you didn't ask for.
ergrelet / windiff-version-diff-analysisGenerate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases
matank001 / cursor-security-rulesThis repository contains Cursor Security Rules designed to improve the security of both development workflows and AI agent usage within the Cursor environment. These rules aim to enforce safe coding practices, control sensitive operations, and reduce risk in AI-assisted development.
hypnguyen1209 / coding-masteryUse when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM â systems & network programming, automation, cryptography implementation
hypnguyen1209 / edr-evasionUse when bypassing EDR/AV to run a payload â hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasion
hypnguyen1209 / initial-accessUse when gaining initial access to a target â phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitation
hypnguyen1209 / shellcode-devUse when writing position-independent shellcode or a loader â PEB walking, API hashing, null-byte avoidance, encoders, loaders, PE-to-shellcode conversion, cross-platform shellcode
hypnguyen1209 / red-team-opsUse when running a full red-team engagement end-to-end â initial access, persistence, privilege escalation, defense evasion, C2 infrastructure, EDR bypass, living-off-the-land
hypnguyen1209 / active-directory-attackUse when attacking a Windows Active Directory domain â Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
hypnguyen1209 / ai-agent-redteamUse when red-teaming an agentic AI / LLM application â indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
hypnguyen1209 / ai-securityUse when attacking an AI/ML system or model â prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
hypnguyen1209 / browser-exploitationUse when building a client-side browser exploit â V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains
hypnguyen1209 / cicd-supply-chainUse when attacking or auditing a CI/CD pipeline or software supply chain â pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance
hypnguyen1209 / cloud-securityUse when attacking AWS/Azure/GCP cloud â IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse
hypnguyen1209 / container-k8s-escapeUse when breaking out of a container or escalating inside Kubernetes â runc/BuildKit CVEs, privileged/capability/cgroup misconfig escapes, NVIDIA GPU toolkit escape, K8s RBAC abuse, kubelet RCE, ingress/admission-controller RCE, node-to-cluster pivot
hypnguyen1209 / crypto-analysisUse when assessing cryptography â TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
hypnguyen1209 / exploit-developmentUse when turning a memory-corruption bug into a working PoC â stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox
hypnguyen1209 / mobile-pentestUse when pentesting an Android/iOS app â Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE
hypnguyen1209 / network-attackUse when attacking a network or moving laterally â L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless
hypnguyen1209 / privesc-linuxUse when escalating privileges on a Linux host â SUID/SGID & GTFOBins, sudo LPE (CVE-2025-32462/32463), capabilities & LD_PRELOAD, kernel LPE (CVE-2024-1086, Dirty Pipe, GameOver(lay)), service misconfig (PwnKit, Looney Tunables), container/namespace escape
hypnguyen1209 / privesc-windowsUse when escalating privileges on a Windows host â SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
hypnguyen1209 / recon-osintUse when mapping a target's external attack surface or gathering OSINT â subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)
hypnguyen1209 / vulnerability-analysisUse when auditing source code for vulnerabilities â drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
