Trending Skills
The hottest skills gaining momentum in the community right now.
ethical-hacking-methodology
by Sekolah76
"Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments."
captcha-solver
by Sekolah76
Universal local sidecar anti-bot & captcha solver (Cloudflare Turnstile, Aliyun 2.0, Arkose FunCaptcha, Akamai, BotGuard, PerimeterX, DataDome, AWS WAF, reCAPTCHA, hCaptcha).
security-arsenal
by Sekolah76
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.
api-fuzzing-bug-bounty
by Sekolah76
"Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors."
bug-bounty-disclosure
by Sekolah76
Skill end-to-end buat authorized/good-faith bug bounty & coordinated vulnerability disclosure ke developer atau pemilik projek — untuk SEMUA jenis bug (web, API, infra, mobile, cloud, smart contract/web3, agent/LLM), crypto maupun non-crypto. Pakai skill ini setiap kali user mau triase & verifikasi temuan, bikin PoC, NYARI kontak dev/owner (security.txt, SECURITY.md, GitHub, WHOIS, on-chain, sosmed), dan KIRIM laporan via email — baik target punya program bug bounty terdaftar (HackerOne/Immunefi/dll) maupun proyek tanpa program resmi. Trigger juga kalau user nyebut "report bug ke dev", "disclosure", "lapor kerentanan", "cari kontak owner projek", "kirim report email", "responsible disclosure", "bug bounty" — walau ga eksplisit bilang "skill". Sisi disclosure jalan buat proyek apapun; dasar pengetesan harus sah/good-faith.
entry-point-analyzer
by Sekolah76
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
encrypting-and-decrypting-data
by Sekolah76
Validate encryption implementations and cryptographic practices. Use when reviewing data security measures. Trigger with 'check encryption', 'validate crypto', or 'review security keys'.
evidence-packager
by Sekolah76
Assemble a reproducible, minimal, tamper-evident evidence bundle for a security finding, preserving provenance and separating observed facts from interpretation.
code-injection-detector
by Sekolah76
Code Injection Detector - Auto-activating skill for Security Fundamentals. Triggers on: code injection detector, code injection detector Part of the Security Fundamentals skill category.
attack-chain-web2
by Sekolah76
Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.
web-exploit-test
by Sekolah76
Localhost-only, stdlib evidence verifier: scan, JWT matrix, race controls.
attack-chain-web3
by Sekolah76
Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.
ruanzhu-kit
by CatCatUncle
生成中国软件著作权登记（软著）全套申请材料——页数写死的程序鉴别材料 PDF、文档鉴别材料（说明书）PDF，以及在线表单逐字段可复制的填写清单。当用户提到「软著」「软件著作权」「版权登记」「程序鉴别材料」「文档鉴别材料」「源程序前30页后30页」时使用。
notebooklm
by roomi-fields
This skill should be used when the user wants to query their Google NotebookLM notebooks for citation-backed, source-grounded answers, or manage notebooks, sources, and Studio content (audio, report, video, infographic, presentation, data table, flashcards, quiz, mind map). It drives the @roomi-fields/notebooklm-mcp engine — via the notebooklm MCP tools when they are available in the session, otherwise via its HTTP REST API — and covers Google login, citation formats, the daily-quota-aware batch/ingestion pattern, and source discovery.
headless-claude-code
by vellum-ai
Reference guide for running Claude Code in third-party headless, container, and CI environments. Covers auth strategies, interactive mode pitfalls, tmux orchestration, root user workarounds, and git auth without SSH agents or keychains
messaging
by vellum-ai
Read, search, send, and manage messages across Gmail, Outlook, Telegram, and other platforms
chatgpt-import
by vellum-ai
Import conversation history from ChatGPT into Vellum
doordash
by vellum-ai
Order food, groceries, and convenience items from DoorDash using the built-in CLI integration
stripe-link-wallet
by vellum-ai
"Agent wallet on the Stripe Link CLI (link-cli). Connect the wallet, then buy, purchase and pay for things on the user's behalf via approved spend requests, one-time-use cards, and 402 / Machine Payment Protocol (MPP) payments"
amazon
by vellum-ai
Shop on Amazon and Amazon Fresh through your browser
llm-provider-setup
by vellum-ai
"Set up a new LLM provider connection, discover valid model ids, create and validate a model profile — securely and end-to-end via CLI. Covers managed vs BYO keys, secure credential collection, model discovery, profile creation, and live verification."
vellum-feature-flag-rollout
by vellum-ai
Guide Vellum Assistant feature flag changes and rollout hygiene. Use when adding, editing, reviewing, or documenting assistant feature flags, rollout-gated behavior, or platform flag follow-up work.
cli-discover
by vellum-ai
Discover which CLI tools are installed, their versions, and authentication status
playbooks
by vellum-ai
Trigger-action automation rules for handling incoming messages