Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kalpmodi/akira/exploitnpx skills add kalpmodi/akira --skill exploitgit clone --depth 1 https://github.com/kalpmodi/akiraWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00128 | $0.03616 |
| Opus 5 | $0.00064 | $0.01808 |
| Sonnet 5 | $0.00026 | $0.00723 |
| Haiku 4.5 | $0.00013 | $0.00362 |
Grade A, and why
exploit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
{"step": 1, "technique": "", "action": "<exact curl command>", "response_fragment": "<quoted response snippet>", "signal": "VULN_CONFIRMED"} How it starts
The opening of the file, as written. The whole thing — 235 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Exploitation Phase
Philosophy
Every confirmed finding must have a direct evidence quote from the actual response. Never claim Critical without proving the full kill chain: access -> escalation -> data. Never skip a technique because "it probably won't work" - the manifest decides what runs. WAF presence means bypass first, then exploit - never give up at the first 403.
Phase 0: Smart Intake
source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh
p0_init_vars "$1"
p0_state_gate || exit 0
p0_read_relay recon secrets
p0_read_hypotheses
p0_read_memory
TECH=$(jq -r '.intel.technologies[]?' "$SESSION" 2>/dev/null | tr '\n' ',')
# Fallback endpoints
[ -z "$API_SPEC_ENDPOINTS" ] && API_ENDPOINTS=$(jq -r '.intel.endpoints[]?' "$SESSION" 2>/dev/null | head -50)
API_ENDPOINTS="${API_SPEC_ENDPOINTS:-$API_ENDPOINTS}"
echo "=== EXPLOIT SMART INTAKE: $TARGET ==="
echo "State: $STATE | WAF: $WAF | Tech: $TECH"
echo "Top hypothesis: [$TOP_HYPO_PROB%] $TOP_HYPO_LABEL"
echo "Verified creds: $(echo "$VERIFIED_CREDS" | grep -c .)"
echo "JWT tokens: $(echo "$JWT_TOKENS" | grep -c .)"
echo "API endpoints: $(echo "$API_ENDPOINTS" | grep -c .)"
echo "ATW flagged (skip): $ATW_FLAGGED"
Tech stack drives technique priority:
| Tech detected | Prioritize first |
|---|---|
| AWS in stack | SSRF->IMDS->IAM, cloud-audit fork |
| Node.js + JWT | JWT RS256->HS256, prototype pollution |
| Django/Python | SSTI Jinja2, Python pickle deserialization |
| Spring/Java | Deserialization (ysoserial), XXE, JNDI |
| PHP | LFI->RCE (filter chains), PHP type juggling |
| .NET/ASP.NET | ViewState deserialization, XXE, SSRF |
| Redis visible | SSRF->gopher->Redis RCE |
| GraphQL | Introspection, batching, aliasing IDOR |
| OAuth/SSO | redirect_uri bypass, state CSRF, JWT kid injection |
| Nginx+Apache chain | Path confusion (CVE-2025-0108), off-by-slash |
| ElasticSearch | Unauthenticated query access, script injection |
| MongoDB | NoSQL operator injection, JS injection |
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- tech/2fa-ato.md 3.6 KB
- tech/business-logic.md 2.9 KB
- tech/cache-smuggling.md 3.5 KB
- tech/cors-misc.md 3.8 KB
- tech/cred-spray.md 2.5 KB
- tech/deser.md 4.0 KB
- tech/graphql.md 3.6 KB
- tech/idor-mass.md 3.5 KB
- tech/jndi-cve.md 3.3 KB
- tech/jwt.md 5.5 KB
- tech/lfi-upload.md 3.6 KB
- tech/nosql.md 3.1 KB
- tech/oauth-saml.md 3.9 KB
- tech/prototype.md 3.2 KB
- tech/race-timing.md 3.4 KB
- tech/sqli.md 3.2 KB
- tech/ssrf.md 4.8 KB
- tech/ssti-xxe.md 3.7 KB
- tech/xs-leaks.md 3.3 KB
- tech/xss.md 3.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 235 lines · 128 tokens per session scan A 9d6bdecf70f5
exploit is a skill published in the GitHub repository kalpmodi/akira (21 stars, last pushed 1mo ago), licensed MIT. It adds 128 tokens to every session and 3,616 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
error-log-mining
Mine errorlog for creds, paths, SQL when leak hunt finds.
xmlrpc-exploitation
Exploit XMLRPC multicall, pingback for brute force and SSRF.
cors-chain-automation
Use when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.
cache-attack
Poison CDN cache or deceive when X-Cache header is detected.
exchange-owa-attack
Exchange/OWA NTLM AD leak, spray attack when mail subdomain.
js-secrets-extraction
Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints.