ffuf-web-fuzzing
Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration,…
Extracts reusable skills from work sessions. Use when: (1) a non-obvious problem was solved worth preserving, (2) a pattern was discovered that would help future sessions, (3) a workaround or debugging technique needs documentation. Manual invocation only via /skill-extractor
$ npx -y skills add trailofbits/skills-curated --skill skill-extractor --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/skill-extractorContext preview
The summary Claude sees to decide when to auto-load this skill.
Extracts reusable skills from work sessions. Use when: (1) a non-obvious problem was solved worth preserving, (2) a pattern was discovered that would help future sessions, (3) a workaround or debugging technique needs documentation. Manual invocation only via /skill-extractor
name: skill-extractor description: >- Extracts reusable skills from work sessions. Use when: (1) a non-obvious problem was solved worth preserving, (2) a pattern was discovered that would help future sessions, (3) a workaround or debugging technique needs documentation. Manual invocation only via /skill-extractor command - no automatic triggers or hooks. allowed-tools: - Read - Write - Glob - Grep - WebSearch - AskUserQuestion
Extracts reusable knowledge from work sessions and saves it as a Claude Code skill.
Use these prompts to identify knowledge worth extracting:
If you can't answer at least two of these with something non-trivial, it's probably not worth extracting.
/skill-extractor [--project] [context hint]
Before creating a new skill, search for existing ones that might cover the same ground:
# Check user skills ls ~/.claude/skills/ # Check project skills ls .claude/skills/ # Search by keyword grep -r "keyword" ~/.claude/skills/ .claude/skills/ 2>/dev/null
If a related skill exists, consider **updating it** instead of creating a new one. See [skill-lifecycle.md](references/skill-lifecycle.md) for guidance on when to update vs create.
If `$ARGUMENTS` contains a context hint (e.g., "the cyclic data DoS fix"), use it to focus the extraction on that specific topic.
Analyze the conversation to identify:
Present a brief summary to the user:
I identified this potential skill: **Problem:** [Brief description] **Key insight:** [What made it non-obvious] **Triggers:** [Error messages or symptoms]
Evaluate the candidate skill against these criteria:
| Criterion | Pass? | Evidence | |-----------|-------|----------| | **Reusable** - Helps future tasks, not just this instance | | [Why] | | **Non-trivial** - Required discovery, not docs lookup | | [Why] | | **Verified** - Solution actually worked | | [Evidence] | | **Specific triggers** - Exact error messages or scenarios | | [What they are] | | **Explains WHY** - Trade-offs and judgment, not just steps | | [How] | | **Value-add** - Teaches judgment, not just facts Claude could look up | | [How] |
Present assessment to user and ask: "Proceed with extraction? [yes/no]"
The user decides whether to proceed regardless of how many criteria pass. Respect their judgment - if they say yes, extract; if no, skip.
Ask the user: 1. **Skill name** - Suggest a kebab-case name based on context, let them override 2. **Scope** - User-level (default) or project-level (`--project`)
If the topic involves a specific library or framework:
Skip research for:
Use the template from [skill-template.md](references/skill-template.md).
**Quality standards:** Follow [quality-guide.md](references/quality-guide.md) to ensure the skill provides lasting value. Key points:
Run through the validation checklist in [skill-template.md](references/skill-template.md). If validation fails, fix the issues before saving.
Create the directory and save:
Report success:
Skill saved to: [path] The skill will be available in future sessions when the context matches: "[first line of description]"
When extracting, consider how the new knowledge relates to existing skills:
**Combine or separate?**
**Update vs create:**
**Cross-referencing:**
Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety.
Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration,…
Reverse engineers binaries using Ghidra's headless analyzer. Use when decompiling executables, extracting functions, strings,…
Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and…
Researches a topic from the last 30 days on Reddit, X, and the web. Surfaces real community discussions with engagement metrics…
Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform
Use when the agent is building or iterating on a web game (HTML/JS) and needs a reliable