Security

yafet-dev Bundle

Advanced server-side template injection testing methodology for bug bounty and application security work. Use when testing or reviewing template rendering, email templates, CMS templates, preview/render APIs, Smarty/Jinja/Twig/ERB/Ruby/Python template engines, path traversal plus SSTI, SSTI-to-RCE, reflected or stored template execution, user-controlled template variables, and workflows where attacker input is evaluated by a server-side template engine.

yafet-dev Bundle

Advanced OAuth security testing methodology for bug bounty and application security work. Use when testing or reviewing OAuth 2.0 authorization flows, redirect_uri validation, state or nonce binding, authorization code leakage, token leakage, account linking, OAuth CSRF, provider callback handling, mobile OAuth handoff, IDP/RP trust, email verification claims, token scope mismatch, OAuth SSRF, and open redirect chains leading to account takeover or data access.

yafet-dev Bundle

Advanced GraphQL security testing methodology for bug bounty and application security work. Use when testing or reviewing GraphQL queries, mutations, subscriptions, schema exposure, resolver authorization, nested data leaks, IDOR/BOLA in variables, mutation aliasing DoS, batched operations, global node IDs, token scope mismatch, hidden admin operations, SSRF through GraphQL fields, and REST/GraphQL permission drift.

yafet-dev Bundle

Advanced web cache poisoning and cache deception testing methodology for bug bounty and application security work. Use when testing or reviewing cache key confusion, Host header poisoning, CORS header poisoning, CDN cache poisoning, web cache deception, stored XSS through cache, DoS through cache, private data cached publicly, missing Vary headers, path normalization mismatch, origin/CDN disagreement, and workflows where shared caches serve attacker-controlled or private responses to other users.

yafet-dev Bundle

Advanced MFA and 2FA bypass testing methodology for bug bounty and application security work. Use when testing or reviewing two-factor authentication, MFA enrollment, MFA disable flows, backup codes, recovery codes, remembered devices, enforcement policies, race conditions, blank or reused codes, session persistence after MFA changes, mobile/web MFA parity, embedded forms, and workflows where a user can bypass, weaken, remove, or satisfy MFA incorrectly.

yafet-dev Bundle

Advanced OpenID, OIDC, SAML, and SSO security testing methodology for bug bounty and application security work. Use when testing or reviewing SSO login, SAML assertions, OpenID Connect ID tokens, SSO domain enforcement, JIT/SCIM provisioning, RelayState, signed assertions, JWT client-side generation, organization joins, enterprise identity matching, SSO token theft, SSO DoS, and workflows where federated identity grants account, tenant, or internal-service access.

yafet-dev Bundle

Advanced file upload vulnerability testing methodology for bug bounty and application security work. Use when testing or reviewing unrestricted uploads, webshell upload, upload-to-RCE, stored XSS through files, SVG/image/PDF upload abuse, MIME/type validation bypass, extension bypass, archive extraction, upload SSRF, metadata abuse, path traversal in filenames, file overwrite, public storage exposure, and workflows where uploaded content is stored, processed, rendered, converted, or executed.

yafet-dev Bundle

Advanced authentication security testing methodology for bug bounty and application security work. Use when testing or reviewing login, logout, registration, OTP/SMS, password reauthentication, password reset, session cookies, auth tokens, 2FA/MFA, SSO/SAML/OAuth/OIDC, subdomain-to-auth chains, redirect-based auth gates, middleware auth, response-manipulation auth bypass, brute-force throttling, exposed unauthenticated admin or infrastructure panels, pre-auth appliance flaws, client authentication, bot authentication, and any workflow where authentication can be bypassed, weakened, replayed, stolen, or desynchronized.

yafet-dev Bundle

Advanced open redirect testing methodology for bug bounty and application security work. Use when testing or reviewing redirect URL parameters, login/logout redirects, OAuth redirect chains, SSO callbacks, payment or QR-code redirects, mobile deeplinks, URL parser mismatches, double encoding, host allowlist bypasses, and chains where redirection leads to token theft, account takeover, phishing, SSRF, XSS, or trusted-domain abuse.

yafet-dev Bundle

Advanced business logic vulnerability testing methodology for bug bounty and application security work. Use when testing or reviewing workflow abuse, price or balance manipulation, approval bypass, abuse-report misuse, account recovery logic, invite or onboarding logic, state machine flaws, negative quantities, duplicate redemption, free purchases, moderation bypass, trust assumptions, and multi-step product flows where valid-looking actions can produce unauthorized business outcomes.

yafet-dev Bundle

Advanced race condition testing methodology for bug bounty and application security work. Use when testing or reviewing concurrent requests, double spending, duplicate redemption, multiple payout, email activation races, 2FA races, undeletable membership, follow/like counters, gift cards, coupons, balance changes, inventory, account state transitions, and workflows where simultaneous or reordered actions break locking, idempotency, or state consistency.

yafet-dev Bundle

Advanced mobile application security testing methodology for bug bounty and application security work. Use when testing or reviewing Android or iOS apps, deeplinks, intents, universal links, WebViews, local storage, hardcoded secrets, mobile API authorization, certificate pinning, host validation, exported components, notification leaks, app-to-app auth handoff, file/path traversal, mobile RCE chains, and mobile-only account takeover or data exposure paths.

yafet-dev Bundle

Advanced account takeover (ATO) testing methodology for bug bounty and application security work. Use when testing or reviewing login, password reset, email or phone change, OAuth/OIDC/SAML/social login, magic links, session cookies, JWTs, remember-me tokens, CSRF on identity-changing actions, linked accounts, SSO/SCIM provisioning, mobile deeplinks or intents, web cache issues, request smuggling chains, exposed admin/debug endpoints, and any workflow where a flaw may let one user obtain another user's session, reset credentials, bind an attacker-controlled identity, or assume account control.

yafet-dev Bundle

Advanced HTTP request smuggling and desync testing methodology for bug bounty and application security work. Use when testing or reviewing front-end/back-end HTTP parser disagreement, CL.TE or TE.CL issues, HTTP/2 downgrading, proxy desync, cache poisoning through desync, credential or token theft, response queue poisoning, request tunneling, internal endpoint access, and chains where malformed HTTP framing crosses authentication, routing, or cache boundaries.

yafet-dev Bundle

Advanced authorization bypass and privilege escalation testing methodology for bug bounty and application security work. Use when testing or reviewing role escalation, admin escalation, tenant or organization boundary bypass, email verification bypass, invitation or SSO join flaws, OAuth/SAML authorization misuse, GraphQL or API authorization leaks, hidden admin accounts, approval workflow bypass, business-rule authorization gaps, unauthorized private data access, exposed admin panels, local-to-root or container privilege escalation, and workflows where a lower-privilege identity can read, act, approve, impersonate, or administer beyond its intended permissions.

yafet-dev Bundle

Advanced information disclosure testing methodology for bug bounty and application security work. Use when testing or reviewing sensitive data leaks, private user data exposure, debug or Sentry leaks, directory listing, cache disclosure, deeplink data leakage, internal metadata, hidden IDs, stack traces, source maps, logs, backups, unauthenticated endpoints, and API, mobile, web, or infrastructure responses that reveal data beyond the intended audience.

yafet-dev Bundle

Test parser and normalization differentials between WAFs, proxies, servers, frameworks, and final sinks during authorized application security work. Use when equivalent requests are blocked or interpreted differently because of charset, URL/JSON/XML encoding, content type, parameter duplication, path normalization, application wrappers, or framework-specific parsing. Do not treat a WAF bypass alone as a vulnerability; require demonstrable backend security impact.

alexisbalayre Skill

Fit this Claude Code template to the repository it was copied into by filling .claude/project.env, AGENTS.md, the conventions docs and their rule loaders, and the architecture, security and glossary docs, then pruning skills and agents the project cannot use.

rudironsoni Bundle

Review code for quality, correctness, and maintainability. Use this skill when reviewing pull requests, auditing existing code, refactoring for clarity, or enforcing coding standards. Covers DRY principles, SOLID design, error handling, performance, security, testing, and TypeScript/JavaScript best practices. For Obsidian plugin-specific API guidance, refer to the obsidian-plugin-development skill.

dyoshikawa Skill

Review a pull request for code quality and security issues. Use when the user wants to review a PR, check PR code changes, or audit a pull request. Triggers on: "review PR", "review pull request", "check this PR", "review-pr skill".

dyoshikawa Skill

Review a pull request for code quality and security issues without using subagents. Use when the user wants a lighter-weight PR review in a single skill.

dyoshikawa Skill

Scan for malicious code in git diff between a tag/commit and HEAD

dyoshikawa Skill

Review a PR for code quality and security issues, then post review comments on it. Runs review-pr followed by post-review-comments sequentially.

seguelacedric Skill

Audit ACA cold email readiness before launch. Use when the user asks about deliverability, inbox placement, warmup, mailbox health, sending limits, bounce risk, or whether a sequence is safe to start.

clanker25 Skill

Configure agy-auto PreToolUse security gate to run Antigravity CLI (agy) unattended with layered policy controls instead of --dangerously-skip-permissions.

clanker25 Skill

Audit multi-role marketplace authorization across roles, resource ownership, tenant boundaries, and order-state transitions; use when access rules need evidence, not UI assumptions.

quality-max Skill

Audit project dependencies for risk — known-vulnerable versions, unpinned ranges, abandoned packages, and badly outdated majors. Reads package.json, requirements.txt, go.mod, Cargo.toml. Pure Claude Code, no signup.

quality-max Skill

Review a REST/HTTP API — from its OpenAPI spec or route code — for security gaps like missing auth, broken object-level authorization, no rate limiting, and verbose errors. Reports file:line. Pure Claude Code, no signup.

quality-max Skill

Check HTTP security headers on any URL. Grades CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Produces an A-F report with specific missing or misconfigured headers. No signup.

h-mmer Skill

Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast <repo_path> [--lang c|cpp|rust|java|python|go|php] [--min-score 4] [--max-files 30] [--skip-static] [--best-of N]

h-mmer Skill

Record a platform response and update learning. Usage: /learn <report_id> <status> [--bounty 500] [--vuln-type XSS]

h-mmer Skill

Check if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck <vuln_type> e.g. /dupcheck XSS in search endpoint

h-mmer Skill

Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.

h-mmer Skill

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

immortalqx Bundle

Evaluates a preliminary research idea against a five-dimension framework (Higher, Faster, Stronger, Cheaper, Broader) plus idea-lifecycle and student-capability matching, paradigm-shift probing, and a fatal-flaws audit. Returns a reviewer-style verdict. Use when the user has a draft research idea and asks whether it is worth pursuing, asks to 'evaluate this idea', 'score this idea', 'assess feasibility', 'novelty check', 'is this a good research direction', or before committing to a paper scope.

immortalqx Bundle

Advises on the design of the three core figures in a technical paper: the Motivated Example (Figure 1), the Solution Overview (Methodology), and the Experimental Results figures. Recommends the right design paradigm, layout, labelling, and tool for each figure type, then runs a quality-control audit. Use when the user asks to 'design a figure', 'draw Figure 1', 'plot experiment results', 'choose the right chart type', 'which figure tool to use', or 'figure looks unprofessional'.