effect
01Skill Claude CodeCodex
Work with Effect v4 / effect-smol TypeScript code in this repo.
566 11d ago A 17 tokens
copy · 100% MIT
566Stars on the repository
33Mods indexed here, across every type
11d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
agents-sdk
02Skill Claude CodeCodex
Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, or chat applications. Covers Agent class, state management, callable RPC, Workflows integration, and React hooks.
566 11d ago A 59 tokens
copy · 100% MIT
cloudflare
03Skill Claude CodeCodex
Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task.
566 11d ago A 68 tokens
copy · 100% MIT
Skill Claude CodeCodex
Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.
566 11d ago A 26 tokens
original MIT
Skill Claude CodeCodex
Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
566 11d ago B 30 tokens
original MIT
Skill Claude CodeCodex
Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POSTEXPLOIT.
566 11d ago C 33 tokens
original MIT
recon-phase
07Skill Claude CodeCodex
Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.
566 11d ago A 35 tokens
original MIT
Skill Claude CodeCodex
Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.
566 11d ago A 24 tokens
original MIT
Skill Claude CodeCodex
Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULNASSESS.
566 11d ago A 35 tokens
original MIT
playbook-ad
10Skill Claude CodeCodex
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
566 11d ago A 88 tokens
original MIT
Skill Claude CodeCodex
Cloud security playbook — AWS/GCP/Azure misconfiguration and attack patterns (IAM, storage, metadata, privesc). Load when the target is a cloud environment or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM role/policy, S3/blob bucket, 169.254.169.254 metadata, access key, assume-role, cloud console.
566 11d ago B 84 tokens
original MIT
Skill Claude CodeCodex
Infrastructure pentest playbook — PTES-based phase flow for internal networks, servers, and non-web services. Load at the START of an internal/infra engagement or multi-host network assessment. Triggers - internal network, subnet/CIDR scan, infra pentest, multi-host, pivoting, lateral movement across services.
566 11d ago A 70 tokens
original MIT
Skill Claude CodeCodex
Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web- skill to load for each surface. Use on any web app / HTTP API engagement.
566 11d ago A 78 tokens
original MIT
svc-cicd
14Skill Claude CodeCodex
CI/CD & dev-infra attack techniques — credential exposure, RCE (script console / build), pipeline abuse, secret stores. Use when a CI/CD or SCM service is exposed. Triggers - Jenkins /job/ or script console, GitLab, ArgoCD, TeamCity, Gitea, Drone, exposed .git, runner token, pipeline.
566 11d ago B 78 tokens
original MIT
svc-database
15Skill Claude CodeCodex
Database service attack techniques — auth bypass, UDF/xpcmdshell/COPY-TO-PROGRAM RCE, file read/write, cred dump. Use when a database service is found or you have DB creds. Triggers - MySQL 3306, PostgreSQL 5432, MSSQL 1433, Oracle 1521, Redis 6379, MongoDB 27017, db banner, default DB creds, NOAUTH.
566 11d ago A 95 tokens
original MIT
svc-dns
16Skill Claude CodeCodex
DNS attack techniques — zone transfer, subdomain enumeration/takeover, cache poisoning. Use when DNS is found or you're mapping a domain. Triggers - port 53, named/bind, AXFR zone transfer, dangling CNAME, subdomain takeover, wildcard DNS.
566 11d ago A 59 tokens
original MIT
Skill Claude CodeCodex
Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft. Use when a container/orchestration surface is found. Triggers - Docker 2375/2376, Kubernetes API 6443, kubelet 10250, etcd 2379, /version, privileged pod, service-account token, docker.sock.
566 11d ago D 85 tokens
original MIT
svc-ftp
18Skill Claude CodeCodex
FTP attack techniques — anonymous access, writable dirs, version CVEs, credential attacks. Use when FTP is open. Triggers - port 21, ftp banner, vsftpd 2.3.4, ProFTPD modcopy, anonymous login, pure-ftpd.
566 11d ago A 60 tokens
original MIT
svc-mail
19Skill Claude CodeCodex
Mail server attack techniques — SMTP open relay, VRFY/EXPN/RCPT user enumeration, header injection, IMAP/POP3 access. Use when a mail service is found. Triggers - SMTP 25/465/587, POP3 110, IMAP 143, Postfix/Exim/Sendmail/Dovecot banner, VRFY.
566 11d ago A 78 tokens
original MIT
svc-pivoting
20Skill Claude CodeCodex
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold…
566 11d ago A 103 tokens
original MIT
svc-smb
21Skill Claude CodeCodex
SMB/CIFS attack techniques — null sessions, share enumeration, NTLM relay, EternalBlue, signing checks. Use when SMB is found. Triggers - ports 445/139, netbios, MS17-010 EternalBlue, signing:False, null session, share access, PetitPotam/coerce.
566 11d ago A 68 tokens
original MIT
svc-ssh
22Skill Claude CodeCodex
SSH attack techniques — version CVEs, auth-method/user enumeration, key issues, targeted brute. Use when SSH is open. Triggers - port 22, OpenSSH banner, regreSSHion CVE-2024-6387, user-enum CVE-2018-15473, authorizedkeys, weak/leaked key.
566 11d ago D 73 tokens
original MIT
Skill Claude CodeCodex
Web SERVER software (not app-layer) attack techniques — server misconfigs, known server CVEs, path traversal, exposed status/config. Use when you fingerprint the web server itself (for app-layer bugs use the web- skills). Triggers - Server header, Apache 2.4.49/2.4.50, nginx alias traversal, IIS, Tomcat…
566 11d ago B 90 tokens
original MIT
Skill Claude CodeCodex
Broken access control - IDOR, privilege escalation, JWT abuse, mass assignment, forced browsing - for web apps and APIs. Use on any multi-user or role-based app with object IDs, tokens, or admin functionality. Triggers - /api/users/ , /orders/ , ?account=/uid=/doc=, JWT (eyJ...), role/isAdmin field, admin panel, "403…
566 11d ago A 97 tokens
original MIT