skshadan

skshadan/kage

Plugin Claude Code

Plugin marketplace listing 1 plugin: kage.

skshadan/kage

Plugin Claude Code

Local pentest sandbox for black-box, greybox, and white-box security audits inside a per-engagement Kali Docker container.

skshadan/kage

Skill Claude CodeCodex

Local pentest sandbox for a full black-box engagement. Triggers on "kage", "pentest", "security audit on", "audit the security of". Runs recon, deep testing, exploit verification, and judging inside a per-engagement Kali Docker container. Each host working directory gets its own isolated sandbox. Produces ./results/…

skshadan/kage

Agent

Vertical access control testing (role escalation, 403 bypass, forwarded-header tricks, admin-path access). Triggered when recon found 403 responses, admin panels, role-gated routes, or privilege tiers in creds.md.

skshadan/kage

Agent

REST and GraphQL API testing — OpenAPI schema fuzzing, GraphQL introspection + abuse, verb tampering, mass assignment, rate-limit bypass. Triggered when recon found an OpenAPI / Swagger URL, a /graphql endpoint, or ID-bearing REST routes without those found.

skshadan/kage

Agent

Tests a single authenticated endpoint for authentication bypass. Triggered when recon surfaces a login / SSO / OAuth / JWT-gated route and a valid token is available in creds.md.

skshadan/kage

Agent

Combines individual verified findings into escalation chains that move severity up. Runs in Turn 3c after the verifier and before the judge.

skshadan/kage

Agent

Client-side vulnerability testing — reflected / stored XSS, CSRF, clickjacking, postMessage handlers, open redirect, DOM sinks. Use for any live web host with user-facing interactivity.

skshadan/kage

Agent

Hidden path, file, and parameter discovery via directory + file fuzzing and hidden-param enumeration. Use when the crawler's surface is thin or when specific high-value paths (admin, debug, backup, .git, .env) might exist but weren't linked.

skshadan/kage

Agent

CORS, security headers, CRLF, host-header injection, and cache-poisoning probes for a single host. Use for every live web target.

skshadan/kage

Agent

Horizontal IDOR / BOLA probe using two accounts. Triggered when recon found an API endpoint with object IDs in the path or query, and creds.md has both attacker and victim tokens.

skshadan/kage

Agent

SQL / NoSQL / command / template / LDAP injection probes. Triggered when recon surfaced parameterised URLs, search fields, forms, or GraphQL variables.

skshadan/kage

Agent

Secrets and sensitive tokens in JavaScript bundles, source maps, and static assets. Use in Turn 1 once the crawler has collected JS file URLs.

skshadan/kage

Agent

Final quality gate before findings reach the audit report. Applies the 4-gate filter, confidence scoring, severity + CVSS assignment, deduplication, and exclusion-list enforcement. Runs in Turn 3d after verify and chain.

skshadan/kage

Agent

Business-logic and workflow abuse — race conditions, coupon / voucher reuse, rate-limit bypass, signup abuse, referral fraud, multi-step flow skipping, quantity manipulation. Triggered when recon found payment / coupon / redeem / invite / signup endpoints.

skshadan/kage

Agent

Fast port scan with service detection and high-value-target classification. Use in Turn 1 when live hosts have been enumerated.

skshadan/kage

Agent

Renders the final consolidated audit report from approved findings. Runs in Turn 4 after the judge has produced approvedfindings.json.

skshadan/kage

Agent

SSRF probe against a URL-accepting parameter. Triggered when recon found a param like url=, redirect=, proxy=, image=, callback=, fetch=, webhook=.

skshadan/kage

Agent

Independently re-tests one exploit PoC in a clean session to confirm reproducibility. Sits between exploiter and judge — only verified findings proceed.

skshadan/kage

Agent

Runs the template-based vuln scanner against the live-host list from Turn 1 discovery and summarises findings by severity. Isolates long-running scan output from the main orchestrator's context.

skshadan/kage

Skill Claude CodeCodex

Give AI agents their own email inboxes using the AgentMail API. Use when building email agents, sending/receiving emails programmatically, managing inboxes, handling attachments, organizing with labels, creating drafts for human approval, or setting up real-time notifications via webhooks/websockets. Supports…

skshadan/kage

Skill Claude CodeCodex

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

skshadan/kage

Agent

Performs ultra-granular per-function deep analysis for security audit context building. Use when analyzing dense functions, data-flow chains, cryptographic implementations, or state machines.

skshadan/kage

Command

Builds deep architectural context before vulnerability hunting.