← all publishers

abelrguezr

@abelrguezr source repo

Report this profile Claim this profile

• 861 skills
• 0 followers
• 1 week ago last updated

1. ▌
   Command Injection Testing · abelrguezr bundle

   How to identify, test, and exploit command injection vulnerabilities in web applications. Use this skill whenever the user mentions command injection, OS command injection, RCE through user input, shell metacharacters, or wants to test for arbitrary command execution. Also trigger when users discuss vulnerable parameters like cmd, exec, command, query, ping, or when they need to bypass input filters for security testing.
   2 installs
2. ▌
   Rate Limit Bypass · abelrguezr bundle

   Use this skill whenever testing rate limits, brute force protection, OTP verification, login throttling, or any API endpoint with request limits. Trigger on mentions of rate limiting, throttling, brute force, OTP bypass, login limits, API quotas, or when you need to test authentication security. This skill provides techniques to bypass rate limiting mechanisms during authorized security assessments.
   2 installs
3. ▌
   Uuid Security Audit · abelrguezr bundle

   Audit web applications for UUID security vulnerabilities. Use this skill whenever you need to analyze UUID implementations, identify predictable UUID patterns, assess password reset token security, or perform security testing on any system using UUIDs. Trigger this skill for any request about UUID security, identifier predictability, token brute-force risks, or when reviewing authentication/authorization systems that use UUIDs.
   2 installs
4. ▌
   Websocket Security Testing · abelrguezr bundle

   Perform WebSocket security testing including enumeration, fuzzing, CSWSH detection, and vulnerability assessment. Use this skill whenever the user mentions WebSocket testing, real-time communication security, wss/ws endpoints, cross-site WebSocket hijacking, or needs to audit WebSocket implementations for vulnerabilities like race conditions, prototype pollution, or authentication bypass.
   2 installs
5. ▌
   Array Indexing Exploitation · abelrguezr bundle

   How to identify and exploit array indexing vulnerabilities in binary exploitation challenges. Use this skill whenever the user mentions array bounds, index manipulation, off-by-one errors, array overflows, heap corruption through arrays, or any CTF/binary challenge involving array access. This skill covers colliding arrays, size field overwrites, GOT corruption, ROP chains triggered by array bugs, and heap exploitation through index manipulation. Make sure to use this skill for any binary exploitation task involving arrays, even if the user doesn't explicitly mention "array indexing" or "bounds checking".
   4 installs
6. ▌
   Freeipa Pentesting · abelrguezr bundle

   FreeIPA penetration testing and enumeration. Use this skill whenever the user mentions FreeIPA, Kerberos on Unix, LDAP enumeration, IPA domain attacks, or any Active Directory-like infrastructure on Linux/Unix systems. This skill covers authentication, enumeration, hash extraction, and privilege escalation techniques for FreeIPA environments.
   2 installs
7. ▌
   Parameter Pollution · abelrguezr bundle

   How to test for HTTP Parameter Pollution (HPP), JSON injection, and parameter parsing vulnerabilities in web applications. Use this skill whenever you're testing web apps for input validation issues, parameter manipulation, duplicate parameter handling, or JSON deserialization inconsistencies. Trigger this skill for any pentesting task involving URL parameters, form fields, API requests, or JSON payloads where parameter pollution could be exploited.
   2 installs
8. ▌
   Reverse Tab Nabbing · abelrguezr bundle

   Security skill for identifying and fixing reverse tab nabbing vulnerabilities in HTML links. Use this skill whenever you need to audit HTML code for target="_blank" security issues, review link patterns, or secure web applications against window.opener attacks. This skill helps detect vulnerable anchor tags and provides remediation guidance. Make sure to use this skill when reviewing any HTML with external links, auditing web applications for security vulnerabilities, or when users mention phishing, link security, or target blank issues.
   2 installs
9. ▌
   Android Apk Pentest · abelrguezr bundle

   Android APK penetration testing methodology and checklist. Use this skill whenever analyzing Android applications for security vulnerabilities, performing mobile app security assessments, reverse engineering APKs, or conducting static/dynamic analysis of Android apps. Trigger for any Android security testing, APK analysis, mobile pentesting, or when investigating Android app vulnerabilities including exported components, insecure data storage, crypto issues, intent-based attacks, WebView exploits, or Play Integrity bypasses.
   2 installs
10. ▌
    Dependency Confusion Audit · abelrguezr bundle

    Audit and remediate dependency confusion vulnerabilities in package management configurations. Use this skill whenever the user mentions package managers (npm, pip, Maven, Gradle, NuGet, Go modules, Cargo, Bundler), CI/CD security, supply chain attacks, internal registries, or wants to secure their build dependencies. Also use when reviewing .npmrc, pip.conf, nuget.config, settings.xml, Gemfile, or any package configuration files. Make sure to use this skill when the user asks about securing dependencies, preventing supply chain attacks, or configuring private registries.
    2 installs
11. ▌
    Sqlmap Pentest · abelrguezr bundle

    SQL injection testing with sqlmap. Use this skill whenever the user needs to test for SQL injection vulnerabilities, enumerate databases, extract data from vulnerable applications, or bypass WAFs with sqlmap. Trigger on any mention of SQL injection testing, sqlmap commands, database enumeration, WAF bypass, or web application security testing involving SQL. Don't wait for explicit "use sqlmap" - if they're testing SQLi or need database extraction, this skill applies.
    2 installs
12. ▌
    Text Tokenizer · abelrguezr bundle

    How to tokenize text for LLMs and NLP models. Use this skill whenever the user needs to convert text into token IDs, understand tokenization methods (BPE, WordPiece, Unigram), work with vocabularies, or implement tokenization for machine learning. Make sure to use this skill when users mention tokenizing, token IDs, vocabulary creation, BPE, WordPiece, or any text preprocessing for ML models.
    2 installs
13. ▌
    Supervised Learning Cybersecurity · abelrguezr bundle

    How to implement supervised machine learning algorithms for cybersecurity tasks like intrusion detection, malware classification, phishing detection, and spam filtering. Use this skill whenever the user mentions machine learning, ML models, classification, regression, cybersecurity datasets, NSL-KDD, phishing detection, intrusion detection, malware analysis, or wants to build predictive models for security applications. This skill covers Linear Regression, Logistic Regression, Decision Trees, Random Forests, SVM, Naive Bayes, k-NN, and Gradient Boosting with ready-to-use Python code.
    2 installs
14. ▌
    Reverse Shell Defense · abelrguezr bundle

    Security education skill for understanding reverse shell techniques to improve defensive security posture. Use this skill when users ask about reverse shells, shell connections, or need to understand how attackers establish remote access for authorized security testing, incident response, or defensive hardening. This skill focuses on detection, prevention, and authorized testing only.
    2 installs
15. ▌
    Pjl Printer Pentest · abelrguezr bundle

    Pentest network printers via PJL (Printer Job Language) on port 9100/tcp. Use this skill whenever the user mentions printer security, port 9100, JetDirect, AppSocket, PJL commands, printer enumeration, printer exploitation, PRET tool, or any printer-related security testing. This includes tasks like enumerating printer info, accessing printer filesystems, uploading/downloading files, or exploiting printer vulnerabilities like TrueType VM bugs.
    2 installs
16. ▌
    JSON XML YAML Hacking · abelrguezr bundle

    Security testing skill for auditing JSON, XML, and YAML parser vulnerabilities. Use this skill whenever you need to test for deserialization attacks, parser inconsistencies, duplicate field exploits, case-insensitivity bypasses, or data format confusion attacks. Trigger this skill for any security audit involving data parsing, API input validation, authentication bypass testing, or when reviewing code that handles JSON/XML/YAML deserialization. Don't skip this skill when testing web applications, microservices, or any system that parses structured data from untrusted sources.
    2 installs
17. ▌
    Malware API Reference · abelrguezr bundle

    Reference for Windows APIs commonly used in malware, malware analysis techniques, and detection strategies. Use this skill whenever the user mentions malware analysis, reversing, Windows API calls, process injection, DLL injection, process hollowing, anti-analysis techniques, threat hunting, detection rules, or any security research involving Windows executables. Trigger even if they don't explicitly say "malware" but describe suspicious behavior, API sequences, or need to understand how malware evades detection.
    2 installs
18. ▌
    Chrome Exploitation Research · abelrguezr bundle

    Guide for Chrome browser exploitation research and full-chain vulnerability analysis. Use this skill when researching Chrome security, analyzing browser vulnerabilities, developing proof-of-concepts for CVEs, or understanding Chrome's multi-layered sandbox architecture. Trigger this skill for any Chrome exploitation questions, V8 sandbox escape techniques, Mojo IPC abuse, WebAssembly JIT bugs, or when setting up Chrome debugging environments for security research.
    2 installs
19. ▌
    Macos Enumeration · abelrguezr bundle

    macOS system enumeration, information gathering, and troubleshooting. Use this skill whenever the user needs to gather system information on macOS, enumerate users and processes, check network configuration, list installed applications, troubleshoot system issues, or perform administrative tasks on macOS. Trigger for any request involving macOS commands, system_profiler, launchctl, networksetup, brew, or general macOS system exploration.
    2 installs
20. ▌
    Cassandra Pentest · abelrguezr bundle

    Pentest Apache Cassandra databases. Use this skill whenever you need to enumerate, assess, or test Cassandra instances on ports 9042 or 9160. Trigger this skill for any Cassandra security assessment, database enumeration, credential discovery, or when you find open Cassandra ports during network reconnaissance. Don't forget to use this skill even if the user just mentions "Cassandra" or "9042" or "9160" in the context of security testing.
    2 installs
21. ▌
    Windows Av Edr Defense Research · abelrguezr bundle

    Use this skill for Windows AV/EDR defense research, detection engineering, and authorized security assessments. Trigger when users need to understand AV/EDR bypass techniques for building detections, analyzing malware behavior, conducting authorized penetration testing, or researching Windows security mechanisms. This skill covers AMSI, ETW, Defender, PPL, DLL sideloading, and other Windows security features from a defensive perspective.
    2 installs
22. ▌
    Ntlm Hardening · abelrguezr bundle

    Guide for understanding NTLM authentication, configuring NTLM security settings, and hardening Windows environments against NTLM-based attacks. Use this skill whenever the user asks about NTLM authentication, LM/NTLMv1/NTLMv2 protocols, Pass-the-Hash attacks, NTLM relay attacks, configuring LMCompatibilityLevel, or Windows authentication security. Also use when users need to parse NTLM challenges from network captures, understand NTLM reflection attacks, or harden systems against credential theft.
    2 installs
23. ▌
    Linux Basics · abelrguezr bundle

    How to work with Linux fundamentals including file permissions, user management, process control, and system navigation. Use this skill whenever the user needs help with Linux commands, file operations, permissions, users/groups, processes, or basic system administration tasks. Trigger for any Linux-related questions about navigating directories, managing files, understanding permissions, running commands, or troubleshooting basic system issues.
    2 installs
24. ▌
    H2c Websocket Smuggling · abelrguezr bundle

    How to perform H2C (HTTP/2 over cleartext) and WebSocket smuggling attacks to bypass reverse proxy protections. Use this skill whenever you need to test for upgrade header smuggling vulnerabilities, bypass WAF/proxy rules, access internal endpoints behind a reverse proxy, or when you encounter HAProxy, Traefik, NGINX, Apache, AWS ALB/CLB, or other proxies that might forward Upgrade headers. Trigger this skill for any pentesting task involving HTTP upgrade mechanisms, WebSocket connections, or when standard requests are blocked but you suspect a proxy misconfiguration.
    2 installs
25. ▌
    Open Redirect Pentest · abelrguezr bundle

    Detect and exploit open redirect vulnerabilities in web applications. Use this skill whenever you need to test for open redirect bugs, analyze redirect parameters, bypass URL validation filters, or chain redirects with XSS/SSRF. Trigger this skill for any web security testing involving URL redirects, OAuth flows, login redirects, or when you see parameters like next=, url=, redirect=, return=, dest=, or similar redirect-related inputs.
    2 installs
26. ▌
    Orm Injection Audit · abelrguezr bundle

    Audit applications for ORM injection vulnerabilities across Django, Prisma, Beego, Entity Framework, and Ransack. Use this skill whenever you need to test for database query manipulation, filter bypass, relational traversal attacks, or data exfiltration through ORM layers. Trigger this skill for any security audit involving user-controlled database queries, API endpoints with filtering, or applications using ORM frameworks with dynamic query construction.
    2 installs
27. ▌
    Captcha Bypass · abelrguezr bundle

    Techniques for bypassing captchas during authorized security testing and penetration testing. Use this skill whenever you're testing web applications and encounter captcha challenges that need to be automated or bypassed for testing purposes. This includes penetration testing, security assessments, and authorized vulnerability scanning. Don't use this for unauthorized access or malicious purposes.
    2 installs
28. ▌
    Ldap Injection Pentest · abelrguezr bundle

    Use this skill whenever you need to test for LDAP injection vulnerabilities, analyze LDAP queries, or perform LDAP security assessments. Trigger this skill for any LDAP-related security testing, authentication bypass attempts, directory service penetration testing, or when investigating web applications that use LDAP for authentication. Don't forget to use this skill when you see login forms, directory services, or any application that might be vulnerable to LDAP injection attacks.
    2 installs
29. ▌
    Race Condition Exploitation · abelrguezr bundle

    How to identify and exploit race condition vulnerabilities in web applications. Use this skill whenever the user mentions race conditions, TOCTOU attacks, concurrent request exploitation, HTTP/2 single-packet attacks, limit-overrun vulnerabilities, hidden substates, or timing-based security bypasses. Also trigger when users want to test for race conditions in authentication flows, payment systems, coupon redemption, email verification, OAuth token generation, or any stateful web application logic.
    2 installs
30. ▌
    Password Reset Bypass Testing · abelrguezr bundle

    Security testing skill for identifying password reset vulnerabilities. Use this skill whenever the user needs to test password reset functionality for security flaws, audit authentication flows, or assess reset token security. Trigger on requests about password reset testing, authentication bypass, token leakage, reset endpoint security, or any password recovery mechanism assessment. Make sure to use this skill for any pentesting task involving password reset flows, even if the user doesn't explicitly mention 'password reset' but describes authentication or account recovery testing.
    2 installs
31. ▌
    Rsql Injection Testing · abelrguezr bundle

    Test REST APIs for RSQL injection vulnerabilities. Use this skill whenever you need to assess API endpoints for RSQL filter injection, including information leakage, authorization bypass, privilege escalation, and IDOR attacks. Trigger this skill when analyzing REST APIs with filter parameters, q parameters, or any query-based filtering in URLs.
    2 installs
32. ▌
    Timing Attacks · abelrguezr bundle

    How to perform timing attacks on web applications to discover hidden parameters, headers, and scoped SSRFs. Use this skill whenever the user mentions timing analysis, response time differences, hidden attack surface discovery, race conditions, or wants to detect backend behavior through response latency. Make sure to use this skill for any web pentesting task involving parameter discovery, proxy detection, or when traditional methods aren't revealing the full attack surface.
    2 installs
33. ▌
    Web Fuzzing Wfuzz · abelrguezr bundle

    How to use WFuzz for web application fuzzing and brute force testing. Use this skill whenever the user mentions web fuzzing, brute forcing login forms, directory enumeration, parameter discovery, header testing, cookie brute forcing, HTTP method testing, or any web application security assessment that involves testing multiple values against a target. Make sure to use this skill for any web penetration testing task that requires systematic testing of inputs, even if the user doesn't explicitly mention "fuzzing" or "brute force."
    2 installs
34. ▌
    Nosql Injection · abelrguezr bundle

    How to test for NoSQL injection vulnerabilities in MongoDB and other NoSQL databases. Use this skill whenever the user mentions NoSQL injection, MongoDB injection, database injection testing, authentication bypass, or wants to test for NoSQL vulnerabilities in web applications. Make sure to use this skill for any security testing involving MongoDB, Mongoose, or NoSQL databases, even if the user doesn't explicitly mention 'injection'.
    2 installs
35. ▌
    Crypto Ctf Helper · abelrguezr bundle

    Help with cryptography challenges for CTFs, security research, and hacking. Use this skill whenever the user mentions crypto, encryption, decryption, hashes, RSA, AES, CTF challenges, cryptographic attacks, or anything related to breaking or analyzing cryptographic systems. This includes recognizing cipher types, identifying vulnerabilities, applying known attacks, and working with crypto primitives.
    2 installs
36. ▌
    Burp MCP Integration · abelrguezr bundle

    Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.
    2 installs
37. ▌
    Text Steganography Detection · abelrguezr bundle

    Detect and decode hidden data in text using Unicode steganography techniques. Use this skill whenever you need to analyze suspicious text files, CTF challenges with hidden messages, or any text that might contain covert data through homoglyphs, zero-width characters, whitespace patterns, or CSS unicode-range encoding. Trigger this skill for any text forensics, CTF steganography challenges, or when text behaves unexpectedly.
    2 installs
38. ▌
    AI Models Rce · abelrguezr bundle

    Security skill for understanding and testing RCE vulnerabilities in AI/ML model loading. Use this skill whenever the user mentions machine learning models, model deserialization, PyTorch, TensorFlow, Keras, ONNX, or any ML framework loading. Also trigger when discussing model security, pickle vulnerabilities, CVE-2024-12029, CVE-2025-23298, or any AI/ML security audit. This skill helps create educational test payloads, audit vulnerable code, and implement mitigations for model loading RCE attacks.
    2 installs
39. ▌
    MCP Security Auditor · abelrguezr bundle

    Security auditing and hardening for Model Context Protocol (MCP) servers. Use this skill whenever the user mentions MCP servers, Model Context Protocol, AI agent security, tool poisoning, prompt injection in MCP, Cursor IDE vulnerabilities, Flowise MCP, or any MCP-related CVEs. Also trigger when users want to secure AI agent integrations, audit MCP configurations, or understand MCP attack vectors. Make sure to use this skill for any MCP security questions, even if the user doesn't explicitly mention "security" or "audit".
    2 installs
40. ▌
    Audio Steganography · abelrguezr bundle

    Extract hidden data from audio files using steganography techniques. Use this skill whenever the user mentions audio forensics, hidden messages in audio, spectrogram analysis, WAV file investigation, DTMF tones, modem sounds, or any audio file that might contain concealed data. This includes CTF challenges, security investigations, or any scenario where audio files need to be analyzed for hidden payloads.
    2 installs
41. ▌
    Skills Locator Navigation · abelrguezr bundle

    Locate, shortlist, and navigate the generated skills corpus quickly. Use this skill whenever the user asks to find a relevant skill, browse the 900+ skills, identify duplicates, map topic coverage, or open the correct SKILL.MD/scripts folder for a task.
    2 installs
42. ▌
    Deep Learning Helper · abelrguezr bundle

    Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.
    2 installs
43. ▌
    Idor Bola Testing · abelrguezr bundle

    How to find and exploit IDOR (Insecure Direct Object Reference) and BOLA (Broken Object Level Authorization) vulnerabilities in web applications and APIs. Use this skill whenever the user mentions IDOR, BOLA, authorization testing, object-level access control, parameter tampering, user ID enumeration, or wants to test if endpoints properly verify that callers are authorized to access specific objects. Make sure to use this skill for any web security testing involving user IDs, order IDs, file IDs, or any object references in URLs, query parameters, request bodies, or headers.
    2 installs
44. ▌
    Image Steganography · abelrguezr bundle

    Analyze images for hidden data using steganography techniques. Use this skill whenever the user mentions image forensics, CTF challenges with images, hidden messages in pictures, PNG/JPEG/GIF analysis, LSB extraction, metadata extraction, or any task involving finding concealed content in image files. Trigger for file extensions like .png, .jpg, .jpeg, .gif, .bmp, .apng, or when users ask about steganography, hidden payloads, or image-based data hiding.
    2 installs
45. ▌
    Crypto Hash Cracking · abelrguezr bundle

    How to crack hashes, perform length extension attacks, and break weak password hashing in CTFs. Use this skill whenever the user mentions hash cracking, password recovery, signature forgery, HMAC, MD5, SHA, bcrypt, hashcat, John the Ripper, or any CTF challenge involving cryptographic hashes. Make sure to use this skill for any challenge that involves identifying hash types, cracking password hashes, or exploiting hash length extension vulnerabilities.
    2 installs
46. ▌
    AI Risk Assessment · abelrguezr bundle

    How to assess and document AI security risks using industry frameworks. Use this skill whenever the user mentions AI security, ML vulnerabilities, model risks, LLM security, adversarial attacks, data poisoning, prompt injection, or needs to evaluate AI system safety. Trigger for any request about AI threat modeling, security audits, risk documentation, or compliance with AI security standards.
    2 installs
47. ▌
    Word Macro Analyzer · abelrguezr bundle

    Analyze and reverse engineer Word macros for security research. Use this skill whenever you need to examine VBA macros in Word documents, identify obfuscation techniques, detect junk code patterns, analyze macro forms for hidden data, or investigate potentially malicious macro behavior. Make sure to use this skill for any Word document macro analysis, VBA code review, or macro security assessment tasks.
    2 installs
48. ▌
    Stego Workflow · abelrguezr bundle

    Steganography analysis workflow for CTF challenges and security investigations. Use this skill whenever the user mentions steganography, hidden data, stego files, image analysis, audio forensics, file carving, or needs to find hidden payloads in files. Trigger for any file analysis task where hidden content might be embedded, including images, audio, documents, or suspicious binaries. Make sure to use this skill when users ask about extracting hidden messages, analyzing suspicious files, or solving steganography CTF challenges.
    2 installs
49. ▌
    Crypto Ctf Esolangs · abelrguezr bundle

    Use this skill whenever a CTF crypto challenge involves code that doesn't look like a standard programming language. This includes Brainfuck, Malbolge, Whitespace, Piet, and other esoteric languages. Trigger this skill when you see unusual syntax, strange characters, or code that appears to be a puzzle rather than normal programming. Also use when a challenge output needs decoding after running an esolang program.
    2 installs
50. ▌
    Xs Search Leaks · abelrguezr bundle

    Cross-origin information extraction using XS-Search and XS-Leak techniques. Use this skill when analyzing web applications for side-channel vulnerabilities, testing for information leakage through timing attacks, event handlers, performance APIs, or other browser-based leak techniques. Trigger when users mention XS-Search, XS-Leaks, cross-origin leaks, timing attacks, side-channel attacks, or need to extract information from cross-origin resources. Make sure to use this skill whenever the user is doing web pentesting and needs to extract cross-origin information, even if they don't explicitly mention XS-Search.
    2 installs
51. ▌
    Mythic C2 Framework · abelrguezr bundle

    How to set up and use the Mythic C2 framework for authorized red teaming and security testing. Use this skill whenever the user needs to install Mythic, configure agents (Apollo, Poseidon, etc.), set up C2 profiles, or execute common red team operations like lateral movement, privilege escalation, or credential access. Make sure to use this skill when the user mentions Mythic, C2 frameworks, red teaming, penetration testing, or authorized security assessments involving command and control infrastructure.
    2 installs
52. ▌
    Rsa Attacks · abelrguezr bundle

    How to break RSA encryption in CTFs and crypto challenges. Use this skill whenever the user mentions RSA, public-key cryptography, ciphertexts, moduli, exponents, or any crypto challenge involving n, e, c values. Make sure to use this skill for any RSA-related task even if the user doesn't explicitly say "RSA" - look for patterns like "modulus", "ciphertext", "public key", "private exponent", or hex strings that look like cryptographic values.
    2 installs
53. ▌
    2fa Bypass Testing · abelrguezr bundle

    Security testing skill for auditing 2FA/MFA/OTP implementations. Use this skill whenever you need to test two-factor authentication security, audit MFA implementations, check for OTP bypass vulnerabilities, or perform authorized penetration testing on authentication systems. This skill covers direct endpoint access, token manipulation, session hijacking, rate limiting analysis, and other 2FA bypass techniques for security assessments. Make sure to use this skill when the user mentions 2FA testing, MFA security, OTP vulnerabilities, authentication bypass, or any security assessment involving multi-factor authentication.
    2 installs
54. ▌
    Crlf Injection Pentest · abelrguezr bundle

    How to test for CRLF (Carriage Return Line Feed) injection vulnerabilities in web applications. Use this skill whenever you need to assess HTTP header injection, response splitting, or newline-based bypasses during web security testing. Trigger this skill when the user mentions CRLF, HTTP header injection, response splitting, newline injection, URL encoding attacks, or any scenario involving user input reflected in HTTP headers. Also use when testing for XSS via header injection, cache poisoning, or SSRF through HTTP request smuggling.
    2 installs
55. ▌
    Document Steganography · abelrguezr bundle

    Analyze documents for hidden steganographic content. Use this skill whenever the user needs to extract hidden data from PDFs, Office files (.docx/.xlsx/.pptx), or other document formats. Trigger on requests to find hidden files, extract embedded content, analyze document structures, or investigate suspicious documents in CTFs, forensics, or security research.
    2 installs
56. ▌
    Crypto Symmetric Ctf · abelrguezr bundle

    How to exploit symmetric cryptography vulnerabilities in CTF challenges. Use this skill whenever you encounter encryption, tokens, cookies, crypto challenges, or any CTF task involving AES, CBC, ECB, CTR, GCM, padding oracles, MACs, or stream ciphers. Trigger this for any challenge mentioning encryption modes, ciphertext, IVs, nonces, or authentication tags.
    2 installs
57. ▌
    Cors Bypass · abelrguezr bundle

    Test for Cross-Origin Resource Sharing (CORS) misconfigurations and bypass vulnerabilities. Use this skill whenever you need to audit web applications for CORS security issues, test Origin header validation, check for credential leakage, or explore DNS rebinding attacks. Trigger this skill for any web security assessment involving cross-origin requests, API security testing, or when investigating potential data exfiltration through CORS. Make sure to use this skill when the user mentions CORS, cross-origin, Origin header, web security testing, API security, or any scenario involving browser-based access to external resources.
    2 installs
58. ▌
    Brute Force Assistant · abelrguezr bundle

    Use this skill for authorized penetration testing and security assessments involving brute force attacks, password cracking, and credential testing. Trigger this skill when users need to test authentication systems, crack password hashes, generate custom wordlists, or perform service-specific brute force operations. Make sure to use this skill whenever the user mentions password cracking, hash cracking, brute force testing, credential testing, wordlist generation, or any authentication security assessment, even if they don't explicitly ask for 'brute force'.
    2 installs
59. ▌
    Clickjacking Pentest · abelrguezr bundle

    How to test for clickjacking vulnerabilities in web applications. Use this skill whenever the user mentions clickjacking, UI redressing, iframe attacks, frame-busting, X-Frame-Options, CSP frame-ancestors, or wants to test if a web page can be embedded in malicious iframes. Also use when testing for doubleclickjacking, SVG filter attacks, or browser extension clickjacking. Make sure to use this skill for any web security assessment involving iframe embedding, form manipulation, or UI overlay attacks.
    2 installs
60. ▌
    Iframe Traps · abelrguezr bundle

    How to build iframe trap attacks for XSS exploitation. Use this skill whenever the user mentions XSS, iframe attacks, credential harvesting, payment skimmers, or wants to persist XSS payloads by trapping victims in iframes. Also use when discussing modern navigation API tricks, overlay attacks, or bypassing content blockers with local frames.
    2 installs
61. ▌
    Prompt Injection Security · abelrguezr bundle

    Security skill for understanding, detecting, and defending against prompt injection attacks on AI/LLM systems. Use this skill whenever the user asks about AI security, prompt injection vulnerabilities, LLM attack vectors, jailbreak techniques, or needs help securing AI applications against malicious prompts. Also use when reviewing AI system designs, conducting security assessments of LLM integrations, or creating security documentation for AI systems.
    2 installs