graphql-and-hidden-parameters
yaklang
Find hidden fields and access gaps in APIs.
API security
Security skills for AI agents
These Skills look at software the way an attacker or an auditor would. The biggest groups review code for injection and broken access rules, probe systems in penetration tests and audit cloud accounts against best practices; smaller sets cover sign-in, malware analysis and forensics.
Sort by
Most installed
794 Skills
Showing Skills in Security.- 3.3k
- 3.3k
ssti-server-side-template-injection
yaklang
Find template injection in your web application.
Application security
- 3.3k
format-string-exploitation
yaklang
Build memory-leak exploits for vulnerable binaries.
Binary exploitation
- 3.3k
xxe-xml-external-entity
yaklang
Find file leaks in XML uploads and APIs.
Security testing
- 3.3k
file-access-vuln
yaklang
Find the right security checks for file access.
Security testing
- 3.3k
kernel-exploitation
yaklang
Build Linux kernel exploits for root access.
Kernel exploitation
- 3.3k
http-parameter-pollution
yaklang
Find security gaps when web requests repeat fields.
Web security testing
- 3.3k
deserialization-insecure
yaklang
Find exploitable flaws in how apps load saved data.
Application security
AS - 3.3k
request-smuggling
yaklang
Find request mix-ups between proxies and servers.
Web security testing
- 3.3k
browser-exploitation-v8
yaklang
Build V8 browser exploits that break out of the sandbox.
Browser exploitation
- 3.3k
race-condition
yaklang
Find race conditions in one-time web actions.
Web security testing
- 3.3k
csp-bypass-advanced
yaklang
Find gaps in a website's script security policy.
Web security
- 3.3k
open-redirect
yaklang
Find unsafe redirects in your web application.
Web application security
- 3.3k
symbolic-execution-tools
yaklang
Find inputs that unlock reverse-engineering puzzles.
Reverse engineering
- 3.3k
mobile-ssl-pinning-bypass
yaklang
Inspect mobile app traffic past certificate checks.
Mobile security testing
- 3.3k
crlf-injection
yaklang
Find CRLF flaws in HTTP headers and server logs.
Web security testing
- 3.3k
insecure-source-code-management
yaklang
Find exposed source code and secrets on websites.
Web security testing
- 3.3k
web-cache-deception
yaklang
Find private data leaks in your website's cache.
Web security testing
- 3.3k
http-host-header-attacks
yaklang
Find Host header flaws in your web application.
Web application security
- 3.3k
dependency-confusion
yaklang
Find public-package risks in your private builds.
Supply-chain security
- 3.3k
expression-language-injection
yaklang
Test Java apps for expression injection.
Application security
+1 - 3.3k
subdomain-takeover
yaklang
Find abandoned services behind your subdomains.
Security testing
3.3kaws-security
aws
Make informed choices about AWS security coverage.
Cloud security
- 3.3k
csv-formula-injection
yaklang
Find formula injection in spreadsheet exports.
Application security
A Skill only gives the agent instructions and tools; it carries no permission of its own. Penetration testing and reverse engineering Skills are written for systems you own or are authorised to test, and the agent works with the access you give it.
A review reads the code or configuration and points out weaknesses. A penetration test runs the system and tries to exploit them, which shows whether a weakness can actually be used.
Tests check that the code does what it should; security Skills check what it should never do, such as letting one user read another's data. The two catch different mistakes.