sleuth-kit
169Skill Claude CodeCodex
Auth/lab ref: CLI file-system forensics toolkit for analyzing disk images (.dd/.img/.E01/.vmdk).
Offensive oriented Skill for agentic AI
This repository also configures its own agents. See what malskill tells them →
Skill Claude CodeCodex
Auth/lab ref: CLI file-system forensics toolkit for analyzing disk images (.dd/.img/.E01/.vmdk).
Skill Claude CodeCodex
Auth/lab ref: steghide JPEG/BMP/WAV/AU hidden-data workflows; embed/extract tests, passphrase handling, challenge evidence.
Skill Claude CodeCodex
Auth/lab ref: high-speed wordlist attacker for steghide-protected files. For you suspect a JPEG/BMP/WAV/AU artifact contains steghide data but extraction is blocked by a passphrase.
Skill Claude CodeCodex
Auth/lab ref: CLI packet capture and BPF filter tool.
Skill Claude CodeCodex
Auth/lab ref: Tesseract OCR engine for extracting text from images and scanned documents.
Skill Claude CodeCodex
Auth/lab ref: Volatility3 memory forensics; process, module, network, registry, file, and suspicious-artifact triage from RAM images.
Skill Claude CodeCodex
Auth/lab ref: YARA pattern matching; files, binaries, memory images, strings/regex/byte rules, malware/stego/IOC classification.
Skill Claude CodeCodex
Auth/lab ref: Protocol-aware network analysis engine that converts raw PCAP or live traffic into structured logs (conn.log, dns.log, http.log, ssl.log, files.log, etc.).
Skill Claude CodeCodex
Auth/lab ref: zsteg PNG/BMP steganography; LSB, bit-plane, color-channel, hidden-data extraction after metadata/strings checks.
Skill Claude CodeCodex
Auth/lab ref: Coverage-guided fuzzing framework for source and binary targets.
Skill Claude CodeCodex
Auth/lab ref: HTTP parameter discovery fuzzer with a large curated parameter dictionary. For fast testing-surface expansion and easy handoff into ffuf, dalfox, sqlmap, and custom replay pipelines.
Skill Claude CodeCodex
Auth/lab ref: Python network protocol fuzzing framework (Sulley successor). For stateful TCP/UDP protocol fuzzing, request-graph modeling, monitor-driven crash detection, and reproducible protocol campaign workflows.
Skill Claude CodeCodex
Auth/lab ref: Specialized web fuzzing tool for CRLF injection and HTTP response splitting detection.
Skill Claude CodeCodex
Auth/lab ref: directory traversal fuzzer for HTTP, FTP, and TFTP with built-in encoding variants (null byte, URL, double-URL, unicode).
Skill Claude CodeCodex
Auth/lab ref: High-speed HTTP fuzzing engine for endpoint discovery and input mutation on web/API targets.
Skill Claude CodeCodex
Auth/lab ref: Feedback-driven, high-speed fuzzer with multi-process/thread execution and persistent fuzzing.
Skill Claude CodeCodex
Auth/lab ref: Coverage-guided in-process fuzzing for JVM (Java/Kotlin/etc), based on libFuzzer concepts.
Skill Claude CodeCodex
Auth/lab ref: In-process, coverage-guided fuzzing engine integrated with Clang/LLVM. For fast unit-level fuzz targets, parser hardening, sanitizer-first bug discovery, and corpus-driven regression loops in C/C++ code.
Skill Claude CodeCodex
Auth/lab ref: Google-hosted continuous fuzzing service for open-source projects. For long-running, scalable fuzz campaigns, sanitizer-backed triage, and continuous bug reporting with reproducible local workflows.
Skill Claude CodeCodex
Auth/lab ref: General-purpose mutation engine for generating malformed test inputs.
Skill Claude CodeCodex
Auth/lab ref: Stateful REST API fuzzer from OpenAPI specs. For testing complex API dependency chains, producer-consumer request sequencing, and replayable bug-bucket workflows for API reliability/security testing.
Skill Claude CodeCodex
Auth/lab ref: OpenAPI/GraphQL property-based API fuzzer. Use to auto-generate API tests, catch schema violations, triage failures systematically, and run high-coverage stateful campaigns in REST/GraphQL services.
Skill Claude CodeCodex
Auth/lab ref: Classic web application fuzzer using FUZZ placeholders across URL, headers, forms, auth, and request components.
Skill Claude CodeCodex
Auth/lab ref: Coverage-guided fuzzing framework for Windows binaries. For fuzzing desktop apps, DLL harnesses, or Windows services with DynamoRIO/TinyInst/Intel PT instrumentation and persistent-loop target functions.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: