How do I install the References skill?

Run npx skillmds@latest add purpleailab/references in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is References safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with References?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is References free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published References?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

References by purpleailab — Agent Skill

Name: References
Author: purpleailab

References

External knowledge integration — HackerOne reports, PayloadsAllTheThings, Book of Secret Knowledge, CVE PoC corpora, bug bounty methodologies, and reference pentest agent architectures. Use these to calibrate, look up payloads, and accelerate research.

purpleailab 1b316c2 4.2 KB Updated Sep 17, 2026

File contents

External References Skill

Decepticon ships with a curated catalogue of high-signal third-party resources. You can either query the metadata directly or fetch the full repo into the sandbox for grep-level access.

Catalogue (13 entries)

Category	Slug	What's inside
report-corpus	hackerone-reports	Every public H1 disclosure — calibrate CVSS + reward
payload-library	payloads-all-the-things	Canonical payloads for every web vuln class
cheat-sheet	book-of-secret-knowledge	Pentester one-liners + recipes
reference-agent	pentagi	vxcontrol multi-agent pentest platform
reference-agent	pentestgpt	Academic pentest LLM agent
reference-agent	shannon	Keygraph autonomous security agent
reference-agent	strix	Usestrix autonomous pentest agent
reference-agent	hexstrike-ai	150+ tools exposed via MCP
reference-agent	neurosploit	LLM + Metasploit driver
tool-index	redteam-tools	Kill-chain-phase tool index
cve-poc	trickest-cve	Continuous CVE + PoC corpus
cve-poc	penetration-testing-poc	Second-opinion PoC mirror
methodology	all-about-bug-bounty	Per-class bug bounty methodology

When to use each

First engagement iteration

ref_suggest(vuln_class="...", goal="recon") to see which references matter for your current lane. Save the suggestions to the graph.

When you need a payload RIGHT NOW

payload_search(vuln_class="ssrf", keyword="imds") — no network needed, bundled offline. Covers sqli, ssrf, xss, ssti, deser, rce, xxe, idor, jwt, oauth, lfi, cmdi, graphql, prompt-injection, proto-pollution.

When you need the FULL library

ref_fetch("payloads-all-the-things") — one-time clone into /workspace/.references/payloads-all-the-things/ (~30s).
ref_grep("payloads-all-the-things", "DNS rebinding") to find specific variants.

Report calibration

ref_fetch("hackerone-reports") then ref_grep("hackerone-reports", "<your bug class>") to find similar disclosed reports.
Copy the report structure that got paid — it's validated by triagers.

CVE → PoC

After cve_lookup returns a CVE ID, check ref_fetch("trickest-cve") then ref_grep("trickest-cve", "CVE-2024-1234") for a working PoC.
Cross-reference with penetration-testing-poc for a second opinion.

Tool discovery

ref_grep("redteam-tools", "lateral movement") to find the right tool for a phase you haven't touched yet.

Workflow

Identify the vuln class or phase you're working on.
ref_suggest to get the top 3-5 relevant references.
For each, decide: metadata only, offline bundled payload, or full repo clone.
Use ref_grep to surface the specific payload / writeup.
Record any borrowed payloads / patterns as hypothesis nodes in the graph until validated.

Shannon, Strix, HexStrike, Pentagi, PentestGPT, NeuroSploit

These are reference architectures, not tools to run. Read them to steal good ideas about:

Multi-agent orchestration patterns
Tool wrapping idioms
Prompt engineering for pentest workflows
How other projects handle memory / state / observability

Don't reinvent wheels — if one of them solved a problem elegantly, borrow the pattern into Decepticon's next iteration.

---name: referencesdescription: External knowledge integration — HackerOne reports, PayloadsAllTheThings, Book of Secret Knowledge, CVE PoC corpora, bug bounty methodologies, and reference pentest agent architectures. Use these to calibrate, look up payloads, and accelerate research.---# External References SkillDecepticon ships with a curated catalogue of high-signal third-partyresources. You can either query the metadata directly or fetch thefull repo into the sandbox for grep-level access.## Catalogue (13 entries)| Category | Slug | What's inside ||-----------------|-------------------------|----------------------------------------------------------------|| report-corpus | hackerone-reports | Every public H1 disclosure — calibrate CVSS + reward || payload-library | payloads-all-the-things | Canonical payloads for every web vuln class || cheat-sheet | book-of-secret-knowledge| Pentester one-liners + recipes || reference-agent | pentagi | vxcontrol multi-agent pentest platform || reference-agent | pentestgpt | Academic pentest LLM agent || reference-agent | shannon | Keygraph autonomous security agent || reference-agent | strix | Usestrix autonomous pentest agent || reference-agent | hexstrike-ai | 150+ tools exposed via MCP || reference-agent | neurosploit | LLM + Metasploit driver || tool-index | redteam-tools | Kill-chain-phase tool index || cve-poc | trickest-cve | Continuous CVE + PoC corpus || cve-poc | penetration-testing-poc | Second-opinion PoC mirror || methodology | all-about-bug-bounty | Per-class bug bounty methodology |## When to use each### First engagement iteration- `ref_suggest(vuln_class="...", goal="recon")` to see which references matter for your current lane. Save the suggestions to the graph.### When you need a payload RIGHT NOW- `payload_search(vuln_class="ssrf", keyword="imds")` — no network needed, bundled offline. Covers sqli, ssrf, xss, ssti, deser, rce, xxe, idor, jwt, oauth, lfi, cmdi, graphql, prompt-injection, proto-pollution.### When you need the FULL library- `ref_fetch("payloads-all-the-things")` — one-time clone into `/workspace/.references/payloads-all-the-things/` (~30s).- `ref_grep("payloads-all-the-things", "DNS rebinding")` to find specific variants.### Report calibration- `ref_fetch("hackerone-reports")` then `ref_grep("hackerone-reports", "<your bug class>")` to find similar disclosed reports.- Copy the report structure that got paid — it's validated by triagers.### CVE → PoC- After `cve_lookup` returns a CVE ID, check `ref_fetch("trickest-cve")` then `ref_grep("trickest-cve", "CVE-2024-1234")` for a working PoC.- Cross-reference with `penetration-testing-poc` for a second opinion.### Tool discovery- `ref_grep("redteam-tools", "lateral movement")` to find the right tool for a phase you haven't touched yet.## Workflow1. Identify the vuln class or phase you're working on.2. `ref_suggest` to get the top 3-5 relevant references.3. For each, decide: metadata only, offline bundled payload, or full repo clone.4. Use `ref_grep` to surface the specific payload / writeup.5. Record any borrowed payloads / patterns as `hypothesis` nodes in the graph until validated.## Shannon, Strix, HexStrike, Pentagi, PentestGPT, NeuroSploitThese are *reference architectures*, not tools to run. Read them tosteal good ideas about:- Multi-agent orchestration patterns- Tool wrapping idioms- Prompt engineering for pentest workflows- How other projects handle memory / state / observabilityDon't reinvent wheels — if one of them solved a problem elegantly,borrow the pattern into Decepticon's next iteration.

Frequently asked questions