Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,840 results · page 25 of 62
- View details
adcs-template-abuseSkillSecurity
Exploits misconfigured AD CS certificate templates to impersonate any domain user via SAN manipulation or enrollment agent abuse. Covers ESC1 (enrollee supplies subject), ESC2 (any-purpose/no EKU), ESC3 (enrollment agent), ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2 CA flag).
Ready to connect★ 275
- View details
auth-coercion-relaySkillSecurity
Forces remote systems to authenticate back to attacker-controlled listeners and relays captured authentication to escalate privileges or move laterally. Covers authentication coercion (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, CheeseOunce), NTLM relay (ntlmrelayx to LDAP/SMB/AD CS/MSSQL), Ker
Ready to connect★ 275
- View details
av-edr-evasionSkillSecurity
Bypass antivirus and EDR detection for payload delivery during exploitation. Covers custom payload compilation (mingw C, Go), AMSI bypass, shellcode alternatives, and ETW patching. Route here when an agent reports a payload was quarantined, blocked, or detected by endpoint protection.
Ready to connect★ 275
- View details
command-injectionSkillSecurity
Guide OS command injection exploitation during authorized penetration testing.
Ready to connect★ 275
- View details
cors-misconfigurationSkillSecurity
Exploit CORS (Cross-Origin Resource Sharing) misconfigurations during authorized penetration testing.
Ready to connect★ 275
- View details
csrfSkillSecurity
Exploit Cross-Site Request Forgery (CSRF) vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
deserialization-dotnetSkillSecurity
Exploit .NET deserialization vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
deserialization-javaSkillSecurity
Exploit Java deserialization vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
deserialization-phpSkillSecurity
Exploit PHP deserialization vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
gpo-abuseSkillSecurity
Exploits Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. Covers GPO enumeration (GPOHound, BloodHound, PowerView), exploitation via immediate tasks, logon scripts, and registry modifications (SharpGPOAbuse, PowerGPOAbuse, pyGPOAbuse, GroupPoli
Ready to connect★ 275
- View details
idorSkillSecurity
Exploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
infrastructure-enumerationSkillSecurity
Enumeration of infrastructure services: DNS, SMTP, SNMP, IPMI, NFS, TFTP, RPC/MSRPC, and HTTP/HTTPS surface detection. Checks zone transfers, open relays, default community strings, cipher zero, NFS exports, and web technology fingerprinting. Use after network-recon identifies infrastructure ports.
Ready to connect★ 275
- View details
jwt-attacksSkillSecurity
Exploit JWT (JSON Web Token) vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
kerberos-delegationSkillSecurity
Exploits Kerberos delegation misconfigurations for privilege escalation and lateral movement in Active Directory. Covers Unconstrained Delegation (TGT harvesting via coercion), Constrained Delegation (S4U2Self + S4U2Proxy with SPN swapping), and Resource-Based Constrained Delegation (RBCD via writab
Ready to connect★ 275
- View details
kerberos-roastingSkillSecurity
Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.
Ready to connect★ 275
- View details
kerberos-ticket-forgingSkillSecurity
Forges Kerberos tickets for domain persistence and privilege escalation. Covers Golden Ticket (krbtgt hash → forged TGT), Silver Ticket (service hash → forged TGS), Diamond Ticket (decrypt/modify/re-encrypt legitimate TGT for stealth), Sapphire Ticket (U2U PAC swap), and Pass-the-Ticket injection.
Ready to connect★ 275
- View details
ldap-injectionSkillSecurity
Exploit LDAP injection vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
linux-cron-service-abuseSkillSecurity
Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.
Ready to connect★ 275
- View details
linux-discoverySkillSecurity
Linux local privilege escalation enumeration and attack surface mapping.
Ready to connect★ 275
- View details
linux-kernel-exploitsSkillSecurity
Exploit Linux kernel vulnerabilities and escape restricted shells for privilege escalation.
Ready to connect★ 275
- View details
linux-sudo-suid-capabilitiesSkillSecurity
Exploit sudo misconfigurations, SUID/SGID binaries, and Linux capabilities for privilege escalation.
Ready to connect★ 275
- View details
network-reconSkillSecurity
Network reconnaissance, host discovery, port scanning, and OS fingerprinting. Produces a port/service map that the orchestrator uses to route to service-specific enumeration skills.
Ready to connect★ 275
- View details
nosql-injectionSkillSecurity
Guide NoSQL injection exploitation during authorized penetration testing.
Ready to connect★ 275
- View details
oauth-attacksSkillSecurity
Exploit OAuth 2.0 and OpenID Connect vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
pass-the-hashSkillSecurity
Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket for lateral movement.
Ready to connect★ 275
- View details
password-reset-poisoningSkillSecurity
Exploit password reset vulnerabilities during authorized penetration testing.
Ready to connect★ 275
- View details
password-sprayingSkillSecurity
Performs password spraying against authentication services with lockout-safe techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA, and any service with username/password auth. Service-agnostic — the orchestrator passes target services and spray intensity tier.
Ready to connect★ 275
- View details
php-code-injectionSkillSecurity
Exploit PHP code evaluation injection via eval(), assert(), preg_replace /e, create_function(), call_user_func(), usort() callbacks, and runtime function creation (runkit, uopz). Distinct from OS command injection (shell operators) and SSTI (template engines) — this targets direct PHP code evaluatio
Ready to connect★ 275
- View details
pivoting-tunnelingSkillSecurity
Network pivoting, port forwarding, and tunneling through compromised hosts to reach internal networks.
Ready to connect★ 275
- View details
python-code-injectionSkillSecurity
Exploit Python eval(), exec(), and compile() injection in web applications. Distinct from OS command injection (shell operators) and SSTI (template engines) — this targets direct Python code evaluation of user input.
Ready to connect★ 275
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
54,764 of the 55,196 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.