NeVibeCode · 1,434 items
Skills for Security
Skills for Security: what each one does, an install command and example prompts.
recon-for-sec skill Routes initial reconnaissance for a new application, from attack-surface mapping to the next security testing path.
CX Codex +1
3,700installs
ios-pentesting-tricks skill A playbook for iOS app testing: keychain extraction, URL scheme hijacking, Universal Links abuse and runtime hooks.
CX Codex +1
3,700installs
cors-cross-origin-misconfiguration skill Guides testing of CORS misconfigurations, origin reflection, and credentialed API access. Useful when auditing cross-origin boundaries and cache policies.
CX Codex +1
3,700installs
injection-checking skill A router skill for injection testing: pick the right workflow based on where attacker-controlled input ends up.
CX Codex +1
3,700installs
kubernetes-pentesting skill A Kubernetes pentesting playbook: API server access, RBAC enumeration, service account token abuse, etcd, the Kubelet API and pod escape.
CX Codex +1
3,700installs
auth-sec skill Entry P1 category router for authentication and authorization testing. Helps choose the right audit path before digging into specific attacks.
CX Codex +1
3,700installs
api-authorization-and-bola skill A playbook for testing API authorization: reaching other users' objects, calling functions your role should not have, and writing hidden fields.
CX Codex +1
3,700installs
vm-and-bytecode-reverse skill A playbook for reversing hand-rolled virtual machines and bytecode: find the dispatcher, map opcodes, write a disassembler.
CX Codex +1
3,700installs
websocket-security skill Helps analyze WebSocket security, detect CSWSH vulnerabilities, and review handshake headers. Useful when auditing real-time messaging, notifications, or WS-backed APIs.
CX Codex +1
3,800installs
analyzing-web-server-logs-for-intrusion skill This skill parses Apache and Nginx logs, flags attack patterns, and builds a findings report. Use it for incident analysis or monitoring checks.
CX Codex +1
408installs
reverse-engineering-tools skill A skill for pulling apart game binaries, drivers and dumps: disassembly, decompilation, debugging and interface reconstruction.
CX Codex +1
544installs
analyzing-cobalt-strike-beacon-configuration skill This skill extracts Cobalt Strike Beacon configuration from PE files and memory dumps. Use it to inspect C2 infrastructure, malleable C2 settings, and operator clues.
CX Codex +1
404installs
neon-auth skill Provisions Managed Better Auth in Neon Postgres branches. The skill sets up email OTP, magic links, OAuth, and migration flows from Supabase Auth.
CX Codex +1
20,300installs
dangling-markup-injection skill A playbook for dangling markup injection: when HTML injection works but JavaScript is blocked, it shows how to pull CSRF tokens and page data through unclosed tags.
CX Codex +1
3,600installs
dns-rebinding-attacks skill Provides an expert playbook for executing DNS rebinding attacks against internal web targets. It helps penetration testers bypass browser Same-Origin Policy during security reviews.
CX Codex +1
3,600installs
prototype-pollution skill Tests JavaScript stacks for prototype pollution, from unsafe object merges to polluted-property reads. Use it for authorized Node or browser security reviews.
CX Codex +1
3,600installs
hash-attack-techniques skill A playbook for hash attacks: length extension, MD5 and SHA-1 collisions, HMAC timing leaks, proof of work. Built for CTFs and authorized testing.
CX Codex +1
3,600installs
arbitrary-write-to-rce skill Playbook for turning memory write primitives into code execution. Maps working targets from GOT entries to thread destructors across glibc versions.
CX Codex +1
3,600installs
active-directory-certificate-services skill This skill maps misconfigured AD CS and ESC1–ESC13 paths. Use it to review privilege escalation, certificate authentication, and certificate-based persistence in Active Directory.
CX Codex +1
3,600installs
saml-sso-assertion-attacks skill A playbook for SAML SSO testing: which XML nodes are signed, how Audience and ACS checks behave, and where IdP/SP trust breaks down.
CX Codex +1
3,600installs
active-directory-kerberos-attacks skill Kerberos attack playbook for Active Directory covering AS-REP roasting, Kerberoasting, ticket forging, and delegation abuse.
CX Codex +1
3,600installs
http2-specific-attacks skill A skill for assessing HTTP/2-specific attack paths such as h2c, pseudo-headers, HPACK, and multiplexing. Use it when an authorised target supports HTTP/2.
CX Codex +1
3,600installs
clickjacking skill A clickjacking playbook: find out whether a page can be framed and whether an invisible overlay can trigger a sensitive action.
CX Codex +1
3,600installs
jndi-injection skill A playbook for JNDI injection: lookup abuse over RMI and LDAP, JDK version limits, and post-8u191 bypasses. Useful when testing Java apps for Log4Shell.
CX Codex +1
3,600installs
active-directory-acl-abuse skill A playbook for abusing misconfigured Active Directory permissions: dangerous ACEs, DCSync, shadow credentials, LAPS and BloodHound paths.
CX Codex +1
3,600installs
csv-formula-injection skill A skill for testing how CSV exports and spreadsheets handle formulas coming from user fields. Useful when reports or exports reach a spreadsheet.
CX Codex +1
3,600installs
expression-language-injection skill An Expression Language injection attack playbook for Java frameworks. Helps security testers detect and exploit vulnerabilities across SpEL, OGNL, and Java EL.
CX Codex +1
3,600installs
dependency-confusion skill Reviews dependency-confusion risk in manifests and CI. Use it for npm, pip, RubyGems, Maven, Composer, and Docker supply-chain checks.
CX Codex +1
3,600installs
subdomain-takeover skill A playbook for finding dangling CNAME, NS and MX records and claiming the resources behind them. Useful for pentests and bug bounty work.
CX Codex +1
3,600installs
http-host-header-attacks skill Playbook for HTTP Host header attacks: password reset poisoning, cache poisoning, routing SSRF, and virtual host bypass. Useful for auditing applications that trust incoming headers.
CX Codex +1
3,600installs
web-cache-deception skill This skill guides checks for cached authenticated pages and cache poisoning conditions. Use it when auditing a CDN, reverse proxy, or application cache.
CX Codex +1
3,600installs
mobile-ssl-pinning-bypass skill A playbook for bypassing SSL pinning in mobile apps: Android and iOS methods plus framework-specific tricks for Flutter, React Native and Xamarin.
CX Codex +1
3,600installs
insecure-source-code-management skill Detects exposed .git, .svn, and .hg repositories along with leaked .env files. Guides extraction workflows during authorized security tests.
CX Codex +1
3,600installs
crlf-injection skill A playbook for CRLF injection: smuggling carriage-return and line-feed characters into response headers, redirects and logs. Useful when scanners miss it.
CX Codex +1
3,600installs
symbolic-execution-tools skill A symbolic execution playbook that keeps your agent's angr, Z3 and Unicorn scripts from breaking on state setup and missing libc hooks.
CX Codex +1
3,600installs
browser-exploitation-v8 skill A playbook for exploiting JavaScript engine bugs: JIT type confusion, bounds elimination, V8 sandbox bypass. Built for CTF work and Chrome bug analysis.
CX Codex +1
3,600installs
csp-bypass-advanced skill A skill for picking apart Content Security Policy: which directives the policy leaves open and how data leaves the page without JavaScript.
CX Codex +1
3,600installs
race-condition skill A skill for testing web apps for race conditions and TOCTOU: parallel requests, rate-limit bypass, one-time operations.
CX Codex +1
3,600installs
http-parameter-pollution skill Guides agents through HTTP Parameter Pollution tests when WAFs, proxies, and backends parse duplicate parameters differently. Built for API security assessments.
CX Codex +1
3,600installs
deserialization-insecure skill This skill helps find unsafe deserialization in Java, PHP, and Python and review possible attack chains. Use it for source and traffic analysis.
CX Codex +1
3,600installs
521–560 of 1,434
