Security & Testing Agent Skills for Claude Desktop

Build the foundational red team engagement plan - scope definition, Rules

Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''s

Guides developers through Exemplar Relay — coding-agent governance for Claude Code, Cursor, Codex, and OpenCode.

BloodHound is a graph-based Active Directory reconnaissance tool that

Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP…

Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them…

Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced…

Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or…

Identifies and exploits insecure local data storage vulnerabilities

Identifies and exploits IPv6-specific vulnerabilities including SLAAC

Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to…

Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan)…

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's…

Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278

Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB,

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations

Identifies and exploits SMB protocol vulnerabilities using Metasploit

Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities

Exploits PHP type juggling vulnerabilities caused by loose (==) comparison

Testing WebSocket implementations for authentication bypass, cross-site

Performs systematic, hypothesis-driven exploration and debugging across complex codebases using tree-search algorithms and domain adapters.