Security

jperezduerto Skill

Build, extend, and operate Wifite — an automated wireless auditing tool for WPA/WPA2, WPS, PMKID, and WEP attacks. Use when the user needs to audit wireless networks, capture handshakes, perform PMKID attacks, crack WPS PINs, or run automated Wi-Fi assessments. Covers installation, target selection, WPA handshake capture, PMKID attacks, WPS attacks, WEP cracking, custom wordlists, monitor mode management, and comparison with manual aircrack-ng workflow for professional wireless penetration testing engagements.

jperezduerto Skill

Build, extend, and operate WPScan — a WordPress security scanner for identifying vulnerabilities in WordPress installations, themes, and plugins. Use when the user asks about WPScan, WordPress enumeration, plugin/theme vulnerability scanning, WordPress brute force, xmlrpc exploitation, WordPress REST API enumeration, or automated WordPress security assessments. Covers installation, API token setup, all enumeration modes, detection strategies, brute force, output formats, stealthy scanning, vulnerability database integration, and full WordPress assessment workflow.

jperezduerto Skill

Reverse engineer Android APKs using Apktool. Use when decoding APKs to smali and resources, rebuilding modified APKs, bypassing certificate pinning, injecting Frida gadgets, analyzing AndroidManifest.xml for attack surface, modifying network security config, or performing combined static analysis with jadx. Covers installation, decode/rebuild workflow, framework management, smali code structure, APK signing, manifest analysis, certificate pinning bypass, Frida gadget injection, and integration with jadx for full decompilation.

jperezduerto Skill

Build, extend, and operate Binwalk — a fast, easy-to-use tool for analyzing, reverse engineering, and extracting firmware images. Use when the user asks about firmware analysis, embedded file extraction, entropy analysis, IoT security research, or hardware hacking. Covers installation, signature scanning, file extraction, recursive extraction, entropy analysis, custom magic signatures, supported formats (squashfs, cramfs, jffs2, LZMA, gzip, and more), firmware modification workflow, filesystem extraction, and firmware version diffing.

jperezduerto Skill

Build, extend, and operate GDB with GEF (GDB Enhanced Features) for binary exploit development, reverse engineering, and vulnerability research. Use when debugging ELF/PE/Mach-O binaries, developing heap or stack exploits, analyzing memory layout, building ROP chains, or integrating GDB with pwntools. Use when the user asks about GEF commands (vmmap, heap, checksec, pattern, xinfo, rop, canary), heap exploitation helpers, breakpoints, memory examination, or comparing GEF with PEDA and pwndbg.

jperezduerto Skill

Build, extend, and operate pwntools — a CTF framework and exploit development library for Python. Use when writing binary exploits, solving CTF pwn challenges, building ROP chains, crafting shellcode, or analyzing ELF binaries. Covers installation, core modules (process, remote, ELF, ROP, fmtstr, shellcraft, DynELF), packing/unpacking helpers, cyclic pattern generation, GDB integration, and complete CTF exploit patterns including buffer overflow, format string, ret2libc, and SROP.

jperezduerto Skill

Use, navigate, and integrate SecLists — the community-curated collection of security wordlists and payloads maintained at danielmiessler/SecLists (61k+ stars). Use when selecting wordlists for directory bruteforcing, credential spraying, fuzzing, subdomain enumeration, or payload injection. Covers directory structure, list selection strategy, key files, integration with ffuf/gobuster/hydra/burp/wfuzz, custom list creation, and operational best practices for penetration testing engagements.

jperezduerto Skill

Operate XSStrike — an advanced XSS detection and exploitation suite with intelligent payload generation, WAF fingerprinting, and DOM analysis. Use when testing web applications for reflected, stored, DOM-based, or blind XSS vulnerabilities. Covers installation, URL/POST scanning, crawler mode, blind XSS, fuzzer, custom headers, proxy integration, encoding, and a complete XSS testing methodology.

jperezduerto Skill

Search and use ExploitDB and searchsploit — the largest public archive of exploits, shellcode, and papers maintained by Offensive Security. Use when working with offensive-security/exploitdb, when the user needs to find public exploits for a CVE or software version, use searchsploit CLI on Kali, examine or mirror exploit code, parse nmap XML for matching exploits, query the Google Hacking Database (GHDB), update the local database, or integrate findings into Metasploit. Covers searchsploit flags, reading exploits safely, modification for targets, and GHDB usage.

jperezduerto Skill

Operate Responder — the LLMNR/NBT-NS/mDNS poisoner and credential capture framework maintained at lgandx/Responder (6.1k+ stars). Use when performing internal network attacks that exploit Windows name resolution fallback to capture NTLMv1/NTLMv2 hashes, setting up WPAD rogue proxies, relaying credentials with ntlmrelayx, or chaining into Active Directory attack paths. Covers poisoning mechanics, interface selection, analyze mode, WPAD, captured hash locations, hash types, relay attacks, Responder.conf tuning, MultiRelay, and hashcat/john cracking integration.

jperezduerto Skill

Build, extend, and operate SpiderFoot — an OSINT automation platform with 200+ modules for passive and active reconnaissance. Use when the user needs automated intelligence gathering on IP addresses, domains, email addresses, phone numbers, usernames, subnets, or ASNs. Covers installation, web UI and CLI operation, scan types, module configuration, API key setup, correlation engine, data visualization, export formats, and OSINT investigation methodology for penetration testing and threat intelligence engagements.

jperezduerto Skill

Operate the Aircrack-ng WiFi security suite for wireless network assessment. Use when performing WEP, WPA, or WPA2 cracking, capturing 4-way handshakes, executing PMKID attacks, injecting deauth frames, performing ARP replay attacks, or analyzing wireless traffic. Covers airmon-ng (monitor mode), airodump-ng (capture/scan), aireplay-ng (deauth/fake auth/ARP replay), aircrack-ng (cracking), airdecap-ng, packetforge-ng, besside-ng, WPS attacks with reaver, hashcat integration with -m 22000, and evil twin concepts for authorized wireless penetration testing engagements.

jperezduerto Skill

Operate Metasploit Framework for penetration testing engagements. Use when the user needs to run exploits, generate payloads with msfvenom, manage Meterpreter sessions, perform post-exploitation (hashdump, getsystem, pivoting, portfwd), set up multi/handler listeners, enumerate with db_nmap, write custom modules, or bypass AV/EDR. Covers msfconsole, workspace management, exploit/payload selection, meterpreter commands, evasion, auxiliary modules, and integration with Cobalt Strike concepts. Source: https://github.com/rapid7/metasploit-framework

bitranox Bundle

Use when sending email from Python or the shell, especially with large attachments that must not be loaded into memory, RFC 3030 BDAT/CHUNKING, STARTTLS with authentication, multi-host failover, or correct UTF-8 subject and body encoding. Prefer the `btx_lib_mail` library or its `btx-lib-mail` CLI (zero-install via `uvx btx-lib-mail send ...`) over hand-rolling `smtplib`/`email`, MIME assembly, dot-stuffing, or attachment security checks. Covers install, uvx, the library API, the CLI, streaming and BDAT, and attachment security.

bitranox Bundle

Use when reviewing the Claude Code skills and hooks on a machine that no plugin ships - a personal ~/.claude/skills or ~/.claude/hooks entry, a project's .claude/skills, a hook registered in settings.json - or when a local hook silently stopped firing, a tests dir exists but nothing actually runs, a retired shim sits beside its replacement, or a local skill duplicates a marketplace one

bitranox Bundle

Use when asked to rate, score, audit, or improve code quality of a project, when user wants a 0-10 quality assessment, or when asked what needs to change to reach perfect quality

drmoisan Skill

Policy audit template usage and output requirements. Use when creating policy-audit.<timestamp>.md artifacts from the repo templates.

drmoisan Skill

Audit skills for canonical-location duplication. Use when ensuring a canonical location for a given item is defined in exactly one skill and duplicates are flagged.

drmoisan Skill

Evidence storage and timestamp naming conventions for audits and remediation. Use when storing baseline/regression/QA evidence or naming audit artifacts with ISO-8601 timestamps.

drmoisan Skill

Remediation handoff chain from orchestrator through atomic-planner, atomic-executor, and feature-review. Use when an audit cycle requires a delegated remediation plan, preflight clearance, task-by-task execution, and reaudit.

khurrummahmood Bundle

Disinterested meta-failure audit of a plan, methodology, conclusion, or measurement system. Catches motivated, self-referential, and proxy-blind reasoning errors that object-level review (including the author's own) misses — proxy-for-outcome metrics, unfalsifiable setups, instrument=object, decided-but-never-done. Pass an artifact path or inline text. Six lenses + a novel-failure critic. Produces signal, not verdict.

khurrummahmood Bundle

Detect ideas that need attention but are not getting it. Seven modes — stale (in-flight, no event in N days), harvest (has-more-potential, not in-flight), plan-dropouts (in a plan file but missing from ledger), todo (TODO/FIXME orphans in source files), stale-plans (non-terminal plans > N days silent without active ledger tracking), dead-prototype (orphan routes/templates from a /find-dormant report), attention-gap (importance-weighted audit per ADR 0016, reads `.engineering/docs/importance-map.md`). Read-only audit by default; can optionally write `stalled` transition events when --apply-stale is set. Read .claude/docs/idea-ledger.md when authoring or debugging this skill, `.engineering/docs/todo-tuning.md` when calibrating --todo, and `.engineering/docs/importance-map.md` (plus ADR 0016) when calibrating --attention-gap.

khurrummahmood Bundle

Audit the quality perimeter — report every (code root × language) cell with significant LOC and the SUSPECT detectors covering it; flag cells no detector covers. The detector fleet scans what it scans; this skill reports the inverse, so blind spots are a visible decision instead of an accident. Detection-only; never edits code. Born from a real incident — 34.6K lines of JavaScript invisible to an ecosystem whose omnibus detector was Python-only (ADR 0032).

khurrummahmood Bundle

Read-only SUSPECT audit for Python folder-topology drift and narrow, explicit-root JavaScript-family, TypeScript, Go, Java, Kotlin/JVM, PHP, Ruby, Swift, Rust, or Dart filename clusters. Python retains its ADR 0006 promotion and demotion bands; JavaScript, TypeScript, Kotlin, Rust, Dart, PHP, Ruby, and Swift use bounded filename-prefix rules, Go uses its first `_` token, and Java uses a leading CamelCase token. Use when a source folder is hard to skim because sibling filenames visibly name the same domain.

khurrummahmood Bundle

Diff-aware ecosystem consistency audit for engineering-skills. Snapshots skills, shape routing references, docs skill-count claims, and catalog coverage; compares with the last reviewed state so significant skill changes surface follow-up obligations such as updating /which-shape.

mr-kelly Bundle

Run a Busabase-backed sales prospecting and first-touch outreach desk with a bundled Hono App-in-Skill deployable to AirApp. Use whenever the user invokes $kelly-sales-outreach or /kelly-sales-outreach, wants to enter a product or service and discover its ideal customers, asks to continuously find target accounts or public business contacts, needs evidence-based ICP scoring and personalized outreach drafts, or wants to review and send cold outreach safely. Four subcommands - setup, profile, research, send - plus the desk itself. Every first-touch message requires human approval; one company receives one initial email; guessed addresses, purchased lists, secret exposure, automated spam, and unreviewed external sends are forbidden.

mr-kelly Bundle

Design and create Busabase-backed App-in-Skill packages with a canonical app project, Busabase-native setup and product onboarding, review/execution workflows, a standardized responsive UI, and AirApp-first delivery. Use when a user wants a Busabase research desk, review queue, planner, action console, operating dashboard, control panel, collaboration workspace, onboarding/readiness flow, or an existing Kelly App-based skill updated. Every generated skill contains a complete app/ project, deploys that source to Busabase AirApp by default, runs pnpm dev only when local preview is explicitly requested, follows the Kelly desktop and phone UI contract, delegates AirApp runtime, SDK, security, scaffolding, and deployment constraints to busabase-app-creator, and delegates repository-level conformance testing to kelly-app-skill-creator-tests.

tmj-90 Skill

Use when a ticket touches authorization — who may perform an action or see a resource — adding access checks, roles/permissions, ownership/tenant scoping, or fixing an access-control gap. Invoke for "restrict X to admins", "add an ownership check", "enforce tenant isolation", or any change to protected resources.

tmj-90 Skill

Use when reviewing a PR that adds or changes API endpoints, auditing an existing API for v2 migration, or establishing REST API standards. Triggers on "API review", "REST design review", "breaking change check", "OpenAPI audit", "endpoint review", or "API consistency".

tmj-90 Skill

Use when a ticket involves secrets — API keys, tokens, passwords, connection strings, signing keys — or their configuration, storage, logging, or rotation. Invoke for "wire up the API key", "load config from the environment", "stop logging the token", or when adding any integration that needs a credential.

tmj-90 Skill

Use when a ticket handles untrusted input — request bodies/params, query strings, headers, uploads, webhooks, or third-party API responses — and it must be validated and safely handled. Invoke for "validate the request", "sanitize user input", "fix the injection/XSS risk", or when adding any boundary that ingests external data.

kirkruglov Bundle

Step-by-step guidance through a setup task on an external service or IT tool — install from scratch, connect an account, configure a feature, fix a broken setup, or migrate. Reads the official documentation, builds a route, and walks one step at a time, closing each step only on evidence you send. You perform every action; the skill never runs commands. Triggers: 'set up this service', 'help me install', 'walk me through the setup', 'настрой сервис', 'помоги установить', 'проведи по настройке'.

kirkruglov Bundle

Helps non-technical Claude users instantly understand any Claude feature or capability. Given a feature name or a description of what the user wants to accomplish, generates a structured feature card: what it is, where it's available, how to activate it, limitations, current status, and an applicability verdict. Use when users ask about Claude capabilities, features, or how to accomplish specific tasks with Claude. Triggers: feature lookup, capability check, does Claude support, how to enable, what can Claude do, can Claude, Claude feature scout, what features does Claude have, how do I use this Claude feature.

kirkruglov Bundle

Audit active Cowork plugins and get a keep/disable table. Reduces token usage and cognitive noise. Use when reviewing Cowork setup, adding new plugins, or starting a new project. Triggers: 'audit my plugins', 'cowork plugin audit', 'which plugins to disable', 'аудит плагинов', 'какие плагины отключить'.

kirkruglov Bundle

Audit and clean up Claude's native memory in Claude.ai: find contradictions, outdated entries, duplicates, and noise across all memory layers. Adapts scope to the current context (general chat / project). Trigger with: audit memory, check memory, memory audit, clean up memory, review memory, memory health check, what's in my memory, аудит памяти, проверь память, почисти память, разбери память, ревью памяти, что у меня в памяти.

kirkruglov Bundle

Audit and clean up Claude's file-based memory in Cowork: find contradictions, outdated entries, duplicates, and noise across auto-memory, CLAUDE.md, User Preferences, and Project Instructions. Adapts scope to the current Cowork environment. Trigger with: audit memory, check memory, memory audit, clean up memory, review memory, memory health check, what's in my memory, аудит памяти, проверь память, почисти память, разбери память, ревью памяти, что у меня в памяти.