Security-testing methodology as portable, tool-agnostic agent skills for Claude Code and any agent runtime: white-box bug hunting, AI-agent and LLM red-teaming, supply-chain risk, and appsec depth.
概览
Agent skills that encode security-testing methodology: the reasoning, ordering, and adjudication discipline behind real black-box and white-box testing, written as portable Claude Code skills. The bet is that a skill's value is judgment, not a script. Enumerate the whole taxonomy before you look at one family. Rank is triage, not a filter. A lead is a fact, never a verdict. That reasoning transfers to anyone, whatever tools they run, so every skill here is tool-agnostic method. Each one names the capability a step needs (for example, "something that answers who calls this from a real parse") without prescribing a product. Bring your own. These skills are for security work only: your own code, OSS you contribute to, CTFs, and engagements where testing is in scope. Every skill opens with a scope check or gate. Nothing here targets systems you do not have permission to test. Installs all skills at once and keeps them updatable.
README
以下为原文 README 节选，完整内容请查看原文。
security-agent-skills
194 tool-agnostic security-testing skills for AI coding agents: white-box bug hunting, AI-agent and LLM red-teaming, code-interpreter sandbox and model-inference-endpoint abuse, server-side injection and deserialization depth across SQL, NoSQL, LDAP, expression-language, and object streams, cloud identity, secrets, and KMS trust, infrastructure-as-code and container/Kubernetes and host workload trust, network, wire-protocol, and multiplexing trust across HTTP/2, gRPC, message brokers, and mutual TLS, federation and token trust across SAML, OIDC, OAuth, and JWT, enterprise identity lifecycle across SCIM and JIT provisioning, directory sync, MFA and key lifecycle, Kerberos delegation, and break-glass and machine-identity trust, account-recovery and payment-and-commerce integrity, client-app trust surfaces across browser and editor extensions and Electron, mobile app security, smart-contract and DeFi review across EVM and Move plus web3 account-abstraction, cross-chain bridge, MEV, signature-replay, and wallet-drainer trust, browser third-party-script and clickjacking trust, IoT and edge BLE and firmware-update trust, skill and supply-chain trust, API and object-authorization depth, firmware and embedded-software trust, web and transport trust boundaries, authentication and session depth, rate-limiting and multi-tenant isolation, file-upload and resource-exhaustion depth, the classic web-attack classes across XSS, template and command injection, XXE, XPath, path traversal, formula and include injection, HTTP parameter pollution, and CRLF, the web trust-boundary classes across open redirect, CSRF, host-header and URL-parsing trust, cache deception, server-side rendering and SVG abuse, Unicode canonicalization bypass, and postMessage trust, Windows and Active Directory privilege escalation and domain identity abuse across services, DLL search order, tokens and privileges, ADCS, directory ACLs, NTLM coercion and relay, group policy, and credentials, native iOS and Android app security across the keychain and data protection, WebView bridges, TLS pinning, biometrics, app groups, app bundles, mobile backends, intent redirection, tapjacking, and tamper resistance, defensive detection and logging, and appsec depth.
Agent skills that encode security-testing methodology: the reasoning, ordering, and adjudication discipline behind real black-box and white-box testing, written as portable Claude Code skills.
The bet is that a skill’s value is judgment, not a script. Enumerate the whole
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add unboundcompute/security-agent-skills