NoorQureshi
UserAn open library of security skills for AI agents - pentest, bug bounty & defense. 85+ trigger-loaded skills across 16 domains (web, API, cloud, AI/LLM, AD, mobile, and more). Load into Claude Code, Codex, Gemini, or a local model.
Categories
Indexed Skills (50)
tools-ad-pivot
One line: Active Directory, pivoting/tunneling, and password-cracking arsenal for authorized engagements. Trigger signals: "Active Directory", "domain", "kerberos", "kerberoast", "AS-REP", "BloodHound", "DCSync", "AD/.local domain", holding domain creds or a foothold. Authorized, in-scope targets only.
ai-agent-tool-abuse
Abuse an LLM agent's tools/functions — coerce it to call tools with attacker-chosen args for SSRF, RCE, data exfil, or privilege abuse. Load when the target is an agent with tools/ function-calling/plugins, MCP servers, code interpreters, or "the assistant can do X". Signals: function-calling, tool schemas, browse/email/query/exec tools, autonomous agents.
ai-mcp-security
Assess Model Context Protocol (MCP) servers and agent tool integrations — tool poisoning, prompt injection via tool descriptions/results, over-broad scopes, and unauth tool exposure. Load when the target uses MCP servers, agent tool/function integrations, or connectors. Signals: mcp.json, MCP server, tool schemas, connector marketplace, agent with external tools.
ai-prompt-injection
Test LLM-backed apps for prompt injection (direct + indirect) and its consequences: data exfil, tool/function abuse, guardrail bypass. Load when the target is a chatbot/assistant/ agent, summarizes untrusted content, has tools/functions, or does RAG. Signals: "ask AI", system prompts, function-calling, "summarize this URL/file", agentic actions.
ai-supply-chain
Attack the ML/LLM supply chain — poisoned models, datasets, plugins, and unsafe model deserialization. Load when an app loads third-party models/weights (HuggingFace, .pt/.pkl/.h5), installs ML deps, uses plugins/extensions, or fine-tunes on external data. Signals: torch.load, pickle model files, model hub downloads, plugin marketplace, RAG over external corpora.
api-mongo-agg-facet-bypass
Bypass a MongoDB aggregation-pipeline stage allowlist by nesting disallowed read stages inside $facet, then $unionWith/$lookup sibling collections to exfiltrate secrets (invite tokens, creds, hashes). Load when: an endpoint accepts a user-supplied `pipeline` (or errors like "operator-form queries not accepted, use the pipeline parameter"), a Node/Express + MongoDB backend, 24-hex `_id`s, or an "advanced query" API. Authorized targets only.
cloud-azure
Attack Azure / Entra ID — managed-identity token theft, Entra (Azure AD) role abuse, and app/ storage misconfig. Load when the target is on Azure, you hold Azure creds/a token, or see Entra/AAD/azurewebsites/blob.core.windows.net. Signals: 169.254.169.254 IMDS, Managed Identity, az cli, Entra roles, service principals.
cloud-gcp
Attack Google Cloud Platform — metadata/SA token theft, IAM privilege escalation, and storage/ function misconfig. Load when the target runs on GCP, you hold a GCP SA key/token, or see gcp/gcloud/GCE/GKE/appspot. Signals: metadata.google.internal, service-account.json, storage.googleapis.com, cloudfunctions, gcloud.
cloud-iam-privesc
Escalate privileges in cloud IAM (AWS/GCP/Azure) from a low-priv set of credentials. Load when you hold cloud creds/keys/a role and want higher privilege or new resources. Signals: leaked AWS keys, an assumed role, a service-account token, "escalate in AWS/GCP/Azure", enumerated permissions.
code-review-cicd
Review CI/CD pipelines for security flaws — poisoned workflows, secret leakage, and injection. Load on GitHub Actions / GitLab CI / Jenkins config, ".github/workflows", pull_request_target, self-hosted runners, or "pipeline security". Signals: workflow YAML, secrets in CI, third-party actions.
code-review-dangerous-sinks
Grep-ready dangerous function/sink catalog per language for fast code review. Load when reviewing source in PHP, Python, JavaScript/Node, Java, Ruby, Go, .NET/C# and you need the exact functions that cause RCE/SQLi/SSRF/traversal/deserialization. Signals: "dangerous functions", "sinks", grepping a codebase.
code-review-methodology
Systematic manual source-code security review — how to find bugs by reading code. Load on "review this code/repo", a source-available target, whitebox testing, or auditing a PR/app for vulnerabilities. Signals: a codebase in scope, "SAST", "secure code review", a language repo.
code-review-nodejs
Security review of Node.js / JavaScript code — dangerous sinks and Express/framework pitfalls. Load when reviewing a Node/JS codebase/PR, on package.json + Express/Next/Nest, or "review this Node app". Signals: child_process, eval, Function, prototype pollution, JWT, Mongoose/Sequelize.
code-review-python
Security review of Python code — dangerous sinks and framework-specific pitfalls (Django/Flask/ FastAPI). Load when reviewing a Python codebase/PR, on .py source in scope, or "review this Python". Signals: requirements.txt/pyproject, Django/Flask/FastAPI, ORMs, pickle/yaml, subprocess.
defense-log-analysis
Hunt for attacker activity in logs — auth, web, cloud, endpoint — with concrete queries and what to look for. Load for blue-team log/SIEM hunting, "analyze these logs", "find the attack", triage of auth/web/cloud logs, or building hunts. Signals: log files/SIEM, "what happened", IOC hunting.
mobile-android-assessment
Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.
ad-adcs
Attack Active Directory Certificate Services (ADCS) — ESC1–ESC8 template/CA misconfigurations to escalate to Domain Admin. Load with a domain foothold/creds where ADCS is present, on "certipy", "ESC1", "certificate template", or a CA server. Signals: Cert Publishers, pKIEnrollmentService, ports 443/135 on a CA, certipy find output.
ad-dacl-abuse
Abuse Active Directory object ACLs/DACLs for lateral movement and escalation — GenericAll, WriteDACL, GenericWrite, WriteOwner, AddMember, ForceChangePassword, and DCSync rights. Load with domain creds + BloodHound showing an ACL edge, on "GenericAll", "WriteDACL", "DCSync", "abuse this edge".
ad-kerberoasting
Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with any domain foothold or valid domain creds, on "kerberoast", "AS-REP", SPNs, service accounts, ports 88/389. Signals: domain creds in hand, SPNs set, accounts with pre-auth disabled.
ai-insecure-output-handling
Exploit apps that trust LLM output — pass model text unsanitized into XSS sinks, SQL, shell, code, or downstream calls. Load when LLM output is rendered as HTML/markdown, executed, or fed to another system. Signals: chatbot output shown with innerHTML/dangerouslySetInnerHTML, "run this code", LLM-generated queries/commands, agent output used in eval/exec.
ai-jailbreak
Bypass an LLM's safety/guardrails to make it produce restricted output or ignore its policy. Load when testing an AI product's content controls, "jailbreak", "guardrail bypass", refusal testing, or safety evals. Signals: a chatbot/assistant with a usage policy, refusals to test, content filters.
ai-llm-dos
Unbounded-consumption / denial-of-wallet attacks on LLM apps — force runaway tokens, cost, or latency. Load when testing an LLM product's limits/billing, on "LLM DoS", cost amplification, or resource exhaustion. Signals: user-controlled prompts/max_tokens, agent loops, no rate/'cost caps'.
ai-model-extraction
Extract or steal an ML/LLM model's parameters, training data, or system prompt via query access — model stealing, membership inference, training-data extraction. Load when testing an ML API/endpoint, "model extraction/inversion", data-leakage or IP-theft concerns, exposed inference endpoints. Signals: a predict/inference API, embeddings endpoint, fine-tuned model.
ai-rag-poisoning
Poison a RAG/knowledge-base pipeline so retrieved content hijacks the model (indirect prompt injection at scale) or exfiltrates data. Load when the app does retrieval over documents/URLs/ tickets/emails the attacker can influence, "RAG", vector DB, "knowledge base", agent that reads content. Signals: upload-to-KB, "chat with your docs", crawled sources.
api-auth-attacks
Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.
api-bola
Broken Object/Function Level Authorization in REST/JSON APIs (the #1 API risk). Load on any REST API with object ids in paths/bodies (/api/v1/users/123, /orders/{id}), Bearer auth, mobile-app backends, or admin vs user function separation. Signals: predictable ids, verbs that skip re-authorization, "role" enforced only in the UI.
api-fuzzing
Discover and fuzz API endpoints, methods, params, and versions systematically. Load when you have an API base but not its full surface, an OpenAPI/Swagger/Postman spec, or "map/fuzz the API". Signals: /api, /v1, swagger.json, GraphQL, mobile backend, undocumented routes.
api-graphql
Attack GraphQL APIs. Load on /graphql, /graphiql, /v1/graphql, a POST with {"query":"..."}, Apollo/Hasura/graphene stacks, or "query/mutation" language. Signals: introspection enabled, batched queries, deeply nested fields, __schema, aliases.
api-grpc
Test gRPC / Protocol Buffers APIs — reflection, method enumeration, authz, and injection. Load on gRPC services (HTTP/2, content-type application/grpc, .proto files, ports like 50051), grpc-web, or "protobuf". Signals: grpc, protobuf, reflection service, ServerReflection.
api-mass-assignment
Mass assignment / auto-binding privilege escalation. Load when an API binds JSON directly to a model (Rails, Spring, Django REST, Node/Mongoose), on signup/profile-update/create endpoints, or when responses expose fields you didn't send (role, isAdmin, balance, verified). Signals: ORM object binding, extra fields accepted silently.
api-versioning
Find and attack old/shadow API versions that missed a fix — improper inventory management. Load when the API is versioned (/v1, /v2, /api/2021-01), on "old API", or after mapping the surface. Signals: version in path/header/subdomain, deprecated docs, mobile app using an older version.
automation-nuclei-templates
Write custom nuclei templates to codify a finding into a repeatable, mass-scannable check. Load on "write a nuclei template", turning a manual bug into automation, checking a CVE across many hosts, or regression-scanning. Signals: a reproducible request→match, YAML templates, nuclei.
automation-recon-pipeline
Chain recon tools into a repeatable, resumable pipeline for continuous bug-bounty coverage. Load on "automate recon", "recon pipeline", monitoring many programs, or scaling subdomain→ live→scan. Signals: wildcard scope at scale, wanting scheduled/continuous discovery.
cloud-container-escape
Break out of a container to the host. Load when you have a shell in a container/pod and want the node: privileged container, mounted docker.sock, dangerous capabilities, hostPath, or "escape the container". Signals: /.dockerenv, cgroup shows docker/k8s, CAP_SYS_ADMIN, mounted socket.
cloud-docker-registry
Find and loot exposed container registries — image pull/push, secrets baked in layers, and registry misconfig. Load on exposed Docker registry (port 5000, /v2/), a registry URL, harbor/ECR/ GCR/ACR references, or "container registry". Signals: /v2/_catalog, registry:2, unauth pull/push.
cloud-imds-ssrf
Escalate SSRF to cloud credential theft via the instance metadata service (IMDS). Load when SSRF is confirmed AND the target runs on AWS/GCP/Azure. Signals: 169.254.169.254 reachable, cloud-hosted app, SSRF that can set arbitrary Host/headers, "metadata".
cloud-kubernetes
Attack exposed Kubernetes: API server, kubelet, etcd, dashboards, and RBAC. Load on k8s signals — ports 6443/10250/2379/8443, /api/v1, kube-dns, a pod foothold, or "kubernetes/k8s". Signals: kubectl, service-account tokens, exposed dashboard, container in a cluster.
cloud-s3-exposure
Find and prove misconfigured cloud object storage (S3/GCS/Azure Blob). Load when assets load from *.s3.amazonaws.com, storage.googleapis.com, *.blob.core.windows.net, bucket-looking hostnames, or "bucket". Signals: public-read/list, unauthenticated writes, predictable bucket names.
code-review-secrets-detection
Find leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env files, private keys, cloud creds, hardcoded passwords.
defense-detection-sigma
Write portable detections as Sigma rules and map them to MITRE ATT&CK, then convert to your SIEM. Load for blue-team/detection-engineering tasks: "write a detection", "sigma rule", "alert on", turning an offensive technique or an incident into a repeatable detection.
defense-dfir-triage
First-response DFIR triage: scope an incident, collect volatile evidence, and find attacker activity on Linux/Windows. Load on "incident", "we got breached", "investigate this host", "IOCs", suspected compromise, or forensic triage. Signals: alert to investigate, suspicious host, "what happened".
defense-hardening-baseline
Turn offensive findings into concrete hardening — the fix side of each vuln class, plus config baselines. Load for blue-team/remediation tasks, "how do we fix/prevent", secure config review, or writing the remediation section of a report. Signals: "harden", "remediation", "secure baseline", "prevent".
defense-purple-team
Run a purple-team exercise — emulate specific attacker techniques and validate detection/response end to end. Load for "purple team", detection validation, ATT&CK coverage testing, "can we detect X", or turning red-team findings into blue-team improvements. Signals: detection gaps, ATT&CK mapping, control testing.
defense-threat-modeling
Threat-model a system or feature (STRIDE + attack trees) to find design-level risk before code. Load on "threat model", a new design/architecture review, security design questions, or planning controls. Signals: architecture diagram, data-flow, "what could go wrong", pre-build security.
exploit-chaining
Combine low/medium findings into one high-impact exploit chain, and amplify demonstrated impact. Load when you have several small bugs, a "so what?" finding, on "chain", "escalate impact", or building the narrative for a report. Signals: self-XSS + CSRF, open-redirect + OAuth, IDOR + info-leak, SSRF + metadata.
exploit-poc-development
Turn a known/1-day vulnerability or a raw bug into a working, reliable PoC for an authorized target. Load when a CVE/advisory needs weaponizing, a public PoC needs adapting, or "write an exploit/PoC". Signals: a versioned service with a known CVE, a crash/primitive to develop, searchsploit hits.
mobile-cert-pinning-bypass
Bypass TLS certificate pinning so you can proxy a mobile app's traffic. Load when a proxy shows no/broken traffic, you see SSL handshake failures in logs, OkHttp CertificatePinner, TrustKit, or "the app won't connect through Burp". Android/iOS.
mobile-deeplink-abuse
Abuse deep links / custom URL schemes / intents for redirect, token theft, and reaching internal screens. Load on custom schemes (myapp://), App Links/Universal Links, exported activities, or "open in app". Signals: intent-filters in the manifest, WebView loading deep-link params, OAuth redirect via a custom scheme.
mobile-ios-assessment
Assess an iOS app (static + dynamic). Load when the target is an IPA / iOS app, an iOS bug-bounty scope, or "test the iOS app". Signals: .ipa, Info.plist, Swift/Obj-C, Keychain, URL schemes, ATS exceptions, Frida/objection on a jailbroken device.
mobile-webview
Exploit insecure mobile WebViews — JS-bridge abuse, file access, and XSS→native. Load when an app renders web content in a WebView/WKWebView, exposes a JS bridge, or loads attacker-influenced URLs. Signals: addJavascriptInterface, WKScriptMessageHandler, loadUrl, file:// access, deep-link → WebView.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.