Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This repository provides a comprehensive set of cybersecurity skills designed to equip AI agents with the technical knowledge required for authorized security engagements. It focuses on translating complex offensive and defensive maneuvers into a structured format that agents can execute reliably.
The collection covers critical security activities including credential access, privilege escalation, and the decryption of Windows DPAPI-protected secrets. It is built for automation builders who need to integrate specific red-team methodologies into AI-driven security workflows.
WHO IT'S FOR
AI agent / automation builders
equipping AI agents with cybersecurity capabilities
Red team operators
automating credential access and privilege escalation
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Triage a suspected business-email-compromise message
Uses detecting-business-email-compromise
Suspected email headers and message body
Sender and recipient roles
Normal communication patterns
Payment-change and approval process
Relevant email or SIEM log excerpts, if available
Use the detecting-business-email-compromise skill to perform an initial defensive triage of this suspected executive or vendor impersonation email: [paste the email headers and message body]. Use this organizational context: [describe the sender, recipient, normal communication pattern, and payment-change approval process]. Identify relevant BEC indicators, list the evidence that should be verified in email or SIEM logs, and recommend immediate non-destructive validation steps. Do not initiate payments, contact external parties, or modify production controls.
Path to or excerpt from authorized API-gateway access logs
Log source and format
Field definitions for user, endpoint, resource ID, status code, source IP, headers, and HTTP method where available
Use the analyzing-api-gateway-access-logs skill to review this authorized log sample: [path to or pasted excerpt from AWS API Gateway, Kong, or Nginx access logs]. First describe the available fields and data limitations, then look for a small set of supported indicators: sequential resource-ID access consistent with BOLA/IDOR, 401 surges consistent with credential scanning, injection attempts, rate-limit bypass patterns, and unusual write methods on read-only endpoints. Return a concise prioritized findings summary with supporting log evidence; do not change gateway configuration.
Confirmation that Wireshark 4.x and tshark are installed
Incident or sandbox time window and known internal address ranges, if available
Use the analyzing-network-traffic-of-malware skill to create an initial overview of the authorized PCAP at [path/to/malware.pcap]. Assume Wireshark 4.x and tshark are installed; state if another documented prerequisite is needed for any proposed step. Summarize capture statistics, protocol hierarchy, top IP endpoints, TCP conversations, and DNS activity, then identify a short list of traffic requiring deeper C2, exfiltration, DGA, tunneling, or fast-flux investigation. Preserve the original capture and do not contact observed external infrastructure.
Claude
Codex
Cursor
Gemini CLI
Copilot
Windsurf
Hermes
Devin
Cline
OpenHands