noorqureshi/security-skills

If you are an AI agent: read AGENTS.md (or README_AI.md for the short bootstrap) and follow it strictly — this repo is designed to be operated by you, not just read by humans.

Benchmarked, not just claimed. That replay is a real run: against OWASP Juice Shop (116 challenges, running locally), an agent with these skills solved 9 challenges in 10 minutes — SQLi auth bypass, UNION credential dump, XXE, JWT algorithm confusion, BOLA — each with a written finding. Scoring comes from the target’s own solve log, never from what the agent claims. Full A/B (skills vs none) and how to reproduce it yourself: bench/RESULTS.md.

What it is

Your AI agent is a strong generalist, but it doesn’t know the exact method for a specific job — say, testing an API for access-control bugs. Security Skills is that missing know-how: a binder of 206 short “how to do this one technique” pages the agent flips to when it needs one.

It’s not a replacement for your toolkit, either: the skills teach your agent when and how to drive the tools you already have — sqlmap, nmap, ffuf, nuclei, Burp Suite, Ghidra, Frida, hashcat, Impacket — with the exact commands, follow-ups, and verification steps each job calls for. And a machine-readable routing table (data/routing.json — 618 trigger cases, CI-verified) lets any agent or integration pick the right skill deterministically, no prompt guesswork.

You describe the task in plain English → it picks the right page, runs it, proves the bug, and writes it up → and it never touches anything outside the scope you set.

Pick your door