Agent Skills by ok-helloworld
Showing 46 vetted skills indexed across 1 GitHub repositories.
ok-helloworldvibe-pentest
Automate black-box web penetration testing with multi-agent reconnaissance and evidence-based reporting.
ok-helloworldfile-access-vuln
Route file access and upload workflow testing to path traversal or processing-chain issues.
ok-helloworldinjection-checking
Route suspected injection inputs to matching injection-testing workflows by sink context.
ok-helloworldprototype-pollution
Probe __proto__ and constructor.prototype paths to detect prototype pollution vulnerabilities.
ok-helloworldsaml-sso-assertion-attacks
Detect SAML SSO authentication bypass paths from assertion trust misconfigurations.
ok-helloworldapi-sec
Route API security testing to workflows based on observed target patterns.
ok-helloworldhttp-host-header-attacks
Identify Host header injection and routing abuse vectors in web applications.
ok-helloworldwebsocket-security
Identify WebSocket handshake weaknesses, CSWSH conditions, and message-level vulnerabilities.
ok-helloworldgraphql-and-hidden-parameters
Discover hidden GraphQL fields and authorization gaps via schema and type probing.
ok-helloworldxxe-xml-external-entity
Detect and exploit XXE vulnerabilities for file disclosure and blind OOB exfiltration.
ok-helloworldnosql-injection
Detect NoSQL injection via MongoDB operator manipulation and blind enumeration.
ok-helloworldclickjacking
Assess X-Frame-Options and CSP frame-ancestors to detect clickjacking vulnerabilities.
ok-helloworldtype-juggling
Probe PHP loose comparisons to verify authentication and signature bypasses.
ok-helloworldauthbypass-authentication-flaws
Identify authentication bypass risks across login, password reset, MFA, and session boundaries.
ok-helloworldapi-recon-and-docs
Discover reachable API endpoints, schemas, and versioned surfaces from REST, mobile, and GraphQL targets.
ok-helloworldsqli-sql-injection
Identify SQL injection vulnerabilities and generate DB-specific exploitation evidence.
ok-helloworldbusiness-logic-vuln
Detect business workflow abuse vulnerabilities across multi-step state-machine flows.
ok-helloworldssrf-server-side-request-forgery
Detect and validate SSRF vulnerabilities in server-side URL fetch paths.
ok-helloworldjndi-injection
Detect Java JNDI injection sinks and map feasible RMI, LDAP, or DNS vectors.
ok-helloworldcsrf-cross-site-request-forgery
Test state-changing endpoints for CSRF weaknesses and anti-CSRF controls.
ok-helloworldxss-cross-site-scripting
Select context-appropriate XSS payloads for HTML, attribute, JavaScript, URL, and XML sinks.
ok-helloworldupload-insecure-files
Validate file upload paths for bypass and processing-chain exploits.
ok-helloworldweb-cache-deception
Detect web cache deception and poisoning vulnerabilities across CDN intermediaries.
ok-helloworldidor-broken-object-authorization
Detect IDOR and broken object level authorization across web and API requests.