Product & Planning

purpleailab Skill

Web application enumeration hub — directory/file fuzzing, vhost discovery, API enumeration, CMS scanning, WAF detection, auth surface mapping, cookie audit.

purpleailab Skill

Entra ID / M365 reconnaissance — unauthenticated tenant discovery via OpenID config, GetUserRealm, autodiscover; user enumeration via login response codes and OneDrive; federation/MFA/CA posture; authenticated enumeration with ROADtools (roadrecon), AADInternals, MSGraph.

purpleailab Skill

gRPC API exploitation — reflection-based discovery via grpcurl, protobuf fuzzing, missing authz on streaming RPCs, gRPC-Web → backend SSRF, mTLS bypass, metadata header injection, h2c smuggling against gRPC fronts.

purpleailab Skill

macOS endpoint post-exploitation — launchd persistence, TCC bypass, Keychain credential access, dylib hijacking, Gatekeeper/quarantine evasion, and discovery on Apple hosts.

purpleailab Skill

BACnet/IP attack — UDP/47808 discovery via Who-Is broadcast, ReadProperty / WriteProperty without auth, BBMD abuse for remote reach, vendor-specific I-Am responses, COV (Change Of Value) subscription flood, Building Automation HMI pivot.

poly-gents Bundle

Startup authoring skill for the Project System Assistant. Teaches Playbook Architect how to clarify intent, use filtered tool discovery, and preserve artifacts and validations while drafting playbooks.

odjaramillo Bundle

Expert technical writing skill. Provides templates for PRD, BRD, SRS, and Engineering docs. Trigger: "Write a PRD", "Document this feature", "Create specs", "Generate readme".

sairam0424 Skill

Remove a future phase from roadmap and renumber subsequent phases

sairam0424 Skill

Review and promote backlog items to active milestone

sairam0424 Skill

Stakeholder Communication

ricneves-ai Skill

10 skills e plugins de agentes de produto para Claude Code. Kit de ferramentas para PM (RICE), PO ágil, estrategista de produto (OKR), pesquisador UX, sistema de UI design, análise competitiva, gerador de landing page, scaffolder SaaS, resumidor de pesquisas. Ferramentas Python (somente stdlib).

ricneves-ai Bundle

Gerador de PRD (Product Requirements Document) em portugues-BR a partir de um Product Brief. Conduz entrevista guiada com 6 perguntas-chave (Nome, Overview, Persona, Objetivo, Requisitos Funcionais, Modelo de Negocio) e gera um PRD completo em Markdown com 9 secoes (Visao Geral, Funcionalidades, Fluxos, Diagrama Mermaid, Design UI, Modelo de Dados com ER e SQL, Arquitetura, Metricas, Roadmap), salvando em .prd/prd_NOME.md para uso em Claude Code. Use SEMPRE que o usuario mencionar gerar PRD, criar PRD, Product Requirements Document, documento de requisitos, transformar brief em PRD, estruturar product brief, preparar requisitos para Lovable Bolt V0, documentar produto, ou enviar um product brief pedindo estruturacao. Trigger TAMBEM quando descrever ideia de produto ou app pedindo estruturar, documentar ou preparar para desenvolvimento. Nao use para specs tecnicas de feature isolada (use sdd-generator).

ricneves-ai Bundle

Especialista em SDD (Software Design Document) — transforma um PRD completo numa estrutura de specs quebrada por pasta no formato .specs/NNN-nome/, com contextos isolados por feature, arquivo EXECUTAR-SPECS.md que dispara subagentes em paralelo, regras de nomenclatura e templates prontos para Claude Code. Use esta skill SEMPRE que o usuário enviar um PRD, documento de requisitos, lista de features, história de usuário detalhada, ou pedir para "quebrar em specs", "gerar SDD", "criar estrutura de tasks", "preparar para Claude Code", "montar .specs", "estruturar subagentes" ou qualquer variação. Trigger também quando o usuário mencionar "executar specs", "subagentes paralelos", "specs por feature", "contexto isolado por task" ou perguntar como organizar um projeto para agentes.

purpleailab Skill

WAF evasion — payload obfuscation, HTTP-level evasion, origin-IP discovery, rate/anomaly evasion, per-WAF notes (Cloudflare/Akamai/AWS WAF/ModSecurity).

purpleailab Skill

Final engagement report generation — executive summary, technical report, findings aggregation, attack path narrative, detection gap matrix, remediation roadmap.

purpleailab Skill

Web app discovery — directory/file fuzzing, vhost discovery, JavaScript endpoint extraction.

purpleailab Skill

Cookie-conditional sink discovery — bisect required cookies per sink, session-write timeline for race-condition challenges.

purpleailab Skill

REST API discovery, GraphQL detection, parameter fuzzing.

netvar1337 Bundle

Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

tomevault-io Bundle

Use when working with a test skill for testing skill discovery

netvar1337 Skill

When planning tasks or reviewing code is important to extend the reasoning of the unstaged changes, commits in the current non-master branch and todo roadmap of the ongoing work.

netvar1337 Bundle

0-day vulnerability discovery workflow. Covers fuzzing strategies, variant analysis, static analysis for bug classes, attack surface mapping, PoC development, and responsible triage. Invoke with /vuln-research or when the task involves finding new vulnerabilities.

netvar1337 Bundle

Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.

netvar1337 Bundle

Windows kernel-driver vulnerability discovery and reverse-engineering workflow for WDM and KMDF .sys files. Use when auditing an unknown driver, recovering device and IOCTL attack surfaces, reconstructing request schemas, fuzzing IOCTL handlers, triaging Driver Verifier crashes, performing cross-version variant analysis, or assessing whether a driver flaw is a new vulnerability.

netvar1337 Bundle

Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

netvar1337 Bundle

Remote Code Execution testing checklist: OS command injection, SSTI-to-RCE, deserialization RCE, file upload RCE, XXE with SSRF to RCE, RCE via dependency confusion, and CVE-based RCE patterns. Use for web app pentests and bug bounty RCE discovery.

netvar1337 Bundle

Cross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty.

netvar1337 Bundle

IDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.

netvar1337 Bundle

Server-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty.

netvar1337 Bundle

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.

netvar1337 Skill

Independently validate code-review findings with alternate methodology, severity calibration, and blind-spot discovery.

ur-grue Bundle

Produces a structured brief identifying the potential financial, professional, and relational conflicts of interest a source or stakeholder may have — and recommending what to disclose, what to investigate further, and how to handle the source editorially.

tangledgroup Bundle

Open standard for communication between independent AI agent systems. Agents discover capabilities via Agent Cards and collaborate on tasks with streaming without exposing internal state. Supports JSON-RPC 2.0, gRPC, and HTTP+JSON bindings with enterprise security. Use when building multi-agent systems requiring agent discovery, task collaboration, or secure inter-agent communication.

netvar1337 Bundle

Open redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery.

netvar1337 Bundle

Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.

netvar1337 Bundle

Full exploit development course roadmap and syllabus: weekly topics, recommended reading, lab setup, and learning path from vulnerability classes through advanced exploitation. Use to structure exploit dev training or onboard new researchers.