Integrations & APIs

jperezduerto Skill

Operate and apply GTFOBins — the curated list of Unix binaries exploitable for privilege escalation, file operations, shell spawning, and capability abuse. Use when performing Linux/Unix privilege escalation, post-exploitation enumeration, SUID/sudo/capabilities exploitation, or when the user needs to leverage a specific binary to escape restricted shells, read protected files, or gain a root shell. Covers all GTFOBins categories, key binary techniques, SUID enumeration, sudo -l parsing, capabilities exploitation, and integration with LinPEAS/LinEnum output.

jperezduerto Skill

Operate Kerbrute — a Kerberos-based Active Directory enumeration and brute force tool that performs user enumeration, password spraying, and credential brute force via Kerberos pre-authentication without triggering traditional LDAP lockout mechanisms. Use during Active Directory assessments for username enumeration, safe password spraying, and credential testing. Covers installation (Go, releases), user enumeration, password spraying cadence, brute force, DC targeting, verbose output, output files, and integration with BloodHound and NetExec AD attack workflows.

jperezduerto Skill

Operate mimikatz — the definitive Windows credential extraction and Active Directory attack tool. Use when extracting credentials from Windows memory or the SAM database, performing DCSync attacks, forging Kerberos tickets (Golden/Silver), conducting Pass-the-Hash or Pass-the-Ticket attacks, or any AD post-exploitation requiring credential access. Covers all major modules (sekurlsa, lsadump, kerberos, token, crypto, dpapi, vault), in-memory execution via Invoke-Mimikatz, Cobalt Strike integration, detection evasion techniques, and complete AD attack chains.

jperezduerto Skill

Operate PEASS-ng (Privilege Escalation Awesome Scripts SUITE) — the industry-standard post-exploitation enumeration toolkit covering LinPEAS and WinPEAS. Use when performing local privilege escalation on Linux, Windows, or macOS targets, when the user asks about PEASS, linpeas.sh, winpeas.exe, or winpeas.bat, or when the user needs to enumerate a compromised host for PE vectors. Covers installation, all execution methods (curl-to-bash, in-memory, AV bypass, certutil), output color interpretation, key checks, flags, quiet/stealth mode, targeted check selection, and integration with privilege escalation methodology.

jperezduerto Skill

Build, extend, and operate Recon-ng — a web reconnaissance framework with a modular architecture for OSINT gathering and passive reconnaissance. Use when the user needs to enumerate domains, discover hosts and contacts, harvest credentials, or produce structured OSINT reports. Covers installation, workspace management, marketplace, module loading and configuration, API key management, database queries, reporting modules, and OSINT methodology integration for penetration testing and intelligence-gathering engagements.

jperezduerto Skill

Operate and script Bettercap — a comprehensive network attack and monitoring framework. Use when working with bettercap/bettercap, when the user needs to perform ARP spoofing, DNS spoofing, SSL stripping, credential sniffing, WiFi attacks (deauth, handshake capture, evil twin), BLE enumeration, HID injection, or man-in-the-middle workflows. Covers installation, interactive REPL, caplets, all major modules, REST API, web UI, and comparison with Ettercap.

jperezduerto Skill

Operate Burp Suite Community and Professional for web application penetration testing. Use when intercepting HTTP/S traffic, fuzzing parameters, testing authentication bypasses, scanning for vulnerabilities, or performing advanced web application assessments. Covers proxy setup, Intercept, Repeater, Intruder (all attack types), Scanner, Sequencer, Decoder, Comparer, Logger, Collaborator, BApp Store extensions (Autorize, Param Miner, JWT Editor, Turbo Intruder, ActiveScan++), scope control, session handling, macros, REST API, and Bambda filters.

jperezduerto Skill

Operate, script, and extend mitmproxy — an interactive TLS-capable intercepting proxy with three interfaces (console, web, scriptable dump). Use when working with mitmproxy/mitmproxy, when the user needs to intercept and modify HTTP/HTTPS traffic, write Python addons to automate request/response manipulation, replay flows, export to curl/httpie, analyze mobile app traffic, or run in transparent/reverse/upstream proxy modes. Covers all three binaries, proxy modes, CA installation, flow filtering, Python scripting API, addons, and Android/iOS configuration.

jperezduerto Skill

Configure and operate Proxychains (proxychains-ng) to route tool traffic through SOCKS4, SOCKS5, or HTTP proxy chains for pivoting, anonymisation, and internal network access. Use when routing nmap, netexec, curl, or other tools through SSH tunnels, chisel, ligolo-ng, or SOCKS proxies during internal network pivoting. Covers installation, chain types, proxy configuration, DNS resolution, integration with tunnelling tools, and pivoting methodology.

jperezduerto Skill

Operate theHarvester — a passive OSINT reconnaissance tool for gathering email addresses, subdomains, hosts, employee names, and open ports from public sources. Use during the reconnaissance phase of penetration tests or red team engagements to enumerate external attack surface from a domain name using dozens of data sources including Google, Bing, LinkedIn, GitHub, Shodan, CertSpotter, crt.sh, and VirusTotal. Covers installation, data sources, all major flags (-d, -b, -l, -n, -v, -S, -f), API key configuration, output formats, and OSINT recon workflow integration.

jperezduerto Skill

Operate Frida — a dynamic instrumentation toolkit for hooking and modifying running processes. Use when performing runtime analysis of desktop or mobile applications, bypassing SSL pinning or root detection, hooking native/Java/Objective-C functions, reversing mobile apps (Android/iOS), or automating instrumentation with Objection. Covers installation, JavaScript API (Interceptor, Module, Memory, NativeFunction), frida-trace, RPC exports, Objection integration, Android/iOS setup with frida-server, and end-to-end mobile app pentesting workflows.

oldwinter Bundle

帮助用户从纯粹的自助服务模式过渡到混合模式，利用人工销售来获取大型企业交易，同时保持无摩擦的产品入口点。

bitranox Bundle

Use when a download, scrape, or API pull is blocked or rate-limited by the target (HTTP 429, IP ban, geoblock) and must be routed through proxies, or when fetching many items from a host that throttles per IP (bulk YouTube transcripts, scraping, API harvesting).

drmoisan Skill

Execute a manually authored multi-feature epic through deterministic waves, isolated worktrees, integration-branch fan-in, and a final integration PR.

khurrummahmood Bundle

Author or amend an Architectural Decision Record under ai-docs/decisions/. Smallest first-class artifact in the senior-engineer skill ecosystem; used at any tier (Quick / Feature / System / Maintenance) when a real choice is being made. Reads canonical-patterns.md and architectural-smells.md to suggest related-pattern / related-smell backrefs and avoid duplicating an existing decision. Read-only against the rest of the codebase — only writes under ai-docs/decisions/. Hands off to /plan-feature, /scope-feature, or implementation work.

khurrummahmood Bundle

Turn a confirmed or suspected missing-boundary into a read-only boundary-extraction proposal. Family-local evidence supports Python, TypeScript/checked-JavaScript, Go, Java 17, Kotlin/JVM, C#, Swift 6.3.3, PHP, Ruby, bounded Rust, and bounded Dart. It emits reports/propose-boundary/<target-slug>/proposal.md with candidate seams, public API, compatibility plan, caller impact, and characterization/native-verification plan. Read-only — no edits. Hands off to /refactor-subsystem (decomposition mode).

khurrummahmood Bundle

Detect route prefixes for a product workflow that are scattered through flat URL modules, missing include ownership boundaries, or duplicated as ambiguous API aliases. SUSPECT skill for product topology.

khurrummahmood Bundle

Advisory SUSPECT scan for incomplete sweeps — multi-site changes that were started but never finished, leaving a forgotten sibling call site at the old shape ("updated N-1 of N"). Python retains the keyword-argument omission band; TypeScript/TSX and checked JavaScript use the host-pinned TypeScript Compiler API to group resolved project function calls by object-option property presence; Go uses host Go `go/types` for one direct top-level function / keyed struct-option shape; Java 17 uses the JDK compiler tree API for one direct record/options-constructor shape; PHP uses bounded Composer PSR-4 direct constructions; Ruby requires project-authored RBS constructor contracts; Kotlin/JVM uses pinned direct constructor-call facts; Rust uses compiler-resolved direct calls for one struct-option omission shape; Dart uses SDK-LSP-resolved top-level calls for one named-argument omission shape; Swift uses compiler-AST-resolved direct calls and default-argument ownership. Gated on a git-trajectory signal: a divergence coun

khurrummahmood Bundle

Advisory SUSPECT scan for configured product route-surface reachability: routes, templates, static JS, inline handlers, prototype pages, and orphaned page/API surfaces. Reuses `/find-dormant` URL extraction where useful, but focuses on the route/template/static wiring in configured targets or explicit paths.

mr-kelly Bundle

Busabase-backed App-in-Skill money ledger for aggregating Mercury, Stripe, Airwallex, and Creem accounts into a read-only dashboard. Use when the user invokes $kelly-money or /kelly-money, wants a total cashflow ledger, account columns, Accounts sidebar, Account Detail views, finance onboarding, connector setup, transaction import/sync, reconciliation, balances, payouts, payments, fees, refunds, transfers, or a review of money movement across these providers.

mr-kelly Bundle

Team standup board (Busabase App-in-Skill) for team leads. Use when the user invokes $kelly-standup or /kelly-standup, or asks for standup, daily standup, 晨会, daily check-in, team status board, 团队日报, blockers, who's working on what, team digest, check-in streaks, missing check-in reminders, or collecting async updates from Slack/WeCom/Discord/WhatsApp/docs into one board.

mr-kelly Bundle

Unified chat inbox (Busabase App-in-Skill) aggregating WhatsApp, Discord, Slack, and Telegram messages into one place with a reply queue. Use when the user invokes $kelly-messenger or /kelly-messenger, wants a unified inbox, chat aggregation, to read WhatsApp/Discord/Slack/Telegram messages in one place, review unanswered conversations, queue or approve replies, run connector sync, or manage the outgoing reply queue.

tmj-90 Skill

Use when a ticket asks to add or extend an HTTP/API endpoint — a new route, handler, or RPC method — with request validation and a defined response. Invoke for "add a POST /things endpoint", "expose a list API", or "add a field to the X response".

tmj-90 Skill

Use when a ticket asks for integration or end-to-end coverage across components — an API route hitting a database, a service-to-service call, a multi-step flow — rather than a single unit. Invoke for "test the endpoint end to end", "cover the checkout flow", or "verify the migration + query together".

kirkruglov Bundle

Extracts structured decisions from meeting notes, Slack threads, or email chains and maintains a decision log separate from action items. Each decision is captured with context, alternatives considered, participants, date, and related tasks or risks. Supports two modes: new log creation and append to an existing log with deduplication. Use when you want to capture decisions from a meeting, update decision log, log decisions, extract decisions from discussion, build decision registry, add decisions to log.

kirkruglov Bundle

Turn dashboard numbers into a ready-to-send weekly narrative for stakeholders. Paste metrics + context → polished email or Slack post in minutes. Use when writing weekly updates for leadership or team. Triggers: 'weekly metrics story', 'write metrics narrative', 'metrics to email', 'turn numbers into story', 'недельный нарратив по метрикам', 'метрики в email', 'напиши обновление по метрикам'.

xoai Bundle

Corrects the 13 most common API design mistakes agents make — grounded in Geewax, Amundsen, Ousterhout, Kleppmann, and Gough/Bryant

leo-kuang-ai Bundle

Sweep configured feedback sources (Slack, GitHub Issues; email experimental) for new items: acknowledge at source, analyze recordings, verify fixes merged to main, and emit a spec-lfg-ready plan. First run sets up sources; supports mode:headless for scheduled runs.

jayrha Bundle

Designs clean, consistent REST and GraphQL APIs covering resource modeling, URL structure, versioning, pagination, filtering, error formats (RFC 9457 Problem Details), idempotency, authentication, rate limiting, and machine-readable contracts (OpenAPI 3.1 / GraphQL SDL). Use this skill when designing a new API or endpoint, reviewing an API design, choosing REST vs GraphQL, deciding on versioning or pagination strategy, defining error responses, adding idempotency keys, writing or critiquing an OpenAPI/GraphQL schema, or establishing API style guidelines and naming conventions.

jayrha Bundle

Generates polished, well-structured project READMEs with badges, a one-line tagline, quick-start, installation, usage examples, configuration tables, contribution guidelines, and a license section. Use this skill when the user asks to "write a README", "generate a README", "create README.md", "improve my README", "add badges", "document my project", "make a project description", or wants onboarding/landing-page docs for a library, CLI, web app, API, or repo.

jayrha Bundle

Authors and validates JSON Schema (Draft 2020-12 and Draft-07) for configuration files and HTTP/REST APIs, applying types, constraints, composition keywords, and human-readable error messaging. Use this skill when the user wants to write, fix, refactor, or validate a JSON Schema, define a config-file contract, document request/response payloads, add validation rules to an OpenAPI spec, generate schemas from sample JSON, or produce clear validation error messages.

liberty91ltd Skill

Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.

liberty91ltd Skill

Censys API v2 reference. Host reconnaissance and certificate data.

liberty91ltd Skill

Shodan API reference. Host reconnaissance, port scanning, and vulnerability data.

liberty91ltd Skill

Use when you need to query a MISP instance for existing events/attributes/objects, or push new intel into MISP — adding attributes to an event, creating an event, or uploading a STIX 2 bundle as one or more events. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already known to your CTI sharing community, and by analytical skills that want to publish their findings back to MISP. Reads $MISP_URL and $MISP_API_KEY.

liberty91ltd Skill

URLScan.io API reference. URL submission, scanning, and result retrieval.