Does hack-skills auto-invoke its skills?

Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.

Security

Plugin

hack-skills

Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 102 deep topic skills across 14 security domains.

Boost this plugin

yaklang@yaklang

GitHub

Plugin Signal94/100Strong

maintained97

capable97

documented100

adopted71

Install

$ npx -y skills add yaklang/hack-skills --agent claude-code

Stats

Python JavaScript Node HTML Java

+7 tags

PHP SQL GraphQL Kubernetes Linux iOS Android

2,260

Stars

294

Forks

Active

Maintenance

CSS

Language

MIT

License

8d ago

Last commit

5mo ago

Created

Repo: yaklang/hack-skills

In this plugin

103 skills

See everything inside

What's inside

Skill(103 skills)

/401-403-bypass-techniques401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools./active-directory-acl-abuseActive Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths./active-directory-certificate-servicesAD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

README

ExcerptRead the full README on GitHub

HACK.SKILLS - Hacker Arsenal for Agents

An Agent Skills knowledge base covering web security, API security, authentication & authorization, OS privilege escalation (Linux/Windows/macOS), Active Directory attacks, mobile security, binary exploitation (Pwn), reverse engineering, cryptography attacks, blockchain & smart contract security, AI/ML & LLM security, network protocols & pivoting, and digital forensics — built for bug bounty, penetration testing, CTF competitions, and authorized security research.

The current branch has converged to a standard directory structure: every skill lives in its own directory, uniformly using skills/{semantic-identifier}/SKILL.md. The design goal is not to expose every minor tip as an entry point, but to compress what the loader truly needs to see into one master entry, six category entries, and deep topic skills drilled down on demand.

The objective is straightforward: organize security knowledge that is genuinely useful in real engagements and easy to audit and maintain into a set of installable, searchable, and composable HackSkills.

Browse Online

This repo is published in three forms — pick whichever your workflow prefers; they are kept in sync on every push to main.

Channel	What you get	When to use
Web UI — https://skills.hackbenchmark.com	Fuzzy search, category sidebar, P0/P1/P2 tier filter, copy-paste install commands, encrypted ZIP download	Quick lookup, sharing links to a specific skill, demoing the catalog
GitHub source — this repo	Plain `SKILL.md` per skill, full markdown rendering, pull-request review	Diff review, contributing, deep reading offline
Encrypted ZIP — see Offline ZIP	One-shot download of all `*.md` for air-gapped use	No internet on target, AV strips plain markdown

The website is a static, fully client-side build of site/ — no tracking, no backend. Source: site/, workflow: .github/workflows/deploy-pages.yml. Search uses a weighted fuzzy index over name / id / category / description with field qualifiers like category:auth, tier:deep, lines:>200.

                        ┌─────────────────────────────────────┐
                        │   skills.hackbenchmark.com (static) │  ── search / filter / copy install cmd
                        └─────────────────────────────────────┘
                                          ▲
   github.com/yaklang/hack-skills ───────►┤  same repo, three views
                                          ▼
                        ┌─────────────────────────────────────┐
                        │   hack-skills.zip (AES-256, public  │  ── offline / behind AV
                        │   password: hack-skills, via CDN)   │
                        └─────────────────────────────────────┘

Knowledge Sources & Distillation Boundaries

This repository is not a mirror of external materials — it is a distillation layer aimed at Agents.

Primary reference sources (all publicly available, used strictly for educational distillation):

Source	What It Provides	How We Use It
`swisskyrepo/PayloadsAllTheThings`	64 vulnerability categories, payload families, bypass techniques, exploit chains	Distilled into scenario-based indices, method matrices, per-engine/per-database payload sections
`PentesterSpecialDict`	OS-specific payload dictionaries, Java middleware path fuzzing lists, file extension databases	Distilled into parameter naming patterns, endpoint frequency tables, middleware fingerprint matrices
`Dictionary-Of-Pentesting`	BugBounty bypass techniques (12 topics), cloud metadata endpoints, XXE payload collections, one-liner toolchains	Distilled into bypass pattern matrices, cloud metadata endpoint tables, WAF vendor bypass sections
`Hello-CTF`	CTF web security tutorials with hands-on tricks for PHP/Python/Java challenges	Distilled into CTF-specific technique sections (handler bypass, filter chain tricks, Flask PIN)
`ctf-wiki`	CTF competition knowledge base covering Pwn, Crypto, Reverse Engineering, Forensics, and Misc	Distilled into binary exploitation techniques (stack/heap/kernel), crypto attack patterns (RSA/lattice/symmetric), RE methodology, steganography, and traffic analysis skills
`hacktricks`	Penetration testing encyclopedia covering web tricks, Linux/Windows/macOS privilege escalation, Active Directory, containers, mobile, and AI security	Distilled into OS-specific privilege escalation playbooks, AD attack chains (Kerberos/ACL/ADCS), mobile pentesting checklists, container escape techniques, and network pivoting strategies
Public security research papers and CVE advisories	Methodology frameworks, vulnerability pattern taxonomies, statistical distributions	Distilled into attack pattern matrices, systematic testing checklists, decision trees

Processing principles:

No direct copying of large dictionaries or full payload lists.
Prioritize distilling into routable, composable, and auditable security skills.
Use small, stable samples, taxonomies, and cross-references to improve Agent stability in real security scenarios.
No customer-specific information, no vendor-identifiable case details, purely educational methodology.

Quick Start

The preferred entry point is hack:

npx skills add yaklang/hack-skills

If your tooling supports pulling a single SKILL.md directly, you can also use:

frontmatter name: hack
raw URL: https://raw.githubusercontent.com/yaklang/hack-skills/main/skills/hack/SKILL.md

After installing, the recommended order is simple: start from the master entry, then move into category entries, and only then drill into deep topic skills.

Loader Priority

Layer	Role	Recommended Exposure	Representative Skill
Master Entry	Global routing, operating doctrine, test sequencing, cross-category switching	Expose first	hack
Category Entry	Route by attack surface to stable topic families	Expose first	recon-for-sec, api-sec, auth-sec
Deep Topic	Provide complete attack playbooks and execution details	Load on demand	xss-cross-site-scripting, sqli-sql-injection

Main Entry Points

Type	Skill	Purpose	When to Use First
Master Entry	hack	Global routing, operating doctrine, phase assessment, cross-category switching	New target, unknown attack surface, authorized pentest / audit / leak / SOC task
Category Entry	recon-for-sec	Asset discovery, technology identification	Just received the target
Category Entry	api-sec	REST, GraphQL, mobile backend routing	Observed API interfaces
Category Entry	auth-sec	Authentication, sessions, OAuth, JWT, authorization	Login, tokens, object IDs
Category Entry	injection-checking	XSS, SQLi, SSRF, XXE, SSTI, CMDi, NoSQL routing	Input enters interpreter
Category Entry	file-access-vuln	Upload, download, LFI, path control	File operations
Category Entry	business-logic-vuln	Race conditions, pricing, workflow, state machines	Business process testing

Complete Skill Index (102 Skills)

Reconnaissance & Methodology

Skill	SKILL.md	SCENARIOS.md	Key Content
hack	248 lines	895 lines	Quality gate + router, impact-first ops, test matrix, evidence standard
recon-for-sec	30 lines	-	Category router for reconnaissance phase
attack-surface-mapping	194 lines	60 lines	Draw hosts/APIs/keys/object graph from one app; login is a shell
recon-and-methodology	389 lines	-	Methodology framework, Java middleware fingerprint matrix, leak detection checklist

API Security

Skill	SKILL.md	SCENARIOS.md	Key Content
api-sec	48 lines	-	Category router for API testing
api-recon-and-docs	60 lines	-	API discovery, OpenAPI/Swagger, hidden endpoints
api-authorization-and-bola	47 lines	-	BOLA/BFLA, mass assignment, object-level authz
api-auth-and-jwt-abuse	75 lines	-	JWT attacks, API key abuse, token manipulation
graphql-and-hidden-parameters	49 lines	-	GraphQL introspection, batching, hidden param discovery

Authentication & Authorization

Skill	SKILL.md	SCENARIOS.md	Key Content
auth-sec	40 lines	-	Category router for auth testing
authbypass-authentication-flaws	441 lines	-	Password reset 22-pattern matrix, captcha bypass 20 methods, insecure randomness (UUID v1/mt_rand/ObjectId)
jwt-oauth-token-attacks	301 lines	-	JWT alg confusion, key confusion, claim tampering, JWKS abuse
oauth-oidc-misconfiguration	45 lines	-	OAuth flow hijacking, OIDC misconfiguration
saml-sso-assertion-attacks	40 lines	-	SAML assertion manipulation, SSO bypass
idor-broken-object-authorization	336 lines	-	8-category systematic IDOR testing, ORM filter chain leaks (Django/Prisma/Ransack)

Injection Attacks

Skill	SKILL.md	SCENARIOS.md	Key Content
injection-checking	49 lines	-	Category router for injection testing
xss-cross-site-scripting	368 lines	278 lines	Polyglot payloads, WAF bypass by vendor (Cloudflare/Akamai/Incapsula/WordFence), CSP bypass, DOM clobbering, CSS injection data exfiltration
sqli-sql-injection	475 lines	575 lines	DB2/Cassandra/BigQuery/SQLite specifics, SQLite RCE, WAF bypass matrix, CTF techniques (handler/prepare/innodb)
ssrf-server-side-request-forgery	314 lines	226 lines	Cloud metadata 6-platform matrix, DNS rebinding, headless browser attacks, Gopher/Redis RCE chain
ssti-server-side-template-injection	340 lines	319 lines	15+ engine coverage (Jinja2/Twig/Pug/Handlebars/EJS/Razor/EEx/Smarty), blind SSTI, Flask PIN calculation
cmdi-command-injection	494 lines	-	WAF bypass (wildcards/xor/base64), PHP disable_functions 6 bypass paths, component RCE (ImageMagick/FFmpeg/ES)

File tree

FAQ

hack-skills is a Claude Code plugin with 103 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes 401-403-bypass-techniques, active-directory-acl-abuse, active-directory-certificate-services. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

What is hack-skills?: Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 102 deep topic skills across 14 security domains.
How do I install hack-skills?: Run these in Claude Code: npx -y skills add yaklang/hack-skills --agent claude-code. Then prompt normally.
Does hack-skills auto-invoke its skills?: Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
Is hack-skills free?: Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.

Is this plugin yours?

Claim it with GitHub Submit a plugin Promote it