windows-kernel-exploit…
Exploit Windows kernel vulnerabilities, vulnerable drivers, and privileged file operations for local privilege escalation to SYSTEM.
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
Exploit Windows kernel vulnerabilities, vulnerable drivers, and privileged file operations for local privilege escalation to SYSTEM.
Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.
Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable
Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal,
Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application
Review a CI/CD pipeline for supply-chain tampering risk — build isolation, runner/agent trust, secret exposure, mutable dependencies, and poisoned-pipeline…
Check GitHub Actions workflows for the two runaway-risk controls that have no safe platform default — a job with no `timeout-minutes`, and a workflow with no…
Develop or review security governance documents — policies, standards, procedures, and guidelines — aligned to a framework and the organization's risk, with a…
Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,
Parse Apache and Nginx access logs to detect SQL injection attempts,
Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s
Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths,…
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack…
Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs…
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery,…
Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the…
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where…
Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for…
Entry P1 category router for reconnaissance and methodology. Use when mapping scope, drawing an attack surface from one application, discovering assets,…
HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing…
Manages organizational risk registers. Performs risk assessments, calculates risk scores, tracks mitigations, and generates risk reports for leadership.
Converts unstructured risk assessments into structured Jira tickets. Extracts Likelihood, Impact, Mitigation from natural language and generates JSON formatted…
Singapore MAS Technology Risk Management Guidelines expert. Reference-depth framework plugin with scope determination, evidence checklist, and SCF-backed…
L1 trigger - audits JSON-RPC and Engine API surfaces for authentication bypass, rate limiting, subscription buffer overflows, and method-specific DoS.
L1 supplement - audits Rust-specific hazards: unsafe blocks, uninitialized memory, Send/Sync violations, panic safety in hot paths, drop order, FFI.
Trigger HAS_MULTI_CONTRACT flag in template_recommendations.md (recon detects 2+ in-scope contracts/modules sharing parameters or formulas) - Agent Type…
Exploit Windows token privileges for local privilege escalation to SYSTEM.
Bypass Windows User Account Control to escalate from medium to high integrity.
XMPP/Jabber service enumeration for Openfire, ejabberd, Prosody, and other XMPP servers. Trigger when ports 5222 (client), 5223 (legacy TLS), or 5269…
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history,
Read a PRD, feature brief, or an AI coding assistant's plan/prompt that has no security content, and inject concrete, testable security requirements and an…
Aggregate a fast, diff-scoped security check before `git commit`/`git push` — secrets/gitignore hygiene, SAST/SCA on changed files, and IaC/Claude-config…
Test an LLM feature for direct and indirect prompt injection using a structured payload set, then record what succeeded and how to mitigate it. Use when…
Analyzes Windows Security, System, and Sysmon event logs in Splunk to
Parse Windows LNK shortcut files to extract target paths, MAC timestamps,
Parse Windows Prefetch (.pf) files with the windowsprefetch Python
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and…
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or…
Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then…
Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external…
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula,…
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific…
Reverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shells, PTY…
RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small…
SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and…
Singapore - Personal Data Protection Ac (PDPA) (2012) expert. Reference-depth framework plugin with assessment, scope determination, and evidence checklist —…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic