browser-exploitation-v…
Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8…
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8…
Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than…
Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening),…
Drift detection + baseline integrity guard for agent workspace files with automatic alerting support
Hunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants. Built from public bug bounty reports…
1. Read program scope, policy, safe harbor 2. Read 5+ disclosed reports in hacktivity 3. Map crown jewels: what would hurt the company most? 4. Understand the…
Record a platform response and update learning. Usage: /learn <report_id> <status> [--bounty 500] [--vuln-type XSS]
LLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain,…
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport…
Operational Technology and industrial control system security — Purdue model segmentation, industrial protocol analysis (Modbus, DNP3, S7, EtherNet/IP),…
Setup guidance for users running a /report:* command before their toolkit has enough context. Use when a report command detects missing findings, frameworks,…
Explains a single control once and shows every framework it maps to via the SCF crosswalk. Resolves SCF IDs, framework-specific IDs, and plain-English…
Designs and documents control testing procedures. Creates test plans, executes walkthroughs, and documents results for audit workpapers.
Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa…
Use when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing,…
--- name: keylogger-architecture description: Use when designing or analyzing keystroke/input capture — SetWindowsHookEx, raw input devices, ETW-based capture,…
Governance behavior for Muse agents governed by DashClaw. Teaches the governance protocol over REST: when to call guard, how to interpret…
Register any agent (including this one) as a governed agent on a DashClaw instance
Turn a bug symptom into a structured, reproducible bug report — summary, environment, exact repro steps, actual vs expected, and evidence (logs, error text,…
L1 trigger - detects non-determinism, state transition completeness violations, and safety/liveness invariant breaks in consensus code. Inject into…
L1 trigger - audits replay protection, transaction identity binding, and cross-layer uniqueness.
Trigger Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents, depth-state-trace
Offline credential and file recovery with hashcat and john. Use when any skill captures hashes (NTLM, Kerberos TGS/AS-REP, shadow, MSCACHE2) or encrypted files…
Exploit Cross-Site Request Forgery (CSRF) vulnerabilities during authorized penetration testing.
Multi-phase penetration test orchestrator. Handles recon, assessment surface mapping, vulnerability chaining, and routes to technique skills for execution.…
Penetration testing framework for exploit development, vulnerability validation, and authorized security assessments using Metasploit Framework. Use when: (1)…
Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA). Use when: (1) Enforcing security and compliance policies across…
Linux privilege escalation enumeration and attack surface analysis using LinPEAS (Linux Privilege Escalation Awesome Script). Automates post-exploitation…
Detect VM/sandbox escape vulnerabilities in packages using node:vm, simpleeval, or custom sandboxes that can be bypassed to achieve code execution.
Detect SQL injection where user input reaches SQL query construction through string concatenation, template literals, or ORM raw query methods.
Detect Server-Side Request Forgery where user-controlled URLs can reach internal services, cloud metadata endpoints, or bypass network boundaries.
Use this skill when the user is auditing a decompiled Android application — directory structure includes `jadx_out/` / `apktool_out/`, files end in `.smali` /…
Use this skill when the user is auditing an iOS application — directory contains `.ipa`, `Info.plist`, `*.swift`, `*.m`, `*.mm`, or an `xcodeproj`. Also…
Use this skill when reviewing mobile code that handles card data, payment tokenization, or third-party payment SDK integrations (Braintree, Stripe, Adyen,…
This skill should be used when the user mentions "payment", "payment gateway", "checkout", "IDOR payment", "payment bypass", "Stripe", "MercadoPago", "Binance…
Activate this skill whenever the user mentions PE analysis, PE file, PE header, portable executable, Windows executable analysis, EXE analysis, DLL analysis,…
This skill should be used when the user mentions "generate report", "pentest report", "engagement report", "findings report", "executive summary", "technical…
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert
Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to
Meta-skill for managing user-dismissed findings. Before reporting any finding, check it against the project's .rugproof.yml ignore list and inline…
Detect fee-on-transfer / deflationary / rebasing token accounting bugs — crediting the *passed amount* instead of the measured balance delta. Activate whenever…
Detect vulnerability to flash-loan-funded attacks — governance manipulation, price manipulation, collateral inflation, vault donation attacks. Activate when…
Test what an AI agent will actually do without human confirmation, including under injected-goal / prompt-injection scenarios, to validate its autonomy and…
Assess an AI model, feature, or dataset for bias and fairness across groups — representational and allocative harms, disparate performance, and skewed refusals…
Produce a board / executive security presentation — risk posture and direction, top risks in business terms, program progress against strategy, the metrics…
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and…
Analyzes DNS query logs to detect data exfiltration via DNS tunneling,
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic