rifteo/skills

The problem with AI agents and security work

Ask an agent to hunt for IDOR bugs. It will improvise. It misses verb inconsistency checks, skips GraphQL object exposure, and never tests parameter pollution. You re-prompt five times, spend 3x the tokens, and still get an incomplete result.

The agent is not dumb. It lacks a methodology.

What a skill is

A skill is a battle-tested methodology file your agent reads before starting a task. It covers every test case, every bypass technique, every output format a practitioner would use. The agent stops improvising and starts executing.

28 skills. 53 agents. One command to install.

---

Benchmarks

19 skills. Real engagements. Same prompt. Same model. Measured.

The agent does not get smarter. It gets a methodology. That is what changes the numbers.

Each skill’s full benchmark is in its BENCHMARK.md.

---

Quickstart

npm install -g @rifteo/skills
rifteo-skills add bugbounty-reporter

No account. No configuration. The CLI detects your installed agents automatically and puts the skill in the right place.

---

Install

npm install -g @rifteo/skills

---

CLI

# Install a skill into all detected agents
rifteo-skills add bugbounty-reporter

# Install into a specific agent
rifteo-skills add bugbounty-reporter --agent claude-code

# Install globally across all projects
rifteo-skills add bugbounty-reporter --global

# Check which installed skills have a newer version available
rifteo-skills outdated

# Update all installed skills to their latest version
rifteo-skills update

# Browse all available skills
rifteo-skills available

# See what is installed
rifteo-skills list

# See which agents were detected on this machine
rifteo-skills agents

# Remove a skill
rifteo-skills remove bugbounty-reporter

Not sure which skill to use? Install find-skills first:

npx rifteo-skills add find-skills

It reads your task and loads the right skill automatically.

---

Skills

Web Application

API Security

Infrastructure

Reconnaissance

Reporting

Compliance

Workflow

Integrations

---

Slash Commands for Claude Code

Install a skill for Claude Code and you get five slash commands that work in every session, no skill loaded required:

rifteo-skills add bugbounty-reporter --agent claude-code
# Install Rifteo slash commands for Claude Code? [Y/n/never]

---

How to activate a skill

After installing, tell your agent to use the skill:

• Claude Code: type /skills and select from the list
• Cursor / Windsurf: type /skill-name in chat
• Gemini CLI: type @skill-name to invoke
• Other agents: skills are loaded automatically from the skills directory on session start

Then describe your task in plain language:

I found that /api/orders/{id} returns order data without checking 
if the authenticated user owns that order. Any integer ID works.

The agent produces a complete, triage-ready report. First try.

---

Supported Agents

---

Contributing

Skills are built by practitioners, for practitioners. If you have a methodology that works, the community needs it.

Read the Skill Structure Guide for the full format.

The short version:

1. Create a folder named after your skill
2. Add SKILL.md with YAML frontmatter and methodology
3. Open a pull request

Once merged, find-skills picks it up automatically and your skill is live for the entire community.

---

Contexts

Skills pair with Rifteo Contexts, engagement-specific knowledge bases for web app pentest, cloud audit, mobile pentest, and more. Load a context at the start of an engagement and the agent knows the full scope, methodology, and relevant skills before you ask the first question.

---

Part of Rifteo

These skills work standalone with any agent and integrate natively with Rifteo, the pentest management platform built for security teams and consultancies.

---

MIT License