effect
01Skill Claude CodeCodex
Work with Effect v4 / effect-smol TypeScript code in this repo.
not rated 849
+21 14d ago A 17 tokens
copy · 100% MIT
Skill Claude CodeCodex
Post-exploitation gotchas — credential dump order, DPAPI trap, host exhaustion checklist. Use when the current phase is POSTEXPLOIT.
not rated 849
+21
changed 1mo ago A SkillSpector: warn 34 tokens
original MIT
Skill Claude CodeCodex
Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.
not rated 849
+21 14d ago A SkillSpector: pass 24 tokens
original MIT
playbook-ad
04Skill Claude CodeCodex
AD attack decision tree — which attacks need creds, delegation types, ADCS, key paths to DA. Load when a Windows domain / DC is found. Triggers - domain controller, Kerberos, LDAP, BloodHound, kerberoast, AS-REP, NTLM, ADCS ESC1-8.
not rated 849
+21
changed 1mo ago A SkillSpector: warn 68 tokens
original MIT
Skill Claude CodeCodex
Cloud IAM privesc paths and metadata endpoints per provider. Load when the target is cloud or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM, S3/blob, 169.254.169.254, access key.
not rated 849
+21
changed 1mo ago C SkillSpector: warn 57 tokens
original MIT
Skill Claude CodeCodex
Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web- skill to load for each surface. Use on any web app / HTTP API engagement.
not rated 849
+21 14d ago A SkillSpector: pass 78 tokens
original MIT
svc-cicd
07Skill Claude CodeCodex
CI/CD gotchas — default creds, instant-RCE paths, secret leaks in logs. Use when a CI/CD service is found. Triggers - Jenkins, GitLab, ArgoCD, Vault, pipeline, runner token.
not rated 849
+21
changed 1mo ago B SkillSpector: warn 51 tokens
original MIT
svc-database
08Skill Claude CodeCodex
Database RCE paths — UDF, xpcmdshell, COPY TO PROGRAM, Redis key write. Use when a database service is found. Triggers - MySQL 3306, PostgreSQL 5432, MSSQL 1433, Redis 6379, MongoDB 27017.
not rated 849
+21
changed 1mo ago A SkillSpector: warn 64 tokens
original MIT
Skill Claude CodeCodex
Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft. Use when a container/orchestration surface is found. Triggers - Docker 2375/2376, Kubernetes API 6443, kubelet 10250, etcd 2379, /version, privileged pod, service-account token, docker.sock.
not rated 849
+21 14d ago D 85 tokens
original MIT
svc-ftp
10Skill Claude CodeCodex
FTP version exploits — vsftpd backdoor, ProFTPD modcopy, writable upload→shell chain. Use when FTP is open. Triggers - port 21, vsftpd 2.3.4, ProFTPD modcopy.
not rated 849
+21
changed 1mo ago A SkillSpector: warn 55 tokens
original MIT
svc-pivoting
11Skill Claude CodeCodex
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold…
not rated 849
+21 14d ago A SkillSpector: warn 103 tokens
original MIT
svc-smb
12Skill Claude CodeCodex
SMB gotchas — DPAPI dump trap, relay when signing disabled, credential dump order. Use when SMB is found. Triggers - ports 445/139, signing:False, null session, EternalBlue MS17-010, PetitPotam.
not rated 849
+21
changed 1mo ago A SkillSpector: warn 56 tokens
original MIT
svc-ssh
13Skill Claude CodeCodex
SSH version CVEs and post-auth tricks — regreSSHion, user enum, agent hijack. Use when SSH is open. Triggers - port 22, OpenSSH banner, regreSSHion CVE-2024-6387, CVE-2018-15473.
not rated 849
+21
changed 1mo ago C 64 tokens
original MIT
Skill Claude CodeCodex
Web SERVER software (not app-layer) attack techniques — server misconfigs, known server CVEs, path traversal, exposed status/config. Use when you fingerprint the web server itself (for app-layer bugs use the web- skills). Triggers - Server header, Apache 2.4.49/2.4.50, nginx alias traversal, IIS, Tomcat…
not rated 849
+21 14d ago B SkillSpector: warn 90 tokens
original MIT
Skill Claude CodeCodex
Broken access control - IDOR, privilege escalation, JWT abuse, mass assignment, forced browsing - for web apps and APIs. Use on any multi-user or role-based app with object IDs, tokens, or admin functionality. Triggers - /api/users/ , /orders/ , ?account=/uid=/doc=, JWT (eyJ...), role/isAdmin field, admin panel, "403…
not rated 849
+21 14d ago A SkillSpector: warn 97 tokens
original MIT
Skill Claude CodeCodex
Insecure deserialization to RCE for web apps. Use when the app deserializes attacker-controlled data - cookies/tokens/hidden fields/params that are serialized blobs, VIEWSTATE, Java/PHP/.NET/Python/Node apps. Triggers - base64 starting rO0AB or hex AC ED 00 05 (Java), PHP serialize O-prefix, VIEWSTATE, python pickle…
not rated 849
+21 14d ago A SkillSpector: pass 98 tokens
original MIT
Skill Claude CodeCodex needs its repo
Path traversal / Local File Inclusion detection→file-read→RCE for web apps. Use when a param names a file/path/page/template/lang/download, or a response embeds file contents. Triggers - file=/page=/path=/template=/lang=/download=/include= param, ../, %2e%2e, "no such file", directory listing, download endpoint.
not rated 849
+21 14d ago A SkillSpector: warn 83 tokens
original MIT
web-sqli
18Skill Claude CodeCodex
SQL injection detection→exploitation→proof for web apps and APIs. Use when a parameter reaches a DB query, when input triggers a SQL error / boolean or time differential, or during VULN-ASSESSMENT/EXPLOITATION on a web target. Triggers - sql syntax error, ORA-/MySQL/psql/SQLite error string, ' or 1=1, order by…
not rated 849
+21 14d ago A SkillSpector: warn 100 tokens
original MIT
web-ssrf
19Skill Claude CodeCodex
Server-Side Request Forgery detection→internal-access→proof for web apps. Use when the app fetches a URL you influence (webhooks, url/image/pdf fetchers, link preview, import-from-URL, SSO/OIDC redirect, XML/SVG). Triggers - url=/uri=/dest=/callback= param, "fetch failed", webhook, image proxy, /next/image…
not rated 849
+21 14d ago C SkillSpector: warn 91 tokens
original MIT
web-ssti
20Skill Claude CodeCodex
Server-Side Template Injection detection→engine-fingerprint→RCE for web apps. Use when user input renders into a server-side template (names, greetings, email/PDF/report generators, error pages, profile fields) and math payloads evaluate. Triggers - {{77}} returns 49, ${77}.
not rated 849
+21 14d ago A SkillSpector: pass 71 tokens
original MIT
Skill Claude CodeCodex
File-upload abuse to code execution for web apps. Use when the app accepts a file (avatar, document, image, import, attachment) and you can influence name/type/content, or find where uploads land. Triggers - multipart upload form, avatar/profile picture, import/attachment, "invalid file type", uploaded file URL…
not rated 849
+21 14d ago A SkillSpector: warn 76 tokens
original MIT
web-xxe
22Skill Claude CodeCodex
XML External Entity injection detection→file-read/SSRF→proof for web apps. Use when the app parses XML you influence - SOAP/REST XML bodies, SAML, RSS/Atom, DOCX/XLSX/SVG/XML file uploads, sitemap import, SVG avatars. Triggers - Content-Type application/xml or text/xml, <?xml, SOAPAction header, SAMLResponse…
not rated 849
+21 14d ago A SkillSpector: warn 94 tokens
original MIT
Skill Claude CodeCodex
Android APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis. Use when target is an APK/Android app. Triggers - APK, Android, mobile app, decompiled, smali, jadx, apktool.
not rated 849
+21 14d ago A SkillSpector: pass 66 tokens
original MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: