Skill Claude CodeCodex
Attack SAML SSO via XSW, signature strip, metadata extract.
not rated 1.3k
+15 1mo ago C SkillSpector: warn 22 tokens
original MIT
Skill Claude CodeCodex
Use when two or more verified findings may combine into a higher-impact authorized attack path.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 23 tokens
original MIT
Skill Claude CodeCodex
Use when verified WordPress findings may combine into an authorized path to administrative or server control.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 23 tokens
original MIT
Skill Claude Code
Escape Docker containers to host root via 5 techniques.
not rated 1.3k
+15 1mo ago A ✓ AI review SkillSpector: warn 16 tokens
original MIT
Skill Claude CodeCodex
Use when classifying a verified web or WordPress behavior and selecting a related validation skill.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 23 tokens
original MIT
Skill Claude CodeCodex
Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 21 tokens
original MIT
Skill Claude Code
High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 24 tokens
original MIT
Skill Claude Code
7-phase pentest pipeline from passive recon to exploitation.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 16 tokens
original MIT
Skill Claude CodeCodex
Use when starting or restructuring an authorized external web and API assessment.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 18 tokens
original MIT
Skill Claude CodeCodex
Pick sectors, compile targets, batch recon for campaigns.
not rated 1.3k
+15 1mo ago C SkillSpector: warn 17 tokens
original MIT
Skill Claude CodeCodex
Use when an API may expose data or privileged operations without authentication.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 19 tokens
original MIT
Skill Claude CodeCodex
Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 24 tokens
original MIT
cache-attack
13Skill Claude CodeCodex
Poison CDN cache or deceive when X-Cache header is detected.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 18 tokens
original MIT
Skill Claude CodeCodex
Identify CMS, frameworks, and server technology stacks on live hosts.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 17 tokens
original MIT
Skill Claude CodeCodex
Exploit WP CORS credential reflection for data theft.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 17 tokens
original MIT
deep-invade
16Skill Claude CodeCodex
Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.
not rated 1.3k
+15 1mo ago C SkillSpector: warn 24 tokens
original MIT
Skill Claude CodeCodex
DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 23 tokens
original MIT
Skill Claude CodeCodex
Exchange/OWA NTLM AD leak, spray attack when mail subdomain.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 22 tokens
original MIT
Skill Claude CodeCodex
Exploit Firebase/Supabase for data via JS config leak probe.
not rated 1.3k
+15 1mo ago B SkillSpector: warn 21 tokens
original MIT
Skill Claude CodeCodex
Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
not rated 1.3k
+15 1mo ago B SkillSpector: warn 22 tokens
original MIT
Skill Claude CodeCodex
Find leaked API keys, tokens, and credentials in public GitHub repositories.
not rated 1.3k
+15 1mo ago A SkillSpector: warn 20 tokens
original MIT
Skill Claude CodeCodex
Mine GitLab for secrets, CI tokens when subdomain found.
not rated 1.3k
+15 1mo ago C SkillSpector: warn 19 tokens
original MIT
Skill Claude CodeCodex
Detect hardcoded passwords in HTML forms, JavaScript, and API responses.
not rated 1.3k
+15 1mo ago C SkillSpector: warn 22 tokens
original MIT
Skill Claude CodeCodex
Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.
not rated 1.3k
+15 1mo ago A SkillSpector: pass 23 tokens
original MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: