example-skill
One or two sentences naming the SITUATION, INPUTS, and OUTCOME so Claude knows exactly when to fire this skill. This text is always in context — be specific…
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
One or two sentences naming the SITUATION, INPUTS, and OUTCOME so Claude knows exactly when to fire this skill. This text is always in context — be specific…
Distill technical security results into a concise, business-oriented summary for leadership or a board. Use when the audience is executives/non-technical…
Export a finished security artifact (report, executive summary, diagram, spreadsheet of findings) to Google Drive — right folder, clear naming, and shareable…
Analyzes malicious VBA macros embedded in Microsoft Office documents
Perform static analysis of malicious PDF documents using peepdf, pdfid,
URLScan.io is a free service for scanning and analyzing suspicious URLs.
Tailwind CSS 4 patterns and best practices. Trigger: When styling with Tailwind (className, variants, cn()), especially when dynamic styling or CSS variables…
Test-Driven Development workflow for ALL Prowler components (UI, SDK, API). Trigger: ALWAYS when implementing features, fixing bugs, or refactoring -…
TypeScript strict patterns and best practices. Trigger: When implementing or refactoring TypeScript in .ts/.tsx (types, interfaces, generics, const maps, type…
Triages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing…
Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex. Use when the user asks to create, write, rewrite, improve, compress, clean up,…
Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new…
Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an…
Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth,…
DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context,…
Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages…
Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2,…
Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com
Sync program scope, policy, and hacktivity from a bug bounty platform. Usage: /sync hackerone tesla or /sync bugcrowd uber
Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage
Tutor that produces working primers on GRC frameworks and roles. Adapts depth to the learner's background. Never reproduces copyrighted standard text —…
Use `gcp-docs` when implementation guidance needs current Google Cloud, Google Workspace, Firebase, Android, Chrome, or related public Google developer…
Expertise in evaluating GCP projects for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret gcloud output.
Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning,…
Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM…
Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI
Trigger Pattern Always required for DAML audits - Inject Into Breadth agents, depth-edge-case
Trigger MISSING_EVENT flag in template_recommendations.md (recon detects admin/state-changing functions without events) - Agent Type general-purpose…
Trigger 15 events detected in recon event_definitions.md (optional skill) - Used By breadth agents (assigned to core state or dedicated agent)
Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.
Linux local privilege escalation enumeration and attack surface mapping.
Exploit writable critical files, NFS misconfigurations, shared library hijacking, and privileged group membership (docker, lxd, disk, adm, video, staff) for…
This skill should be used when the user asks about "vulnerability chains", "chained exploits", "multi-step attacks", "SSRF to RCE", "pivot attacks", or needs…
This skill should be used when the user asks to "detect workspaces", "find packages", "list monorepo packages", "workspace structure", "monorepo analysis", or…
Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system
Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families
Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry
Detect restaking / AVS bugs — EigenLayer / Symbiotic / Karak operator slashing edge cases, withdrawal-queue gaming, cascading-slashing across AVSs, LST depeg…
Detect selfdestruct misuse and EIP-6780 implications post-Cancun — bricked contracts, broken `assert(balance == X)` invariants, factory patterns relying on…
Detect ECDSA signature malleability and ecrecover pitfalls — missing low-s (EIP-2) enforcement, unconstrained v, unchecked address(0) from ecrecover, replay…
Discover an organization's public exposures — leaked credentials and secrets, exposed services and storage, source-code/config leaks, and breach data — from…
Write up a single security finding in a consistent, actionable format: title, severity (CVSS), affected assets, evidence, impact, reproduction, and…
Perform forensic triage on a host or artifacts — collect and analyze disk, memory, and log evidence with proper handling, then build an incident timeline. Use…
Detonate malware samples in Cuckoo Sandbox to observe runtime behavior
Query the Malpedia API to look up malware family aliases and naming
Use Sysinternals Autoruns to systematically enumerate and analyze malware
Vitest unit testing patterns with React Testing Library. Trigger: When writing unit tests for React components, hooks, or utilities.
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic