MCP App StoreMCP App StoreThis skill provides a rigorous process for hunting BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object Reference) vulnerabilities. It focuses on identifying where servers fail to verify if a user owns the resource they are requesting.
Activate this skill when testing APIs or web applications that use resource identifiers (numeric IDs, UUIDs) in URLs or request bodies, especially when auditing user-scoped data or administrative endpoints.
ffuf, curl, and recommendations for Burp Suite (Autorize extension).Optimized for agents assisting in bug bounty hunting or security research using tools like Burp Suite, curl, or ffuf (e.g., Claude Code).
This skill has not been reviewed by our automated audit pipeline yet.
Kerberoasting Active Directory
Execute Kerberoasting attacks to extract and crack SPN ticket hashes for privilege escalation in Active Directory.
Active Directory Security Audit
Comprehensive AD security auditing using MITRE ATT&CK, covering ADCS, GPOs, ACLs, and Kerberos attacks.
Active Directory Kerberos Attack Playbook
Expert-level guide for executing Kerberos-based attacks in AD environments, including roasting, ticket forging, and delegation abuse.
Bounty Hunter — Atlas
Persona skill: 'Atlas' — a profit-focused developer persona for discovering, evaluating and executing paid bounties or freelance tasks with ROI-aware workflows.
Anthropic Security Basics
Practical security practices for Anthropic Claude integrations: API key management, input validation, prompt-injection defenses, and output scanning.
Security Research Meta-Methodology
A structured vulnerability research framework distilled from 5600+ security docs, covering web injection, deserialization, binary exploitation, domain pentest,
Input Validation Checker
Automated guidance and code patterns for implementing robust input validation and secure-coding practices (OWASP-aligned).
Performing Threat Modeling with OWASP Threat Dragon
Use OWASP Threat Dragon to create data-flow diagrams, apply STRIDE/LINDDUN threat classifications, and generate threat-model reports to guide secure design revi
Nuxt Users
Add and configure user authentication, authorization, database and CLI tools for Nuxt 3/4 apps using the nuxt-users module.
Security Headers Generator
Auto-activating skill that generates and validates security HTTP headers and provides guidance for implementing secure header configurations.
Upstash Rate Limit TypeScript SDK
Guidance and practical examples for using Upstash's TypeScript rate-limit SDK (setup, common algorithms, and traffic-protection patterns).