This is a router skill for bug bounty and web security testing that helps you figure out what to look at first instead of spraying random payloads. It triages targets by observable behavior (input reflection, file uploads, API endpoints, auth flows) and routes you to the right specialized skill from a collection covering XSS, SQLi, SSRF, IDOR, JWT attacks, business logic flaws, and about 20 other categories. The routing table is surprisingly practical, linking things like controllable filenames to path traversal or MongoDB syntax exposure to NoSQL injection. Use it when you have a new target and need a methodical starting point, or when you want the AI to stop missing boundary conditions that matter in real engagements.
- skills.sh installs
- 4.6K
- GitHub stars
- 2.6K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yaklang/hack-skills --skill hack --agent claude-codeInstalls into .claude/skills of the current project.
Files
HACKING SKILLS / HackSkills
Overview
This is the master quality gate and technical router for authorized bug bounty, web/API security, pentest, code audit, source-leak work, and (when the task is blue) SOC / detection / IR.
It does not replace specialized techniques. It makes the agent:
- Pass the start gate (authorization, role, scope, success definition)
- Spend effort on paths that reach real control
- Route by observed behavior to the correct category / deep topic skill
- Prefer structured methodology over baseline-model memory and scanner dumps
This file is a quality gate, not a capability ceiling. Surfaces not listed here stay in play if field evidence exists.
This file is not an exploit cookbook. Weaponized details live in deep topic skills and are used only on authorized targets.
Load on demand:
- Red-team execution → RED_TEAM.md
- Test matrix and effort → TEST_MATRIX.md
- Blue-team execution → BLUE_TEAM.md
- Code audit → CODE_AUDIT.md
- Source leak → SOURCE_LEAK.md
- Evidence and report → EVIDENCE_REPORT.md
0. Task Start Gate
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yaklang/hack-skills
- Categories
- Backend & APIs, Testing & QA, Security, Productivity & Planning
- First seen
- May 16, 2026
More from yaklang/hack-skills
All 102- Android Pentesting Tricks4.3K
- Recon And Methodology4.3K
- Sqli Sql Injection4.2K
- Code Obfuscation Deobfuscation4.2K
- Xss Cross Site Scripting4.2K
- Api Sec4.1K
- Business Logic Vulnerabilities4.1K
- Ssrf Server Side Request Forgery4.1K
- Idor Broken Object Authorization4K
- Authbypass Authentication Flaws4K
- Jwt Oauth Token Attacks4K
- Api Recon And Docs4K
- 401 403 Bypass Techniques4K
- Api Auth And Jwt Abuse4K
- Waf Bypass Techniques4K
- Vm And Bytecode Reverse4K
- Websocket Security4K
- Api Authorization And Bola3.9K
- Auth Sec3.9K
- Kubernetes Pentesting3.9K
- Cors Cross Origin Misconfiguration3.9K
- Ios Pentesting Tricks3.9K
- Injection Checking3.9K
- Recon For Sec3.9K
Recommended
More Backend & APIs
clickhousectl-local-devclickhouse/agent-skillsUse when a user wants to build an application with ClickHouse, set up a local ClickHouse development environment, install ClickHouse, create a local server, cre4.5Kskills.sh installs
mcp-developerjeffallan/claude-skillsUse when building, debugging, or extending MCP servers or clients that connect AI systems with external tools and data sources. Invoke to implement tool handler4.4Kskills.sh installs
building-storefrontsmedusajs/medusa-agent-skillsLoad automatically when planning, researching, or implementing Medusa storefront features (calling custom API routes, SDK integration, React Query patterns, dat4.4Kskills.sh installs
typescript-docsgiuseppe-trisciuoglio/developer-kitGenerates comprehensive TypeScript documentation using JSDoc, TypeDoc, and multi-layered documentation patterns for different audiences. Use when creating API d4.4Kskills.sh installs
gh-review-requestsgetsentry/skillsFetch unread GitHub notifications for open PRs where review is requested from a specified team or opened by a team member. Use when asked to "find PRs I need to4.3Kskills.sh installs
composiostarchild-ai-agent/official-skillsComposio gateway: act on 1000+ connected apps like Gmail, Slack, GitHub, Calendar. Use when the user wants to act in a connected SaaS app (e.g. send Gmail, crea4.3Kskills.sh installs