hack-skills

HACK.SKILLS - Hacker Arsenal for Agents

Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 102 deep topic skills across 14 security domains.

An Agent Skills knowledge base covering web security, API security, authentication & authorization, OS privilege escalation (Linux/Windows/macOS), Active Directory attacks, mobile security, binary exploitation (Pwn), reverse engineering, cryptography attacks, blockchain & smart contract security, AI/ML & LLM security, network protocols & pivoting, and digital forensics — built for bug bounty, penetration testing, CTF competitions, and authorized security research.

The current branch has converged to a standard directory structure: every skill lives in its own directory, uniformly using skills/{semantic-identifier}/SKILL.md. The design goal is not to expose every minor tip as an entry point, but to compress what the loader truly needs to see into one master entry, six category entries, and deep topic skills drilled down on demand.

The objective is straightforward: organize security knowledge that is genuinely useful in real engagements and easy to audit and maintain into a set of installable, searchable, and composable HackSkills.

Browse Online

This repo is published in three forms — pick whichever your workflow prefers; they are kept in sync on every push to main.

The website is a static, fully client-side build of site/ — no tracking, no backend. Source: site/, workflow: .github/workflows/deploy-pages.yml. Search uses a weighted fuzzy index over name / id / category / description with field qualifiers like category:auth, tier:deep, lines:>200.

                        ┌─────────────────────────────────────┐
                        │   skills.hackbenchmark.com (static) │  ── search / filter / copy install cmd
                        └─────────────────────────────────────┘
                                          ▲
   github.com/yaklang/hack-skills ───────►┤  same repo, three views
                                          ▼
                        ┌─────────────────────────────────────┐
                        │   hack-skills.zip (AES-256, public  │  ── offline / behind AV
                        │   password: hack-skills, via CDN)   │
                        └─────────────────────────────────────┘

Knowledge Sources & Distillation Boundaries

This repository is not a mirror of external materials — it is a distillation layer aimed at Agents.

Primary reference sources (all publicly available, used strictly for educational distillation):

Processing principles:

• No direct copying of large dictionaries or full payload lists.
• Prioritize distilling into routable, composable, and auditable security skills.
• Use small, stable samples, taxonomies, and cross-references to improve Agent stability in real security scenarios.
• No customer-specific information, no vendor-identifiable case details, purely educational methodology.

Quick Start

The preferred entry point is hack:

npx skills add yaklang/hack-skills

If your tooling supports pulling a single SKILL.md directly, you can also use:

• frontmatter name: hack
• raw URL: https://raw.githubusercontent.com/yaklang/hack-skills/main/skills/hack/SKILL.md

After installing, the recommended order is simple: start from the master entry, then move into category entries, and only then drill into deep topic skills.

Loader Priority

Main Entry Points

Complete Skill Index (102 Skills)

Reconnaissance & Methodology

API Security

Authentication & Authorization

Injection Attacks